Pigsty v4.0.0-b4

[Vonng]

Release Date: 2026-01-01

v4.0.0 is a major release with 229 commits, 540 files changed, 91,214 insertions, and 40,782 deletions.

curl https://pigsty.cc/get | bash

GitHub Release: https://github.com/pgsty/pigsty/releases/tag/v4.0.0-b4

---

Highlights

• Observability Stack Overhaul: Prometheus → VictoriaMetrics, Loki → VictoriaLogs, Promtail → Vector
• Security Hardening: etcd RBAC enabled by default, tightened permissions, password management improvements
• PostgreSQL 17/18 Features: io_method, io_workers, idle_replication_slot_timeout support
• PITR Enhancement: New pg-fork script, backup-before-PITR, pg_timeline metrics
• License Change: AGPL-3.0 → Apache-2.0
• Platform Expansion: Full EL10/Debian13 support, uv replaces pip

---

Software Versions

Infrastructure Packages

MinIO now uses Pigsty-maintained RPM/DEB packages:

Package	Version	Notes
grafana	12.3.1
alertmanager	0.30.0
victoria-metrics	1.132.0	Replaces Prometheus
victoria-logs	1.43.1	Replaces Loki
vector	0.52.0	Replaces Promtail
blackbox_exporter	0.28.0
duckdb	1.4.3
etcd	3.6.7
rclone	1.72.1
pev2	1.19.0
pg_exporter	1.1.0
pgbackrest_exporter	0.22.0
pig	0.8.1
genai-toolbox	0.23.0
minio	20251203120000
uv	0.9.18	New package, replaces pip

PostgreSQL Extensions

Extension	Change	Notes
IvorySQL	5.0 → 5.1
pg_textsearch	0.1.0	New extension
pg_clickhouse	0.1.0	New extension
pg_ai_query	0.1.1	New extension
timescaledb	2.23.1 → 2.24.0
pg_search	0.20.0 → 0.20.4
pg_duckdb	1.1.0 → 1.1.1	Official release
pg_biscuit	1.0 → 2.0.1	Repository renamed
pg_convert	0.0.4 → 0.0.5	Removed PG13 support
pgdd	0.6.0 → 0.6.1	Removed PG13 support
pglinter	1.0.0 → 1.0.1
pg_session_jwt	0.3.3 → 0.4.0
pg_anon	2.4.1 → 2.5.1
pg_enigma	0.4.0 → 0.5.0
wrappers	0.5.6 → 0.5.7
pg_vectorize	0.25.0 → 0.26.0
vchord_bm25	0.2.2 → 0.3.0
pg_timeseries	0.1.7 → 0.1.8

Fixed PG18 Deb packages: pg_vectorize, pg_tiktoken, pg_tzf, pglite_fusion, pgsmcrypto, pgx_ulid, plprql, pg_summarize, supautils

---

Breaking Changes

Observability Stack Replacement

Old Component	New Component	Purpose
Prometheus	VictoriaMetrics	Metrics storage & query
Loki	VictoriaLogs	Log storage & query
Promtail	Vector	Log collection agent

Key Commits:

• d50cd813e feat: replace prometheus stack with victoria
• a426ef724 feat: provision vlogs instead of loki in role infra
• ac8ca88a8 feat: add node_monitor vector log agent support
• 8564c430c feat: register victoria datasource to grafana
• 63e9f7fa0 feat: update prometheus rules/bin to victoria

Parameter Changes

Deprecated	New Parameter	Commit
node_disable_selinux	node_selinux_mode	8f763bf07
node_disable_firewall	node_firewall_mode	699a7bc75
infra_pip	infra_uv	87f71ca1e
pg_pwd_enc	pg_io_method	7689d25d0
pgbackrest_clean	(removed)	9fe8167d2

License Change

• Main license changed from AGPL-3.0 to Apache-2.0 (287d7ca47)
• More permissive open-source license

---

New Features

1. VictoriaMetrics Observability Stack

Complete log collection coverage for all components:

• b782b8b87 feat: collect pgbouncer logs with vector
• 26b3d8f5e feat: collect redis logs with vector
• 8c2774ba9 feat: collect minio logs with vector
• 0c174a794 feat: collect etcd log with vector
• c32cbf2b9 feat: collect nginx log with vector
• 8bcf7b484 feat: collect grafana logs with vector
• 22c8ba6c3 feat: add vip-manager and pg exporters logs

New Grafana datasources and dashboards:

• b4c7f9f5a feat: update grafana dashboards to use vlogs
• 32fbf54b6 add new dashboard node-vector
• 63e1b5a5e feat: update grafana dashboards logs panel

2. Security Hardening

etcd RBAC:

• 05dd7a259 feat: enable etcd rbac
• 26bb46e31 feat: harden etcdctl env and root password

Permission Tightening:

• 99a4a05de harden: tight permission on /infra/conf/patronictl
• 408c5cfdd feat: add admin_ip to patroni allowlist
• d19dbe77c fix(minio): harden credential security
• 67cca894c use mode 0700 for files/pki/ca directory

New Security Parameters:

• 67e241949 feat: new param node_admin_sudo to specify sudo level
• 358e85b12 feat(node): add vip_auth_pass parameter for VRRP authentication
• 4a163753f new param grafana_view_pass to customize pg meta ds password

3. PostgreSQL Features

PG17/18 I/O Parameters:

• 7d1e980d9 feat: setup io_method and io_workers param
• 7689d25d0 add pg_io_method, remove pg_pwd_enc
• 22ae87732 feat: set maintenance_io_concurrency according to ssd

Replication Slot Timeout:

• fd0d70af6 feat: set idle_replication_slot_timeout to 7d/3d

Database/User Definition Enhancements:

• 791f9c765 feat: add state support for pg_databases
• 5608b43dd feat: allow using strategy in pg_databases definition
• d9f8fe0d8 feat: allow pg15-18 database param to be used in definition
• 47534693f feat: customize user/role with admin/set/inherit options
• c99f4f0e6 feat: add order support for pg/pgb hba rules
• 03eb3fbcf add ipv6 support for pg/pgb hba

Other PostgreSQL Improvements:

• 75a46f617 add --no-data-checksums for pg17+ when pg_checksums is disabled
• 523da88bc optimize log_lock_failures, log_connections
• a802e9e08 feat: optimize default pg log settings (UTC timezone, weekly auto rotate)

4. PITR Enhancement

• 72c221931 add instance-level fork script: /pg/bin/pg-fork
• af673d1c7 feat: add pitr.backup support, backup data before pitr
• fd927eaa9 add new collector pg_timeline
• de69b5d73 use the new pg_timeline_id metrics in dashboards
• f896a2482 feat: optimize pg_pitr roles
• bea60e349 feat: reuse pg_pitr command templates
• 5916e5cde feat: loose pg_pitr etcd metadata remove condition
• 5e0eca474 update pgsql-pitr dashboard with more details

5. Configuration & Deployment

New Playbook:

• ba0217e11 add the new playbook deploy.yml

Configuration Improvements:

• 749857a97 feat: add -g to configure to auto generate password
• 7a057182a feat: specify pg/pgb hba intranet with node_firewall_intranet

Grafana Enhancements:

• c3197e2c9 feat: allow using postgres as grafana backend db
• d3e273116 feat: add grafana_pgurl param
• debca012c feat: add auth support for nginx_servers
• 60c1bced3 feat: use relative links in grafana

Package Management:

• 87f71ca1e replace infra_pip with infra_uv
• c7850c5f0 feat: add skip_ifna, minor, priority fields in repo definition
• 634e1b42d allow using meta in repo definition

6. Other Features

• 85dd9f21f feat: allow blackbox ping
• a0bf166dd feat: add stream option support in infra_portal
• 699a7bc75 feat: customize node firewall rules
• 606dd1e04 feat: add haproxy selinux policy module
• 815d4f9b9 feat: add new pg metric pg:ixact_ratio
• 478da9b23 feat: add 2 script back: pg-vacuum pg-repack

---

Improvements

Module Refactoring

Redis Module:

• 3c3b6ab85 refactor(redis): unify playbook patterns with etcd/minio modules
• 0454a2a6b refactor(redis): separate deployment and removal concerns
• eb87545ef refactor(redis): unify systemd service templates for all Redis modes
• 6d4a5fcee refactor redis module to work with victoria stack

MinIO Module:

• f3403ab1d refactor(minio): clean up tasks and fix typos
• a886fec71 refactor(minio): unify when conditions in playbooks
• 24e152a14 feat(minio): improve startup reliability and code documentation
• 4f9306506 refactor minio target register / deregister

ETCD Module:

• 543f0f578 fix(etcd_remove): add systemd service cleanup and update docs
• e6b323a66 fix(etcd): remove unused variable and improve reliability
• f9d753542 delegate etcd metadata remove task to etcd nodes

INFRA Module:

• f99db6da2 refactor: infra module overhaul
• 2c23a019b feat: refactor the infra nginx role
• 4e66f6be8 feat: optimize infra user/group creation
• 2af7f4321 refactor: move dnsmasq data to /data/infra/hosts

pgBackRest Improvements

• 134525d38 feat: change pgbackrest_exporter_options with --collect.interval=120
• edbd9d804 reduce pgbackrest_exporter cache interval from 600 to 120s
• dbc829d42 fix: allow group read to /etc/pgbackrest config
• 136a43d2f feat: optimize postgres and pgbackrest logs

Platform Support

• c36b1adcd add support for el 10.1 epel bootstrap
• ef9e508a6 fix(node_id): update OS fallback to el10
• 399b9483c add d13 and remove el8 from build specs
• acfb5887d feat: add aliyun debian13 image for terraform
• 1926332da bump terraform debian 13 to 13.2
• 553ff5d5b add back infra el7 compatibility

Code Standardization

• 3258e3099 style: unify YAML boolean values to true/false
• 88acf24cf style(node): unify ignore_errors boolean representation
• 0cc286a91 chore: normalize Minio to MinIO
• 121bee498 rename systemd service file to .svc file
• 8fb2f1dea feat: normalize systemd service file timeout unit

---

Bug Fixes

PostgreSQL Related

• ebcb06195 fix pg-vacuum transaction block issue
• 369cab14a add coalesce slotname for pg_recv metrics collector
• 519c42e31 fix: add pg_sub_16 branch for parallel logical worker
• c0b6772a1 fix pg_pitr multiple replica clonefrom timing issue
• a8d6e477f fix pg_pitr patroni primary restart condition
• 67aac3ab3 fix missing pg_namespace in roles pg_pitr
• 70e446c66 fix: pg-failover-script typo

Node Related

• 9d95f5f9d fix(node): prevent empty sudoers file generation
• 4a2e5441e fix(node): correct misleading task names and comments
• 363462a6f fix debian groupadd path issue
• 0b50553e6 fix node_data / etcd_data permission

Service Related

• 6b60a7768 fix(haproxy): correct variable path in service template
• 8005c47db fix(redis_remove): correct variable name from redis_seq to redis_node
• 743d9e87c fix: redis remove task typo
• fb4de6d71 fix: redis instance log file name and service filename

MinIO Related

• 39b4f2e51 fix(minio): correct vmetrics_port default value to 8428
• 315a6369d fix(minio): remove ineffective reload handler
• 49839eb62 fix(minio_remove): clean up minio dns entries from /etc/hosts
• c8dacc4ee fix(minio_remove): correct license and config path

Other Fixes

• efe306fb3 fix(cert): use correct ownca_not_after parameter
• 6e2a67cb3 fix ssl cert force and ownca_not_after
• 174a51c88 fix vector 0.52 issue with syslog_raw
• 8b53aa2b9 fix: align vmalert eval interval with vmetrics scrape interval
• ffc631207 feat: eliminate race condition in dnsmasq and selinux/ansible
• 368a2c3a0 fix: el9.aarch64 patroni & llvmjit hotfix
• 4b2cd7bd9 fix: add newer postgres version to policy-rc.d
• 3a962bdee fix(ferret): fix certificate SAN, restart policy
• 731d236c1 fix(cache): fix EL10 compatibility and improve documentation
• 62c2e91d9 fix(pgmon): correct typos and outdated references
• 832d5c56c chore(docker): sync docker_data default in configs and cmdb
• b203c999e fix(docker): update default data directory and fix docs

---

Documentation

• 102395a3c docs(node): enhance README documentation for node-related modules
• 6bfa477f6 chore: add roles README.md docs
• 67058a91f chore: add CONTRIBUTING.md for pigsty
• f0e054510 feat: add more detailed docs for alertmanager
• 33013821f docs(etcd): fix playbook comments and task documentation
• 5c0b45d3f docs(etcd): fix README file structure and tag hierarchy
• 66074248f docs(minio): update comments and documentation
• 4f1899141 docs(minio): fix certificate path in README
• 1f5b207d0 docs(mongo): add -l flag to purge command for safety
• 649567874 docs(redis): update playbooks and configs for refactored redis module

---

Infrastructure

Vagrant Templates

• 942377e08 add xfs /data disk to vagrant templates
• dfa078f45 increase vagrant libvirt disk size to 128GB
• 9baed8fe6 add 10-node vagrant template
• d3bbd0b61 refactor the simu config template with 20 nodes

Terraform

• 1926332da bump terraform debian 13 to 13.2
• acfb5887d feat: add aliyun debian13 image for terraform

Homepage

• 6a76865df feat: add zh-Hans homepage
• 546ee22f0 replace h.pigsty to i.pigsty
• a3705d299 change default infra_portal to the i.pigsty
• 1e8144837 optimize i.pigsty homepage style
• 46cf24d38 update zh home page template

---

Migration Guide

Upgrading from v3.x

1. Backup Current Configuration

   cp pigsty.yml files/pigsty-$(date +%Y%m%d).yml

2. Observability Stack Changes

   • Prometheus/Loki/Promtail will be replaced with VictoriaMetrics/VictoriaLogs/Vector
   • Historical monitoring data requires manual migration or re-collection

3. Parameter Migration

   # Old (v3.x)
   node_disable_selinux: true
   node_disable_firewall: true
   
   # New (v4.0)
   node_selinux_mode: disabled    # disabled|enforcing|permissive
   node_firewall_mode: off        # off|none|zone

4. etcd RBAC

   • v4.0 enables etcd RBAC by default
   • Ensure etcd_root_pass is properly configured

5. Redeploy Infrastructure

   ./infra.yml -l infra

---

Compatibility

OS	x86_64	aarch64
RHEL/Rocky/Alma 8	✅	✅
RHEL/Rocky/Alma 9	✅	✅
RHEL/Rocky/Alma 10	✅	✅
Debian 11 (Bullseye)	✅	✅
Debian 12 (Bookworm)	✅	✅
Debian 13 (Trixie)	✅	✅
Ubuntu 22.04 (Jammy)	✅	✅
Ubuntu 24.04 (Noble)	✅	✅

PostgreSQL Versions: 13, 14, 15, 16, 17, 18

---

Statistics

Total commits: 229
Files changed: 540
Insertions:    91,214
Deletions:     40,782

---

This discussion was created from the release Pigsty v4.0.0-b4.