# yaml-language-server: $schema=https://schema.zeabur.app/template.json
apiVersion: zeabur.com/v1
kind: Template
metadata:
    name: Elasticsearch Single Node with Kibana (v9)
spec:
    description: Production-ready single-node Elasticsearch with Kibana, using official images. Password and SSL enabled by default.
    coverImage: https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/bltd2b695348ddc99f3/62fcf82cbcca746334bc3ddc/blog-thumb-release-platform.png
    icon: https://cdn.zeabur.com/templates/icon/elastic.svg
    variables:
        - key: PUBLIC_KIBANA_DOMAIN
          type: DOMAIN
          name: Kibana Domain
          description: The domain for your Kibana service.
        - key: PUBLIC_ELASTICSEARCH_DOMAIN
          type: DOMAIN
          name: Elasticsearch Domain
          description: The domain for your Elasticsearch service.
    tags:
        - Search
        - Analytics
        - Elasticsearch
        - Kibana
        - Single Node
    readme: |
        # Elasticsearch Single Node with Kibana

        This template deploys a single-node Elasticsearch + Kibana stack using official Elastic images. Password authentication is enabled out of the box, and HTTPS is provided by Zeabur's edge for the public domains.

        ## Features

        - Single-node Elasticsearch with built-in security (username + password)
        - Kibana connects to Elasticsearch via a service-account token over in-cluster HTTP
        - Auto-generated password for the `elastic` user
        - HTTPS access via Zeabur edge for both Elasticsearch and Kibana domains
        - Suitable for development and small single-node deployments

        > Note: Inter-service traffic between Kibana and Elasticsearch is plain HTTP inside the project network. The cluster is single-node, so transport-layer TLS is disabled. If you need full end-to-end TLS or a multi-node cluster, use a different template.

        ## Usage

        ELK does not provide a one-click deployment. Follow these steps to finish setting up Kibana:

        1. Deploy the stack.
        2. Open the **Terminal** on the `elasticsearch` service and create a service-account token for Kibana:
           ```bash
           $ ./bin/elasticsearch-service-tokens create elastic/kibana kibana
           SERVICE_TOKEN elastic/kibana/kibana = <your-service-token>
           ```
        3. Set the printed token as the `ELASTICSEARCH_SERVICEACCOUNTTOKEN` environment variable on the `kibana` service.
        4. Restart the `kibana` service.
        5. Open the **Terminal** on the `kibana` service and generate the encryption keys:
           ```bash
           $ bin/kibana-encryption-keys generate
           ```
           The output prints three values that should be set as environment variables on the `kibana` service:
           - `XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY` — encrypts stored objects (dashboards, visualizations)
           - `XPACK_REPORTING_ENCRYPTIONKEY` — encrypts saved reports
           - `XPACK_SECURITY_ENCRYPTIONKEY` — encrypts session information
        6. Set those three environment variables on the `kibana` service.
        7. Restart the `kibana` service.
        8. Access Elasticsearch at `https://<your-elasticsearch-domain>` (Zeabur edge terminates TLS — no port suffix needed).
        9. Access Kibana at `https://<your-kibana-domain>` — the web-based visualization interface.

        > Note: On first load, the browser DevTools console may show a single red CSP error like `Refused to execute inline script ... script-src 'self'`. This is **expected** — Kibana intentionally probes whether the browser enforces strict CSP, and immediately logs `^ A single error about an inline script not firing due to content security policy is expected!` right after. Kibana continues to load and works normally.

        ## Default Credentials

        Check the instructions section of the Kibana service to see the auto-generated credentials.

        Log in to Kibana with the `elastic` username and the auto-generated password to explore, visualize, and manage your Elasticsearch data.

        ## Official Docs

        - [Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html)
        - [Kibana](https://www.elastic.co/guide/en/kibana/current/index.html)
    services:
        - name: elasticsearch
          icon: https://cdn.zeabur.com/templates/icon/elastic.svg
          template: PREBUILT
          spec:
            id: elasticsearch
            source:
                image: docker.elastic.co/elasticsearch/elasticsearch-wolfi:9.2.3
                runAsUserID: 1000
            ports:
                - id: http
                  port: 9200
                  type: HTTP
            volumes:
                - id: esdata
                  dir: /usr/share/elasticsearch/data
            instructions:
                - title: Elasticsearch Username
                  content: elastic
                - title: Elasticsearch Password
                  content: ${ELASTIC_PASSWORD}
            env:
                ELASTIC_PASSWORD:
                    default: ${PASSWORD}
                    expose: true
                ES_JAVA_OPTS:
                    default: -Xms1g -Xmx1g
                bootstrap.memory_lock:
                    default: "true"
                discovery.type:
                    default: single-node
                node.name:
                    default: elasticsearch
                xpack.license.self_generated.type:
                    default: basic
                xpack.ml.use_auto_machine_memory_percent:
                    default: "true"
                xpack.security.autoconfiguration.enabled:
                    default: "false"
                xpack.security.enabled:
                    default: "true"
                xpack.security.http.ssl.enabled:
                    default: "false"
                xpack.security.transport.ssl.enabled:
                    default: "false"
          domainKey: PUBLIC_ELASTICSEARCH_DOMAIN
        - name: kibana
          icon: https://cdn.zeabur.com/templates/icon/elastic.svg
          dependencies:
            - elasticsearch
          template: PREBUILT
          spec:
            id: kibana
            source:
                image: docker.elastic.co/kibana/kibana-wolfi:9.2.3
                command:
                    - /usr/local/bin/kibana-docker
                runAsUserID: 1000
            ports:
                - id: web
                  port: 5601
                  type: HTTP
            volumes:
                - id: kibanadata
                  dir: /usr/share/kibana/data
            instructions:
                - title: Elasticsearch Username
                  content: elastic
                - title: Elasticsearch Password
                  content: ${ELASTIC_PASSWORD}
            env:
                ELASTICSEARCH_HOSTS:
                    default: http://elasticsearch:9200
                ELASTICSEARCH_SERVICEACCOUNTTOKEN:
                    default: ""
                KIBANA_PORT:
                    default: "5601"
                SERVER_PUBLICBASEURL:
                    default: https://${ZEABUR_WEB_DOMAIN}
                SERVERNAME:
                    default: kibana
                XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY:
                    default: ""
                XPACK_REPORTING_ENCRYPTIONKEY:
                    default: ""
                XPACK_SECURITY_ENCRYPTIONKEY:
                    default: ""
          domainKey: PUBLIC_KIBANA_DOMAIN