apps/rybbit: clickhouse missing CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1, rybbit_query self-provisioning likely fails #225

Summary

apps/rybbit/docker-compose.yml's clickhouse service (via ../clickhouse-26.5.yml) does not set CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1. Upstream's own docker-compose.yml (rybbit-io/rybbit) does set it, with this comment on the clickhouse service:

- CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1
# Lets the backend provision the least-privilege `rybbit_query` user
# (custom SQL queries / dashboards) with SQL at startup.

Why this matters

The backend's provisionQueryUser() (server/src/db/clickhouse/queryUser.ts in rybbit-io/rybbit) runs on every startup and requires the main ClickHouse connection to have access_management to create/alter the rybbit_query user and its settings profile. The source comment is explicit:

Requires the main connection to have access_management (the bundled compose sets CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1); otherwise the steps fail, the error is logged, and custom queries fail closed until the user is created by hand.

The failure is caught (try/catch) and non-fatal — the app doesn't crash, core dashboards/sites/session-replay still work — but the "Custom SQL queries" / dashboard-cards feature (which depends on the rybbit_query user existing with SELECT on events) silently fails closed, logging:

Could not provision ClickHouse user "rybbit_query" (the main ClickHouse user needs access_management). Custom SQL queries and dashboards will fail until it exists with SELECT on <db>.events — see docs: self-hosting-advanced → Custom SQL queries

What I checked

• Confirmed by reading apps/rybbit/docker-compose.yml and apps/clickhouse-26.5.yml in this repo (today) — neither sets CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT.
• Confirmed by reading server/src/db/clickhouse/queryUser.ts in a real rybbit-io/rybbit v2.9.1 checkout (upgraded a self-hosted instance from a pre-2.0 snapshot, in place, as part of migrating it onto Flightdeck).
• Not yet reproduced against an actual Flightdeck deploy of apps/rybbit — this is from code inspection, not a live repro. Filing so it can be verified and fixed if confirmed, per your own request.

Suggested fix

clickhouse-26.5.yml is a generic, multi-app template, so setting this globally there would grant every app's default ClickHouse user elevated self-management rights it doesn't need. The override probably belongs in apps/rybbit/docker-compose.yml itself, e.g. re-declaring the clickhouse service there with just:

services:
  clickhouse:
    environment:
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1

(merged with the included clickhouse-26.5.yml service definition via include:).

Also noticed, same app, possibly separate issues

• Upstream's current docker-compose.yml pins clickhouse/clickhouse-server:26.3.17.4; this catalog pins 26.5r — worth confirming that's intentional/tested rather than just a newer tag nobody's re-checked against.
• Upstream also has CLICKHOUSE_QUERY_PASSWORD, DEPLOYMENT, LITE_DASHBOARD, OPENROUTER_API_KEY, OPENROUTER_MODEL, CLUSTER_WORKERS env vars not wired into apps/rybbit's vault-env/internal-env — all optional with safe fallbacks upstream, so lower priority, but flagging since they were found in the same pass.