From 36ea7d5cb9d1cf6c4d2dfa38b6b841cc81e3519f Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Sat, 10 Oct 2026 22:45:17 +0200 Subject: [PATCH] fix(rybbit): grant clickhouse access_management for rybbit_query provisioning Upstream's backend runs provisionQueryUser() on every startup to create the least-privilege rybbit_query user (powers custom SQL queries and dashboard cards) via SQL against the main ClickHouse connection. That requires access_management on that connection, which upstream's own compose grants via CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1 - missing here since apps/clickhouse-26.5.yml is a generic multi-app template and shouldn't grant this by default. Override it on rybbit's own clickhouse service instead, merged in via include: (verified against a scratch copy of apps/ with docker compose config - the override's environment: key merges into the template's own environment map rather than replacing it, same as every other field the template declares). The failure mode without this is non-fatal and silent: core dashboards/sites/session-replay keep working, only custom SQL queries/dashboard cards fail closed, logged but not surfaced anywhere flightdeck would see. Fixes #225 Co-Authored-By: Claude Sonnet 5 --- apps/rybbit/docker-compose.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apps/rybbit/docker-compose.yml b/apps/rybbit/docker-compose.yml index f3416ac8..c539f374 100644 --- a/apps/rybbit/docker-compose.yml +++ b/apps/rybbit/docker-compose.yml @@ -23,6 +23,9 @@ x-internal-env: &internal-env REDIS_HOST: redis REDIS_PORT: 6379 services: + clickhouse: + environment: + CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1 client: image: ghcr.io/rybbit-io/rybbit-client extends: