← Archive

CouchDB - Persistent Admin Accounts

Archived post · originally published · may be out of date

Docker Containers & Applications · #CouchDB #Docker

Introduction

I run CouchDB in a containerized environment but I had a strange issue where when a new Docker image of CouchDB was released and deployed in my environment, all of my customized admin users were deleted from my CouchDB instance. The good news was that the data in the database is NOT touched by these updates and the solution to fix this problem was straightforward.

Solution

What we are going to do is reference the individual admin accounts in a local.ini file that is loaded by CouchDB every time the container is restarted (and updated).

Compose File Modification

Firstly, we will remove any environmental variables that create an admin user in our Docker compose file and then we will tell CouchDB to use a local.ini file that will persist since it is pointed to a Docker volume.

What happens is that the local.ini file overrides the default.ini settings used by CouchDB as mentioned in the documentation "this file won't be; overwritten on server upgrade."

My previous compose file:

services:
  couchdb:
    image: couchdb
    restart: always
    ports:
      - "5984:5984"
    environment:
     COUCHDB_USER: XXXX
     COUCHDB_PASSWORD: XXXX
    volumes:
      - /volume1/docker/storage/couchdb/data:/opt/couchdb/data:rw

The modified compose file referencing the local.ini file:

services:
  couchdb:
    image: couchdb
    restart: always
    ports:
      - "5984:5984"
    volumes:
      - /volume1/docker/storage/couchdb/data:/opt/couchdb/data:rw
      - /volume1/docker/storage/couchdb/local.ini:/opt/couchdb/etc/local.ini

The local.ini File

What we will do is create a local.ini file based on my file below, or use the example provided by CouchDB itself, then modify the [admins] section at the bottom of the local.ini file, listing the customized admins with their accompanying passwords, for example:

[admins]
admin1 = YOUR_PASSWORD
admin2 = YOUR_PASSWORD

An example of the local.ini file I used with the Obsidian Self-hosted LiveSync extension:

[couchdb]
single_node = true
max_document_size = 50000000

[chttpd]
require_valid_user = true
max_http_request_size = 4294967296

[chttpd_auth]
require_valid_user = true
authentication_redirect = /_utils/session.html

[httpd]
WWW-Authenticate = Basic realm="couchdb"
enable_cors = true

[cors]
origins = app://obsidian.md,capacitor://localhost,http://localhost,https://YOUR_COUCHDB_URL
credentials = true
headers = accept, authorization, content-type, origin, referer
methods = GET, PUT, POST, HEAD, DELETE
max_age = 3600

[admins]
admin1 = PASSWORD
admin2 = PASSWORD