chproxy for ClickHouse on Ubuntu 24.04 LTS

Azure Networking

an http proxy and load balancer for clickhouse, with per instance authentication

Base
Hardened build
minimal ports, security patches applied at build time
Access
Unique credentials
generated on first boot, readable only by root
Verified
Boots working
services pass a health gate before release
Support
24/7, 365 days
by email and live chat, 24 hour response SLA

Overview

chproxy is an HTTP proxy and load balancer for ClickHouse, the open source column oriented analytics database. It sits in front of one or more ClickHouse nodes, terminating client HTTP requests, enforcing its own user based access control and request limits, spreading queries across replicas and shards, and caching responses. This image ships chproxy as a single Go binary in front of a bundled local ClickHouse server, so you get a working, authenticated ClickHouse HTTP endpoint on one virtual machine.

Why the cloudimg image

cloudimg ships chproxy secure by default. The bundled ClickHouse server listens on loopback only and is never exposed directly; every request reaches it through chproxy. There is no shared bootstrap credential: a unique chproxy client password and a unique ClickHouse default user password are generated on the first boot of every virtual machine, so anonymous and wrong credential requests are refused. The credentials are written to a root only file, the image is kept fully patched, ships with a paired deployment guide, and is backed by 24/7 support.

Common uses

  • Authenticated HTTP gateway in front of a ClickHouse database
  • User based access control and query limits for ClickHouse clients
  • Load balancing and response caching across ClickHouse replicas