fix(sql): fall back to main ClickHouse creds for the read-only client

Closed
0X
5mo ago
+20-8

Problem

On self-hosted deployments, the SQL editor and every dashboard chart fail with:

ClickHouse client is not configured.

even though ClickHouse itself is up and CLICKHOUSE_URL / CLICKHOUSE_USER / CLICKHOUSE_PASSWORD are set correctly.

Root cause: the read-only ClickHouse client (used by /v1/sql/query, dashboards, MCP SQL, dataset exports) is only built when the separate CLICKHOUSE_RO_USER / CLICKHOUSE_RO_PASSWORD vars are set. Feature::ClickhouseReadOnly is off otherwise, so clickhouse_readonly_client is None and those routes return the error. These extra vars aren't part of a normal quickstart, so SQL/dashboards silently don't work out of the box.

Refs #832

Fix

  • Enable Feature::ClickhouseReadOnly whenever ClickHouse is configured (CLICKHOUSE_URL set).
  • When CLICKHOUSE_RO_USER / CLICKHOUSE_RO_PASSWORD are absent, the read-only client falls back to the main CLICKHOUSE_USER / CLICKHOUSE_PASSWORD. Operators who want a restricted user can still set the dedicated vars.
  • Document the vars as optional in .env.example.

Why this is safe

The "read-only" client is a plain ClickHouse client with its own credentials — it does not rely on a privileged read-only ClickHouse user to enforce safety. The public SQL path is already guarded by the query-engine validator (which strips mutations and inline SETTINGS) plus the per-query max_execution_time / max_result_bytes / max_memory_usage caps. So reusing the main credentials when no dedicated read-only user exists doesn't change the security posture; it just removes a config foot-gun. .env.example already shipped CLICKHOUSE_RO_USER == CLICKHOUSE_USER, so this matches the project's own defaults.

Scope

This fixes the headline "ClickHouse client is not configured" symptom from #832. The separate issue of older dashboard charts using stale enum encodings (span_type = 1 / trace_type = 0) noted in the thread is out of scope here.

[!NOTE]
Low Risk
Small boot-time config change; SQL safety still relies on the query engine validator and limits, not RO ClickHouse users alone.

Overview
Fixes self-hosted setups where SQL editor and dashboards error with "ClickHouse client is not configured" despite valid CLICKHOUSE_URL / user / password.

Feature::ClickhouseReadOnly now turns on when CLICKHOUSE_URL is set, instead of requiring separate CLICKHOUSE_RO_USER / CLICKHOUSE_RO_PASSWORD. The read-only client still uses dedicated RO env vars when present; otherwise it falls back to CLICKHOUSE_USER / CLICKHOUSE_PASSWORD (with small main.rs refactors so those values can be reused). .env.example notes that RO credentials are optional.

Dedicated read-only ClickHouse users remain supported for operators who want them; app-layer query validation and limits are unchanged.

Reviewed by Cursor Bugbot for commit e28ad67c50f194d830f2bb5f0b39325b5e7eeaa9. Bugbot is set up for automated code reviews on this repo. Configure here.