bump component versions

Author: overheadhunter

chart/templates/keycloak-deployment.yaml

@@ -52,7 +52,7 @@ spec:
       {{- end }}
       containers:
         - name: keycloak
-          image: "ghcr.io/cryptomator/keycloak:{{ .Values.keycloak.image.tag | default "26.6.2" }}"
+          image: "ghcr.io/cryptomator/keycloak:{{ .Values.keycloak.image.tag | default "26.7.2" }}"
           imagePullPolicy: {{ .Values.keycloak.imagePullPolicy }}
           command:
             - /opt/keycloak/bin/kc.sh

chart/templates/postgres-statefulset.yaml

@@ -34,9 +34,11 @@ spec:
           args:
             - |
               set -eux
-              mkdir -p /var/lib/postgresql/data /var/run/postgresql
-              chown -R 70:70 /var/lib/postgresql/data /var/run/postgresql
-              chmod 700 /var/lib/postgresql/data
+              # Since postgres:18 the volume is /var/lib/postgresql and PGDATA lives in a per-major subdirectory
+              # (/var/lib/postgresql/18/docker) so that pg_upgrade can keep old and new clusters side by side.
+              # The entrypoint creates PGDATA itself; it only needs the volume root to be writable by uid 70.
+              chown 70:70 /var/lib/postgresql /var/run/postgresql
+              chmod 750 /var/lib/postgresql
               chmod 775 /var/run/postgresql
           securityContext:
             runAsNonRoot: false
@@ -46,13 +48,12 @@ spec:
             privileged: false
           volumeMounts:
             - name: data
-              mountPath: /var/lib/postgresql/data
-              subPath: pgdata
+              mountPath: /var/lib/postgresql
             - name: run
               mountPath: /var/run/postgresql
       containers:
         - name: postgres
-          image: "postgres:{{ .Values.postgres.image.tag | default "17-alpine" }}"
+          image: "postgres:{{ .Values.postgres.image.tag | default "18-alpine" }}"
           imagePullPolicy: {{ .Values.postgres.imagePullPolicy }}
           ports:
             - name: postgres
@@ -102,8 +103,7 @@ spec:
               subPath: initdb.sql
               readOnly: true
             - name: data
-              mountPath: /var/lib/postgresql/data
-              subPath: pgdata
+              mountPath: /var/lib/postgresql
             - name: run
               mountPath: /var/run/postgresql
             - name: tmp

chart/values.yaml

@@ -124,7 +124,7 @@ postgres:
   enabled: true
   imagePullPolicy: IfNotPresent
   image:
-    tag: ""
+    tag: "" # defaults to 18-alpine; the volume layout requires postgres >= 18 (PGDATA in /var/lib/postgresql/<major>/docker)
   service:
     type: ClusterIP
     port: 5432

deploy/compose/dev/compose.yaml

@@ -7,7 +7,7 @@
 services:
 
   postgres:
-    image: postgres:17-alpine
+    image: postgres:18-alpine
     environment:
       POSTGRES_DB: hub
       POSTGRES_USER: hub
@@ -16,15 +16,16 @@ services:
       - source: create-keycloak-db
         target: /docker-entrypoint-initdb.d/create-keycloak-db.sql
     volumes:
-      - postgres-data:/var/lib/postgresql/data
+      # postgres >= 18 keeps PGDATA in /var/lib/postgresql/<major>/docker, so the volume is mounted one level up
+      - postgres-data:/var/lib/postgresql
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U hub -d hub"]
       interval: 5s
       timeout: 3s
       retries: 12
 
   keycloak:
-    image: ghcr.io/cryptomator/keycloak:26.6.4
+    image: ghcr.io/cryptomator/keycloak:26.7.2
     command: start --optimized --import-realm
     environment:
       KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak

deploy/compose/local/README.md

@@ -23,7 +23,7 @@ On first login Hub asks for a license. Any Hub license works for testing; see <h
 
 ## What the stack contains
 
-- `postgres:17.11-alpine` with two databases (`hub`, `keycloak`), persisted in the named volume `postgres-data`.
+- `postgres` with two databases (`hub`, `keycloak`), persisted in the named volume `postgres-data`.
 - `ghcr.io/cryptomator/keycloak` — the stock Keycloak image plus the Cryptomator login theme and `curl` for the health check. A minimal `cryptomator` realm (one admin user, the OIDC clients `cryptomatorhub`, `cryptomator` and `cryptomatorhub-system`) is embedded in the compose file and imported on first boot. It matches what the Helm chart renders in `chart/templates/_realm.tpl`.
 - `ghcr.io/cryptomator/hub` — the Hub application, configured through environment variables; the same settings the Helm chart uses.
 
@@ -47,3 +47,5 @@ For real deployments use the Helm chart, see [`../../helm/prod/`](../../helm/pro
 ## Upgrading
 
 Image versions are pinned in `compose.yaml`. To upgrade, change the tags and run `docker compose up -d`. Hub applies database migrations automatically at start; Keycloak upgrades follow the [Keycloak upgrade guide](https://www.keycloak.org/docs/latest/upgrading/). Always back up the `postgres-data` volume first.
+
+PostgreSQL minor updates (e.g. `18.6` → `18.7`) are drop-in. A major update (`18` → `19`) is not: the data directory must be migrated with `pg_upgrade` or a dump/restore, see the [PostgreSQL upgrade notes](https://www.postgresql.org/docs/current/upgrading.html). The same applies to a `postgres-data` volume created by an earlier version of this stack that still ran PostgreSQL 17 — either dump it before switching images, or start fresh with `docker compose down -v`.

deploy/compose/local/compose.yaml

@@ -9,7 +9,7 @@
 services:
 
   postgres:
-    image: postgres:17.11-alpine
+    image: postgres:18.6-alpine
     environment:
       POSTGRES_DB: hub
       POSTGRES_USER: hub
@@ -18,7 +18,8 @@ services:
       - source: create-keycloak-db
         target: /docker-entrypoint-initdb.d/create-keycloak-db.sql
     volumes:
-      - postgres-data:/var/lib/postgresql/data
+      # postgres >= 18 keeps PGDATA in /var/lib/postgresql/<major>/docker, so the volume is mounted one level up
+      - postgres-data:/var/lib/postgresql
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U hub -d hub"]
       interval: 5s