runable

ingestion/bulker/internal/writer/clickhouse.go

@@ -8,6 +8,7 @@ package writer
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"strconv"
@@ -23,9 +24,13 @@ type ClickHouse struct {
 	db   string
 }
 
-func New(ctx context.Context, addr, db, user, password string) (*ClickHouse, error) {
-	conn, err := clickhouse.Open(&clickhouse.Options{
-		Addr: []string{addr},
+// New opens a ClickHouse connection. `secure` enables TLS. The wire protocol
+// is auto-selected from the port: 8123/8443 (HTTP interface) use HTTP, the
+// native default otherwise.
+func New(ctx context.Context, addr, db, user, password string, secure bool) (*ClickHouse, error) {
+	opts := &clickhouse.Options{
+		Addr:     []string{addr},
+		Protocol: protocolFromAddr(addr),
 		Auth: clickhouse.Auth{
 			Database: db,
 			Username: user,
@@ -35,7 +40,11 @@ func New(ctx context.Context, addr, db, user, password string) (*ClickHouse, err
 			"async_insert":          0,
 			"wait_for_async_insert": 0,
 		},
-	})
+	}
+	if secure {
+		opts.TLS = &tls.Config{MinVersion: tls.VersionTLS12}
+	}
+	conn, err := clickhouse.Open(opts)
 	if err != nil {
 		return nil, fmt.Errorf("clickhouse open: %w", err)
 	}
@@ -45,6 +54,26 @@ func New(ctx context.Context, addr, db, user, password string) (*ClickHouse, err
 	return &ClickHouse{conn: conn, db: db}, nil
 }
 
+func protocolFromAddr(addr string) clickhouse.Protocol {
+	// 8443 = HTTPS interface, 8123 = HTTP interface (both speak the HTTP wire).
+	// Everything else (9000/9440/...) speaks the native protocol.
+	switch port := portOf(addr); port {
+	case "8123", "8443":
+		return clickhouse.HTTP
+	default:
+		return clickhouse.Native
+	}
+}
+
+func portOf(addr string) string {
+	for i := len(addr) - 1; i >= 0; i-- {
+		if addr[i] == ':' {
+			return addr[i+1:]
+		}
+	}
+	return ""
+}
+
 func (c *ClickHouse) Close() error { return c.conn.Close() }
 
 // WriteEvents fans out a mixed-type batch into the per-type tables.