---
apiVersion: clickhouse.altinity.com/v1
kind: ClickHouseInstallation
metadata:
  name: logs
  namespace: logging
spec:
  defaults:
    templates:
      dataVolumeClaimTemplate: data-volume
      serviceTemplate: chi-service
      podTemplate: clickhouse
  configuration:
    users:
      # Password hash is sourced from the Vault-synced clickhouse-credentials
      # Secret; the plaintext never lands in git or the ClickHouse config.
      vector/password_sha256_hex:
        valueFrom:
          secretKeyRef:
            name: clickhouse-credentials
            key: password_sha256_hex
      vector/networks/ip:
        - "::/0"
      vector/profile: default
      vector/quota: default
      # Allow the vector user to create the logs database/table (bootstrap Job)
      # and to INSERT. Restrict the built-in default user to loopback only.
      vector/access_management: "1"
      default/networks/ip:
        - "127.0.0.1"
        - "::1"
      # Read-only user for CLI tools + the logviewer UI. Hash sourced from the
      # Vault-synced clickhouse-logreader Secret, same mechanism as vector.
      # Scoped to the logs database only (unlike vector, which bootstraps it).
      logreader/password_sha256_hex:
        valueFrom:
          secretKeyRef:
            name: clickhouse-logreader
            key: password_sha256_hex
      logreader/networks/ip:
        - "::/0"
      logreader/profile: readonly
      logreader/quota: default
      logreader/allow_databases/database:
        - "logs"
    profiles:
      default/max_memory_usage: "10000000000"
      default/max_execution_time: "120"
      readonly/readonly: "1"
      readonly/max_memory_usage: "10000000000"
      readonly/max_execution_time: "120"
    clusters:
      - name: logs
        layout:
          shardsCount: 1
          replicasCount: 1
  templates:
    volumeClaimTemplates:
      - name: data-volume
        spec:
          storageClassName: cephrbd-fast-delete
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              # 3d TTL on logs.raw. At ~130 GiB/day raw, ClickHouse LZ4/ZSTD
              # (~6x on log text) stores ~20-25 GiB/day => ~60-75 GiB/3d, plus
              # merge headroom (~2x peak). logs.raw is the only table. 150Gi
              # gives comfortable headroom; long-term data lives in S3, not here.
              storage: 150Gi
    serviceTemplates:
      - name: chi-service
        generateName: "clickhouse-{chi}"
        spec:
          type: ClusterIP
          ports:
            - name: http
              port: 8123
            - name: tcp
              port: 9000
    podTemplates:
      - name: clickhouse
        spec:
          securityContext:
            fsGroup: 101
            runAsUser: 101
            runAsGroup: 101
          containers:
            - name: clickhouse
              image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
              resources:
                requests:
                  cpu: 500m
                  memory: 2Gi
                limits:
                  cpu: "2"
                  memory: 8Gi