Fixes to clickhouse related configs

ooni · Nov 22, 2024 · edef980 · edef980
1 parent db8334a
commit edef980
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 4 deletions.
diff --git a/ansible/group_vars/clickhouse/vars.yml b/ansible/group_vars/clickhouse/vars.yml
@@ -154,6 +154,8 @@ clickhouse_distributed_ddl:
 clickhouse_default_profiles:
   default:
     readonly: 2
+  readonly:
+    readonly: 1
   write:
     readonly: 0
 
@@ -168,10 +170,27 @@ clickhouse_default_users:
       - "127.0.0.1"
     profile: default
     quota: default
+  - user:
+    name: readonly
+    password_sha256_hex: "{{ lookup('amazon.aws.aws_ssm', '/oonidevops/secrets/clickhouse_readonly_password', profile='oonidevops_user_prod') | hash('sha256') }}"
+    networks:
+      - "0.0.0.0/0"
+    profile: readonly
+    quota: default
   - user:
     name: write
-    password_sha256_hex: "{{ lookup('amazon.aws.aws_secret', 'oonidevops/clickhouse_write_password', profile='oonidevops_user_prod') | hash('sha256') }}"
+    password_sha256_hex: "{{ lookup('amazon.aws.aws_ssm', '/oonidevops/secrets/clickhouse_write_password', profile='oonidevops_user_prod') | hash('sha256') }}"
     networks:
       - "0.0.0.0/0"
     profile: write
     quota: default
+
+clickhouse_default_quotas:
+  - quota:
+    name: default
+    duration: 3600
+    queries: 0
+    errors: 0
+    result_rows: 0
+    read_rows: 0
+    execution_time: 0
diff --git a/ansible/host_vars/notebook.ooni.org b/ansible/host_vars/notebook.ooni.org
@@ -75,6 +75,8 @@ clickhouse_default_profiles:
   write:
     readonly: 0
 
+clickhouse_version: "24.10.2.80"
+clickhouse_release_type: stable
 clickhouse_listen_hosts:
   - "127.0.0.1"
 
@@ -88,7 +90,7 @@ clickhouse_default_users:
     quota: default
   - user:
     name: write
-    password_sha256_hex: "{{ lookup('amazon.aws.aws_secret', 'oonidevops/clickhouse_write_password', profile='oonidevops_user_prod') | hash('sha256') }}"
+    password_sha256_hex: "{{ lookup('amazon.aws.aws_ssm', '/oonidevops/secrets/clickhouse_notebook_write_password', profile='oonidevops_user_prod') | hash('sha256') }}"
     networks:
       - "127.0.0.1"
     profile: write

diff --git a/ansible/playbook.yml b/ansible/playbook.yml
@@ -34,7 +34,7 @@
   tags:
     - clickhouse
   roles:
-    - tailnet
+    #- tailnet
     - oonidata_clickhouse
 
 - name: Deploy oonidata worker nodes
@@ -48,7 +48,7 @@
   vars:
     enable_jupyterhub: false
     enable_oonipipeline_worker: true
-    clickhouse_url: "clickhouse://write:{{ lookup('amazon.aws.aws_secret', 'oonidevops/clickhouse_write_password', profile='oonidevops_user_prod') | hash('sha256') }}@clickhouse1.prod.ooni.io/ooni"
+    clickhouse_url: "clickhouse://write:{{ lookup('amazon.aws.aws_ssm', '/oonidevops/secrets/clickhouse_write_password', profile='oonidevops_user_prod') | hash('sha256') }}@clickhouse1.prod.ooni.io/ooni"
 
 - name: Deploy notebook host
   hosts: notebook.ooni.org