In production images LOGS_REDIS_TLS/TRACES_REDIS_TLS default to true, so
the logs-ingestion consumer (part of the plugin-server default mode) kept
attempting a TLS handshake against the plaintext Redis, timed out every
~11s and killed the process after 10 errors (restart loop every ~2.5 min).
Constrain the plugins service to the capability groups this template
ships (cdp_workflows, realtime_cohorts, feature_flags) and pin the redis
TLS flags to false as belt-and-braces.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Based on the official hobby deployment, trimmed to run on a single
server: Django web + Celery worker, Node plugin-server (CDP, ingestion,
session replay, recording API), Rust capture/replay-capture/
feature-flags/hypercache, livestream, Caddy path router, Postgres,
Redis, Redpanda (Kafka), ZooKeeper, ClickHouse and MinIO.
Images are pinned to a tested master commit (PostHog no longer
publishes tagged releases); an init container fetches the matching
ClickHouse configuration, Kafka table schemas, funnel UDF binaries and
the GeoIP database at the same pinned ref.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
