Docker

Crystalline is primarily made to be deployed to a container runtime such as Docker or Podman.

The container is built with 4 mountpoints to be configured, These are:

• /data is used for storing ingested events and is where all indices are saved.
• /config is used to store the configuration database.
• /extra is used to store additional configurations such as lookups or rulesets.
• /cache is used for temporary data such as search results, it should be placed on tmpfs in most configurations.

Example compose file

version: "3"
services:
  crystalline:
    image: codeberg.org/kryesh/crystalline:latest
    hostname: crystalline
    restart: unless-stopped
    volumes:
      - crystalline_data:/data
      - crystalline_config:/config
      - crystalline_extra:/extra
      - type: tmpfs
        target: /cache
    ports:
      - 8080:8080
    environment:
      - CRYSTALLINE_HTTP_PORT=8080
      - CRYSTALLINE_BATCH_SIZE=500
      - CRYSTALLINE_WRITER_WORKER_MEM=16
      - CRYSTALLINE_COMMIT_INTERVAL=5
      - CRYSTALLINE_SEARCH_JOB_TTL=7200
volumes:
  crystalline_data:
  crystalline_config:
  crystalline_extra: