Going to Production

You can generate a strong secret using `openssl`:

```
openssl rand -hex 32
```

Avoid committing secrets to source control. In production, consider using environment variable management tools (e.g. Docker Secrets, HashiCorp Vault, or environment-specific CI/CD configs).

### Secure ingestion[​](#secure-ingestion "Direct link to Secure ingestion")

All ingestion should occur via the OTLP ports exposed by ClickStack distribution of the OpenTelemetry (OTel) collector. By default, this requires a secure ingestion API key generated at startup. This key is required when sending data to the OTel ports, and can be found in the HyperDX UI under `Team Settings → API Keys`.

Additionally, enabling TLS for OTLP endpoints is recommended.

#### Create an ingestion user[​](#create-a-database-ingestion-user-oss "Direct link to Create an ingestion user")

Creating a dedicated user for the OTel collector for ingestion into ClickHouse and ensuring ingestion is sent to a specific database e.g. `otel` is recommended. See ["Creating an ingestion user"](/docs/use-cases/observability/clickstack/ingesting-data/otel-collector#creating-an-ingestion-user) for further details.

### ClickHouse[​](#clickhouse "Direct link to ClickHouse")

Users managing their own ClickHouse instance should adhere to the following best practices.

#### Security best practices[​](#self-managed-security "Direct link to Security best practices")

If you're managing your own ClickHouse instance, it's essential to enable **TLS**, enforce authentication, and follow best practices for hardening access. See [this blog post](https://www.wiz.io/blog/clickhouse-and-wiz) for context on real-world misconfigurations and how to avoid them.

ClickHouse OSS provides robust security features out of the box. However, these require configuration:

- **Use TLS** via `tcp_port_secure` and `<openSSL>` in `config.xml`. See [guides/sre/configuring-tls](/docs/guides/sre/tls/configuring-tls).
- **Set a strong password** for the `default` user or disable it.
- **Avoid exposing ClickHouse externally** unless explicitly intended. By default, ClickHouse binds only to `localhost` unless `listen_host` is modified.
- **Use authentication methods** such as passwords, certificates, SSH keys, or [external authenticators](/docs/operations/external-authenticators).
- **Restrict access** using IP filtering and the `HOST` clause. See [sql-reference/statements/create/user#user-host](/docs/sql-reference/statements/create/user#user-host).
- **Enable Role-Based Access Control (RBAC)** to grant granular privileges. See [operations/access-rights](/docs/operations/access-rights).
- **Enforce quotas and limits** using [quotas](/docs/operations/quotas), [settings profiles](/docs/operations/settings/settings-profiles), and read-only modes.
- **Encrypt data at rest** and use secure external storage. See [operations/storing-data](/docs/operations/storing-data) and [cloud/security/CMEK](/docs/cloud/security/cmek).
- **Avoid hard coding credentials.** Use [named collections](/docs/operations/named-collections) or IAM roles in ClickHouse Cloud.
- **Audit access and queries** using [system logs](/docs/operations/system-tables/query_log) and [session logs](/docs/operations/system-tables/session_log).

See also [external authenticators](/docs/operations/external-authenticators) and [query complexity settings](/docs/operations/settings/query-complexity) for managing users and ensuring query/resource limits.

#### User permissions for ClickStack UI[​](#user-permissions "Direct link to User permissions for ClickStack UI")

The ClickHouse user for the ClickStack UI only needs to be a `readonly` user with access to change the following settings:

- `max_rows_to_read` (at least up to 1 million)
- `read_overflow_mode`
- `cancel_http_readonly_queries_on_client_close`
- `wait_end_of_query`

By default, the `default` user in both OSS and ClickHouse Cloud will have these permissions available however you're recommended to create a new user with these permissions.

### Configure Time To Live (TTL)[​](#configure-ttl "Direct link to Configure Time To Live (TTL)")

Ensure the [Time To Live (TTL)](/docs/use-cases/observability/clickstack/ttl) has been [appropriately configured](/docs/use-cases/observability/clickstack/ttl#modifying-ttl) for your ClickStack deployment. This controls how long data is retained for - the default of 3 days often needs to be modified.

### MongoDB guidelines[​](#mongodb-guidelines "Direct link to MongoDB guidelines")

Follow the official [MongoDB security checklist](https://www.mongodb.com/docs/manual/administration/security-checklist/).

Was this page helpful?