coffey-labs/cairnobs
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Fix two bugs found by actually running the Phase 0 pipeline end-to-end

Browse Source 
Both surfaced only by running docker compose up for real, not from review:

- ClickHouse's official image silently disables network access for the
  default user unless CLICKHOUSE_USER or CLICKHOUSE_PASSWORD is set to a
  genuinely non-empty value (an explicit empty password still triggers
  it). Set a dev-only password across clickhouse, clickhouse-migrate,
  ingest, and api in both docker-compose.yml files.

- rpk cluster health and rpk topic ... don't accept --brokers; health
  checks need -X admin.hosts=... (port 9644), topic commands need
  -X brokers=... (port 9092). The old script's retry loop silently
  swallowed the resulting "unknown flag" error and retried forever,
  which blocked ingest from ever starting.

Verified: agent -> ingest -> Redpanda -> ClickHouse -> api round-trip
confirmed with a real log line on a real host.
This commit is contained in:
jcoffey-dev
2026-08-13 09:31:44 -07:00
parent b6b092c912
commit fe854b1091
5 changed files with 62 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
storage/README.md
+15 -5
View File
@@ -59,18 +59,28 @@ split multi-statement files — keep each migration to a single statement.
## Running
```sh
docker compose up -d # starts a standalone ClickHouse for local work
./migrate.sh # applies migrations/*.sql
docker compose up -d # starts a standalone ClickHouse for local work
CLICKHOUSE_PASSWORD=sentry-dev-only ./migrate.sh # applies migrations/*.sql
```
Environment variables `migrate.sh` reads (all optional, matching
`/ingest`'s ClickHouse defaults so the two stay in sync out of the box):
`CLICKHOUSE_PASSWORD` here has to match whatever `docker-compose.yml` set
on the `clickhouse` service — found this the hard way running the Phase 0
runbook for real: the official ClickHouse image silently disables *all*
network access (including the published port, not just container-to-
container traffic) for the `default` user unless `CLICKHOUSE_USER` or
`CLICKHOUSE_PASSWORD` is a genuinely non-empty value. An empty
`CLICKHOUSE_PASSWORD=""` still triggers the lockdown — it has to actually
have a value. Not a real secret, just what this image demands.
Environment variables `migrate.sh` reads (all optional except
`CLICKHOUSE_PASSWORD` as of the above, matching `/ingest`'s ClickHouse
defaults so the two stay in sync out of the box):
| Var | Default |
|---|---|
| `CLICKHOUSE_HTTP` | `http://localhost:8123` |
| `CLICKHOUSE_USER` | `default` |
| `CLICKHOUSE_PASSWORD` | (empty) |
| `CLICKHOUSE_PASSWORD` | (empty — override, see above) |
| `CLICKHOUSE_DATABASE` | `sentry` |
There's also a `Dockerfile` (bash + curl baked in, `migrations/` copied in