Secure a Managed ClickHouse® service
You can secure your Managed ClickHouse® service in a few different ways, for example by restricting network access and enabling service termination protection.
Restrict network access to your service
One of the most fundamental ways to keep your service secure is managing its network access properly. Access is controlled by the service IP filter, which lists the CIDR blocks allowed to connect. Set it when you create the service, or update it at any time:
exo dbaas update my-clickhouse -z ch-gva-2 -f \
--clickhouse-ip-filter 203.0.113.0/24The flag replaces the whole list. To allow several ranges, separate them with commas or repeat the flag.
Read the current filter back with:
exo dbaas show my-clickhouse -z ch-gva-2 --output-template '{{ .Clickhouse.IPFilter }}'Note
The IP filter applies to every interface of the service, including the Prometheus scrape endpoint. A connection from an address that is not allowed times out rather than returning an authentication error.
Protect a service from termination
Exoscale services can be protected against accidental deletion or powering off by enabling the Termination Protection feature. Services created with the CLI have it enabled by default. To enable it on another service:
exo dbaas update my-clickhouse -z ch-gva-2 -f --termination-protectionNote
Termination Protection has no effect on service migrations or upgrades.
Terminate a protected service
Before terminating a protected service, disable Termination Protection for this service:
exo dbaas update my-clickhouse -z ch-gva-2 -f --termination-protection=falseNote
Running out of free Exoscale sign-up credits stops your services unless a payment method has been added to your Exoscale organization.