docs: update pgedge + coraza template pages - #291
Merged
Conversation
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The template no longer creates a GVC (gvc.name / gvc.locations removed, locations now top-level), and a 1.x release must never be upgraded in place onto 2.0.0 — that deletes the GVC and everything in it. Documents the migrate-to-a-new-release path, the Spock output-plugin fix that made replication work at all, the restart/self-repair behaviour, corrected DDL guidance, and pgcat statement-shape routing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
B1 (pgedge) -- the page told a 1.x operator to "restart one location at a time", which is not safe. The pre-2.0.0 daemon drops inactive replication slots on every peer it can reach, not just locally, so a single node restarting drops the slots its peers hold for it and nothing recreates them. One-at-a-time is no safer than all at once; pg_reload_conf() alone is the whole procedure. This had partially re-introduced the instruction templates#501 removed. B2 (pgedge) -- removed an invented password-rotation procedure. It was traceable to no source, and it would have broken the cluster it was aimed at: the password is baked into stored Spock DSNs, so ALTER ROLE on a formed mesh invalidates them and no redeployment rewrites them. It also only redeployed pgcat, leaving every pgEdge node on the old credential. Replaced with what is actually true -- a 2.0.0 install builds its roles from the secret on a fresh data directory, so choose the new password before installing. B3 (coraza) -- removed the claim that CRS 4.28 and later ship only as nginx and apache variants. Four 4.28 caddy builds exist; the error was mine, from an unpaginated registry query. Page now points at the 1.2.1 pin (CRS 4.28.0). Plus three nits: the GCP role is Storage OBJECT Admin, which is what the chart binds; the 1.0.x postgres.* validator still fires and was undocumented after the old warning was removed; SecRequestBodyLimit is 12.5 MiB, not 13 MB. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
W1/W2 -- the coraza page said Caddy v2.11.2 while the pinned image reports v2.11.3. The version parenthetical had been hand-edited to fix CRS 4.25.0 -> 4.28.0 and the adjacent Caddy version was left stale, on the one line that identifies the pinned image. The template carried the same error and is fixed in templates#505, so the page's values block now matches the shipped file byte-for-byte again. N1 -- the postgres.* validator Note sat flush against the section heading and opened with 'also refused at render' before anything had mentioned a render refusal. Moved it beside the render-refusal paragraph it refers to. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
|
No description provided. |
The template gained an unconditional `mkdir -p /tmp/coraza` in 1.2.1 (templates#507) after it turned out to be the load-bearing half of the removed `diskBodyInspection` knob -- Coraza spills bodies over its in-memory limit to that directory, and without it a large request fails with a 500 that reads as a WAF fault. The page documented the 504 ceiling thoroughly but said nothing about disk buffering, so it described only one of the two ways a large body can fail. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
enk21
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two in-place page updates. No index changes — both templates already have an overview card, a nav entry and an icon, and all are correct, so
overview.mdx,docs.jsonand the icons are deliberately untouched. Diff is exactly two files.pgedge 2.0.0 (
template-catalog/templates/pgedge.mdx)gvc.name/gvc.locationsare gone, and locations moved to a top-levellocationslist.Migrating from 1.xrunbook, and the fix for 1.x clusters whose replication never worked —pg_reload_conf()only, explicitly not a restart, which would trigger the peer-wide slot drop 2.0.0 exists to fix.coraza 1.2.1 (
template-catalog/templates/coraza.mdx)4.28-caddy-alpine-202608260808(CRS 4.28.0, Caddy v2.11.3), digestsha256:ed1e4a65….*-caddy-alpine-*build for each release.timeoutSeconds, the ~1.8 MB ceiling at shipped defaults, the fixed 12.5 MiBSecRequestBodyLimit, and the CRS 920450 /Expect: 100-continuetrap.Review
Verdict PASS after two rounds. Round 1 raised three blockers (harmful 1.x restart advice, an invented password-rotation procedure, the false image-tag claim); all three were fixed and re-verified, along with two warnings on coraza image metadata and a Note-placement nit.
Verified: scope; both values blocks byte-identical to the shipped
values.yaml; the coraza pin resolved against the GHCR registry (tag→digest confirmed, Caddy version andSecRequestBodyLimitread from the image config); every measured claim traced to the test reports; allcplnverbs checked against--help; all 10 external URLs 200; and every in-page anchor checked against rendered ids from the live site rather than the linter, which does not check them.One cross-repo note: the coraza block matches
values.yamlas corrected in templates#505 (comment-only, render byte-identical), which is open. The page is independently correct against the registry either way. templates#504 (changelog naming 1.2.1) is likewise open and not a blocker.🤖 Generated with Claude Code