Elasticsearch
-
Maybe to add that a cronjob in NextCloud App is recommended to update the index, e.g.
*/15 * * * * occ fulltextsearch:index --quiet@Kubernetes Recommended is
occ fulltextsearch:liveas per the docs -
@Kubernetes Recommended is
occ fulltextsearch:liveas per the docs@andreasdueren said in Elasticsearch:
@Kubernetes Recommended is
occ fulltextsearch:liveas per the docsThere was a cron command that ran once upon starting. @girish what was that again?
-
@Joseph I thought @service was different and there was another one. But maybe I'm wrong.
-
@andreasdueren maybe
@reboot? https://docs.cloudron.io/apps/#cron I would have preferred if it was called oneoff or startup
. -
@andreasdueren maybe
@reboot? https://docs.cloudron.io/apps/#cron I would have preferred if it was called oneoff or startup .@Joseph Yup I think that was it!
-
A andreasdueren referenced this topic on
-
@girish what do you need to make this gem a official package?
@Kubernetes I don't think it's wanted because they'd prefer to make it an add-on not as an app.
-
When i look at the time this thread is open I wonder if it could be an interims solution until the add-on is ready
-
Why not build it locally and deploy it?
(I wonder if the reluctance of deploying non-appstore comes from the difficulty of building an app or because it's seen as dangerous/unstable?)
@joseph 1) This approach is seperate to the common Cloudron usage
2) Updates are not automatically, but manually
3) Not everybody is able to build and install custom packages
4) It requires public space on docker.hub or a private instance of docker repo
5) the package is not optimized by the Cloudron maintainers
-
@Nicolas Indeed, current plan is to implement Elastic search as an addon and not as an app. This will help apps like Nextcloud etc have document search as well. I will move this port to Feature Requests since it's a platform level change.
If you want to use this right away, there are two approaches:
- use an external elastic search (i.e install it on a separate server and have the LAMP app access that)
- alternately, create a cloudron package and install elastic search as an app. You can install this package on
elastic.domain.comand then your app can use it directly.
@girish Perhaps the Nextcloud Talk High Performance Backend as well as the Elasticsearch could be installed together onto the same server, somehow.
There is also Manticore:
https://forum.cloudron.io/topic/9753/manticore-search-oss-fast-database-for-search-alternative-for-elasticsearch -
Updated Elastic to v9.1.5
https://git.due.ren/andreas/elasticsearch-cloudron/releases/tag/v9.1.5 -
Updated: https://git.due.ren/andreas/elasticsearch-cloudron/releases/tag/v1.0.17
- Plugins: bundle analysis-icu in the image so language-specific analyzers (incl. German) work out of the box and no longer hit runtime install failures on Cloudron’s read-only FS.
- Stability: revamped heap management to respect ES_JAVA_HEAP, custom jvm.options.d, and cgroup limits
-
@nichu42 This is honestly not super stable yet, I'm only using it for some nextcloud purposes and haven't tested it thoroughly.
-
@andreasdueren do you know if it's multi-tenant ? I think it makes sense to make elasticsearch as an addon (instead of an app). That way apps can come pre-installed/pre-configured with it. Apps and addons are very similar packaging wise. There is just some automation on top of it for backups and upgrades.
What's needed for addons is: an automated way to create (say) a username/password on the fly for a specific app. (The platform then injects these as env var in the container). If ES supports multiple stores (db/index or whatever it's called in ES world), then this username/password pair has to limit access to specific store i.e one app cannot access another app's store.
-
@andreasdueren do you know if it's multi-tenant ? I think it makes sense to make elasticsearch as an addon (instead of an app). That way apps can come pre-installed/pre-configured with it. Apps and addons are very similar packaging wise. There is just some automation on top of it for backups and upgrades.
What's needed for addons is: an automated way to create (say) a username/password on the fly for a specific app. (The platform then injects these as env var in the container). If ES supports multiple stores (db/index or whatever it's called in ES world), then this username/password pair has to limit access to specific store i.e one app cannot access another app's store.
@girish I'd love to be able to use Eleasticsearch on Cloudron so we can have full text search on Nextcloud (because I keep thinking of moving my Nextcloud away Cloudron and search is one of the reasons why - high performance backends and other shiny features that come as standard in the AIO package being other reasons)...
...so I was intrigued by you question and didn't know the response. ChatGPT say:
Right — so what Girish is asking about hinges on whether Elasticsearch supports secure multi-tenancy, meaning:
can multiple apps share a single ES instance safely, with each app isolated to its own dataset (index or namespace) and credentials?Here’s how that works in Elasticsearch:
Multi-tenancy in ElasticsearchElasticsearch does not natively provide hard multi-tenant isolation in the open-source (Basic) tier. All indices in a cluster are accessible to any client that can authenticate, unless you’re running a commercial licence (Elastic’s “Gold” or higher) with role-based access control (RBAC) via Elastic Stack Security (formerly X-Pack).
However, you can approximate multi-tenancy in several ways:
1. Single cluster, per-app indices (no true isolation)
- Each app gets its own index (e.g.
app1_*,app2_*). - Credentials: You can create separate API keys or users per app if you’re using Elastic Stack Security.
- Without X-Pack security, you can’t restrict one user to only their own indices.
Simple to manage
No isolation without paid security features
2. Single cluster, per-app namespaces with RBAC (requires paid Elastic licence)
- You create roles limiting each user to their own index patterns (e.g.
role_app1 → indices: app1_*). - Then create a user per app and assign its role.
- True logical isolation
️ Requires enabling security features (which are part of Elastic’s commercial licence, not open source)
3. Separate Elasticsearch instances per app
- Each app gets its own single-tenant ES container.
- Cloudron would manage these automatically as separate addons (like how Postgres addons work).
- Strong isolation, no need for commercial features
- More resource usage, less efficient
4. OpenSearch alternative
If you switch to OpenSearch (the fully open-source fork of Elasticsearch 7.10), it includes fine-grained access control (FGAC) and multi-tenancy features under the Apache 2.0 licence.
That makes it more suitable for Cloudron’s addon model, since you can:- Create tenants
- Restrict users to specific indices
- Use internal user databases or LDAP for auth
- Do all this without paid licensing
Summary (for Girish / Cloudron dev context)Option Isolation Licensing Suitable for Addon Model? Notes Elasticsearch OSS None Open source No way to restrict users per index Elasticsearch (with X-Pack Security) Yes Commercial ️Technically possible, but licence issue Multiple ES containers Full Open source More resource-heavy OpenSearch Yes Open source Best fit for Cloudron addon use-case
RecommendationIf the goal is to package Elasticsearch as a Cloudron addon shared by multiple apps with per-app credentials:
-
Use OpenSearch, not Elastic’s OSS build.
-
Implement addon hooks to:
- Create an index pattern per app (
app_<id>_*) - Create a user + password via the OpenSearch security API
- Assign permissions for that index pattern
- Inject credentials into the app container’s env vars
- Create an index pattern per app (
That way, the model matches existing Cloudron addons like PostgreSQL: single shared service, isolated logical databases per app.
Would you like me to sketch a quick pseudo-flow (in YAML or JSON) showing how Cloudron could auto-provision an OpenSearch user/index when an app requests the addon?
- Each app gets its own index (e.g.
