Qdrant on your own box, from the release binary, in one OpenTofu-style config

[jamesconwaydev]

Hi. I built a Qdrant circuit for Conn3x, a fork of OpenTofu that configures servers over SSH: https://github.com/conn3xorg/circuit-qdrant. If you already create your VMs with OpenTofu or Terraform, the same conn3x apply now installs Qdrant on them too.

It downloads a pinned release (the static musl build, so one binary covers every distro), checks its SHA-256, and runs it under systemd as its own qdrant user. It listens on 127.0.0.1 with telemetry off until you say otherwise. The API key is write-only, so it stays out of the state file and the plan.

CI applies it on Rocky Linux 10, Fedora 45, Ubuntu 24.04 and Debian 13, then creates a collection, upserts two points, searches, and checks that a request without the key gets a 401. By hand it ran on Ubuntu 24.04 and Rocky Linux 10 droplets, the Rocky one with SELinux enforcing, through a reboot.

One thing I hit, in case it's useful: a SIGTERM that arrives in the moment Qdrant opens its HTTP port seems to be ignored until systemd kills it 90 seconds later. I saw it 3 times out of 3 on 1.20.0 when a restart followed straight after a start, so the circuit now waits for /readyz first. Happy to open an issue with details if that's not known.

It pairs with an Ollama circuit for fully local retrieval: https://github.com/conn3xorg/circuit-ollama. There's also a DigitalOcean example that builds a private AI box with both, behind a cloud firewall, in one apply: https://github.com/conn3xorg/circuit-ollama/tree/main/examples/digitalocean

Questions and "you're doing it wrong" both welcome.