@fjall/components-infrastructure 1.1.0 → 2.1.1

package/dist/lib/patterns/aws/clickhouseDatabase.d.ts

@@ -2,7 +2,7 @@ import { Connections, type IConnectable, type IVpc } from "aws-cdk-lib/aws-ec2";
 import { type TaskDefinition } from "aws-cdk-lib/aws-ecs";
 import { type IBucket } from "aws-cdk-lib/aws-s3";
 import { Construct } from "constructs";
-import { Secret } from "../../resources/aws/secrets/secret.js";
+import { Secret, type SecretImport } from "../../resources/aws/secrets/secret.js";
 import { type ClickHouseSchemaAdmin, type ProfileSpec } from "../../resources/aws/database/clickhouseSchemas.js";
 import { type ISecret } from "aws-cdk-lib/aws-secretsmanager";
 import type { ClickHouseTlsOptions } from "./clickhouseTls/index.js";
@@ -174,8 +174,14 @@ export declare class ClickHouseDatabase extends Construct implements IClickHouse
      * Port matches: HTTPS (8443) under TLS, HTTP (8123) otherwise.
      */
     getUrl(): string;
-    /** @deprecated Alias for {@link getUrl}. Removed in a follow-up landing. */
-    getHttpUrl(): string;
+    /**
+     * SecretImport for the CA certificate secret, or `undefined` when TLS is
+     * disabled (`tls: { mode: "none", … }`). Consumers wire this into their
+     * `secretsImport:` block under `CLICKHOUSE_CA_CERT` so `@fjall/clickhouse`
+     * `createFjallClickHouseClient()` picks it up from `process.env`. The secret
+     * holds raw PEM (no JSON field) so `field` is `undefined`.
+     */
+    getTlsCaCertImport(): SecretImport | undefined;
     getNativeUrl(): string;
     getDatabaseName(): string;
     getBackupBucket(): IBucket;

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -294,6 +294,15 @@ export class ClickHouseDatabase extends Construct {
             ...OPTIMISE_MV_TABLES.map((table) => `OPTIMIZE TABLE ${CLICKHOUSE_DATABASE_NAME}.${table}`)
         ].join("; ");
         const adminSecret = expectDefined(userSecrets.get(schemaAdmin.name), `schemaAdmin '${schemaAdmin.name}' secret not minted.`);
+        const sidecarTlsPreamble = tlsActive
+            ? `set -eu && printf '%s\\n' "$CLICKHOUSE_CA_CERT" > /tmp/ca.crt && printf '%s' '<?xml version="1.0"?><config><openSSL><client><caConfig>/tmp/ca.crt</caConfig><verificationMode>strict</verificationMode><loadDefaultCAFile>false</loadDefaultCAFile><invalidCertificateHandler><name>RejectCertificateHandler</name></invalidCertificateHandler></client></openSSL></config>' > /tmp/clickhouse-client.xml && `
+            : "";
+        const sidecarTlsClientArgs = tlsActive
+            ? " --config-file=/tmp/clickhouse-client.xml --secure"
+            : "";
+        const sidecarTlsSecrets = tlsActive && tlsCaSecret !== undefined
+            ? { CLICKHOUSE_CA_CERT: EcsSecret.fromSecretsManager(tlsCaSecret) }
+            : {};
         const scheduledTasks = [];
         if (optimiseEnabled) {
             scheduledTasks.push({
@@ -303,19 +312,13 @@ export class ClickHouseDatabase extends Construct {
                 cpu: OPTIMISE_TASK_CPU_UNITS,
                 memoryLimitMiB: OPTIMISE_TASK_MEMORY_MIB,
                 command: [
-                    "clickhouse-client",
-                    "--host",
-                    clickHouseHost,
-                    "--port",
-                    String(nativePort),
-                    "--user",
-                    schemaAdmin.name,
-                    ...(tlsActive ? ["--secure", "--accept-invalid-certificate"] : []),
-                    "--query",
-                    `${optimiseQuery};`
+                    "sh",
+                    "-c",
+                    `${sidecarTlsPreamble}clickhouse-client --host ${clickHouseHost} --port ${nativePort} --user ${schemaAdmin.name}${sidecarTlsClientArgs} --query "${optimiseQuery};"`
                 ],
                 secrets: {
-                    CLICKHOUSE_PASSWORD: EcsSecret.fromSecretsManager(adminSecret.secret, "password")
+                    CLICKHOUSE_PASSWORD: EcsSecret.fromSecretsManager(adminSecret.secret, "password"),
+                    ...sidecarTlsSecrets
                 },
                 logRetention: RetentionDays.ONE_WEEK,
                 securityGroups: [securityGroup]
@@ -332,10 +335,11 @@ export class ClickHouseDatabase extends Construct {
                     "sh",
                     "-c",
                     // Password via CLICKHOUSE_PASSWORD env, not --password on argv (argv → /proc/<pid>/cmdline).
-                    `STAMP=$(date +%Y%m%d-%H%M%S) && clickhouse-client --host ${clickHouseHost} --port ${nativePort} --user ${schemaAdmin.name}${tlsActive ? " --secure --accept-invalid-certificate" : ""} --query "BACKUP DATABASE ${CLICKHOUSE_DATABASE_NAME} TO S3('${backupDestUrl}weekly-$STAMP/')"`
+                    `${sidecarTlsPreamble}STAMP=$(date +%Y%m%d-%H%M%S) && clickhouse-client --host ${clickHouseHost} --port ${nativePort} --user ${schemaAdmin.name}${sidecarTlsClientArgs} --query "BACKUP DATABASE ${CLICKHOUSE_DATABASE_NAME} TO S3('${backupDestUrl}weekly-$STAMP/')"`
                 ],
                 secrets: {
-                    CLICKHOUSE_PASSWORD: EcsSecret.fromSecretsManager(adminSecret.secret, "password")
+                    CLICKHOUSE_PASSWORD: EcsSecret.fromSecretsManager(adminSecret.secret, "password"),
+                    ...sidecarTlsSecrets
                 },
                 logGroup: backupTaskLogGroup,
                 securityGroups: [securityGroup]
@@ -445,7 +449,7 @@ export class ClickHouseDatabase extends Construct {
                                 command: [
                                     "CMD-SHELL",
                                     tlsActive
-                                        ? `wget -q --no-check-certificate -O /dev/null https://127.0.0.1:${httpPort}/ping || exit 1`
+                                        ? `wget -q --ca-certificate=${CLICKHOUSE_TLS_CERT_MOUNT_PATH}/ca.crt -O /dev/null https://127.0.0.1:${httpPort}/ping || exit 1`
                                         : `wget -q -O /dev/null http://127.0.0.1:${httpPort}/ping || exit 1`
                                 ],
                                 interval: CLICKHOUSE_HEALTH_CHECK.INTERVAL_SECONDS,
@@ -489,7 +493,7 @@ export class ClickHouseDatabase extends Construct {
             `ADMIN_PASSWORD=$(aws secretsmanager get-secret-value --secret-id "${adminSecretName}" --query SecretString --output text | jq -r .password)`,
             `if [ -z "$ADMIN_PASSWORD" ] || [ "$ADMIN_PASSWORD" = "null" ]; then echo "fjall:reload:status=failed reason=password-fetch" >&2; exit 1; fi`,
             `mv /var/lib/clickhouse/users.d/fjall.xml.new /var/lib/clickhouse/users.d/fjall.xml`,
-            `docker exec -i -e CLICKHOUSE_CLIENT_PASSWORD="$ADMIN_PASSWORD" "$CONTAINER" clickhouse-client${tlsActive ? " --secure --accept-invalid-certificate" : ""} --port ${nativePort} --user ${schemaAdmin.name} -q "SYSTEM RELOAD USERS"`
+            `docker exec -i -e CLICKHOUSE_CLIENT_PASSWORD="$ADMIN_PASSWORD" "$CONTAINER" clickhouse-client${tlsActive ? ` --config-file=${CLICKHOUSE_TLS_CERT_MOUNT_PATH}/client.xml --secure --host localhost` : ""} --port ${nativePort} --user ${schemaAdmin.name} -q "SYSTEM RELOAD USERS"`
         ].join("\n");
         const region = Stack.of(this).region;
         const account = Stack.of(this).account;
@@ -605,9 +609,21 @@ export class ClickHouseDatabase extends Construct {
         const scheme = this.tlsCaSecret !== undefined ? "https" : "http";
         return `${scheme}://${this.getHostEndpoint()}:${this.#httpPort}`;
     }
-    /** @deprecated Alias for {@link getUrl}. Removed in a follow-up landing. */
-    getHttpUrl() {
-        return this.getUrl();
+    /**
+     * SecretImport for the CA certificate secret, or `undefined` when TLS is
+     * disabled (`tls: { mode: "none", … }`). Consumers wire this into their
+     * `secretsImport:` block under `CLICKHOUSE_CA_CERT` so `@fjall/clickhouse`
+     * `createFjallClickHouseClient()` picks it up from `process.env`. The secret
+     * holds raw PEM (no JSON field) so `field` is `undefined`.
+     */
+    getTlsCaCertImport() {
+        if (this.tlsCaSecret === undefined)
+            return undefined;
+        return {
+            id: `${this.node.id}TlsCaCertImport`,
+            name: this.tlsCaSecret.secretName,
+            field: undefined
+        };
     }
     getNativeUrl() {
         return `tcp://${this.getHostEndpoint()}:${this.#nativePort}`;
@@ -662,12 +678,19 @@ export class ClickHouseDatabase extends Construct {
      */
     getMigrationContributions() {
         const environment = {
-            CLICKHOUSE_URL: this.getHttpUrl(),
+            CLICKHOUSE_URL: this.getUrl(),
             CLICKHOUSE_DATABASE: this.getDatabaseName()
         };
         const secretsImport = {};
         const adminSecret = this.getUser(this.#schemaAdmin.name);
         secretsImport.SCHEMA_ADMIN_PASSWORD = adminSecret.getImport("password");
+        const caCertImport = this.getTlsCaCertImport();
+        if (caCertImport !== undefined) {
+            secretsImport.CLICKHOUSE_CA_CERT = caCertImport;
+        }
+        if (this.caCertSha256 !== undefined) {
+            environment.CLICKHOUSE_CA_CERT_SHA256 = this.caCertSha256;
+        }
         for (const name of this.#managedPasswordNames) {
             const userSecret = this.getUser(name);
             secretsImport[userPasswordEnvName(name)] =
@@ -707,7 +730,7 @@ export class ClickHouseDatabase extends Construct {
         if (container === undefined) {
             throw new Error("ClickHouseDatabase.connectFromTask: task has no default container");
         }
-        container.addEnvironment("CLICKHOUSE_URL", this.getHttpUrl());
+        container.addEnvironment("CLICKHOUSE_URL", this.getUrl());
         container.addEnvironment("CLICKHOUSE_DATABASE", CLICKHOUSE_DATABASE_NAME);
         if (opts?.user !== undefined) {
             const userSecret = this.getUser(opts.user);

package/dist/lib/patterns/aws/interfaces/database.d.ts

@@ -263,12 +263,14 @@ export interface IClickHouseDatabase extends IDatabase, IConnectable, IMigration
     /** Native TCP port (typically 9000). */
     getNativePort(): number;
     /**
-     * HTTP URL for clickhouse-client / chproxy (`http://<host>:<httpPort>`).
-     * No credentials in the URL — ClickHouse HTTP uses Basic Auth headers or
-     * `X-ClickHouse-User`/`X-ClickHouse-Key` headers. Compose creds at runtime
-     * via `getUser(name).getImport(...)`.
+     * Canonical URL for the HTTP(S) interface. Scheme is `https` when TLS is
+     * active (default), `http` only when `tls: { mode: "none", … }` is set.
+     * Port matches: HTTPS (8443) under TLS, HTTP (8123) otherwise. No
+     * credentials in the URL — ClickHouse HTTP uses Basic Auth headers or
+     * `X-ClickHouse-User`/`X-ClickHouse-Key` headers. Compose creds at
+     * runtime via `getUser(name).getImport(...)`.
      */
-    getHttpUrl(): string;
+    getUrl(): string;
     /**
      * Native TCP URL (`tcp://<host>:<nativePort>`).
      * No credentials in the URL — the native protocol handshake carries them.

package/dist/lib/resources/aws/database/clickhouseUserData.js

@@ -288,8 +288,28 @@ SERVER_JSON=$(aws secretsmanager get-secret-value --secret-id "${options.serverS
 printf '%s' "$SERVER_JSON" | jq -r .cert > "$MOUNT_POINT/server-certs/server.crt"
 printf '%s' "$SERVER_JSON" | jq -r .key > "$MOUNT_POINT/server-certs/server.key"
 
+# Strict-verify client config consumed by docker-exec reload SSM script and any
+# in-container clickhouse-client invocation. RejectCertificateHandler + strict
+# verificationMode together close the trust-anchor-skipped class.
+cat > "$MOUNT_POINT/server-certs/client.xml" <<'CLIENTXML'
+<?xml version="1.0"?>
+<config>
+  <openSSL>
+    <client>
+      <caConfig>/etc/clickhouse-server/certs/ca.crt</caConfig>
+      <verificationMode>strict</verificationMode>
+      <loadDefaultCAFile>false</loadDefaultCAFile>
+      <invalidCertificateHandler>
+        <name>RejectCertificateHandler</name>
+      </invalidCertificateHandler>
+    </client>
+  </openSSL>
+</config>
+CLIENTXML
+
 chown -R 101:101 "$MOUNT_POINT/server-certs"
 chmod 600 "$MOUNT_POINT/server-certs/server.key"
+chmod 644 "$MOUNT_POINT/server-certs/client.xml"
 `
         : "";
     const script = `#!/bin/bash

package/dist/lib/utils/manifestWriter.js

@@ -17,7 +17,7 @@ import { writeFileSync, readFileSync, existsSync, readdirSync, renameSync, unlin
 import { join, basename } from "path";
 import { createHash } from "crypto";
 import { buildConstructMap, constructMapToRecord, ACCOUNT_CONSTRUCT_GROUPS } from "@fjall/util/constructMap";
-import { maskSensitiveOutput } from "@fjall/util";
+import { getErrorMessage, maskSensitiveOutput } from "@fjall/util";
 import { FJALL_MANIFEST_FILENAME, MANIFEST_SCHEMA_VERSION, FjallManifestSchema } from "@fjall/util/manifest/schemas";
 import { FjallLogger } from "./validationLogger.js";
 /**
@@ -117,7 +117,7 @@ function computeTemplateHash(templatePath) {
         return createHash("sha256").update(normalised).digest("hex");
     }
     catch (error) {
-        const maskedMessage = maskSensitiveOutput(error instanceof Error ? error.message : String(error));
+        const maskedMessage = maskSensitiveOutput(getErrorMessage(error));
         FjallLogger.warn(`Failed to compute hash for ${templatePath}: ${maskedMessage}`);
         return null;
     }
@@ -144,7 +144,7 @@ function computeStackHashes(cdkOutPath) {
         }
     }
     catch (error) {
-        const maskedMessage = maskSensitiveOutput(error instanceof Error ? error.message : String(error));
+        const maskedMessage = maskSensitiveOutput(getErrorMessage(error));
         FjallLogger.warn(`Failed to read cdk.out for hash computation: ${maskedMessage}`);
     }
     return stacks;
@@ -194,16 +194,10 @@ export function writeManifest(assembly, collector) {
                 unlinkSync(tmpPath);
             }
             catch (cleanupError) {
-                const cleanupMessage = cleanupError instanceof Error
-                    ? cleanupError.message
-                    : String(cleanupError);
-                FjallLogger.warn(`Failed to clean up tmp manifest at ${tmpPath}: ${maskSensitiveOutput(cleanupMessage)}`);
+                FjallLogger.warn(`Failed to clean up tmp manifest at ${tmpPath}: ${maskSensitiveOutput(getErrorMessage(cleanupError))}`);
             }
         }
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        throw new Error(`Failed to write Fjall manifest: ${errorMessage}`, {
-            cause: error
-        });
+        throw new Error(`Failed to write Fjall manifest: ${getErrorMessage(error)}`, { cause: error });
     }
 }
 /**
@@ -224,8 +218,7 @@ export function readExistingManifest(cdkOutPath) {
         return result.data;
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        FjallLogger.warn(`Failed to parse existing manifest: ${maskSensitiveOutput(message)}`);
+        FjallLogger.warn(`Failed to parse existing manifest: ${maskSensitiveOutput(getErrorMessage(error))}`);
         return null;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "1.1.0",
+  "version": "2.1.1",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -59,12 +59,12 @@
     "eslint": "^10.2.1",
     "prettier": "^3.8.3",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.7"
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^1.1.0",
-    "@fjall/util": "^1.1.0",
+    "@fjall/generator": "^2.1.1",
+    "@fjall/util": "^2.1.1",
     "constructs": "^10.0.0",
     "uuid": "^14.0.0"
   },
@@ -79,5 +79,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "437ec726425bd7610b83a57c12c1a4e1980bbb01"
+  "gitHead": "971d9ed50c6a21d24e67c9c83b9c471a632bf284"
 }