PMM-14118 Generate SSL certificates for ClickHouse

[ademidoff]

PMM-14118

Link to the Feature Build: SUBMODULES-4054

This pull request introduces SSL support for the ClickHouse server and fixes a configuration path for Nginx certificate generation. The main changes include generating SSL certificates for ClickHouse, adding Diffie-Hellman parameters, and ensuring the correct configuration file is used for Nginx certificate creation.

SSL support for ClickHouse:

• Added a new Ansible task to generate self-signed SSL certificates (server.key and server.crt) for ClickHouse using OpenSSL, improving security for ClickHouse connections.
• Included the dhparam.pem file containing Diffie-Hellman parameters for enhanced SSL security, and updated the Ansible copy task to deploy this file to the ClickHouse server directory.

Nginx certificate generation fix:

• Corrected the path to the certificate configuration file in the Nginx SSL certificate generation script, ensuring it references /srv/nginx/certificate.conf instead of /etc/nginx/ssl/certificate.conf.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.54%. Comparing base (fa6ecd0) to head (5030ef4).
⚠️ Report is 1 commits behind head on v3.

Additional details and impacted files

@@           Coverage Diff           @@
##               v3    #4575   +/-   ##
=======================================
  Coverage   44.54%   44.54%           
=======================================
  Files         363      363           
  Lines       45715    45715           
=======================================
  Hits        20365    20365           
  Misses      23692    23692           
  Partials     1658     1658           

Flag	Coverage Δ
admin	17.33% <ø> (ø)
agent	53.35% <ø> (ø)
managed	44.48% <ø> (ø)
vmproxy	74.13% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ademidoff]

@BupycHuk Are we OK with this fix?

[BupycHuk]

Have you tested it?

[ademidoff]

Yes, no issues )

[ademidoff]

I wonder, wasn't it meant to be that way? I thought it was an oversight, no? If we don't take the certificate.conf from /srv/nginx/, then there is no way for the user to override ours, which comes from /etc/nginx/.