tubearchivist-es
Elasticsearch backend paired with the tubearchivist main
service. Uses the bbilly1/tubearchivist-es
OCI image. The image reference is digest-pinned per ADR-0005.
| Attribute | Value |
|---|---|
| Runtime | OCI (Podman) |
| Port | 9200 (internal — accessed by tubearchivist via localhost) |
| Idle timeout | 43200 s (12 h) |
| OCI image | bbilly1/tubearchivist-es |
Blueprint environment defaults:
| Variable | Default |
|---|---|
ES_JAVA_OPTS | -Xms1g -Xmx1g |
xpack.security.enabled | true |
discovery.type | single-node |
path.repo | /usr/share/elasticsearch/data/snapshot |
Consumer must provide:
- Environment variable:
ELASTIC_PASSWORD(supplied throughenvironmentFiles). - Volume mount for
/usr/share/elasticsearch/data(persistent index storage).
Current Recommended Pin
The blueprint pins recommended.main to the following digest-pinned image reference (verified
against merlin production 2026-05-17):
8.19.0@sha256:9da63fb1973ec3d57daf6916be948eddd0d8a404cc8e447c938480c85fe2c554
This is a paired image with the main tubearchivist service. Bumping the Elasticsearch tag
requires checking the TubeArchivist compatibility matrix to confirm the new ES version is
supported by the corresponding TubeArchivist release.
Usage
The canonical consumer pattern calls mk {} and merges host-specific identity and volume via
lib.recursiveUpdate:
nixda.zones.private.services.tubearchivist-es = lib.recursiveUpdate
((blueprint "tubearchivist-es").mk {})
{
id = 11;
runtime.oci.volumes = [
"/var/lib/tubearchivist-es/data:/usr/share/elasticsearch/data"
];
};
ELASTIC_PASSWORD is a secret and should be supplied through environmentFiles rather than
inline. See the consumer host documentation for the secret-wiring pattern.
To opt into the recommended pin explicitly:
nixda.zones.private.services.tubearchivist-es = lib.recursiveUpdate
((blueprint "tubearchivist-es").mk {
versions = (blueprint "tubearchivist-es").recommended;
})
{
id = 11;
# ... volume as above
};
Pinning to a Different Tag
nixda.zones.private.services.tubearchivist-es = lib.recursiveUpdate
((blueprint "tubearchivist-es").mk {
versions = {
main = "<new-tag>@sha256:<64-lowercase-hex-chars>";
};
})
{
id = 11;
# ... volume as above
};
See the upgrade-sandbox runbook
(docs/runbooks/upgrade-sandbox.md) for the procedure to validate an Elasticsearch bump
against a sandbox copy of the merlin index before applying.