From 780b2d0ef98846d03f64f3d1890ae6963e994142 Mon Sep 17 00:00:00 2001
From: Dmitry Dementiev <me@dementev.space>
Date: Thu, 13 Aug 2026 10:23:32 +0300
Subject: [PATCH] =?UTF-8?q?feat(clickhouse):=20=D0=B4=D0=BE=D0=B1=D0=B0?=
 =?UTF-8?q?=D0=B2=D0=BB=D0=B5=D0=BD=20=D0=BF=D0=B0=D1=80=D0=BE=D0=BB=D1=8C?=
 =?UTF-8?q?=20=D1=81=D0=BB=D1=83=D0=B6=D0=B5=D0=B1=D0=BD=D0=BE=D0=BC=D1=83?=
 =?UTF-8?q?=20default?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Зачем:
  - default должен остаться только учёткой локальных служебных вызовов.
- Что:
  - пароль default подставлен из окружения на обеих нодах.
  - healthcheck и служебные скрипты передают его внутри контейнера.
- Проверка:
  - make config-test, make up, make smoke, make check-clickhouse, make check-services.
---
 compose.yaml                        |  3 ++-
 infra/clickhouse/users.d/access.xml |  3 +++
 scripts/check-clickhouse.sh         | 14 ++++++++++++--
 scripts/wait-for-world.sh           |  7 ++++++-
 4 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/compose.yaml b/compose.yaml
index f0ae5d4..1f4ff61 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -12,6 +12,7 @@ x-clickhouse-common: &clickhouse-common
     # Стенд локальный: нодам нужен общий пользователь без пароля для Distributed.
     CLICKHOUSE_SKIP_USER_SETUP: "1"
     CLICKHOUSE_CLUSTER_SECRET: ${CLICKHOUSE_CLUSTER_SECRET:?Скопируйте .env.example в .env}
+    CLICKHOUSE_DEFAULT_PASSWORD: ${CLICKHOUSE_DEFAULT_PASSWORD:?Скопируйте .env.example в .env}
     CLICKHOUSE_ETL_PASSWORD: ${CLICKHOUSE_ETL_PASSWORD:?Скопируйте .env.example в .env}
     CLICKHOUSE_BI_PASSWORD: ${CLICKHOUSE_BI_PASSWORD:?Скопируйте .env.example в .env}
     CLICKHOUSE_ANALYST_PASSWORD: ${CLICKHOUSE_ANALYST_PASSWORD:?Скопируйте .env.example в .env}
@@ -22,7 +23,7 @@ x-clickhouse-common: &clickhouse-common
   # Гигабайта не хватало: половину съедали страницы самого бинарника (ADR 0004).
   mem_limit: 4g
   healthcheck:
-    test: ["CMD-SHELL", "clickhouse-client --host 127.0.0.1 --query 'SELECT 1' >/dev/null 2>&1"]
+    test: ["CMD-SHELL", "clickhouse-client --host 127.0.0.1 --user default --password \"$$CLICKHOUSE_DEFAULT_PASSWORD\" --query 'SELECT 1' >/dev/null 2>&1"]
     interval: 5s
     timeout: 3s
     retries: 30
diff --git a/infra/clickhouse/users.d/access.xml b/infra/clickhouse/users.d/access.xml
index dc45cff..caa8f6c 100644
--- a/infra/clickhouse/users.d/access.xml
+++ b/infra/clickhouse/users.d/access.xml
@@ -37,6 +37,9 @@
     </roles>
 
     <users>
+        <default>
+            <password from_env="CLICKHOUSE_DEFAULT_PASSWORD"/>
+        </default>
         <etl>
             <password from_env="CLICKHOUSE_ETL_PASSWORD"/>
             <profile>default</profile>
diff --git a/scripts/check-clickhouse.sh b/scripts/check-clickhouse.sh
index 51423f3..e0c895a 100755
--- a/scripts/check-clickhouse.sh
+++ b/scripts/check-clickhouse.sh
@@ -18,7 +18,12 @@ compose() {
 query() {
     local service="$1"
     local sql="$2"
-    compose exec -T "$service" clickhouse-client --query "$sql" </dev/null
+    compose exec -T "$service" sh -c '
+        clickhouse-client \
+            --user default \
+            --password "$CLICKHOUSE_DEFAULT_PASSWORD" \
+            --query "$1"
+    ' _ "$sql" </dev/null
 }
 
 query_with_timeout() {
@@ -27,7 +32,12 @@ query_with_timeout() {
     local sql="$3"
     timeout --foreground "${timeout_seconds}s" \
         docker compose --project-directory "$ROOT_DIR" exec -T "$service" \
-        clickhouse-client --query "$sql"
+        sh -c '
+            clickhouse-client \
+                --user default \
+                --password "$CLICKHOUSE_DEFAULT_PASSWORD" \
+                --query "$1"
+        ' _ "$sql"
 }
 
 fail() {
diff --git a/scripts/wait-for-world.sh b/scripts/wait-for-world.sh
index 9252c6a..de81076 100755
--- a/scripts/wait-for-world.sh
+++ b/scripts/wait-for-world.sh
@@ -42,7 +42,12 @@ fail() {
 
 query() {
     "${COMPOSE_CMD[@]}" --project-directory "$ROOT_DIR" exec -T clickhouse-01 \
-        clickhouse-client --query "$1" </dev/null
+        sh -c '
+            clickhouse-client \
+                --user default \
+                --password "$CLICKHOUSE_DEFAULT_PASSWORD" \
+                --query "$1"
+        ' _ "$1" </dev/null
 }
 
 expected="$(jq '[.days[].events] | add' "$INVENTORY")"