Configure ClickHouse

Overview

Follow the steps in this guide to update the nms.conf file if you used a custom address, username, or password or enabled TLS when installing ClickHouse. NGINX Management Suite requires this information to connect to ClickHouse.

Default ClickHouse Values

Unless specified differently in the nms.conf file, NGINX Management Suite uses the following values for ClickHouse by default:

Configuration Default Notes
clickhouse.address tcp://localhost:9000
clickhouse.username
clickhouse.password
clickhouse.tls_mode false
clickhouse.tls.address tcp://localhost:9440
clickhouse.tls.skip_verify false clickhouse.tls.skip_verify should be used only for self-signed certificates and is never recommended for production use. When set to true, certificates are not verified, which exposes the connection to man-in-the-middle attacks.
clickhouse.tls.key_path
clickhouse.tls.cert_path
clickhouse.tls.ca_path /etc/ssl/certs/ca-certificates.crt The default value for clickhouse.tls.ca_path works out-of-the-box for Ubuntu and Debian. You’ll need to configure a different Certificate Authority for other distributions. Refer to your distribution’s documentation for additional information.


Use Custom Address, Username, Password

If your ClickHouse installation has a different address, username, or password than the default values, you need to configure NGINX Management Suite to connect to ClickHouse.

Default ClickHouse values

Configuration Default Notes
clickhouse.address tcp://localhost:9000
clickhouse.username
clickhouse.password
clickhouse.tls_mode false
clickhouse.tls.address tcp://localhost:9440
clickhouse.tls.skip_verify false clickhouse.tls.skip_verify should be used only for self-signed certificates and is never recommended for production use. When set to true, certificates are not verified, which exposes the connection to man-in-the-middle attacks.
clickhouse.tls.key_path
clickhouse.tls.cert_path
clickhouse.tls.ca_path /etc/ssl/certs/ca-certificates.crt The default value for clickhouse.tls.ca_path works out-of-the-box for Ubuntu and Debian. You’ll need to configure a different Certificate Authority for other distributions. Refer to your distribution’s documentation for additional information.

After installing Instance manager, take the following steps to set custom values for the ClickHouse address, username, and password:

  1. On the NGINX Management Suite server, open the /etc/nms/nms.conf file for editing.

  2. Change the following settings to match your ClickHouse configuration:

    clickhouse:
      address: tcp://localhost:9000
      username: <INSERT USERNAME HERE>
      password: <INSERT PASSWORD HERE>
    
  3. Save the changes and close the file.


Configure TLS

If you configured ClickHouse to work with TLS, take the following steps to update the settings in the NGINX Management Suite nms.conf file:

  1. On the NGINX Management Suite server, open the /etc/nms/nms.conf file for editing.

  2. Configure the clickhouse TSL settings to suit your environment:

    Example ClickHouse config
    clickhouse:
    
      # set the log level
      log_level: debug
    
      address: 127.0.0.1:9001
    
      # Edit your username
      username: test-1
    
      # Edit your password
      password: test-2
    
      debug_mode: true
    
      # tls_mode will be deprecated. Use tls section below.
      tls_mode: true
    
      # Enable tls to run clickhouse in TLS mode
      tls:
        # set the IP address and port Clickhouse listens on
        address: 127.0.0.1:9441
    
        skip_verify: false
    
        # set the path to TLS private cert
        cert_path: /etc/certs
    
        # set the path to TLS private key
        key_path: /etc/key
    
        # set the path to certificate authority for certificate validation
        cert_ca: /etc/ca
    
      migrations_path: /test/migrations
    
  3. Save the changes and close the file.