signalk-questdb 1.1.0 → 1.1.2-beta.0

package/README.md

@@ -103,31 +103,58 @@ wants to slice it into kopia-dedup-friendly shards. Allowed tables:
 
 ## Configuration
 
-| Setting            | Default      | Description                                                   |
-| ------------------ | ------------ | ------------------------------------------------------------- |
-| QuestDB version    | `latest`     | Docker image tag (dropdown shows stable + pre-releases)       |
-| Managed container  | `true`       | Let signalk-container manage QuestDB, or connect to external  |
-| QuestDB host       | `127.0.0.1`  | Host (only used when managed=false)                           |
-| HTTP port          | `9000`       | QuestDB REST API port                                         |
-| ILP port           | `9009`       | InfluxDB Line Protocol write port                             |
-| PostgreSQL port    | `8812`       | For Grafana connections                                       |
-| Sampling rate (ms) | `1000`       | Default min ms between writes per path (0 = every update)     |
-| Record own vessel  | `true`       | Record self context                                           |
-| Record AIS targets | `false`      | Record other vessels                                          |
-| Retention (days)   | `0`          | Auto-delete old partitions (0 = keep forever)                 |
-| Compression codec  | `lz4`        | On-disk WAL compression: `none`, `lz4`, or `zstd`             |
-| Compression level  | `3`          | ZSTD level 1-22 (only when codec is zstd)                     |
-| Container network  | `sk-network` | Shared Podman/Docker network for Grafana integration          |
-| Bind to 0.0.0.0    | `false`      | Bind ports to all interfaces instead of localhost (see below) |
+| Setting            | Default      | Description                                                       |
+| ------------------ | ------------ | ----------------------------------------------------------------- |
+| QuestDB version    | `latest`     | Docker image tag (dropdown shows stable + pre-releases)           |
+| Managed container  | `true`       | Let signalk-container manage QuestDB, or connect to external      |
+| QuestDB host       | `127.0.0.1`  | External QuestDB host (only used when managed=false)              |
+| HTTP port          | `9000`       | External mode, or the host binding when "Bind to 0.0.0.0" is on   |
+| ILP port           | `9009`       | External mode, or the host binding when "Bind to 0.0.0.0" is on   |
+| PostgreSQL port    | `8812`       | Host binding for Grafana/psql when "Bind to 0.0.0.0" is on        |
+| Sampling rate (ms) | `2000`       | Default min ms between writes per path (0 = every update)         |
+| Memory limit       | `768m`       | Hard cgroup cap on QuestDB container RAM (empty = unlimited)      |
+| CPU limit (cores)  | `1.5`        | Max CPU cores QuestDB can use (0 = unlimited)                     |
+| Record own vessel  | `true`       | Record self context                                               |
+| Record AIS targets | `false`      | Record other vessels                                              |
+| Retention (days)   | `0`          | Auto-delete old partitions (0 = keep forever)                     |
+| Compression codec  | `lz4`        | On-disk WAL compression: `none`, `lz4`, or `zstd`                 |
+| Compression level  | `3`          | ZSTD level 1-22 (only when codec is zstd)                         |
+| Container network  | `sk-network` | Shared network for QuestDB (only applied when binding to 0.0.0.0) |
+| Bind to 0.0.0.0    | `false`      | Expose QuestDB's ports on the LAN (see Connectivity below)        |
+
+## Connectivity
+
+In **managed mode** the plugin no longer needs `QuestDB host` to be correct for
+your deployment — signalk-container resolves the right address automatically,
+whether Signal K runs on bare metal or is itself containerized:
+
+- **Bind to 0.0.0.0 = off (default).** QuestDB stays private. signalk-container
+  binds its ports to the host loopback (bare-metal Signal K) or attaches QuestDB
+  to Signal K's own container network (containerized Signal K), and the plugin
+  connects to whatever address it reports back. Nothing is exposed to the
+  network. QuestDB is also attached to the shared `Container network` so the
+  companion [signalk-grafana](https://github.com/dirkwa/signalk-grafana) plugin
+  still reaches it by container DNS. This is the recommended setup and fixes
+  connectivity for Signal K in a container.
+- **Bind to 0.0.0.0 = on.** QuestDB's HTTP/ILP/PostgreSQL ports are published on
+  all interfaces using the configured port numbers, on the shared
+  `Container network`. Enable this only to reach QuestDB from another machine or
+  from a Grafana running in a separate Docker instance. When Signal K itself is
+  containerized it reaches the published ports via `host.containers.internal`.
+
+In **external mode** (`Managed container` off) the plugin connects to the
+QuestDB you point it at via `QuestDB host` + the HTTP/ILP ports.
 
 ## Performance (Pi / Low-Power Devices)
 
 The plugin is optimized for Raspberry Pi and similar low-power devices:
 
-- **Default sampling rate** of 1000ms limits each path to 1 write/sec, reducing total writes from ~500/s to ~238/s on a typical NMEA 2000 bus
+- **Default sampling rate** of 2000ms limits each path to 1 write per 2 seconds, keeping write volume modest on busy NMEA 2000 buses
+- **Resource caps** of 768 MB RAM and 1.5 CPU cores (cgroup limits via signalk-container) keep QuestDB from squeezing co-resident containers like Grafana, mayara, or signalk-backup. The JVM auto-sizes its heap to a fraction of the memory cap, so total footprint (heap + off-heap) is bounded
 - **QuestDB worker threads** reduced to 1 each (WAL, shared, ILP) to minimize CPU usage
 - **ILP batching** at 500ms intervals with 1000-row batches reduces TCP overhead
 - Per-path overrides allow faster rates for critical paths (e.g. `{ "environment.wind.*": 200 }`) while keeping slow-changing paths throttled
+- Set the memory limit to empty or CPU limit to `0` to disable the cap entirely on roomier hosts
 
 ## History API Provider
 
@@ -139,16 +166,20 @@ QuestDB data is stored at `~/.signalk/plugin-config-data/signalk-questdb/` on th
 
 ## Grafana Integration
 
-Connect Grafana to QuestDB via the PostgreSQL data source:
+Connect Grafana to QuestDB via the PostgreSQL data source (user `admin`,
+password `quest`, database `qdb`).
 
-- Host: `localhost:8812`
-- User: `admin`
-- Password: `quest`
-- Database: `qdb`
+The companion [signalk-grafana](https://github.com/dirkwa/signalk-grafana)
+plugin wires this up for you: it runs Grafana as a managed container and
+reaches QuestDB by its container DNS name on the shared `sk-network`, so no
+host port needs to be exposed.
 
-If Grafana runs on the host or in Podman, `localhost:8812` works out of the box.
+For a **self-hosted Grafana on the host or in Podman**, point it at
+`localhost:<HTTP/PostgreSQL port>` — but note this only works when **"Bind to
+0.0.0.0"** is enabled (otherwise QuestDB is not published on a host port).
 
-If Grafana runs in a **separate Docker** container, it cannot reach the host's localhost. In that case, enable **"Bind to 0.0.0.0"** in the QuestDB plugin config and use your machine's LAN IP (e.g. `192.168.0.122:8812`) as the host in Grafana.
+For Grafana in a **separate Docker instance**, enable **"Bind to 0.0.0.0"** and
+use your machine's LAN IP (e.g. `192.168.0.122:8812`) as the host in Grafana.
 
 **Warning:** Binding to 0.0.0.0 exposes QuestDB's ports to your entire network. Only enable this if necessary, and ensure your firewall is configured appropriately.
 
@@ -166,7 +197,7 @@ SAMPLE BY $__interval
 ## Requirements
 
 - Node.js >= 22
-- [signalk-container](https://github.com/dirkwa/signalk-container) >= 1.6.0 plugin (for managed mode)
+- [signalk-container](https://github.com/dirkwa/signalk-container) >= 1.14.0 plugin (for managed mode; older versions still work but fall back to loopback connectivity)
 - Signal K server
 
 ## License

package/dist/config/schema.js

@@ -6,18 +6,22 @@ exports.ConfigSchema = typebox_1.Type.Object({
     questdbHost: typebox_1.Type.String({
         default: "127.0.0.1",
         title: "QuestDB host",
+        description: "Only used when managed container is off (external QuestDB). In managed mode the address is resolved automatically.",
     }),
     questdbIlpPort: typebox_1.Type.Number({
         default: 9009,
         title: "ILP port (writes)",
+        description: "External mode, or the host binding when 'Bind to 0.0.0.0' is on. Ignored otherwise (signalk-container allocates the port).",
     }),
     questdbHttpPort: typebox_1.Type.Number({
         default: 9000,
         title: "HTTP port (queries)",
+        description: "External mode, or the host binding when 'Bind to 0.0.0.0' is on. Ignored otherwise (signalk-container allocates the port).",
     }),
     questdbPgPort: typebox_1.Type.Number({
         default: 8812,
         title: "PostgreSQL wire port",
+        description: "Host binding for Grafana/psql when 'Bind to 0.0.0.0' is on. Ignored otherwise (signalk-container allocates the port).",
     }),
     questdbVersion: typebox_1.Type.String({
         default: "9.2.0",
@@ -74,12 +78,12 @@ exports.ConfigSchema = typebox_1.Type.Object({
     networkName: typebox_1.Type.String({
         default: "sk-network",
         title: "Container network",
-        description: "Shared Podman/Docker network so Grafana can connect via container DNS",
+        description: "Shared Podman/Docker network for QuestDB. Only applied when 'Bind to 0.0.0.0' is on (so a separate-Docker Grafana can reach QuestDB by DNS).",
     }),
     exposeToContainers: typebox_1.Type.Boolean({
         default: false,
         title: "Bind to 0.0.0.0",
-        description: "Caution! This can expose your data to the internet. Only enable if Grafana runs in a separate Docker instance.",
+        description: "Publish QuestDB's ports on all interfaces so another machine or a separate-Docker Grafana can reach them. Off (default) keeps QuestDB private — Signal K still reaches it automatically. Caution! Enabling exposes your data to the network.",
     }),
     compression: typebox_1.Type.Union([typebox_1.Type.Literal("none"), typebox_1.Type.Literal("lz4"), typebox_1.Type.Literal("zstd")], {
         default: "lz4",

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":";;;AAAA,+CAAiD;AAEpC,QAAA,YAAY,GAAG,cAAI,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,cAAI,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,cAAc;KACtB,CAAC;IACF,cAAc,EAAE,cAAI,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mBAAmB;KAC3B,CAAC;IACF,eAAe,EAAE,cAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,qBAAqB;KAC7B,CAAC;IACF,aAAa,EAAE,cAAI,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,sBAAsB;KAC9B,CAAC;IACF,cAAc,EAAE,cAAI,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,uBAAuB;KAC/B,CAAC;IAEF,gBAAgB,EAAE,cAAI,CAAC,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,gDAAgD;QACvD,WAAW,EAAE,oDAAoD;KAClE,CAAC;IAEF,kBAAkB,EAAE,cAAI,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,8KAA8K;KACjL,CAAC;IAEF,eAAe,EAAE,cAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,sEAAsE;KACzE,CAAC;IAEF,UAAU,EAAE,cAAI,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,cAAI,CAAC,KAAK,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE;YACnE,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,aAAa;SACrB,CAAC;QACF,KAAK,EAAE,cAAI,CAAC,KAAK,CAAC,cAAI,CAAC,MAAM,EAAE,EAAE;YAC/B,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,8CAA8C;SAC5D,CAAC;KACH,CAAC;IAEF,mBAAmB,EAAE,cAAI,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,gMAAgM;KACnM,CAAC;IAEF,aAAa,EAAE,cAAI,CAAC,MAAM,CAAC,cAAI,CAAC,MAAM,EAAE,EAAE,cAAI,CAAC,MAAM,EAAE,EAAE;QACvD,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,gGAAgG;KACnG,CAAC;IAEF,UAAU,EAAE,cAAI,CAAC,OAAO,CAAC;QACvB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mBAAmB;KAC3B,CAAC;IACF,YAAY,EAAE,cAAI,CAAC,OAAO,CAAC;QACzB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,oBAAoB;KAC5B,CAAC;IAEF,aAAa,EAAE,cAAI,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,oCAAoC;KAC5C,CAAC;IAEF,WAAW,EAAE,cAAI,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,uEAAuE;KAC1E,CAAC;IAEF,kBAAkB,EAAE,cAAI,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,gHAAgH;KACnH,CAAC;IAEF,WAAW,EAAE,cAAI,CAAC,KAAK,CACrB,CAAC,cAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,cAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACjE;QACE,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,wFAAwF;KAC3F,CACF;IACD,gBAAgB,EAAE,cAAI,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,sCAAsC;KACpD,CAAC;CACH,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":";;;AAAA,+CAAiD;AAEpC,QAAA,YAAY,GAAG,cAAI,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,cAAI,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,oHAAoH;KACvH,CAAC;IACF,cAAc,EAAE,cAAI,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,4HAA4H;KAC/H,CAAC;IACF,eAAe,EAAE,cAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,4HAA4H;KAC/H,CAAC;IACF,aAAa,EAAE,cAAI,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,uHAAuH;KAC1H,CAAC;IACF,cAAc,EAAE,cAAI,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,uBAAuB;KAC/B,CAAC;IAEF,gBAAgB,EAAE,cAAI,CAAC,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,gDAAgD;QACvD,WAAW,EAAE,oDAAoD;KAClE,CAAC;IAEF,kBAAkB,EAAE,cAAI,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,8KAA8K;KACjL,CAAC;IAEF,eAAe,EAAE,cAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,sEAAsE;KACzE,CAAC;IAEF,UAAU,EAAE,cAAI,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,cAAI,CAAC,KAAK,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE;YACnE,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,aAAa;SACrB,CAAC;QACF,KAAK,EAAE,cAAI,CAAC,KAAK,CAAC,cAAI,CAAC,MAAM,EAAE,EAAE;YAC/B,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,8CAA8C;SAC5D,CAAC;KACH,CAAC;IAEF,mBAAmB,EAAE,cAAI,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,gMAAgM;KACnM,CAAC;IAEF,aAAa,EAAE,cAAI,CAAC,MAAM,CAAC,cAAI,CAAC,MAAM,EAAE,EAAE,cAAI,CAAC,MAAM,EAAE,EAAE;QACvD,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,gGAAgG;KACnG,CAAC;IAEF,UAAU,EAAE,cAAI,CAAC,OAAO,CAAC;QACvB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mBAAmB;KAC3B,CAAC;IACF,YAAY,EAAE,cAAI,CAAC,OAAO,CAAC;QACzB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,oBAAoB;KAC5B,CAAC;IAEF,aAAa,EAAE,cAAI,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,oCAAoC;KAC5C,CAAC;IAEF,WAAW,EAAE,cAAI,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,8IAA8I;KACjJ,CAAC;IAEF,kBAAkB,EAAE,cAAI,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,8OAA8O;KACjP,CAAC;IAEF,WAAW,EAAE,cAAI,CAAC,KAAK,CACrB,CAAC,cAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,cAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACjE;QACE,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,wFAAwF;KAC3F,CACF;IACD,gBAAgB,EAAE,cAAI,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,sCAAsC;KACpD,CAAC;CACH,CAAC,CAAC"}

package/dist/index.js

@@ -41,6 +41,10 @@ const history_v2_1 = require("./history-v2");
 const history_v1_1 = require("./history-v1");
 const retention_1 = require("./retention");
 const full_export_range_1 = require("./full-export-range");
+const questdb_endpoint_1 = require("./questdb-endpoint");
+// The managed QuestDB container's name. signalk-container prefixes it with
+// `sk-` for the actual container and its DNS name (e.g. `sk-signalk-questdb`).
+const QUESTDB_CONTAINER_NAME = "signalk-questdb";
 // Tables exposed by /api/full-export. Hardcoded (not introspected via
 // QuestDB's tables() function) because we DO know our schema — we
 // created it. Single source of truth for both the listing endpoint and
@@ -51,6 +55,27 @@ const FULL_EXPORT_TABLES = [
     "signalk_position",
 ];
 const FULL_EXPORT_TABLE_SET = new Set(FULL_EXPORT_TABLES);
+// Healthcheck for the QuestDB container. The `questdb/questdb` image ships no
+// HEALTHCHECK of its own, so under Podman the container would otherwise sit in
+// `starting` forever (Podman reports a probeless container as perpetually
+// starting, never healthy). We give it an explicit probe — `curl` is present
+// in the image — hitting QuestDB's purpose-built `/ping` liveness endpoint,
+// which returns an empty `204` immediately. (Probing `/` instead makes curl
+// hang on the web-console `301` redirect until it times out.) signalk-container
+// emits this as `--health-*` run flags (see its `healthcheck` ContainerConfig
+// field).
+const QUESTDB_HEALTHCHECK = {
+    test: [
+        "CMD",
+        "curl",
+        "-f",
+        `http://127.0.0.1:${questdb_endpoint_1.QUESTDB_INTERNAL_HTTP_PORT}/ping`,
+    ],
+    interval: "30s",
+    timeout: "5s",
+    startPeriod: "15s",
+    retries: 3,
+};
 function buildResourceLimits(config) {
     return {
         memory: config.questdbMemoryLimit?.trim() || null,
@@ -64,8 +89,29 @@ module.exports = (app) => {
     let queryClient = null;
     let retentionTimer = null;
     let currentConfig = null;
+    // The HTTP/ILP endpoints the Signal K process uses to reach QuestDB. In
+    // managed mode signalk-container resolves these (loopback bare-metal,
+    // container DNS when SK is containerized); in external mode they come from
+    // config. The REST/export endpoints read `questdbEndpoints.http` so they
+    // stay correct in every topology, not just when questdbHost is loopback.
+    let questdbEndpoints = null;
     const unsubscribes = [];
     const throttleMap = new Map();
+    // The HTTP base URL for QuestDB's REST API (/exp, /exec). Used by the export
+    // endpoints, which talk to QuestDB directly rather than through QueryClient.
+    // Those callers all guard on `!queryClient` first, and `questdbEndpoints` is
+    // set before `queryClient` in asyncStart and cleared after it in stop(), so
+    // it is non-null whenever this runs. The config-derived branch is purely
+    // defensive (never exercised in practice).
+    function questdbHttpBaseUrl() {
+        if (questdbEndpoints) {
+            const { host, port } = questdbEndpoints.http;
+            return `http://${host}:${port}`;
+        }
+        const host = currentConfig?.questdbHost ?? "127.0.0.1";
+        const port = currentConfig?.questdbHttpPort ?? questdb_endpoint_1.QUESTDB_INTERNAL_HTTP_PORT;
+        return `http://${host}:${port}`;
+    }
     /**
      * Compute the bind-mount source for QuestDB's /var/lib/questdb volume.
      *
@@ -95,6 +141,77 @@ module.exports = (app) => {
             return dataPath;
         }
     }
+    /**
+     * Apply the chosen networking to a managed-QuestDB ContainerConfig and
+     * return the endpoints the Signal K process should use to reach it. Two
+     * paths, keyed on `exposeToContainers`:
+     *
+     *   - off (default): signalkAccessiblePorts — signalk-container owns the
+     *     networking and resolveContainerAddress() yields the endpoint. Secure;
+     *     QuestDB is not published beyond loopback / the shared network.
+     *   - on: publish the configured host ports on 0.0.0.0 (for LAN / separate-
+     *     Docker Grafana) on the shared `networkName`; the Signal K process
+     *     reaches them on the host loopback (bare-metal) or via the
+     *     host.containers.internal gateway (containerized SK).
+     *
+     * `endpoints` is resolved AFTER ensureRunning() on the signalkAccessiblePorts
+     * path (the host port is allocated by then); on the LAN path it is already
+     * known, so the returned resolver just echoes it.
+     */
+    async function applyQuestdbNetworking(config, containers, name, containerConfig) {
+        const httpPort = config.questdbHttpPort ?? questdb_endpoint_1.QUESTDB_INTERNAL_HTTP_PORT;
+        const ilpPort = config.questdbIlpPort ?? questdb_endpoint_1.QUESTDB_INTERNAL_ILP_PORT;
+        const pgPort = config.questdbPgPort ?? questdb_endpoint_1.QUESTDB_INTERNAL_PG_PORT;
+        const fallbackHost = config.questdbHost ?? "127.0.0.1";
+        // signalkAccessiblePorts is the modern (1.14.0+) connectivity path. Without
+        // it, signalk-container ignores the field and would publish no host port,
+        // so on older versions we must keep the historical manual port bindings.
+        const hasAccessiblePorts = typeof containers.resolveContainerAddress === "function";
+        // The LAN-exposure path and the old-container fallback both publish ports
+        // and attach to networkName; only the host the SK process uses differs.
+        const publishOnHost = config.exposeToContainers || !hasAccessiblePorts;
+        if (publishOnHost) {
+            const bind = config.exposeToContainers ? "0.0.0.0" : "127.0.0.1";
+            containerConfig.ports = {
+                [`${questdb_endpoint_1.QUESTDB_INTERNAL_HTTP_PORT}/tcp`]: `${bind}:${httpPort}`,
+                [`${questdb_endpoint_1.QUESTDB_INTERNAL_ILP_PORT}/tcp`]: `${bind}:${ilpPort}`,
+                [`${questdb_endpoint_1.QUESTDB_INTERNAL_PG_PORT}/tcp`]: `${bind}:${pgPort}`,
+            };
+            if (config.networkName) {
+                await containers.ensureNetwork(config.networkName);
+                containerConfig.networkMode = config.networkName;
+            }
+            // A 0.0.0.0-published port is reachable from a containerized SK via the
+            // host gateway; a loopback-only one (or any bare-metal/old-container
+            // case) is reached on 127.0.0.1.
+            const skHost = config.exposeToContainers
+                ? await (0, questdb_endpoint_1.resolveLanExposureHost)(containers, (msg) => app.debug(msg))
+                : "127.0.0.1";
+            const endpoints = (0, questdb_endpoint_1.lanExposureEndpoints)(skHost, httpPort, ilpPort);
+            return async () => endpoints;
+        }
+        // Default path: signalk-container owns the networking. After the container
+        // is up we additionally attach it to `networkName` so the companion
+        // signalk-grafana (which joins that network and resolves QuestDB by its
+        // `sk-`-prefixed DNS name) keeps working, then resolve the SK->QuestDB
+        // endpoint from whatever address signalk-container reports.
+        containerConfig.signalkAccessiblePorts = questdb_endpoint_1.QUESTDB_ACCESSIBLE_PORTS;
+        return async () => {
+            if (config.networkName &&
+                typeof containers.connectToNetwork === "function") {
+                try {
+                    await containers.ensureNetwork(config.networkName);
+                    await containers.connectToNetwork(name, config.networkName);
+                }
+                catch (err) {
+                    // Non-fatal: SK->QuestDB does not depend on this network; only the
+                    // companion Grafana's DNS path does. Log and carry on.
+                    app.debug(`connectToNetwork(${name}, ${config.networkName}) failed: ${String(err)}`);
+                }
+            }
+            return (0, questdb_endpoint_1.resolveManagedEndpoints)(containers, name, fallbackHost, (msg) => app.debug(msg));
+        };
+    }
     function shouldRecord(path, filter) {
         if (!filter.paths || filter.paths.length === 0)
             return true;
@@ -126,9 +243,18 @@ module.exports = (app) => {
     }
     async function asyncStart(config) {
         currentConfig = config;
-        const host = config.questdbHost ?? "127.0.0.1";
-        const ilpPort = config.questdbIlpPort ?? 9009;
-        const httpPort = config.questdbHttpPort ?? 9000;
+        // External mode: the configured host/ports are authoritative. Managed mode
+        // overwrites this below with the endpoints signalk-container resolves.
+        questdbEndpoints = {
+            http: {
+                host: config.questdbHost ?? "127.0.0.1",
+                port: config.questdbHttpPort ?? questdb_endpoint_1.QUESTDB_INTERNAL_HTTP_PORT,
+            },
+            ilp: {
+                host: config.questdbHost ?? "127.0.0.1",
+                port: config.questdbIlpPort ?? questdb_endpoint_1.QUESTDB_INTERNAL_ILP_PORT,
+            },
+        };
         if (config.managedContainer !== false) {
             const containers = globalThis.__signalk_containerManager;
             if (!containers) {
@@ -174,30 +300,23 @@ module.exports = (app) => {
                         }
                         : {}),
                 };
-                const bind = config.exposeToContainers ? "0.0.0.0" : "127.0.0.1";
                 const volumeSource = await resolveQuestdbVolumeSource(containers);
                 const containerConfig = {
                     image: "questdb/questdb",
                     tag: config.questdbVersion ?? "latest",
-                    ports: {
-                        "9000/tcp": `${bind}:${httpPort}`,
-                        "9009/tcp": `${bind}:${ilpPort}`,
-                        "8812/tcp": `${bind}:${config.questdbPgPort ?? 8812}`,
-                    },
                     volumes: {
                         "/var/lib/questdb": volumeSource,
                     },
                     env: containerEnv,
                     restart: "unless-stopped",
                     resources: buildResourceLimits(config),
+                    healthcheck: QUESTDB_HEALTHCHECK,
                 };
-                if (config.networkName) {
-                    await containers.ensureNetwork(config.networkName);
-                    containerConfig.networkMode = config.networkName;
-                }
+                const resolveEndpoints = await applyQuestdbNetworking(config, containers, QUESTDB_CONTAINER_NAME, containerConfig);
                 app.setPluginStatus("Starting QuestDB container...");
-                await containers.ensureRunning("signalk-questdb", containerConfig);
+                await containers.ensureRunning(QUESTDB_CONTAINER_NAME, containerConfig);
                 app.debug("QuestDB container ready");
+                questdbEndpoints = await resolveEndpoints();
             }
             catch (err) {
                 app.debug("ensureRunning failed:", err);
@@ -205,8 +324,10 @@ module.exports = (app) => {
                 return;
             }
         }
-        app.debug("connecting to QuestDB at %s:%d", host, httpPort);
-        queryClient = new query_client_1.QueryClient(host, httpPort);
+        const { host: httpHost, port: httpPort } = questdbEndpoints.http;
+        const { host: ilpHost, port: ilpPort } = questdbEndpoints.ilp;
+        app.debug("connecting to QuestDB at %s:%d", httpHost, httpPort);
+        queryClient = new query_client_1.QueryClient(httpHost, httpPort);
         app.setPluginStatus("Waiting for QuestDB to become ready...");
         const deadline = Date.now() + 30000;
         while (Date.now() < deadline) {
@@ -215,12 +336,12 @@ module.exports = (app) => {
             await new Promise((resolve) => setTimeout(resolve, 500));
         }
         if (!(await queryClient.isHealthy())) {
-            app.setPluginError(`QuestDB not responding at ${host}:${httpPort}`);
+            app.setPluginError(`QuestDB not responding at ${httpHost}:${httpPort}`);
             return;
         }
         app.setPluginStatus("Creating tables...");
         await queryClient.ensureTables();
-        writer = new ilp_writer_1.ILPWriter(host, ilpPort, (msg) => app.debug(msg));
+        writer = new ilp_writer_1.ILPWriter(ilpHost, ilpPort, (msg) => app.debug(msg));
         await writer.connect();
         const v2Provider = (0, history_v2_1.createHistoryProviderV2)(queryClient, app.selfContext);
         app.registerHistoryApiProvider(v2Provider);
@@ -273,7 +394,7 @@ module.exports = (app) => {
         if (config.retentionDays && config.retentionDays > 0) {
             retentionTimer = (0, retention_1.startRetention)(queryClient, config.retentionDays, (msg) => app.debug(msg));
         }
-        app.setPluginStatus(`Recording to QuestDB at ${host}:${ilpPort}`);
+        app.setPluginStatus(`Recording to QuestDB at ${ilpHost}:${ilpPort}`);
     }
     const plugin = {
         id: "signalk-questdb",
@@ -306,12 +427,13 @@ module.exports = (app) => {
             }
             throttleMap.clear();
             queryClient = null;
+            questdbEndpoints = null;
             // Stop the managed container when plugin is disabled
             if (currentConfig?.managedContainer !== false) {
                 const containers = globalThis.__signalk_containerManager;
                 if (containers) {
                     try {
-                        await containers.stop("signalk-questdb");
+                        await containers.stop(QUESTDB_CONTAINER_NAME);
                     }
                     catch {
                         // container may already be stopped
@@ -353,6 +475,9 @@ module.exports = (app) => {
                         status: "running",
                         totalRows,
                         activePathsToday,
+                        endpoint: questdbEndpoints
+                            ? `${questdbEndpoints.http.host}:${questdbEndpoints.http.port}`
+                            : null,
                     });
                 }
                 catch (err) {
@@ -514,22 +639,11 @@ module.exports = (app) => {
                             });
                         });
                     }
-                    const host = currentConfig?.questdbHost ?? "127.0.0.1";
-                    const httpPort = currentConfig?.questdbHttpPort ?? 9000;
-                    const ilpPort = currentConfig?.questdbIlpPort ?? 9009;
-                    const updateBind = currentConfig?.exposeToContainers
-                        ? "0.0.0.0"
-                        : "127.0.0.1";
                     const updateVolumeSource = await resolveQuestdbVolumeSource(containers);
                     app.setPluginStatus(`Starting QuestDB ${newTag}...`);
-                    await containers.ensureRunning("signalk-questdb", {
+                    const updateConfig = {
                         image: "questdb/questdb",
                         tag: newTag,
-                        ports: {
-                            "9000/tcp": `${updateBind}:${httpPort}`,
-                            "9009/tcp": `${updateBind}:${ilpPort}`,
-                            "8812/tcp": `${updateBind}:${currentConfig?.questdbPgPort ?? 8812}`,
-                        },
                         volumes: {
                             "/var/lib/questdb": updateVolumeSource,
                         },
@@ -554,8 +668,18 @@ module.exports = (app) => {
                         resources: currentConfig
                             ? buildResourceLimits(currentConfig)
                             : undefined,
-                    });
-                    // Reconnect ILP and query client
+                        healthcheck: QUESTDB_HEALTHCHECK,
+                    };
+                    const resolveUpdateEndpoints = await applyQuestdbNetworking(currentConfig ?? {}, containers, QUESTDB_CONTAINER_NAME, updateConfig);
+                    await containers.ensureRunning(QUESTDB_CONTAINER_NAME, updateConfig);
+                    // Re-resolve so the export endpoints and status line reflect the
+                    // current endpoint. The version bump keeps the same container name
+                    // and networking, so the endpoint is stable — the existing
+                    // QueryClient/ILPWriter stay valid (and the registered history
+                    // providers keep their reference).
+                    questdbEndpoints = await resolveUpdateEndpoints();
+                    const { host: ilpHost, port: ilpPort } = questdbEndpoints.ilp;
+                    // Wait for the recreated container to answer, then reconnect ILP.
                     if (queryClient) {
                         const deadline = Date.now() + 30000;
                         while (Date.now() < deadline) {
@@ -573,7 +697,7 @@ module.exports = (app) => {
                         }
                         await writer.connect();
                     }
-                    app.setPluginStatus(`Recording to QuestDB ${newTag} at ${host}:${ilpPort}`);
+                    app.setPluginStatus(`Recording to QuestDB ${newTag} at ${ilpHost}:${ilpPort}`);
                     res.json({
                         status: "updated",
                         newVersion: newTag,
@@ -670,9 +794,7 @@ module.exports = (app) => {
                     const safeTo = toDate.toISOString();
                     const sql = `SELECT ts, path, context, value FROM signalk WHERE ts >= '${safeFrom}' AND ts <= '${safeTo}' ORDER BY ts`;
                     const dateSlug = safeFrom.slice(0, 10);
-                    const host = currentConfig?.questdbHost ?? "127.0.0.1";
-                    const httpPort = currentConfig?.questdbHttpPort ?? 9000;
-                    const expUrl = new URL("/exp", `http://${host}:${httpPort}`);
+                    const expUrl = new URL("/exp", questdbHttpBaseUrl());
                     expUrl.searchParams.set("query", sql);
                     if (format === "parquet") {
                         expUrl.searchParams.set("fmt", "parquet");
@@ -772,9 +894,7 @@ module.exports = (app) => {
                     // timestamp order, and adding ORDER BY forces a sort over the full
                     // table that's slow on the Pi for the wide signalk table.
                     const sql = `SELECT * FROM ${table}${rangeResult.where}`;
-                    const host = currentConfig?.questdbHost ?? "127.0.0.1";
-                    const httpPort = currentConfig?.questdbHttpPort ?? 9000;
-                    const expUrl = new URL("/exp", `http://${host}:${httpPort}`);
+                    const expUrl = new URL("/exp", questdbHttpBaseUrl());
                     expUrl.searchParams.set("query", sql);
                     expUrl.searchParams.set("fmt", "parquet");
                     const codec = currentConfig?.compression ?? "lz4";