diff --git a/bitnami/couchdb/3/debian-12/Dockerfile b/bitnami/couchdb/3/debian-12/Dockerfile index c10053efcf31..f34cd9c3ae6c 100644 --- a/bitnami/couchdb/3/debian-12/Dockerfile +++ b/bitnami/couchdb/3/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-05T10:52:16Z" \ + org.opencontainers.image.created="2026-05-07T08:04:42Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/couchdb/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/couchdb" \ @@ -51,7 +51,7 @@ COPY rootfs / RUN /opt/bitnami/scripts/couchdb/postunpack.sh ENV APP_VERSION="3.5.1" \ BITNAMI_APP_NAME="couchdb" \ - IMAGE_REVISION="23" \ + IMAGE_REVISION="24" \ LD_LIBRARY_PATH="/opt/bitnami/common/lib:$LD_LIBRARY_PATH" \ PATH="/opt/bitnami/common/bin:/opt/bitnami/erlang/bin:/opt/bitnami/couchdb/bin:$PATH" diff --git a/bitnami/couchdb/3/debian-12/rootfs/opt/bitnami/scripts/couchdb-env.sh b/bitnami/couchdb/3/debian-12/rootfs/opt/bitnami/scripts/couchdb-env.sh index 8764755c6a6c..d6e04773d87a 100644 --- a/bitnami/couchdb/3/debian-12/rootfs/opt/bitnami/scripts/couchdb-env.sh +++ b/bitnami/couchdb/3/debian-12/rootfs/opt/bitnami/scripts/couchdb-env.sh @@ -33,6 +33,12 @@ couchdb_env_vars=( COUCHDB_USER COUCHDB_PASSWORD COUCHDB_SECRET + COUCHDB_ERLANG_HMAX + COUCHDB_EXTRA_VM_ARGS + COUCHDB_INTERNODE_TLS_ENABLED + COUCHDB_TLS_CERT_FILE + COUCHDB_TLS_KEY_FILE + COUCHDB_TLS_CA_FILE ) for env_var in "${couchdb_env_vars[@]}"; do file_env_var="${env_var}_FILE" @@ -54,6 +60,7 @@ export COUCHDB_BIN_DIR="${COUCHDB_BASE_DIR}/bin" export COUCHDB_CONF_DIR="${COUCHDB_BASE_DIR}/etc" export COUCHDB_CONF_FILE="${COUCHDB_CONF_DIR}/default.d/10-bitnami.ini" export COUCHDB_DATA_DIR="${COUCHDB_VOLUME_DIR}/data" +export COUCHDB_PERSISTENT_CONF_FILE="${COUCHDB_VOLUME_DIR}/persist-conf/99-runtime-conf.ini" export COUCHDB_INITSCRIPTS_DIR="/docker-entrypoint-initdb.d" export COUCHDB_TMP_DIR="${COUCHDB_BASE_DIR}/var/run" export COUCHDB_PID_FILE="${COUCHDB_TMP_DIR}/couchdb.pid" @@ -73,5 +80,11 @@ export COUCHDB_IGNORE_INITDB_SCRIPTS="${COUCHDB_IGNORE_INITDB_SCRIPTS:-no}" export COUCHDB_USER="${COUCHDB_USER:-admin}" export COUCHDB_PASSWORD="${COUCHDB_PASSWORD:-couchdb}" export COUCHDB_SECRET="${COUCHDB_SECRET:-bitnami}" +export COUCHDB_ERLANG_HMAX="${COUCHDB_ERLANG_HMAX:-}" +export COUCHDB_EXTRA_VM_ARGS="${COUCHDB_EXTRA_VM_ARGS:-}" +export COUCHDB_INTERNODE_TLS_ENABLED="${COUCHDB_INTERNODE_TLS_ENABLED:-no}" +export COUCHDB_TLS_CERT_FILE="${COUCHDB_TLS_CERT_FILE:-}" +export COUCHDB_TLS_KEY_FILE="${COUCHDB_TLS_KEY_FILE:-}" +export COUCHDB_TLS_CA_FILE="${COUCHDB_TLS_CA_FILE:-}" # Custom environment variables may be defined below diff --git a/bitnami/couchdb/3/debian-12/rootfs/opt/bitnami/scripts/libcouchdb.sh b/bitnami/couchdb/3/debian-12/rootfs/opt/bitnami/scripts/libcouchdb.sh index 266684d69992..f08efc4675a3 100644 --- a/bitnami/couchdb/3/debian-12/rootfs/opt/bitnami/scripts/libcouchdb.sh +++ b/bitnami/couchdb/3/debian-12/rootfs/opt/bitnami/scripts/libcouchdb.sh @@ -102,6 +102,9 @@ couchdb_initialize() { else info "Deploying CouchDB with persisted data" fi + + # Avoid exit code of previous commands to affect the result of this function + true } ######################## @@ -117,10 +120,14 @@ couchdb_update_conf_file() { is_empty_value "$COUCHDB_PORT_NUMBER" || couchdb_conf_set "chttpd" "port" "$COUCHDB_PORT_NUMBER" is_empty_value "$COUCHDB_BIND_ADDRESS" || couchdb_conf_set "chttpd" "bind_address" "$COUCHDB_BIND_ADDRESS" couchdb_conf_set "admins" "$COUCHDB_USER" "$COUCHDB_PASSWORD" "${COUCHDB_CONF_DIR}/local.ini" + # Write to the volume-backed persistent conf (loaded last, highest precedence) so that password + # rotation takes effect on restarts with a new secret. + [[ -f "${COUCHDB_PERSISTENT_CONF_FILE:-}" ]] && couchdb_conf_set "admins" "$COUCHDB_USER" "$COUCHDB_PASSWORD" "${COUCHDB_PERSISTENT_CONF_FILE}" couchdb_conf_set "chttpd" "require_valid_user" "true" couchdb_conf_set "couch_httpd_auth" "require_valid_user" "true" couchdb_conf_set "httpd" "WWW-Authenticate" 'Basic realm="administrator"' is_empty_value "$COUCHDB_SECRET" || couchdb_conf_set "couch_httpd_auth" "secret" "$COUCHDB_SECRET" + is_empty_value "$COUCHDB_SECRET" || couchdb_conf_set "chttpd_auth" "secret" "$COUCHDB_SECRET" } ######################## @@ -132,11 +139,38 @@ couchdb_update_conf_file() { # Returns: # None ######################### -couchdb_update_vm_args_file() { # TODO Confirm that works +couchdb_update_vm_args_file() { couchdb_vm_args_set "-name" "$COUCHDB_NODENAME" couchdb_vm_args_set "-kernel inet_dist_listen_min" "$COUCHDB_CLUSTER_PORT_NUMBER" couchdb_vm_args_set "-kernel inet_dist_listen_max" "$COUCHDB_CLUSTER_PORT_NUMBER" couchdb_vm_args_set "-setcookie" "$COUCHDB_SECRET" + couchdb_vm_args_set "-kernel inet_dist_use_interface" "{0,0,0,0}" + if ! is_empty_value "${COUCHDB_ERLANG_HMAX:-}" && [ "${COUCHDB_ERLANG_HMAX}" -gt 0 ]; then + couchdb_vm_args_set "+hmax" "$((COUCHDB_ERLANG_HMAX / 8))" + fi + if is_boolean_yes "${COUCHDB_INTERNODE_TLS_ENABLED:-no}"; then + local ssl_dist_cfg="${COUCHDB_CONF_DIR}/ssl_dist.cfg" + cat > "${ssl_dist_cfg}" << EOF +[{server, + [{certfile, "${COUCHDB_TLS_CERT_FILE}"}, + {keyfile, "${COUCHDB_TLS_KEY_FILE}"}, + {cacertfile, "${COUCHDB_TLS_CA_FILE}"}, + {verify, verify_peer}, + {fail_if_no_peer_cert, true}]}, + {client, + [{certfile, "${COUCHDB_TLS_CERT_FILE}"}, + {keyfile, "${COUCHDB_TLS_KEY_FILE}"}, + {cacertfile, "${COUCHDB_TLS_CA_FILE}"}, + {verify, verify_peer}, + {server_name_indication, disable}]}]. +EOF + couchdb_vm_args_set "-proto_dist" "couch" + couchdb_vm_args_set "-couch_dist no_tls" "false" + couchdb_vm_args_set "-ssl_dist_optfile" "${ssl_dist_cfg}" + fi + if ! is_empty_value "${COUCHDB_EXTRA_VM_ARGS:-}"; then + echo "${COUCHDB_EXTRA_VM_ARGS}" >>"${COUCHDB_CONF_DIR}/vm.args" + fi } ######################## @@ -156,7 +190,7 @@ couchdb_vm_args_set() { if ! is_empty_value "$value"; then if grep -q -E "^\s*${key}\s+.*$" "${COUCHDB_CONF_DIR}/vm.args"; then - vm_args_content="$(sed -E "s/^\s*${key}\s+.*$/${key} ${value}/" "${COUCHDB_CONF_DIR}/vm.args")" + vm_args_content="$(sed -E "s|^\s*${key}\s+.*$|${key} ${value}|" "${COUCHDB_CONF_DIR}/vm.args")" echo "$vm_args_content" >"${COUCHDB_CONF_DIR}/vm.args" else echo "${key} ${value}" >>"${COUCHDB_CONF_DIR}/vm.args" @@ -198,9 +232,14 @@ couchdb_start_bg() { info "Starting CouchDB in background..." local start_command=("${COUCHDB_BIN_DIR}/couchdb") am_i_root && start_command=("run_as_user" "$COUCHDB_DAEMON_USER" "${start_command[@]}") - debug_execute "${start_command[@]}" & - wait-for-port "${COUCHDB_PORT_NUMBER:-5984}" - wait-for-port "${COUCHDB_CLUSTER_PORT_NUMBER:-9100}" + local -r couchdb_log_file="${COUCHDB_TMP_DIR}/couchdb-startup.log" + "${start_command[@]}" >"${couchdb_log_file}" 2>&1 & + if ! wait-for-port "${COUCHDB_PORT_NUMBER:-5984}" || ! wait-for-port "${COUCHDB_CLUSTER_PORT_NUMBER:-9100}"; then + error "CouchDB failed to start. Startup output:" + cat "${couchdb_log_file}" >&2 + return 1 + fi + debug_execute cat "${couchdb_log_file}" } ######################## diff --git a/bitnami/couchdb/README.md b/bitnami/couchdb/README.md index a8a3cd89edb2..b19c9a589183 100644 --- a/bitnami/couchdb/README.md +++ b/bitnami/couchdb/README.md @@ -87,22 +87,29 @@ The following tables list the main variables you can set. | `COUCHDB_USER` | CouchDB admin username. | `admin` | | `COUCHDB_PASSWORD` | Password for the CouchDB admin user. | `couchdb` | | `COUCHDB_SECRET` | CouchDB secret/token used for proxy and cookie authentication. | `bitnami` | +| `COUCHDB_ERLANG_HMAX` | Per-process Erlang heap cap in bytes. Used to compute +hmax (value / 8 = word count). | `nil` | +| `COUCHDB_EXTRA_VM_ARGS` | Additional Erlang VM arguments appended to vm.args. | `nil` | +| `COUCHDB_INTERNODE_TLS_ENABLED` | Enable TLS encryption for the Erlang distribution protocol (inter-node communication). | `no` | +| `COUCHDB_TLS_CERT_FILE` | Path to the TLS certificate file used for Erlang distribution encryption. | `nil` | +| `COUCHDB_TLS_KEY_FILE` | Path to the TLS private key file used for Erlang distribution encryption. | `nil` | +| `COUCHDB_TLS_CA_FILE` | Path to the CA certificate file used to verify peers during Erlang distribution. | `nil` | #### Read-only environment variables -| Name | Description | Value | -|---------------------------|--------------------------------------------------------------------------|------------------------------------------------| -| `COUCHDB_BASE_DIR` | CouchDB installation directory. | `${BITNAMI_ROOT_DIR}/couchdb` | -| `COUCHDB_VOLUME_DIR` | CouchDB persistence directory. | `/bitnami/couchdb` | -| `COUCHDB_BIN_DIR` | CouchDB directory for binary executables. | `${COUCHDB_BASE_DIR}/bin` | -| `COUCHDB_CONF_DIR` | CouchDB configuration directory. | `${COUCHDB_BASE_DIR}/etc` | -| `COUCHDB_CONF_FILE` | CouchDB configuration file. | `${COUCHDB_CONF_DIR}/default.d/10-bitnami.ini` | -| `COUCHDB_DATA_DIR` | CouchDB directory where data is stored. | `${COUCHDB_VOLUME_DIR}/data` | -| `COUCHDB_INITSCRIPTS_DIR` | Path to directory containing custom init scripts executed on first boot. | `/docker-entrypoint-initdb.d` | -| `COUCHDB_TMP_DIR` | Directory where CouchDB temporary files are stored. | `${COUCHDB_BASE_DIR}/var/run` | -| `COUCHDB_PID_FILE` | Path to the PID file for CouchDB. | `${COUCHDB_TMP_DIR}/couchdb.pid` | -| `COUCHDB_DAEMON_USER` | CouchDB system user. | `couchdb` | -| `COUCHDB_DAEMON_GROUP` | CouchDB system group. | `couchdb` | +| Name | Description | Value | +|--------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------| +| `COUCHDB_BASE_DIR` | CouchDB installation directory. | `${BITNAMI_ROOT_DIR}/couchdb` | +| `COUCHDB_VOLUME_DIR` | CouchDB persistence directory. | `/bitnami/couchdb` | +| `COUCHDB_BIN_DIR` | CouchDB directory for binary executables. | `${COUCHDB_BASE_DIR}/bin` | +| `COUCHDB_CONF_DIR` | CouchDB configuration directory. | `${COUCHDB_BASE_DIR}/etc` | +| `COUCHDB_CONF_FILE` | CouchDB configuration file. | `${COUCHDB_CONF_DIR}/default.d/10-bitnami.ini` | +| `COUCHDB_DATA_DIR` | CouchDB directory where data is stored. | `${COUCHDB_VOLUME_DIR}/data` | +| `COUCHDB_PERSISTENT_CONF_FILE` | Path to the persistent CouchDB configuration file (survives container restarts). Admin credentials are written here so password rotation works. | `${COUCHDB_VOLUME_DIR}/persist-conf/99-runtime-conf.ini` | +| `COUCHDB_INITSCRIPTS_DIR` | Path to directory containing custom init scripts executed on first boot. | `/docker-entrypoint-initdb.d` | +| `COUCHDB_TMP_DIR` | Directory where CouchDB temporary files are stored. | `${COUCHDB_BASE_DIR}/var/run` | +| `COUCHDB_PID_FILE` | Path to the PID file for CouchDB. | `${COUCHDB_TMP_DIR}/couchdb.pid` | +| `COUCHDB_DAEMON_USER` | CouchDB system user. | `couchdb` | +| `COUCHDB_DAEMON_GROUP` | CouchDB system group. | `couchdb` | ### Mounting your own configuration files