From 03a4587a06bd97fe1f54815509a8008e493064be Mon Sep 17 00:00:00 2001 From: John Coffey Date: Sat, 22 Aug 2026 18:58:44 -0700 Subject: [PATCH] Correct the CLICKHOUSE_PASSWORD comment: it is a real secret now The note called this password "not a real secret ... purely to satisfy this image's login gate for local/homelab use". That was accurate when written, and stopped being accurate a phase later, in the same file: CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1 was added directly below it for Phase 4's per-tenant provisioning, which promoted the default user to a ClickHouse superuser. `SHOW GRANTS FOR default` on a running instance returns ACCESS MANAGEMENT and CLUSTER ON *.* WITH GRANT OPTION -- read and write over every tenant's logs, plus the ability to mint more users. Nothing about the deployment changes here; this is a comment-only edit. It matters because the old wording actively told a reader the value was safe to treat casually, which is how such a value ends up pasted into a ticket or a screenshot. Also records what the surrounding text did not: that rotation is not an env-var edit, since the image's entrypoint consumes this only at volume-init time, and which three services actually carry it. --- docker-compose.yml | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 0eb7dac..9c7f342 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -67,10 +67,27 @@ services: # CLICKHOUSE_USER or CLICKHOUSE_PASSWORD is set to a genuinely # non-empty value — confirmed by testing, not just reading docs: an # explicitly-empty CLICKHOUSE_PASSWORD="" still triggers the - # lockdown, silently returning 403 to every other container. This - # password isn't a real secret (mTLS between agent and ingest is - # the actual security boundary here) — it exists purely to satisfy - # this image's login gate for local/homelab use. + # lockdown, silently returning 403 to every other container. + # + # TREAT THIS AS A REAL SECRET in any deployment. It began as + # nothing more than a login gate — mTLS between agent and ingest + # is still the security boundary that matters for *ingestion* — + # but CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT below (added for Phase + # 4's per-tenant provisioning) promoted the default user to a + # ClickHouse superuser: `SHOW GRANTS FOR default` returns ACCESS + # MANAGEMENT and CLUSTER ON *.* WITH GRANT OPTION. Whoever holds + # this password can read and write every tenant's logs and mint + # further users at will. + # + # The value below is a dev-only default and must be overridden via + # docker-compose.override.yml (gitignored) anywhere real -- + # api/internal/config warns at startup if it is still in use. + # + # Rotating it is not just an env-var edit: the image's entrypoint + # consumes this only at volume-init time, so on an existing volume + # you must ALTER USER default IDENTIFIED BY '' inside + # ClickHouse first, then update the override and restart + # clickhouse, api, and ingest -- the three services that carry it. CLICKHOUSE_PASSWORD: "cairnobs-dev-only" # Phase 4's per-tenant provisioning (enterprise/internal/tenantprovision) # runs CREATE USER/GRANT against this connection as the ClickHouse