fix: stop plugins service crash loop (logs-redis TLS default)

In production images LOGS_REDIS_TLS/TRACES_REDIS_TLS default to true, so
the logs-ingestion consumer (part of the plugin-server default mode) kept
attempting a TLS handshake against the plaintext Redis, timed out every
~11s and killed the process after 10 errors (restart loop every ~2.5 min).

Constrain the plugins service to the capability groups this template
ships (cdp_workflows, realtime_cohorts, feature_flags) and pin the redis
TLS flags to false as belt-and-braces.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mauricio Siu
2026-07-14 15:50:16 -06:00
parent 7f3a08eb00
commit 3eb1d3b7bd

View File

@@ -334,6 +334,11 @@ services:
init-assets:
condition: service_completed_successfully
environment:
# Run only the pipelines this template ships (CDP destinations/workflows,
# realtime cohorts, feature-flag evaluation). The default mode would also
# start the logs/error-tracking ingestion consumers, which this template
# intentionally omits.
NODEJS_CAPABILITY_GROUPS: cdp_workflows,realtime_cohorts,feature_flags
SITE_URL: ${POSTHOG_SITE_URL}
SECRET_KEY: ${POSTHOG_SECRET_KEY}
ENCRYPTION_SALT_KEYS: ${POSTHOG_ENCRYPTION_SALT_KEYS}
@@ -345,8 +350,13 @@ services:
REDIS_URL: redis://redis7:6379/
CDP_REDIS_HOST: redis7
CDP_REDIS_PORT: 6379
# TLS for these defaults to "true" in production images; this stack's
# Redis is plaintext (a TLS handshake against it hangs until timeout and
# crash-loops the process if these consumers ever run).
LOGS_REDIS_HOST: redis7
LOGS_REDIS_TLS: "false"
TRACES_REDIS_HOST: redis7
TRACES_REDIS_TLS: "false"
COOKIELESS_REDIS_HOST: redis7
COOKIELESS_REDIS_PORT: 6379
CLICKHOUSE_HOST: clickhouse
@@ -392,7 +402,9 @@ services:
COOKIELESS_REDIS_PORT: 6379
CDP_REDIS_HOST: redis7
LOGS_REDIS_HOST: redis7
LOGS_REDIS_TLS: "false"
TRACES_REDIS_HOST: redis7
TRACES_REDIS_TLS: "false"
CLICKHOUSE_HOST: clickhouse
CLICKHOUSE_DATABASE: posthog
CLICKHOUSE_SECURE: "false"