diff --git a/docs/installation/production-podman/index.md b/docs/installation/production-podman/index.md index 6aaf5693b..b28de23bd 100644 --- a/docs/installation/production-podman/index.md +++ b/docs/installation/production-podman/index.md @@ -51,6 +51,9 @@ supported production path. | **lookup** | Term autocomplete / lookup — see below. | | **nginx** | Host package (not a container): terminates backend TLS on `:443` and proxies to the app. | +Monitoring (Prometheus, Grafana and exporters) runs beside these services in its +own containers and changes none of them; see **[Monitoring](monitoring.md)**. + ### The lookup service The **lookup** service runs diff --git a/docs/installation/production-podman/install.md b/docs/installation/production-podman/install.md index 2346b765e..175025630 100644 --- a/docs/installation/production-podman/install.md +++ b/docs/installation/production-podman/install.md @@ -25,9 +25,10 @@ only part that needs root. - Outbound network access for the first image build (downloads the OEO release, the JDBC driver, and base images). -!!! note "Podman 4.x assumed" +!!! note "Podman 4.4 or newer" - This guide targets Podman 4.x (netavark backend, native DNS). Quadlets attach + This guide targets Podman 4.4 or newer (netavark backend, native DNS) and is + tested with Podman 5.4. Quadlets attach each container to the `oep` network explicitly, so the older podman-compose networking workarounds do not apply here. @@ -52,16 +53,17 @@ $EDITOR ~/.config/oeplatform/oep.env For a first bring-up you only need the database and Fuseki credentials; the HTTPS block comes later in this page. -| Variable | Description | -| ------------------------------------------------------ | ------------------------------------------------------------- | -| `POSTGRES_USER` / `POSTGRES_PASSWORD` | PostgreSQL superuser credentials. | -| `OEP_DJANGO_USER` / `OEP_DB_PW` | DB user Django connects as (often the same as the superuser). | -| `OEP_DJANGO_HOST` / `OEP_DJANGO_NAME` | Keep as `postgres` / `oep_django`. | -| `LOCAL_DB_USER` / `LOCAL_DB_PASSWORD` | Credentials for the OEDB (`oedb`) database. | -| `LOCAL_DB_HOST` / `LOCAL_DB_NAME` | Keep as `postgres` / `oedb`. | -| `FUSEKI_ADMIN_PASSWORD` | Fuseki web UI admin password. | -| `FUSEKI_DATASET_1` | Fuseki dataset name — keep as `ds`. | -| `ONTOP_DB_URL` / `ONTOP_DB_USER` / `ONTOP_DB_PASSWORD` | Ontop's connection to the OEDB — see **Ontop**. | +| Variable | Description | +| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- | +| `POSTGRES_USER` / `POSTGRES_PASSWORD` | PostgreSQL superuser credentials. | +| `OEP_DJANGO_USER` / `OEP_DB_PW` | DB user Django connects as (often the same as the superuser). | +| `OEP_DJANGO_HOST` / `OEP_DJANGO_NAME` | Keep as `postgres` / `oep_django`. | +| `LOCAL_DB_USER` / `LOCAL_DB_PASSWORD` | Credentials for the OEDB (`oedb`) database. | +| `LOCAL_DB_HOST` / `LOCAL_DB_NAME` | Keep as `postgres` / `oedb`. | +| `RDF_DATABASE_HOST` | Keep as `fuseki`; without it every OEKG read answers `503`. | +| `FUSEKI_ADMIN_PASSWORD` | Not read yet: the Fuseki image expects `ADMIN_PASSWORD` and generates a random admin password on its first start. | +| `FUSEKI_DATASET_1` | Fuseki dataset name — keep as `ds`. | +| `ONTOP_DB_URL` / `ONTOP_DB_USER` / `ONTOP_DB_PASSWORD` | Ontop's connection to the OEDB — see **Ontop**. | !!! warning "The CSRF origin needs a scheme" diff --git a/docs/installation/production-podman/maintenance.md b/docs/installation/production-podman/maintenance.md index 60e7c6aca..839e7afc8 100644 --- a/docs/installation/production-podman/maintenance.md +++ b/docs/installation/production-podman/maintenance.md @@ -80,19 +80,22 @@ skips error-log lines, which share the journal. ## Backups Persistent state is in named volumes (physically under the service user's home). -At minimum, back up the **Postgres** data and the **media** volume regularly, -and always before a release that runs migrations. List volumes and their -locations: +At minimum, back up the **Postgres** data, the **Fuseki** volume (the OEKG) and +the **media** volume regularly, and always before a release that runs +migrations. List volumes and their locations: ```sh podman volume ls -podman volume inspect pgdata +podman volume inspect systemd-pgdata ``` +Quadlet prefixes every volume name with `systemd-`. + Use `pg_dump` from inside/against the postgres container for logical database -backups, and snapshot the media volume for uploaded files. (Physical volume -placement per server is a separate storage-configuration concern, out of scope -for this generic guide.) +backups, and snapshot the media and Fuseki volumes. Stop `oep-oeplatform`, the +only writer, while copying the Fuseki volume, so the copy is consistent. +(Physical volume placement per server is a separate storage-configuration +concern, out of scope for this generic guide.) ## Reset the database (destructive) @@ -100,7 +103,7 @@ This **deletes all database data**. Only for a throwaway/dev-like environment. ```sh systemctl --user stop oep-oeplatform oep-postgres -podman volume rm pgdata # confirm the exact name with: podman volume ls +podman volume rm systemd-pgdata # confirm the exact name with: podman volume ls systemctl --user start oep-postgres oep-oeplatform ``` diff --git a/docs/installation/production-podman/monitoring.md b/docs/installation/production-podman/monitoring.md index e23646d60..d5ce28f40 100644 --- a/docs/installation/production-podman/monitoring.md +++ b/docs/installation/production-podman/monitoring.md @@ -12,7 +12,7 @@ SPDX-License-Identifier: AGPL-3.0-or-later **[Maintenance](maintenance.md)**. It adds monitoring beside a running installation without changing the app's containers. -The monitoring answers five questions: +The monitoring answers six questions: | Question | Source | | -------------------------------------------------- | --------------------------------------------------------------------------------- | diff --git a/docs/installation/production-podman/ontop.md b/docs/installation/production-podman/ontop.md index 46d477a49..738a7d18f 100644 --- a/docs/installation/production-podman/ontop.md +++ b/docs/installation/production-podman/ontop.md @@ -34,7 +34,7 @@ bakes in everything it needs, so there are **no files to place by hand**: ```sh podman build --build-arg JDBC_VERSION=42.7.3 \ - -t localhost/oep-ontop:latest \ + -t ghcr.io/openenergyplatform/oeplatform-ontop:latest \ -f docker/Dockerfile.ontop docker/ ``` @@ -100,7 +100,7 @@ Choose one of two ways to apply it: `docker/serviceConfigs/ontop/mapping.obda`, rebuild, and restart: ```sh - podman build -t localhost/oep-ontop:latest -f docker/Dockerfile.ontop docker/ + podman build -t ghcr.io/openenergyplatform/oeplatform-ontop:latest -f docker/Dockerfile.ontop docker/ systemctl --user restart oep-ontop ``` diff --git a/versions/changelogs/current.md b/versions/changelogs/current.md index e224f659b..b2d5f46d2 100644 --- a/versions/changelogs/current.md +++ b/versions/changelogs/current.md @@ -31,6 +31,12 @@ the previous release's highlights. ## Changes +- The Podman deployment guide, reviewed: the Ontop page builds under the image + name the unit starts (it named the one that fails with exit code 125), the + install page lists `RDF_DATABASE_HOST` and says `FUSEKI_ADMIN_PASSWORD` is not + read yet, the backups include the Fuseki volume, and volume names carry + Quadlet's `systemd-` prefix + [(#2412)](https://github.com/OpenEnergyPlatform/oeplatform/issues/2412) - The Podman monitoring stack also watches security: failed logins, rejected requests (401/403) and requests to typical attack paths are counted from the access log every minute, four alert rules (service down, disk filling up,