Configure ClickHouse (Hardened)

Configuration files

/etc/clickhouse-server/config.d/ and users.d/ (drop-in overrides; don't edit the main XML)

Credential rotation

Before any network exposure, create users with passwords/quotas in users.d/ — see configuration.

Monitoring & logging

• Logs: /var/log/clickhouse-server/; `journalctl -u clickhouse-server -f`
• Health: clickhouse-client -q 'SELECT 1' — wire this into your cloud's monitoring agent or an external probe.
• Cloud-native agents (CloudWatch agent, Google Cloud Ops Agent) install normally on this image if you want metrics/log shipping — none is pre-installed or phoning home by default.

Upgrades

Replace with the newest image version, or `dnf update clickhouse-server clickhouse-client` between refreshes.

Backup & restore

BACKUP TABLE ... TO Disk|S3 (native backup), or volume snapshots with the server stopped.