From d224105693ffc41d2ed3fae95f4b2025ec08657f Mon Sep 17 00:00:00 2001
From: Sam Calder-Mason <sam@puritydev.io>
Date: Thu, 17 Oct 2024 13:40:52 +1000
Subject: [PATCH] chore: Update ClickHouse password handling in config files

---
 .../etc/clickhouse-server/config.d/config.xml          |  3 +--
 .../docker-entrypoint-initdb.d/init-db.sh              | 10 ++++------
 .../etc/clickhouse-server/users.d/users.xml            |  1 -
 .../etc/clickhouse-server/config.d/config.xml          |  3 +--
 .../docker-entrypoint-initdb.d/init-db.sh              | 10 ++++------
 .../etc/clickhouse-server/users.d/users.xml            |  1 -
 docker-compose.yml                                     |  5 +----
 7 files changed, 11 insertions(+), 22 deletions(-)

diff --git a/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/config.d/config.xml b/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/config.d/config.xml
index 215ad5e5..52f555cb 100644
--- a/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/config.d/config.xml
+++ b/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/config.d/config.xml
@@ -20,18 +20,17 @@
     </distributed_ddl>
     <remote_servers>
         <cluster_2S_1R>
+            <secret>supersecret</secret>
             <shard>
                 <replica>
                     <host>xatu-clickhouse-01</host>
                     <port>9000</port>
-                    <password from_env="CLICKHOUSE_PASSWORD" replace="replace"></password>
                 </replica>
             </shard>
             <shard>
                 <replica>
                     <host>xatu-clickhouse-02</host>
                     <port>9000</port>
-                    <password from_env="CLICKHOUSE_PASSWORD" replace="replace"></password>
                 </replica>
             </shard>
         </cluster_2S_1R>
diff --git a/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/docker-entrypoint-initdb.d/init-db.sh b/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/docker-entrypoint-initdb.d/init-db.sh
index fcd8d46d..72b0244d 100755
--- a/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/docker-entrypoint-initdb.d/init-db.sh
+++ b/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/docker-entrypoint-initdb.d/init-db.sh
@@ -11,7 +11,7 @@ cat <<EOT >> /etc/clickhouse-server/users.d/default.xml
       <networks>
         <ip>::/0</ip>
       </networks>
-      <password>${CLICKHOUSE_PASSWORD}</password>
+      $([ -n "${CLICKHOUSE_PASSWORD}" ] && echo "<password>${CLICKHOUSE_PASSWORD}</password>")
       <quota>default</quota>
     </${CLICKHOUSE_USER}>
     <readonly>
@@ -22,24 +22,22 @@ cat <<EOT >> /etc/clickhouse-server/users.d/default.xml
 EOT
 
 cat <<EOT >> /etc/clickhouse-server/config.d/users.xml
-<yandex>
-
 <clickhouse replace="true">
     <remote_servers>
         <cluster_2S_1R>
             <shard>
                 <replica>
                     <host>xatu-clickhouse-01</host>
-                    $([ -n "${CLICKHOUSE_PASSWORD}" ] && echo "<password>${CLICKHOUSE_PASSWORD}</password>")
+                    $([ -n "${CLICKHOUSE_PASSWORD}" ] && echo "<password replace=\"true\">${CLICKHOUSE_PASSWORD}</password>")
                 </replica>
             </shard>
             <shard>
                 <replica>
                     <host>xatu-clickhouse-02</host>
-                    $([ -n "${CLICKHOUSE_PASSWORD}" ] && echo "<password>${CLICKHOUSE_PASSWORD}</password>")
+                    $([ -n "${CLICKHOUSE_PASSWORD}" ] && echo "<password replace=\"true\">${CLICKHOUSE_PASSWORD}</password>")
                 </replica>
             </shard>
         </cluster_2S_1R>
     </remote_servers>
-</yandex>
+</clickhouse>
 EOT
\ No newline at end of file
diff --git a/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/users.d/users.xml b/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/users.d/users.xml
index 86641f3c..31f5dbc0 100644
--- a/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/users.d/users.xml
+++ b/deploy/local/docker-compose/clickhouse/clickhouse-01/etc/clickhouse-server/users.d/users.xml
@@ -23,7 +23,6 @@
                 <ip>::/0</ip>
             </networks>
             <quota>default</quota>
-            <password from_env="CLICKHOUSE_PASSWORD" replace="replace"></password>
             <access_management>1</access_management>
             <named_collection_control>1</named_collection_control>
             <show_named_collections>1</show_named_collections>
diff --git a/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/config.d/config.xml b/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/config.d/config.xml
index 35e61c2a..3a9915f1 100644
--- a/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/config.d/config.xml
+++ b/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/config.d/config.xml
@@ -20,18 +20,17 @@
     </distributed_ddl>
     <remote_servers>
         <cluster_2S_1R>
+            <secret>supersecret</secret>
             <shard>
                 <replica>
                     <host>xatu-clickhouse-01</host>
                     <port>9000</port>
-                    <password from_env="CLICKHOUSE_PASSWORD" replace="replace"></password>
                 </replica>
             </shard>
             <shard>
                 <replica>
                     <host>xatu-clickhouse-02</host>
                     <port>9000</port>
-                    <password from_env="CLICKHOUSE_PASSWORD" replace="replace"></password>
                 </replica>
             </shard>
         </cluster_2S_1R>
diff --git a/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/docker-entrypoint-initdb.d/init-db.sh b/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/docker-entrypoint-initdb.d/init-db.sh
index 391fa9b4..adba0b29 100755
--- a/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/docker-entrypoint-initdb.d/init-db.sh
+++ b/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/docker-entrypoint-initdb.d/init-db.sh
@@ -21,26 +21,24 @@ cat <<EOT >> /etc/clickhouse-server/users.d/default.xml
 EOT
 
 cat <<EOT >> /etc/clickhouse-server/config.d/users.xml
-<yandex>
-
-<clickhouse replace="true">
+<clickhouse>
     <remote_servers>
         <cluster_2S_1R>
             <shard>
                 <replica>
                     <host>xatu-clickhouse-01</host>
-                    $([ -n "${CLICKHOUSE_PASSWORD}" ] && echo "<password>${CLICKHOUSE_PASSWORD}</password>")
+                    $([ -n "${CLICKHOUSE_PASSWORD}" ] && echo "<password replace=\"true\">${CLICKHOUSE_PASSWORD}</password>")
                 </replica>
             </shard>
             <shard>
                 <replica>
                     <host>xatu-clickhouse-02</host>
-                    $([ -n "${CLICKHOUSE_PASSWORD}" ] && echo "<password>${CLICKHOUSE_PASSWORD}</password>")
+                    $([ -n "${CLICKHOUSE_PASSWORD}" ] && echo "<password replace=\"true\">${CLICKHOUSE_PASSWORD}</password>")
                 </replica>
             </shard>
         </cluster_2S_1R>
     </remote_servers>
-</yandex>
+</clickhouse>
 EOT
 
 
diff --git a/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/users.d/users.xml b/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/users.d/users.xml
index 0b0675d5..31f5dbc0 100644
--- a/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/users.d/users.xml
+++ b/deploy/local/docker-compose/clickhouse/clickhouse-02/etc/clickhouse-server/users.d/users.xml
@@ -22,7 +22,6 @@
             <networks>
                 <ip>::/0</ip>
             </networks>
-            <password from_env="CLICKHOUSE_PASSWORD" replace="replace"></password>
             <quota>default</quota>
             <access_management>1</access_management>
             <named_collection_control>1</named_collection_control>
diff --git a/docker-compose.yml b/docker-compose.yml
index b1470928..32f9d076 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -485,12 +485,9 @@ services:
         "-path",
         "/migrations",
         "-database",
-        "${CLICKHOUSE_PASSWORD:+clickhouse://xatu-clickhouse-01:9000?username=${CLICKHOUSE_USER}&password=${CLICKHOUSE_PASSWORD}&database=default&x-multi-statement=true}${CLICKHOUSE_PASSWORD:-clickhouse://xatu-clickhouse-01:9000?username=${CLICKHOUSE_USER}&database=default&x-multi-statement=true}",
+        "clickhouse://xatu-clickhouse-01:9000?username=${CLICKHOUSE_USER:-default}&database=default&x-multi-statement=true",
         "up",
       ]
-    environment:
-      CLICKHOUSE_USER: ${CLICKHOUSE_USER:-default}
-      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
     depends_on:
       xatu-clickhouse-01:
         condition: service_healthy