Pigsty v4.6: 625 Extensions, VAULT, MySQL 8.4 Overhaul, and PG 18.7

Pigsty v4.6.0 is released! This feature release covers secrets infrastructure, database orchestration, PostgreSQL kernels/extensions, and supply-chain tooling. It introduces VAULT with OpenBao 2.7.2, redesigns MYSQL 8.4, updates PostgreSQL to 18.7 and refreshes its major forks, expands packaged extensions to 625, and updates pig v1.11.0, pg_exporter v1.6.1, sow v0.7.1, and infrastructure packages.

From v4.5.0 (dab5dba3, 2026-08-14) to v4.6.0 (d71d9de8, 2026-11-12), the tagged changes cover 139 commits, 441 files, 21,701 additions, and 5,026 deletions. See the tag comparison.

Highlights

• 625 packaged PostgreSQL extensions: 52 additions and two removals since v4.5.0’s 575 entries, a net gain of 50. There are 457 non-contrib package families and 2,740 entries in the online catalog. Many Rust extensions move to pgrx 0.19.3.
• VAULT secrets management: the new VAULT module uses OpenBao 2.7.2 (MPL-2.0), built-in Raft with topology-derived modes, static seal auto-unseal, TLS 1.3, VIP/HAProxy HA access, daily snapshots, monitoring, and alerts.
• MySQL 8.4 overhaul: MYSQL now has 16 public parameters and a consistent /data/mysql layout, complete-outage recovery (rebootClusterFromCompleteOutage), InnoDB Clone rebuilding, 70 recording rules, and eight alerts.
• PostgreSQL 18.7 and kernel updates: IvorySQL 5.6, Babelfish 6.2.0 / 5.7.0, Percona pg_tde 18.6.1, OrioleDB 1.10.3, AgensGraph 2.18.6.1, pgEdge 3PGSTY with Spock 5.0.13, PolarDB 17.11.1.0, Cloudberry 2.2.0, and DocumentDB 1.0.
• KAFKA, JUICE, and VIBE hardening: optional embedded Kafka JMX agent, graceful dynamic-controller retirement before shutdown, strict JuiceFS mount checks, native claude-code / codex packages, and JupyterLab isolation through uv venv.
• Tooling and observability: pig v1.11.0, pg_exporter v1.6.1, sow v0.7.1, Silo 20261112 with silo-console 2.7.2, 68 Grafana dashboards, 775 static recording rules (790 with dynamic templates), and 79 alerts.
• Templates and automation: ten kernel templates move to conf/fork/*, including conf/mysql.yml → conf/fork/halo.yml. There are 53 independent templates. OpenTofu becomes the default under terraform/, offline archives use /var/tmp/pkg.tgz, and Docker/Nginx have independent repository modules.

VAULT Secrets Management (Beta)

The new VAULT module deploys OpenBao (2.7.2, MPL-2.0), the Linux Foundation-hosted secrets system, in the fixed vault group as a shared KMS and secrets store:

• Small interface and topology: eight parameters, five for deployment and three for removal. One member provides a lab instance; three provide production Raft HA, without ETCD or PostgreSQL dependencies.
• Trust roots and auto-unseal: the 32-byte static seal key, root token, and recovery material reside in files/pki/vault/ on the admin node, within the same backup boundary as the CA private key. Members unseal automatically after restart.
• TLS 1.3 and HA access: Pigsty CA signs certificates with TLS 1.3 minimum. OpenBao binds only node IP and loopback, leaving <VIP>:8200 to HAProxy for TLS passthrough to the active member. Clients use https://vault.pigsty:8200.
• Ready-to-use engines and snapshots: secret/ (KV v2), transit/, and approle are enabled. /usr/local/bin/vault-backup uses flock to retrieve daily snapshots from the active member and retains seven locally. Initial and pre-removal snapshots are also retrieved to the admin node.
• Monitoring and safeguards: vault_safeguard defaults to true; 14 recording rules, six alerts, and a new Vault Overview dashboard are included.

MySQL 8.4 Overhaul

Building on the v4.5 pilot, v4.6 redesigns MYSQL with a smaller interface, explicit platform conventions, and recovery workflows:

• 16 public parameters: 13 for deployment and three for guarded removal. Preflight rejects obsolete variables such as mysql_backup_repo. ./configure -g randomizes mysql_root_password, mysql_monitor_password, and mysql_cluster_password.
• Fixed layout and derived settings: /data/mysql includes binlog/ and tmp/; physical backups default to /data/backups/mysql, retaining three. Memory settings account for host size and PostgreSQL co-location; server_id derives from member IPv4 addresses.
• Recovery and Clone rebuilding: complete-outage quorum recovery through dba.rebootClusterFromCompleteOutage() and rebuilding lagging or damaged members through InnoDB Clone and cluster.rescan(). mysql_safeguard defaults to true.
• Expanded observability: rules match mysqld-exporter 0.21.0 metric type changes, with 70 recording rules and eight alerts, including MySQLBackupStale based on mysql_backup_last_run_timestamp_seconds.

KAFKA, JUICE, and VIBE

• KAFKA adds kafka_jmx_exporter_enabled, default true, to disable the embedded agent and scrape independently of kafka-exporter. Removal retires dynamic KRaft voters before shutdown and cleans exporter units and targets. Kafka updates to 4.4.0.
• JUICE checks systemd Result=success and mounts with findmnt on startup/restart to avoid reporting readiness when only the process is alive. JuiceFS updates to 1.4.2.
• VIBE replaces npm install -g with native Infra packages: signed claude-code 2.1.322, codex 0.167.2, plus pi-coding-agent 1.5.2, opencode 1.19.5, crush 0.100.0, and mcp-toolbox 1.16.0. JupyterLab uses /data/jupyter/.venv managed by uv venv; Node.js updates to 26.13.1 LTS.

PostgreSQL 18.7, Kernel Variants, and 625 Extensions

Kernels and PGSQL Role

• The default production version becomes PostgreSQL 18.7, alongside maintenance baselines PG 17.11 / 16.15 / 15.19 / 14.22.
• Kernel updates include IvorySQL 5.6 (PG 18.6, with a native Infra recipe), Babelfish 6.2.0 / 5.7.0 (PG 18.6 / 17.11), Percona pg_tde 18.6 (Server 18.6.1, pg_tde 2.2.2), OrioleDB 1.10.3 (PG 16–18), AgensGraph 2.18.6.1, pgEdge 15–18 3PGSTY (Spock 5.0.13, LOLOR 1.2.3), PolarDB 17.11.1.0 2PGSTY, Cloudberry 2.2.0 with backup/PXF tools, and DocumentDB 1.0.
• The 125th PGSQL parameter, pg_pitr, renders declarative recovery settings. Server certificate SANs include pg_vip_address; crit.yml starts with synchronous_commit: local to avoid blocking single-node bootstrap. HAProxy normalizes pg_rto, and kernel-specific pgBackRest compatibility settings are completed.

625 Packaged Extensions

Comparing pig v1.11.0 (625 entries) with the v4.5.0 baseline pig v1.7.0 (575), this cycle adds 52 entries and removes two, gaining 50 across 457 non-contrib package families:

• 49 new primary extensions and tools: acdat, addressing_dictionary, codesystem, colnames, edtf_postgres, encsearch, hdr_histogram, is_jsonb_valid, istore, jev, kafgres, libx509pq, macavity, oai_fdw, opencc, pg_agent_gate, pg_circuit, pg_grammar_guard, pg_icu_parser, pg_improv, pg_integrity_checksums, pg_json_diff, pg_kv, pg_lease, pg_lexo, pg_lion, pg_living_assertions, pg_money, pg_nanotime, pg_relation_sql, pg_rusage, pg_stat_tcpinfo, pg_statecharts, pg_statkit, pg_statvfs, pg_synonym, pg_table_range, pg_tre, pg_try_cast, pg_vectorsearch, pg_warren, pgexporter_ext, pgs3, pgtelemetry, plphp, stannum, textsearch_intl, tin, and vgram.
• Three new subextensions: pg_lion_citext, pg_lion_vector, and pg_statecharts_dev.
• Two removed subextensions: documentdb_distributed (removed upstream in DocumentDB 1.0) and pgcontext_pgvector.

PostgreSQL Kernel and Extension Package Updates

Infrastructure, Applications, and Tooling

• 53 templates and reorganized kernels: agens, halo (formerly conf/mysql.yml), ivory, mongo, mssql, oriole, pgedge, pgsql, pgtde, and polar move to conf/fork/, selected with ./configure -c fork/<name>. ./configure -v skips fixed-major fork/mssql and fork/polar. New app/silo and app/discourse bring the independent total to 53, with the conf/app/supa.yml symlink retained.
• Repositories and certificate hooks: Docker has a separate docker module; Nginx repositories on EL and Debian/Ubuntu use nginx. INFRA supports production portal templates and cache directories. /etc/nginx/certbot-deploy-hook calls /etc/nginx/link-cert after renewal, then reloads Nginx. Remote pg_exporters credentials use owner prometheus and mode 0600.
• Application templates: .env rendering escapes literal $ as $$ to prevent Compose interpolation. app/silo replaces the standalone MinIO Compose template; app/discourse pins image/source references. Templates update Supabase 0.8.2, Dify 1.17.1, InsForge 2.3.3, JumpServer 5.0.0, and Registry 3.1.2.
• OpenTofu, offline archives, and containers: terraform/ defaults to IAC_CLI=tofu, with IAC_CLI=terraform supported; see OpenTofu. Offline archives default to /var/tmp/pkg.tgz, retaining the /tmp/pkg.tgz fallback and cleanup on failure. Docker builds consume make source archives, use Debian 13.7, and pin pig=1.11.0-*.

Infra and PIG Package Updates

Compatibility and Upgrades

Before upgrading from v4.5 or migrating configuration, check:

1. Kernel template paths: conf/<fork>.yml becomes conf/fork/<fork>.yml; OpenHalo moves from conf/mysql.yml to conf/fork/halo.yml. Use ./configure -c fork/<name>; native MySQL 8.4 remains demo/mysql.
2. MYSQL parameters and layout: remove obsolete variables such as mysql_backup_repo, mysql_rm_confirm, mysql_role, and mysql_port, following the 16 public parameters. mysql_safeguard now defaults to true.
3. Docker/Nginx repository modules: explicitly include docker or nginx in custom repo_modules when needed. Default templates have been updated.
4. OpenTofu default: the terraform/ Makefile runs tofu. Set IAC_CLI=terraform to keep HashiCorp Terraform, or follow the migration guide.
5. Offline archive path: update transfer scripts to /var/tmp/pkg.tgz. bootstrap still checks /tmp/pkg.tgz when the default is absent.
6. Claude Code package name: the official signed claude-code 2.1.322 joins Infra. The old claude package remains at 2.1.319, with no automatic Obsoletes replacement. Migrate existing installations by package name.
7. SOW workspace migration: sow 0.7.1 requires an explicit migration for old 0.3 / 0.4 workspaces.

Get v4.6.0

Install on a fresh supported Linux node:

curl -fsSL https://repo.pigsty.io/get | bash -s v4.6.0
cd ~/pigsty
./bootstrap
./configure
./deploy.yml

Do not rerun all initialization playbooks for production upgrades. Check cluster state, valid backups (pig pg list, pig pb info), and the compatibility notes first. Use an explicit -l scope, run --check, and perform maintenance in stages.

Offline Release and Bilingual Notes

All 14 archives passed independent rich deployments on fresh x86_64 / ARM64 VMs running EL9/10, Debian 12/13, and Ubuntu 22/24/26, with no failed or ignored deployment tasks. Default groups exclude hdfs_fdw and OneSparse; APT/DNF solve the full target set together. Use the release attachment pigsty-v4.6.0.tgz, which includes offline fixes not yet in the tag.

See the v4.6.0 release notes for both languages, package version definitions, source differences, and offline validation results.

All 14 archives passed a fresh, isolated installation with the stock rich template on x86_64 and ARM64. Use the attached pigsty-v4.6.0.tgz, which includes the offline fixes absent from the automatic tag archives. See the English release notes, shared package tables and validation details.