Merge remote-tracking branch 'upstream/main'

Co-authored-by: Cursor <cursoragent@cursor.com>

# Conflicts:
#	.github/workflows/publish_docker_images.yml

Author: aanufriev-celonis

.github/workflows/publish_docker_images.yml

@@ -4,8 +4,8 @@ on:
   workflow_dispatch:
   push:
     branches:
+      # Triggers an edge build, gated behind manual approval of the "production" environment.
       - main
-      - release-0.9
     paths:
       - "quickwit/**"
     tags:
@@ -36,7 +36,12 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Extract asset version
-        run: echo "ASSET_VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
+        run: |
+          if [[ "${{ github.ref_type }}" == "tag" ]]; then
+            echo "ASSET_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          else
+            echo "ASSET_VERSION=edge-${GITHUB_SHA::7}" >> $GITHUB_ENV
+          fi
 
       - name: Install rustup
         run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain none -y
@@ -223,7 +228,6 @@ jobs:
             type=semver,pattern={{version}},value=latest
             type=semver,pattern={{version}},suffix=-slim-bookworm
             type=ref,event=tag
-            type=raw,value=v0.9.0-rc,enable=${{ github.ref == 'refs/heads/release-0.9' }}
       - name: Login to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:

config/quickwit.yaml

@@ -48,7 +48,13 @@ version: 0.8
 #     verify_client_cert: true
 #     # How often cert_path/key_path are polled for changes and hot-reloaded; an
 #     # immediate reload can also be triggered with SIGHUP. Defaults to 5m.
-#     cert_reload_interval: 5m
+#     cert_poll_interval: 5m
+#     # Maximum lifetime of a connection before the server sends an HTTP/2 GOAWAY and the
+#     # client reconnects. Disabled when unset.
+#     max_connection_age: 30m
+#     # Grace period after the GOAWAY before a still-draining connection is forcefully
+#     # closed. Requires `max_connection_age` to be set.
+#     max_connection_age_grace: 30s
 #
 # Optional plaintext health-check server. Disabled unless `listen_port` is set (or the
 # `QW_HEALTH_LISTEN_PORT` environment variable). It serves only `/health/livez` and
@@ -74,7 +80,13 @@ version: 0.8
 #     expected_name: quickwit.local
 #     # How often cert_path/key_path are polled for changes and hot-reloaded; an
 #     # immediate reload can also be triggered with SIGHUP. Defaults to 5m.
-#     cert_reload_interval: 5m
+#     cert_poll_interval: 5m
+#     # Maximum lifetime of an inbound connection before the server sends an HTTP/2 GOAWAY
+#     # and the peer reconnects. Disabled when unset.
+#     max_connection_age: 30m
+#     # Grace period after the GOAWAY before a still-draining connection is forcefully
+#     # closed. Requires `max_connection_age` to be set.
+#     max_connection_age_grace: 30s
 #
 # IP address advertised by the node, i.e. the IP address that peer nodes should use to connect to the node for RPCs.
 # The environment variable `QW_ADVERTISE_ADDRESS` can also be used to override this value.

docs/configuration/node-config.md

@@ -127,9 +127,9 @@ When the REST API is behind mTLS, simple HTTP health probes can no longer reach
 | `ca_path` | Path to a PEM file holding the trusted CA certificate(s). Used by the server to validate client certificates when `verify_client_cert` is enabled, and by the gRPC client to validate peer certificates. Multiple CA certificates may be concatenated in the same file: all of them are trusted (see [CA rotation](#ca-rotation)). | |
 | `verify_client_cert` | If `true`, require clients (REST) or peers (gRPC) to present a certificate signed by `ca_path`, i.e. enforce mutual TLS. | `false` |
 | `expected_name` | gRPC only. The hostname the gRPC client checks against the peer certificate's Subject Alternative Name (SAN). Defaults to the peer's address. | |
-| `cert_reload_interval` | How often `cert_path` and `key_path` are polled for on-disk changes and hot-reloaded, without restarting the process. An immediate reload can also be triggered by sending `SIGHUP` to the process. | `5m` |
+| `cert_poll_interval` | How often `cert_path` and `key_path` are polled for on-disk changes and hot-reloaded, without restarting the process. An immediate reload can also be triggered by sending `SIGHUP` to the process. | `5m` |
 
-Certificates are hot-reloaded: when `cert_path`/`key_path` change on disk, new connections pick up the new certificate within `cert_reload_interval` (or immediately on `SIGHUP`), while in-flight connections keep the certificate they negotiated. A new certificate is only applied if it parses and matches its key; otherwise the previous certificate is kept. Note that the CA trust roots (`ca_path`) are **not** hot-reloaded — rotating them still requires a restart.
+Certificates are hot-reloaded: when `cert_path`/`key_path` change on disk, new connections pick up the new certificate within `cert_poll_interval` (or immediately on `SIGHUP`), while in-flight connections keep the certificate they negotiated. A new certificate is only applied if it parses and matches its key; otherwise the previous certificate is kept. Note that the CA trust roots (`ca_path`) are **not** hot-reloaded — rotating them still requires a restart.
 
 ### CA rotation
 
@@ -152,7 +152,7 @@ rest:
     key_path: /path/to/server.key
     ca_path: /path/to/ca.crt
     verify_client_cert: true
-    cert_reload_interval: 5m
+    cert_poll_interval: 5m
 ```
 
 Example of a gRPC configuration with mTLS:
@@ -165,7 +165,7 @@ grpc:
     ca_path: /path/to/ca.crt
     expected_name: quickwit.local
     verify_client_cert: true
-    cert_reload_interval: 5m
+    cert_poll_interval: 5m
 ```
 
 ## Storage configuration

quickwit/CLAUDE.md

@@ -106,6 +106,11 @@ zip = { workspace = true, default-features = false, features=["deflate"] }
 to
 zip = "2"
 
+Do not write Cargo.lock yourself.
+Instead, just may run `cargo check`, if you have edited Cargo.toml.
+It will update `Cargo.lock` with as little changes as possible.
+You may also run `cargo update` to update dependencies provide you were explicitly asked to update dependencies.
+
 ## Code Formatting
 ### Quick Fix