<!-- For HTTPS and SSL over native protocol. --> <!-- <https_port>8443</https_port> <tcp_ssl_port>9440</tcp_ssl_port> -->
<!-- Used with https_port and tcp_ssl_port. Full ssl options list: https://github.com/yandex/ClickHouse/blob/master/contrib/libpoco/NetSSL_OpenSSL/include/Poco/Net/SSLManager.h#L71 --> <openSSL> <server><!-- Used for https server AND secure tcp port --> <!-- openssl req -subj "/CN=localhost" -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout /etc/clickhouse-server/server.key -out /etc/clickhouse-server/server.crt --> <certificateFile>/etc/clickhouse-server/server.crt</certificateFile> <privateKeyFile>/etc/clickhouse-server/server.key</privateKeyFile> <!-- openssl dhparam -out /etc/clickhouse-server/dhparam.pem 4096 --> <dhParamsFile>/etc/clickhouse-server/dhparam.pem</dhParamsFile> <verificationMode>none</verificationMode> <loadDefaultCAFile>true</loadDefaultCAFile> <cacheSessions>true</cacheSessions> <disableProtocols>sslv2,sslv3</disableProtocols> <preferServerCiphers>true</preferServerCiphers> </server>
<client><!-- Used for connecting to https dictionary source --> <loadDefaultCAFile>true</loadDefaultCAFile> <cacheSessions>true</cacheSessions> <disableProtocols>sslv2,sslv3</disableProtocols> <preferServerCiphers>true</preferServerCiphers> <!-- Use for self-signed: <verificationMode>none</verificationMode> --> <invalidCertificateHandler> <!-- Use for self-signed: <name>AcceptCertificateHandler</name> --> <name>RejectCertificateHandler</name> </invalidCertificateHandler> </client> </openSSL>
<!-- Default root page on http[s] server. For example load UI from https://tabix.io/ when opening http://localhost:8123 --> <!-- <http_server_default_response><![CDATA[<html ng-app="SMI2"><head><base href="http://ui.tabix.io/"></head><body><div ui-view="" class="content-ui"></div><script src="http://loader.tabix.io/master.js"></script></body></html>]]></http_server_default_response> -->
<!-- Port for communication between replicas. Used for data exchange. --> <interserver_http_port>9009</interserver_http_port>
<!-- Hostname that is used by other replicas to request this server. If not specified, than it is determined analoguous to 'hostname -f' command. This setting could be used to switch replication to another network interface. --> <!-- <interserver_http_host>example.yandex.ru</interserver_http_host> -->
<!-- Listen specified host. use :: (wildcard IPv6 address), if you want to accept connections both with IPv4 and IPv6 from everywhere. --> <!-- <listen_host>::</listen_host> --> <!-- Same for hosts with disabled ipv6: --> <!-- <listen_host>0.0.0.0</listen_host> -->
<!-- Default values - try listen localhost on ipv4 and ipv6: --> <!-- <listen_host>::1</listen_host> <listen_host>127.0.0.1</listen_host> -->
<!-- Maximum number of concurrent queries. --> <max_concurrent_queries>100</max_concurrent_queries>
<!-- Set limit on number of open files (default: maximum). This setting makes sense on Mac OS X because getrlimit() fails to retrieve correct maximum value. --> <!-- <max_open_files>262144</max_open_files> -->
<!-- Size of cache of uncompressed blocks of data, used in tables of MergeTree family. In bytes. Cache is single for server. Memory is allocated only on demand. Cache is used when 'use_uncompressed_cache' user setting turned on (off by default). Uncompressed cache is advantageous only for very short queries and in rare cases. --> <uncompressed_cache_size>8589934592</uncompressed_cache_size>
<!-- Approximate size of mark cache, used in tables of MergeTree family. In bytes. Cache is single for server. Memory is allocated only on demand. You should not lower this value. --> <mark_cache_size>5368709120</mark_cache_size>
<!-- Path to data directory, with trailing slash. --> <path>/var/lib/clickhouse/</path>
<!-- Path to temporary data for processing hard queries. --> <tmp_path>/var/lib/clickhouse/tmp/</tmp_path>
<!-- Server time zone could be set here. Time zone is used when converting between String and DateTime types, when printing DateTime in text formats and parsing DateTime from text, it is used in date and time related functions, if specific time zone was not passed as an argument. Time zone is specified as identifier from IANA time zone database, like UTC or Africa/Abidjan. If not specified, system time zone at server startup is used. Please note, that server could display time zone alias instead of specified name. Example: W-SU is an alias for Europe/Moscow and Zulu is an alias for UTC. --> <timezone>Asia/Shanghai</timezone>
<!-- You can specify umask here (see "man umask"). Server will apply it on startup. Number is always parsed as octal. Default umask is 027 (other users cannot read logs, data files, etc; group can only read). --> <!-- <umask>022</umask> -->
<!-- Configuration of clusters that could be used in Distributed tables. https://clickhouse.yandex/reference_en.html#Distributed --> <remote_serversincl="clickhouse_remote_servers" > <!-- Test only shard config for testing distributed storage --> <test_shard_localhost> <shard> <replica> <host>localhost</host> <port>9000</port> </replica> </shard> </test_shard_localhost> </remote_servers>
<!-- If element has 'incl' attribute, then for it's value will be used corresponding substitution from another file. By default, path to file with substitutions is /etc/metrika.xml. It could be changed in config in 'include_from' element. Values for substitutions are specified in /yandex/name_of_substitution elements in that file. -->
<!-- ZooKeeper is used to store metadata about replicas, when using Replicated tables. Optional. If you don't use replicated tables, you could omit that. See https://clickhouse.yandex/reference_en.html#Data%20replication --> <zookeeperincl="zookeeper-servers"optional="true" />
<!-- Substitutions for parameters of replicated tables. Optional. If you don't use replicated tables, you could omit that. See https://clickhouse.yandex/reference_en.html#Creating%20replicated%20tables --> <macrosincl="macros"optional="true" />
<!-- Reloading interval for embedded dictionaries, in seconds. Default: 3600. --> <builtin_dictionaries_reload_interval>3600</builtin_dictionaries_reload_interval>
<!-- Maximum session timeout, in seconds. Default: 3600. --> <max_session_timeout>3600</max_session_timeout>
<!-- Default session timeout, in seconds. Default: 60. --> <default_session_timeout>60</default_session_timeout>
<!-- Sending data to Graphite for monitoring. Several sections can be defined. --> <!-- interval - send every X second root_path - prefix for keys hostname_in_path - append hostname to root_path (default = true) metrics - send data from table system.metrics events - send data from table system.events asynchronous_metrics - send data from table system.asynchronous_metrics --> <!-- <graphite> <host>localhost</host> <port>42000</port> <timeout>0.1</timeout> <interval>60</interval> <root_path>one_min</root_path> <hostname_in_path>true<hostname_in_path> <metrics>true</metrics> <events>true</events> <asynchronous_metrics>true</asynchronous_metrics> </graphite> <graphite> <host>localhost</host> <port>42000</port> <timeout>0.1</timeout> <interval>1</interval> <root_path>one_sec</root_path> <metrics>true</metrics> <events>true</events> <asynchronous_metrics>false</asynchronous_metrics> </graphite> -->
<!-- Query log. Used only for queries with setting log_queries = 1. --> <query_log> <!-- What table to insert data. If table is not exist, it will be created. When query log structure is changed after system update, then old table will be renamed and new table will be created automatically. --> <database>system</database> <table>query_log</table>
<!-- Interval of flushing data. --> <flush_interval_milliseconds>7500</flush_interval_milliseconds> </query_log>
<!-- Uncomment if use part_log <part_log> <database>system</database> <table>part_log</table> <flush_interval_milliseconds>7500</flush_interval_milliseconds> </part_log> -->
<!-- Parameters for embedded dictionaries, used in Yandex.Metrica. See https://clickhouse.yandex/reference_en.html#Internal%20dictionaries -->
<!-- Path to file with region hierarchy. --> <!-- <path_to_regions_hierarchy_file>/opt/geo/regions_hierarchy.txt</path_to_regions_hierarchy_file> -->
<!-- Path to directory with files containing names of regions --> <!-- <path_to_regions_names_files>/opt/geo/</path_to_regions_names_files> -->
<!-- Configuration of external dictionaries. See: https://clickhouse.yandex/reference_en.html#External%20Dictionaries --> <dictionaries_config>*_dictionary.xml</dictionaries_config>
<!-- Uncomment if you want data to be compressed 30-100% better. Don't do that if you just started using ClickHouse. --> <compressionincl="clickhouse_compression"> <!-- <!- - Set of variants. Checked in order. Last matching case wins. If nothing matches, lz4 will be used. - -> <case> <!- - Conditions. All must be satisfied. Some conditions may be omitted. - -> <min_part_size>10000000000</min_part_size> <!- - Min part size in bytes. - -> <min_part_size_ratio>0.01</min_part_size_ratio> <!- - Min size of part relative to whole table size. - -> <!- - What compression method to use. - -> <method>zstd</method> </case> --> </compression>
<!-- Allow to execute distributed DDL queries (CREATE, DROP, ALTER, RENAME) on cluster. Works only if ZooKeeper is enabled. Comment it if such functionality isn't required. --> <distributed_ddl> <!-- Path in ZooKeeper to queue with DDL queries --> <path>/clickhouse/task_queue/ddl</path> </distributed_ddl>
<!-- Settings to fine tune MergeTree tables. See documentation in source code, in MergeTreeSettings.h --> <!-- <merge_tree> <max_suspicious_broken_parts>5</max_suspicious_broken_parts> </merge_tree> -->
<!-- Protection from accidental DROP. If size of a MergeTree table is greater than max_table_size_to_drop (in bytes) than table could not be dropped with any DROP query. If you want do delete one table and don't want to restart clickhouse-server, you could create special file <clickhouse-path>/flags/force_drop_table and make DROP once. By default max_table_size_to_drop is 50GB, max_table_size_to_drop=0 allows to DROP any tables. Uncomment to disable protection. --> <!-- <max_table_size_to_drop>0</max_table_size_to_drop> -->
<!-- Directory in <clickhouse-path> containing schema files for various input formats. The directory will be created if it doesn't exist. --> <format_schema_path>/var/lib/clickhouse/format_schemas/</format_schema_path> </yandex>
<?xml version="1.0"?> <yandex> <!-- Profiles of settings. --> <profiles> <!-- Default settings. --> <default> <!-- Maximum memory usage for processing single query, in bytes. --> <max_memory_usage>10000000000</max_memory_usage>
<!-- Use cache of uncompressed blocks of data. Meaningful only for processing many of very short queries. --> <use_uncompressed_cache>0</use_uncompressed_cache>
<!-- How to choose between replicas during distributed query processing. random - choose random replica from set of replicas with minimum number of errors nearest_hostname - from set of replicas with minimum number of errors, choose replica with minumum number of different symbols between replica's hostname and local hostname (Hamming distance). in_order - first live replica is choosen in specified order. --> <load_balancing>random</load_balancing> </default>
<!-- Profile that allows only read queries. --> <readonly> <readonly>1</readonly> </readonly> </profiles>
<!-- Users and ACL. --> <users> <!-- If user name was not specified, 'default' user is used. --> <default> <!-- Password could be specified in plaintext or in SHA256 (in hex format). If you want to specify password in plaintext (not recommended), place it in 'password' element. Example: <password>qwerty</password>. Password could be empty. If you want to specify SHA256, place it in 'password_sha256_hex' element. Example: <password_sha256_hex>65e84be33532fb784c48129675f9eff3a682b27168c0ea744b2cf58ee02337c5</password_sha256_hex> How to generate decent password: Execute: PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha256sum | tr -d '-' In first line will be password and in second - corresponding SHA256. --> <password></password>
<!-- List of networks with open access. To open access from everywhere, specify: <ip>::/0</ip> To open access only from localhost, specify: <ip>::1</ip> <ip>127.0.0.1</ip> Each element of list has one of the following forms: <ip> IP-address or network mask. Examples: 213.180.204.3 or 10.0.0.1/8 or 2a02:6b8::3 or 2a02:6b8::3/64. <host> Hostname. Example: server01.yandex.ru. To check access, DNS query is performed, and all received addresses compared to peer address. <host_regexp> Regular expression for host names. Example, ^server\d\d-\d\d-\d\.yandex\.ru$ To check access, DNS PTR query is performed for peer address and then regexp is applied. Then, for result of PTR query, another DNS query is performed and all received addresses compared to peer address. Strongly recommended that regexp is ends with $ All results of DNS requests are cached till server restart. --> <networksincl="networks"replace="replace"> <ip>::1</ip> <ip>127.0.0.1</ip> </networks>
<!-- Settings profile for user. --> <profile>default</profile>
<!-- Quota for user. --> <quota>default</quota> </default>
<!-- Example of user with readonly access. 说明：下面有两个用户seluser（readonly表示只读权限）和inuser（default表示默认权限）密码如下 --> <seluser> <password>meiyoumima</password> <networksincl="networks"replace="replace"> <ip>::/0</ip> </networks> <profile>readonly</profile> <quota>default</quota> </seluser> <inuser> <password>meiyoumima</password> <networksincl="networks"replace="replace"> <ip>::/0</ip> </networks> <profile>default</profile> <quota>default</quota> </inuser> </users>
<!-- Quotas. --> <quotas> <!-- Name of quota. --> <default> <!-- Limits for time interval. You could specify many intervals with different limits. --> <interval> <!-- Length of interval. --> <duration>3600</duration>
<!-- No limits. Just calculate resource usage for time interval. --> <queries>0</queries> <errors>0</errors> <result_rows>0</result_rows> <read_rows>0</read_rows> <execution_time>0</execution_time> </interval> </default> </quotas> </yandex>
三、启动并测试服务
1、启动服务
1 2 3 4 5 6 7
# 启动该服务，docker-compose表示创建并启动该容器，-d表示放入后台 [rootxxxx docker_compose]# docker-compose up -d Creating clickhouse-server_1 ... done # 查看启动状态 [rootxxxx docker_compose]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 92b25e101be0 clickhouse-server-demo:1.0 "/entrypoint.sh" 3 seconds ago Up 2 seconds 0.0.0.0:8123->8123/tcp, 0.0.0.0:9000->9000/tcp, 0.0.0.0:9004->9004/tcp, 9009/tcp clickhouse-server_1
Received exception from server (version 20.3.4): Code: 164. DB::Exception: Received from docker_compose:9000. DB::Exception: seluser: Cannot execute query inreadonly mode.
0 rows inset. Elapsed: 0.071 sec.
clickhouse-server_1 :)
## 2. inuser读写用户登陆 [rootxxxx docker_compose]# docker run -it --rm --link clickhouse-server_1:docker_compose --net docker_compose_default clickhouse-server-demo:1.0 usr/bin/clickhouse-client --host docker_compose --user inuser --password meiyoumima ClickHouse client version 20.3.4.10 (official build). Connecting to docker_compose:9000 as user inuser. Connected to ClickHouse server version 20.3.4 revision 54433.
┌─name────┐ │ default │ │ system │ │ test │ └─────────┘
3 rows inset. Elapsed: 0.002 sec.
# 3、从上面的config.xml中可以看到开启了其他远程主机通过mysql登陆的方法，端口为9004 [rootxxxx ~] $ mysql -h xx.xx.xx.xx -P9004 -u seluser -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 3 Server version: 20.3.4.10-ClickHouse
Copyright (c) 2009-2017 Percona LLC and/or its affiliates Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
mysql> show databases; +---------+ | name | +---------+ | default | | system | | test | +---------+ 3 rows inset (0.00 sec)