chore: bump clickhouse to 23.4.6.25-alpine (23.4 LTS patch)

These five were added to .env.sample while abra.sh already exported them, so every
deployment got a second, divergent copy.

That is not just untidy. .env.sample becomes the operator .env at `abra app new`,
and a .env is NEVER updated by a recipe upgrade. So the next time a recipe change
bumps e.g. CLICKHOUSE_ENTRYPOINT_VERSION in abra.sh, an existing deployment keeps
the stale value from its .env: the config CONTENT changes while the swarm config
NAME does not, and swarm configs are immutable -

  FATA failed to update config <stack>_clickhouse_entrypoint_v6:
       only updates to Labels are allowed

which is exactly the failure gitea hit with app_ini_v22.

The fleet convention, consistent across gitea/discourse/keycloak/mailu: .env.sample
carries SECRET_*_VERSION only (operator-managed secret rotation); config object
versions live in abra.sh (recipe-managed - bumping one IS a recipe change).
plausible main already followed this; only this branch diverged.

abra.sh is unchanged and keeps CLICKHOUSE_USER_CONF_VERSION=v3 - that bump is
correct, clickhouse-user-config.xml content genuinely changed.

.env.sample

@@ -5,21 +5,7 @@ DOMAIN=plausible.example.com
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.plausible.example.com`'
 LETS_ENCRYPT_ENV=production
-#LOG_LEVEL=debug
-COMPOSE_FILE="compose.yml"
 
-DISABLE_REGISTRATION=true # true or false
-
-# Mail Configuration
-#COMPOSE_FILE="$COMPOSE_FILE:compose.mail.yml"
-#SECRET_SMTP_PASSWORD_VERSION=v1 # generate=false
-#MAILER_ADAPTER=Bamboo.Mua
-#MAILER_EMAIL=noreply@example.com
-#MAILER_NAME=Noreply
-#SMTP_HOST_ADDR=mail.example.com
-#SMTP_HOST_PORT=587
-#SMTP_USER_NAME=foo
-#SMTP_HOST_SSL_ENABLED=false
-
-SECRET_TOTP_VAULT_KEY_VERSION=v1 # length=32 encoding=base64
-SECRET_KEY_BASE_VERSION=v1 # length=64
+SECRET_KEY_BASE=replace-me
+DISABLE_AUTH=replace-me # true or false
+DISABLE_REGISTRATION=replace-me # true or false

README.md

@@ -4,13 +4,13 @@
 
 <!-- metadata -->
 * **Category**: Apps
-* **Status**: 3
+* **Status**: 1, alpha
 * **Image**: [`plausible/analytics`](https://hub.docker.com/plausible/analytics), 4, upstream
 * **Healthcheck**:
 * **Backups**: Yes
-* **Email**: Yes
-* **Tests**: No
-* **SSO**: N/A
+* **Email**: No
+* **Tests**:
+* **SSO**: No
 <!-- endmetadata -->
 
 ## Basic usage
@@ -19,11 +19,10 @@
 2. Deploy [`coop-cloud/traefik`]
 3. `abra app new ${REPO_NAME} --secrets` (optionally with `--pass` if you'd like
    to save secrets in `pass`)
-4. `abra app secret insert YOURAPPDOMAIN smtp_password v1` and add your smtp password
-5. `abra app config YOURAPPDOMAIN` - be sure to change `$DOMAIN` to something that resolves to
+4. `abra app config YOURAPPDOMAIN` - be sure to change `$DOMAIN` to something that resolves to
    your Docker swarm box
-6. `abra app deploy YOURAPPDOMAIN`
-7. Open the configured domain in your browser to finish set-up and create an admin account
+5. `abra app deploy YOURAPPDOMAIN`
+6. Open the configured domain in your browser to finish set-up
 
 [`abra`]: https://git.coopcloud.tech/coop-cloud/abra
 [`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik

abra.sh

@@ -1,6 +1,5 @@
-export CLICKHOUSE_CONFIG_VERSION=v2
-export CLICKHOUSE_USER_CONFIG_VERSION=v2
-export CLICKHOUSE_ENTRYPOINT_VERSION=v7
+export CLICKHOUSE_CONF_VERSION=v2
+export CLICKHOUSE_USER_CONF_VERSION=v2
+export CLICKHOUSE_ENTRYPOINT_VERSION=v6
 export PG_BACKUP_VERSION=v1
-export CLICKHOUSE_BACKUP_VERSION=v1
-export PLAUSIBLE_ENTRYPOINT_VERSION=v2
+export CLICKHOUSE_BACKUP_SCRIPT_VERSION=v1

compose.smtp.yml

@@ -1,21 +0,0 @@
----
-version: "3.8"
-
-services:
-  app:
-    environment:
-      - MAILER_ADAPTER
-      - SMTP_HOST_ADDR
-      - MAILER_EMAIL
-      - MAILER_NAME
-      - SMTP_HOST_PORT
-      - SMTP_USER_NAME
-      - SMTP_USER_PWD
-      - SMTP_HOST_SSL_ENABLED
-    secrets:
-      - smtp_password
-
-secrets:
-  smtp_password:
-    name: ${STACK_NAME}_smtp_password_${SECRET_SMTP_PASSWORD_VERSION}
-    external: true

compose.yml

@@ -3,34 +3,27 @@ version: "3.8"
 
 services:
   app:
-    image: ghcr.io/plausible/community-edition:v3.2.1
-    entrypoint: /plausible_entrypoint.sh
+    image: plausible/analytics:v2.0.0
+    command: sh -c "sleep 10 && /entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run"
     depends_on:
       - db
-      - events
+      - plausible_events_db
     environment:
       - BASE_URL=https://$DOMAIN
       - SECRET_KEY_BASE
       - DATABASE_URL=postgres://plausible:plausible@${STACK_NAME}_db:5432/plausible
-      - CLICKHOUSE_DATABASE_URL=http://${STACK_NAME}_events:8123/plausible_events_db
+      - CLICKHOUSE_DATABASE_URL=http://${STACK_NAME}_plausible_events_db:8123/plausible_events_db
+      - SMTP_HOST_ADDR
+      - MAILER_EMAIL
+      - SMTP_HOST_PORT
+      - SMTP_USER_NAME
+      - SMTP_USER_PWD
+      - SMTP_HOST_SSL_ENABLED
       - DISABLE_REGISTRATION
-      - LOG_LEVEL
-    secrets:
-      - totp_secret
-      - key_base
-    configs:
-      - source: plausible_entrypoint
-        target: /plausible_entrypoint.sh
-        mode: 0555
+      - DISABLE_AUTH
     networks:
       - proxy
       - internal
-    healthcheck:
-          test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:8000"]
-          interval: 15s
-          timeout: 10s
-          retries: 10
-          start_period: 15s
     deploy:
       restart_policy:
         # `any`, not `on-failure`: a restore disrupts postgres under the app and Erlang then
@@ -42,7 +35,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - coop-cloud.${STACK_NAME}.version=5.1.0+v3.2.1
+        - coop-cloud.${STACK_NAME}.version=3.1.0+v2.0.0
   db:
     image: pgautoupgrade/pgautoupgrade:18-alpine
     volumes:
@@ -73,17 +66,15 @@ services:
         backupbot.restore: "true"
         backupbot.restore.post-hook: "/pg_backup.sh restore"
 
-  events:
-    image: clickhouse/clickhouse-server:24.12-alpine
+  plausible_events_db:
+    image: clickhouse/clickhouse-server:23.4.6.25-alpine
     volumes:
       - event-data:/var/lib/clickhouse
-    environment:
-      - CLICKHOUSE_SKIP_USER_SETUP=1
     entrypoint: /custom-entrypoint.sh
     configs:
-      - source: clickhouse_config
+      - source: clickhouse-config
         target: /etc/clickhouse-server/config.d/logging.xml
-      - source: clickhouse_user_config
+      - source: clickhouse-user-config
         target: /etc/clickhouse-server/users.d/clickhouse-user-config.xml
       - source: clickhouse_entrypoint
         target: /custom-entrypoint.sh
@@ -93,12 +84,6 @@ services:
         mode: 0555
     networks:
       - internal
-    healthcheck:
-          test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:8123/ping || exit 1"]
-          interval: 15s
-          timeout: 10s
-          retries: 10
-          start_period: 15s
     deploy:
       labels:
         backupbot.backup: "true"
@@ -118,14 +103,11 @@ networks:
   internal:
 
 configs:
-  plausible_entrypoint:
-    name: ${STACK_NAME}_plausible_entrypoint_${PLAUSIBLE_ENTRYPOINT_VERSION}
-    file: plausible_entrypoint.sh
-  clickhouse_config:
-    name: ${STACK_NAME}_clickhouse_config_${CLICKHOUSE_CONFIG_VERSION}
+  clickhouse-config:
+    name: ${STACK_NAME}_clickhouse_config_${CLICKHOUSE_CONF_VERSION}
     file: clickhouse-config.xml
-  clickhouse_user_config:
-    name: ${STACK_NAME}_clickhouse_user_config_${CLICKHOUSE_USER_CONFIG_VERSION}
+  clickhouse-user-config:
+    name: ${STACK_NAME}_clickhouse_user_config_${CLICKHOUSE_USER_CONF_VERSION}
     file: clickhouse-user-config.xml
   clickhouse_entrypoint:
     name: ${STACK_NAME}_clickhouse_entrypoint_${CLICKHOUSE_ENTRYPOINT_VERSION}
@@ -134,13 +116,5 @@ configs:
     name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
     file: pg_backup.sh
   clickhouse_backup:
-    name: ${STACK_NAME}_clickhouse_backup_${CLICKHOUSE_BACKUP_VERSION}
+    name: ${STACK_NAME}_clickhouse_backup_${CLICKHOUSE_BACKUP_SCRIPT_VERSION}
     file: clickhouse_backup.sh
-
-secrets:
-  totp_secret:
-    name: ${STACK_NAME}_totp_secret_${SECRET_TOTP_VAULT_KEY_VERSION}
-    external: true
-  key_base:
-    name: ${STACK_NAME}_key_base_${SECRET_KEY_BASE_VERSION}
-    external: true

entrypoint.clickhouse.sh

@@ -7,7 +7,7 @@
 
 set -e
 
-CLICKHOUSE_BACKUP_VERSION=2.8.1
+CLICKHOUSE_BACKUP_VERSION=2.4.2
 
 ARCH=$(uname -m)
 if [[ $ARCH =~ "aarch64" ]]; then

plausible_entrypoint.sh

@@ -1,9 +0,0 @@
-#!/bin/sh
-
-set -e
-
-[ -f /run/secrets/totp_secret ] && export TOTP_VAULT_KEY="$(cat /run/secrets/totp_secret)"
-[ -f /run/secrets/key_base ] && export SECRET_KEY_BASE="$(cat /run/secrets/key_base)"
-[ -f /run/secrets/smtp_password ] && export SMTP_USER_PWD="$(cat /run/secrets/smtp_password)"
-
-sh -c "sleep 10 && /entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run"

release/4.0.0+v2.1.0

@@ -1 +0,0 @@
-Switch to the new container of the Plausible Community Edition. Two new secrets need to be added. mail support is now available optionally. the clickhouse container was renamed, hopefully this does not lead to hickups.

release/4.0.1+v2.1.0

@@ -1 +0,0 @@
-fix smtp separation

release/5.0.0+v3.0.1

@@ -1 +0,0 @@
-Major upgrade of plausible version, but should not be breaking