**Environment:**
- Carbonio CE 25.12.0, Ubuntu 24.04
- 4-node multi-server setup: Directory, MTA/Proxy, Mailstore, Apps
- External Patroni PostgreSQL 17 cluster (3 nodes, VIP: 10.10.30.100:5432)
- No local PostgreSQL on any Carbonio node
**Problem:**
`carbonio-files-ce` and `carbonio-tasks-ce` services fail immediately after start. Both services produce the same error. The root cause appears to be in the Consul mesh / Envoy sidecar layer.
**Error log (`journalctl -u carbonio-files.service`):**
```
Caused by: javax.persistence.PersistenceException: org.postgresql.util.PSQLException: The connection attempt failed.
Caused by: org.postgresql.util.PSQLException: The connection attempt failed.
Caused by: java.io.EOFException: null
at org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication(ConnectionFactoryImpl.java:696)
Exception in thread "main" java.lang.NullPointerException: Cannot invoke
"com.zextras.carbonio.files.dal.EbeanDatabaseManager.stop()" because
"this.ebeanDatabaseManager" is null
```
**Root cause identified:**
The `carbonio-files-db` Consul sidecar proxy was initializing with `LocalServiceAddress: 127.0.0.1` instead of the external database IP, routing all traffic to localhost port 5432, which does not exist on the Apps node. We confirmed this via the Envoy admin API:
```
local_app::127.0.0.1:5432::health_flags::healthy ← incorrect, before fix
```
**What we tried:**
**1. HCL fix — partially successful:**
We modified ` removed link ` to include `local_service_address` in the sidecar proxy config:
```hcl
services {
check {
tcp = "10.10.30.100:5432"
timeout = "1s"
interval = "5s"
}
connect {
sidecar_service {
proxy {
local_service_address = "10.10.30.100"
}
}
}
address = "10.10.30.100"
name = "carbonio-files-db"
port = 5432
}
```
After this, Envoy correctly shows:
```
local_app::10.10.30.100:5432::health_flags::healthy ← correct, after fix
```
The same fix was applied to `carbonio-tasks-db.hcl` and `carbonio-docs-connector-db.hcl`.
**2. Password re-sync in Consul KV and PostgreSQL — unsuccessful:**
We retrieved the password from Consul KV (`carbonio-files/db-password`), dropped and recreated the `carbonio-files-db` PostgreSQL role with that exact password using `md5` encryption (`SET password_encryption='md5'`), and also added `host all all 10.10.40.0/24 md5` to `pg_hba.conf` via `patronictl edit-config`. The service still fails with the same `EOFException` at `doAuthentication`.
**Observation:**
Even after the HCL fix, no connection attempts appear in the PostgreSQL logs on any Patroni node. This suggests the connection is still not reaching PostgreSQL at all, and the failure is occurring before or within the Envoy sidecar layer.
**Questions:**
1. Is using an external Patroni PostgreSQL cluster (no local PostgreSQL on Carbonio nodes) a supported configuration for Carbonio CE multi-server?
2. Is modifying `local_service_address` in the sidecar proxy config the correct approach for external database addresses?
3. Are there additional configuration steps required beyond the HCL change to make `carbonio-files-ce` and `carbonio-tasks-ce` connect to an external PostgreSQL instance?
4. Why does `EOFException` occur at `doAuthentication` even when the Envoy cluster correctly points to the external PostgreSQL IP?
Any guidance from the community or Zextras team would be greatly appreciated.
```