From 0e948befac754f5bcb1aab3328824548654234da Mon Sep 17 00:00:00 2001
From: Sun-ZhenXing <1006925066@qq.com>
Date: Wed, 15 Apr 2026 15:05:16 +0800
Subject: [PATCH] refactor: signoz

---
 .../openlit/assets/otel-collector-config.yaml |    2 -
 src/signoz/.env.example                       |  111 +-
 src/signoz/README.md                          |  142 +-
 src/signoz/README.zh.md                       |  143 +--
 src/signoz/clickhouse/cluster.xml             |   75 ++
 src/signoz/clickhouse/config.xml              | 1142 +++++++++++++++++
 src/signoz/clickhouse/custom-function.xml     |   21 +
 src/signoz/clickhouse/users.xml               |  123 ++
 src/signoz/docker-compose.yaml                |  326 ++---
 src/signoz/otel-collector-config.yaml         |  114 ++
 .../signoz/otel-collector-opamp-config.yaml   |    1 +
 11 files changed, 1802 insertions(+), 398 deletions(-)
 create mode 100644 src/signoz/clickhouse/cluster.xml
 create mode 100644 src/signoz/clickhouse/config.xml
 create mode 100644 src/signoz/clickhouse/custom-function.xml
 create mode 100644 src/signoz/clickhouse/users.xml
 create mode 100644 src/signoz/otel-collector-config.yaml
 create mode 100644 src/signoz/signoz/otel-collector-opamp-config.yaml

diff --git a/apps/openlit/assets/otel-collector-config.yaml b/apps/openlit/assets/otel-collector-config.yaml
index 66c2676..a67475e 100644
--- a/apps/openlit/assets/otel-collector-config.yaml
+++ b/apps/openlit/assets/otel-collector-config.yaml
@@ -1,5 +1,3 @@
-file_format: '1.0'
-
 receivers:
   otlp:
     protocols:
diff --git a/src/signoz/.env.example b/src/signoz/.env.example
index 4edd17c..d186e8d 100644
--- a/src/signoz/.env.example
+++ b/src/signoz/.env.example
@@ -9,27 +9,31 @@ TZ=UTC
 # SigNoz Version Configuration
 # ============================================
 
-# SigNoz ClickHouse version
-SIGNOZ_CLICKHOUSE_VERSION=24.11.1-alpine
+# SigNoz all-in-one backend + frontend + alertmanager version
+SIGNOZ_VERSION=v0.118.0
 
-# SigNoz OTel Collector version
-SIGNOZ_OTEL_COLLECTOR_VERSION=0.102.8
+# SigNoz OTel Collector version (also used for migration jobs)
+SIGNOZ_OTEL_COLLECTOR_VERSION=v0.144.2
 
-# SigNoz Query Service version
-SIGNOZ_QUERY_SERVICE_VERSION=0.55.0
+# ClickHouse version
+SIGNOZ_CLICKHOUSE_VERSION=25.5.6
 
-# SigNoz Frontend version
-SIGNOZ_FRONTEND_VERSION=0.55.0
+# ZooKeeper version
+SIGNOZ_ZOOKEEPER_VERSION=3.7.1
 
-# SigNoz Alert Manager version
-SIGNOZ_ALERTMANAGER_VERSION=0.23.5
+# ============================================
+# Security Configuration
+# ============================================
+
+# JWT secret for SigNoz token signing - MUST be changed in production
+SIGNOZ_JWT_SECRET=please-change-this-secret
 
 # ============================================
 # Port Configuration
 # ============================================
 
-# SigNoz Frontend UI port (default: 3301)
-SIGNOZ_PORT_OVERRIDE=3301
+# SigNoz UI port (default: 8080)
+SIGNOZ_PORT_OVERRIDE=8080
 
 # OTel Collector OTLP gRPC port (default: 4317)
 SIGNOZ_OTEL_GRPC_PORT_OVERRIDE=4317
@@ -37,38 +41,15 @@ SIGNOZ_OTEL_GRPC_PORT_OVERRIDE=4317
 # OTel Collector OTLP HTTP port (default: 4318)
 SIGNOZ_OTEL_HTTP_PORT_OVERRIDE=4318
 
-# ============================================
-# ClickHouse Configuration
-# ============================================
-
-# ClickHouse database name
-SIGNOZ_CLICKHOUSE_DB=signoz
-
-# ClickHouse connection URL
-SIGNOZ_CLICKHOUSE_URL=tcp://clickhouse:9000/?database=signoz
-
-# ============================================
-# Query Service Configuration
-# ============================================
-
-# Storage type (clickhouse)
-SIGNOZ_STORAGE=clickhouse
-
-# Go debug settings
-SIGNOZ_GODEBUG=netdns=go
-
-# Telemetry enabled (true/false)
-SIGNOZ_TELEMETRY_ENABLED=true
-
-# Deployment type
-SIGNOZ_DEPLOYMENT_TYPE=docker-standalone-amd
-
 # ============================================
 # OTel Collector Configuration
 # ============================================
 
 # OTel resource attributes
-SIGNOZ_OTEL_RESOURCE_ATTRIBUTES=host.name=signoz-host
+SIGNOZ_OTEL_RESOURCE_ATTRIBUTES=host.name=signoz-host,os.type=linux
+
+# Exception grouping for low-cardinality exceptions (true/false)
+SIGNOZ_LOW_CARDINAL_EXCEPTION_GROUPING=false
 
 # ============================================
 # Resource Limits - ClickHouse
@@ -103,49 +84,33 @@ SIGNOZ_OTEL_COLLECTOR_CPU_RESERVATION=0.25
 SIGNOZ_OTEL_COLLECTOR_MEMORY_RESERVATION=512M
 
 # ============================================
-# Resource Limits - Query Service
+# Resource Limits - SigNoz
 # ============================================
 
-# CPU limit for Query Service
-SIGNOZ_QUERY_SERVICE_CPU_LIMIT=1.0
+# CPU limit for SigNoz
+SIGNOZ_CPU_LIMIT=1.0
 
-# Memory limit for Query Service
-SIGNOZ_QUERY_SERVICE_MEMORY_LIMIT=1G
+# Memory limit for SigNoz
+SIGNOZ_MEMORY_LIMIT=2G
 
-# CPU reservation for Query Service
-SIGNOZ_QUERY_SERVICE_CPU_RESERVATION=0.25
+# CPU reservation for SigNoz
+SIGNOZ_CPU_RESERVATION=0.25
 
-# Memory reservation for Query Service
-SIGNOZ_QUERY_SERVICE_MEMORY_RESERVATION=256M
+# Memory reservation for SigNoz
+SIGNOZ_MEMORY_RESERVATION=256M
 
 # ============================================
-# Resource Limits - Frontend
+# Resource Limits - ZooKeeper
 # ============================================
 
-# CPU limit for Frontend
-SIGNOZ_FRONTEND_CPU_LIMIT=0.5
+# CPU limit for ZooKeeper
+SIGNOZ_ZOOKEEPER_CPU_LIMIT=0.5
 
-# Memory limit for Frontend
-SIGNOZ_FRONTEND_MEMORY_LIMIT=512M
+# Memory limit for ZooKeeper
+SIGNOZ_ZOOKEEPER_MEMORY_LIMIT=512M
 
-# CPU reservation for Frontend
-SIGNOZ_FRONTEND_CPU_RESERVATION=0.1
+# CPU reservation for ZooKeeper
+SIGNOZ_ZOOKEEPER_CPU_RESERVATION=0.1
 
-# Memory reservation for Frontend
-SIGNOZ_FRONTEND_MEMORY_RESERVATION=128M
-
-# ============================================
-# Resource Limits - Alert Manager
-# ============================================
-
-# CPU limit for Alert Manager
-SIGNOZ_ALERTMANAGER_CPU_LIMIT=0.5
-
-# Memory limit for Alert Manager
-SIGNOZ_ALERTMANAGER_MEMORY_LIMIT=512M
-
-# CPU reservation for Alert Manager
-SIGNOZ_ALERTMANAGER_CPU_RESERVATION=0.1
-
-# Memory reservation for Alert Manager
-SIGNOZ_ALERTMANAGER_MEMORY_RESERVATION=128M
+# Memory reservation for ZooKeeper
+SIGNOZ_ZOOKEEPER_MEMORY_RESERVATION=128M
diff --git a/src/signoz/README.md b/src/signoz/README.md
index 26d2db1..66f76d2 100644
--- a/src/signoz/README.md
+++ b/src/signoz/README.md
@@ -13,133 +13,109 @@ SigNoz is an open-source observability platform that provides monitoring and tro
 - **Alerts**: Configure alerts based on metrics and traces
 - **OpenTelemetry Native**: Built on top of OpenTelemetry standards
 
+## Services
+
+| Service                          | Image                                 | Description                                            |
+| -------------------------------- | ------------------------------------- | ------------------------------------------------------ |
+| `signoz`                         | signoz/signoz:v0.118.0                | All-in-one backend, frontend UI, and alert manager     |
+| `otel-collector`                 | signoz/signoz-otel-collector:v0.144.2 | Receives, processes, and exports telemetry data        |
+| `clickhouse`                     | clickhouse/clickhouse-server:25.5.6   | Time-series database for traces, metrics, and logs     |
+| `zookeeper-1`                    | signoz/zookeeper:3.7.1                | ZooKeeper for ClickHouse replication metadata          |
+| `init-clickhouse`                | clickhouse/clickhouse-server:25.5.6   | One-shot init that downloads the histogramQuantile UDF |
+| `signoz-telemetrystore-migrator` | signoz/signoz-otel-collector:v0.144.2 | One-shot schema migration for ClickHouse               |
+
 ## Quick Start
 
-1. Copy the environment file and adjust if needed:
+1. Copy the environment file and set the JWT secret:
 
    ```bash
    cp .env.example .env
+   # Edit .env and set SIGNOZ_JWT_SECRET to a random string
    ```
 
-2. Create required configuration files:
-
-   ```bash
-   mkdir -p query-service frontend
-   # Download or create configuration files as needed
-   ```
-
-3. Start the services:
+2. Start the services:
 
    ```bash
    docker compose up -d
    ```
 
-4. Access SigNoz UI at `http://localhost:3301`
+3. Access SigNoz UI at `http://localhost:8080`
+
+> **Note**: On first start, `init-clickhouse` must download a binary from GitHub (~10 MB). Ensure internet access is available.
 
 ## Default Ports
 
 | Service               | Port | Description          |
 | --------------------- | ---- | -------------------- |
-| Frontend UI           | 3301 | SigNoz web interface |
+| SigNoz UI             | 8080 | SigNoz web interface |
 | OTel Collector (gRPC) | 4317 | OTLP gRPC receiver   |
 | OTel Collector (HTTP) | 4318 | OTLP HTTP receiver   |
 
 ## Configuration
 
-### Environment Variables
+### Key Environment Variables
 
-Key environment variables (see `.env.example` for complete list):
+| Variable                         | Default                     | Description                                    |
+| -------------------------------- | --------------------------- | ---------------------------------------------- |
+| `SIGNOZ_JWT_SECRET`              | `please-change-this-secret` | JWT secret for token signing — **change this** |
+| `SIGNOZ_PORT_OVERRIDE`           | `8080`                      | SigNoz UI host port                            |
+| `SIGNOZ_OTEL_GRPC_PORT_OVERRIDE` | `4317`                      | OTLP gRPC receiver host port                   |
+| `SIGNOZ_OTEL_HTTP_PORT_OVERRIDE` | `4318`                      | OTLP HTTP receiver host port                   |
+| `SIGNOZ_VERSION`                 | `v0.118.0`                  | SigNoz image version                           |
+| `SIGNOZ_OTEL_COLLECTOR_VERSION`  | `v0.144.2`                  | OTel Collector image version                   |
+| `SIGNOZ_CLICKHOUSE_VERSION`      | `25.5.6`                    | ClickHouse image version                       |
+| `TZ`                             | `UTC`                       | Timezone                                       |
 
-- `SIGNOZ_PORT_OVERRIDE`: Frontend UI port (default: 3301)
-- `SIGNOZ_OTEL_GRPC_PORT_OVERRIDE`: OTLP gRPC receiver port (default: 4317)
-- `SIGNOZ_OTEL_HTTP_PORT_OVERRIDE`: OTLP HTTP receiver port (default: 4318)
-- `SIGNOZ_CLICKHOUSE_VERSION`: ClickHouse version
-- `SIGNOZ_QUERY_SERVICE_VERSION`: Query service version
-- `SIGNOZ_FRONTEND_VERSION`: Frontend version
-
-### Required Configuration Files
-
-This setup requires several configuration files:
-
-1. **clickhouse-config.xml**: ClickHouse server configuration
-2. **clickhouse-users.xml**: ClickHouse user configuration
-3. **otel-collector-config.yaml**: OTel Collector pipeline configuration
-4. **query-service/prometheus.yml**: Query service Prometheus configuration
-5. **frontend/nginx-config.conf**: Nginx configuration for frontend
-
-You can obtain these files from the [official SigNoz repository](https://github.com/SigNoz/signoz/tree/main/deploy/docker/clickhouse-setup).
+See `.env.example` for the complete list including resource limits.
 
 ### Sending Telemetry Data
 
-To send telemetry data to SigNoz, configure your application to use OpenTelemetry with the following endpoints:
+Configure your application's OpenTelemetry SDK to export to:
 
-- **gRPC**: `localhost:4317`
-- **HTTP**: `localhost:4318`
-
-Example for Node.js:
-
-```javascript
-const { OTLPTraceExporter } = require('@opentelemetry/exporter-trace-otlp-grpc')
-const { NodeTracerProvider } = require('@opentelemetry/sdk-trace-node')
-
-const exporter = new OTLPTraceExporter({
-  url: 'http://localhost:4317',
-})
-```
+- **gRPC**: `http://localhost:4317`
+- **HTTP**: `http://localhost:4318`
 
 ## Architecture
 
-SigNoz consists of the following components:
+```text
+User → SigNoz UI (8080) → signoz backend
+              ↓
+App  → OTel Collector (4317/4318) → ClickHouse
+                                         ↑
+                          Zookeeper (replication metadata)
+```
 
-1. **ClickHouse**: Time-series database for storing traces, metrics, and logs
-2. **OTel Collector**: Receives, processes, and exports telemetry data
-3. **Query Service**: Queries data from ClickHouse
-4. **Frontend**: Web UI for visualization and analysis
-5. **Alert Manager**: Manages and sends alerts
+Startup order:
 
-## Resource Requirements
+1. `init-clickhouse` downloads histogramQuantile binary → `zookeeper-1` starts
+2. `clickhouse` starts (after init completes and zookeeper is healthy)
+3. `signoz-telemetrystore-migrator` runs schema migrations
+4. `signoz` and `otel-collector` start
 
-Minimum recommended resources:
-
-- **CPU**: 4 cores
-- **Memory**: 8GB RAM
-- **Storage**: 20GB for data
 
 ## Data Persistence
 
-Data is persisted in Docker volumes:
+Data is persisted in Docker named volumes:
 
-- `clickhouse_data`: ClickHouse database files
-- `signoz_data`: SigNoz application data
-- `alertmanager_data`: Alert manager data
+| Volume                    | Contents                              |
+| ------------------------- | ------------------------------------- |
+| `clickhouse_data`         | ClickHouse database files             |
+| `clickhouse_user_scripts` | histogramQuantile UDF binary          |
+| `signoz_data`             | SigNoz SQLite DB and application data |
+| `zookeeper_data`          | ZooKeeper state                       |
 
 ## Security Considerations
 
-- Change default credentials if applicable
-- Use environment variables for sensitive configuration
-- Consider using secrets management for production deployments
-- Restrict network access to necessary ports only
-- Enable authentication for production use
-
-## Healthchecks
-
-All services include healthchecks to ensure proper startup and dependency management:
-
-- ClickHouse: HTTP health endpoint
-- OTel Collector: HTTP health endpoint
-- Query Service: HTTP health endpoint
-- Frontend: HTTP health endpoint
-- Alert Manager: HTTP health endpoint
+- **Change `SIGNOZ_JWT_SECRET`** to a unique random value before production use
+- Restrict port exposure to trusted networks in production
+- Run behind a reverse proxy with TLS termination for production
 
 ## Troubleshooting
 
-1. **Services not starting**: Check logs with `docker compose logs`
-2. **No data visible**: Verify OTel Collector configuration and application instrumentation
-3. **High memory usage**: Adjust ClickHouse memory limits or data retention policies
-
-## License
-
-SigNoz is licensed under the MIT License. See the [official repository](https://github.com/SigNoz/signoz) for more details.
+1. **Services not starting**: `docker compose logs` — check for connection errors
+2. **init-clickhouse fails**: No internet access — the UDF binary cannot be downloaded
+3. **otel-collector unhealthy**: May be waiting for migrations to settle; check with `docker compose logs signoz-telemetrystore-migrator`
+4. **No data visible**: Verify OTel Collector configuration and application instrumentation
 
 ## References
 
diff --git a/src/signoz/README.zh.md b/src/signoz/README.zh.md
index c1f7aa7..60a9670 100644
--- a/src/signoz/README.zh.md
+++ b/src/signoz/README.zh.md
@@ -13,133 +13,108 @@ SigNoz 是一个开源的可观测性平台，为分布式应用程序提供监
 - **告警**：基于指标和追踪配置告警
 - **OpenTelemetry 原生**：构建在 OpenTelemetry 标准之上
 
+## 服务列表
+
+| 服务                             | 镜像                                  | 描述                                     |
+| -------------------------------- | ------------------------------------- | ---------------------------------------- |
+| `signoz`                         | signoz/signoz:v0.118.0                | 后端、前端 UI 和告警管理器的合体镜像     |
+| `otel-collector`                 | signoz/signoz-otel-collector:v0.144.2 | 接收、处理和导出遥测数据                 |
+| `clickhouse`                     | clickhouse/clickhouse-server:25.5.6   | 存储追踪、指标和日志的时序数据库         |
+| `zookeeper-1`                    | signoz/zookeeper:3.7.1                | ZooKeeper，用于 ClickHouse 副本元数据    |
+| `init-clickhouse`                | clickhouse/clickhouse-server:25.5.6   | 一次性初始化，下载 histogramQuantile UDF |
+| `signoz-telemetrystore-migrator` | signoz/signoz-otel-collector:v0.144.2 | 一次性 ClickHouse Schema 迁移            |
+
 ## 快速开始
 
-1. 复制环境文件并根据需要调整：
+1. 复制环境文件并设置 JWT 密钥：
 
    ```bash
    cp .env.example .env
+   # 编辑 .env，将 SIGNOZ_JWT_SECRET 设置为随机字符串
    ```
 
-2. 创建所需的配置文件：
-
-   ```bash
-   mkdir -p query-service frontend
-   # 根据需要下载或创建配置文件
-   ```
-
-3. 启动服务：
+2. 启动服务：
 
    ```bash
    docker compose up -d
    ```
 
-4. 访问 SigNoz UI：`http://localhost:3301`
+3. 访问 SigNoz UI：`http://localhost:8080`
+
+> **注意**：首次启动时，`init-clickhouse` 需要从 GitHub 下载约 10 MB 的二进制文件，请确保网络可访问。
 
 ## 默认端口
 
 | 服务                  | 端口 | 描述             |
 | --------------------- | ---- | ---------------- |
-| Frontend UI           | 3301 | SigNoz Web 界面  |
+| SigNoz UI             | 8080 | SigNoz Web 界面  |
 | OTel Collector (gRPC) | 4317 | OTLP gRPC 接收器 |
 | OTel Collector (HTTP) | 4318 | OTLP HTTP 接收器 |
 
 ## 配置说明
 
-### 环境变量
+### 主要环境变量
 
-主要环境变量（完整列表请查看 `.env.example`）：
+| 变量                             | 默认值                      | 描述                                |
+| -------------------------------- | --------------------------- | ----------------------------------- |
+| `SIGNOZ_JWT_SECRET`              | `please-change-this-secret` | JWT 签名密钥 — **生产环境必须修改** |
+| `SIGNOZ_PORT_OVERRIDE`           | `8080`                      | SigNoz UI 宿主机端口                |
+| `SIGNOZ_OTEL_GRPC_PORT_OVERRIDE` | `4317`                      | OTLP gRPC 接收器宿主机端口          |
+| `SIGNOZ_OTEL_HTTP_PORT_OVERRIDE` | `4318`                      | OTLP HTTP 接收器宿主机端口          |
+| `SIGNOZ_VERSION`                 | `v0.118.0`                  | SigNoz 镜像版本                     |
+| `SIGNOZ_OTEL_COLLECTOR_VERSION`  | `v0.144.2`                  | OTel Collector 镜像版本             |
+| `SIGNOZ_CLICKHOUSE_VERSION`      | `25.5.6`                    | ClickHouse 镜像版本                 |
+| `TZ`                             | `UTC`                       | 时区                                |
 
-- `SIGNOZ_PORT_OVERRIDE`：前端 UI 端口（默认：3301）
-- `SIGNOZ_OTEL_GRPC_PORT_OVERRIDE`：OTLP gRPC 接收器端口（默认：4317）
-- `SIGNOZ_OTEL_HTTP_PORT_OVERRIDE`：OTLP HTTP 接收器端口（默认：4318）
-- `SIGNOZ_CLICKHOUSE_VERSION`：ClickHouse 版本
-- `SIGNOZ_QUERY_SERVICE_VERSION`：查询服务版本
-- `SIGNOZ_FRONTEND_VERSION`：前端版本
-
-### 必需的配置文件
-
-此设置需要以下配置文件：
-
-1. **clickhouse-config.xml**：ClickHouse 服务器配置
-2. **clickhouse-users.xml**：ClickHouse 用户配置
-3. **otel-collector-config.yaml**：OTel Collector 管道配置
-4. **query-service/prometheus.yml**：查询服务 Prometheus 配置
-5. **frontend/nginx-config.conf**：前端 Nginx 配置
-
-您可以从 [SigNoz 官方仓库](https://github.com/SigNoz/signoz/tree/main/deploy/docker/clickhouse-setup) 获取这些文件。
+完整变量列表（含资源限制）请查看 `.env.example`。
 
 ### 发送遥测数据
 
-要向 SigNoz 发送遥测数据，请配置您的应用程序使用 OpenTelemetry 并使用以下端点：
+将应用程序的 OpenTelemetry SDK 配置为向以下端点导出数据：
 
-- **gRPC**：`localhost:4317`
-- **HTTP**：`localhost:4318`
-
-Node.js 示例：
-
-```javascript
-const { OTLPTraceExporter } = require('@opentelemetry/exporter-trace-otlp-grpc')
-const { NodeTracerProvider } = require('@opentelemetry/sdk-trace-node')
-
-const exporter = new OTLPTraceExporter({
-  url: 'http://localhost:4317',
-})
-```
+- **gRPC**：`http://localhost:4317`
+- **HTTP**：`http://localhost:4318`
 
 ## 架构说明
 
-SigNoz 由以下组件组成：
+```text
+用户 → SigNoz UI（8080）→ signoz 后端
+                  ↓
+应用 → OTel Collector（4317/4318）→ ClickHouse
+                                          ↑
+                             Zookeeper（副本元数据）
+```
 
-1. **ClickHouse**：用于存储追踪、指标和日志的时序数据库
-2. **OTel Collector**：接收、处理和导出遥测数据
-3. **Query Service**：从 ClickHouse 查询数据
-4. **Frontend**：用于可视化和分析的 Web UI
-5. **Alert Manager**：管理和发送告警
+启动顺序：
 
-## 资源需求
-
-最低推荐资源：
-
-- **CPU**：4 核
-- **内存**：8GB RAM
-- **存储**：20GB 数据存储空间
+1. `init-clickhouse` 下载 histogramQuantile 二进制文件，`zookeeper-1` 同步启动
+2. `clickhouse` 在初始化完成且 ZooKeeper 健康后启动
+3. `signoz-telemetrystore-migrator` 执行 Schema 迁移
+4. `signoz` 和 `otel-collector` 启动
 
 ## 数据持久化
 
-数据持久化在 Docker 卷中：
+数据持久化在 Docker 命名卷中：
 
-- `clickhouse_data`：ClickHouse 数据库文件
-- `signoz_data`：SigNoz 应用程序数据
-- `alertmanager_data`：告警管理器数据
+| 卷名                      | 内容                           |
+| ------------------------- | ------------------------------ |
+| `clickhouse_data`         | ClickHouse 数据库文件          |
+| `clickhouse_user_scripts` | histogramQuantile UDF 二进制   |
+| `signoz_data`             | SigNoz SQLite 数据库及应用数据 |
+| `zookeeper_data`          | ZooKeeper 状态数据             |
 
 ## 安全注意事项
 
-- 如适用，请更改默认凭据
-- 使用环境变量配置敏感信息
-- 生产环境部署时考虑使用密钥管理
-- 仅限制必要端口的网络访问
-- 生产环境请启用身份验证
-
-## 健康检查
-
-所有服务都包含健康检查以确保正确启动和依赖管理：
-
-- ClickHouse：HTTP 健康端点
-- OTel Collector：HTTP 健康端点
-- Query Service：HTTP 健康端点
-- Frontend：HTTP 健康端点
-- Alert Manager：HTTP 健康端点
+- **生产环境必须将 `SIGNOZ_JWT_SECRET` 修改为唯一的随机值**
+- 生产环境中限制端口仅对可信网络暴露
+- 生产环境建议在反向代理后面启用 TLS 终止
 
 ## 故障排查
 
-1. **服务未启动**：使用 `docker compose logs` 检查日志
-2. **无数据显示**：验证 OTel Collector 配置和应用程序仪器化
-3. **内存使用过高**：调整 ClickHouse 内存限制或数据保留策略
-
-## 许可证
-
-SigNoz 采用 MIT 许可证。详情请参阅 [官方仓库](https://github.com/SigNoz/signoz)。
+1. **服务未启动**：运行 `docker compose logs` 检查连接错误
+2. **init-clickhouse 失败**：没有网络访问权限，无法下载 UDF 二进制文件
+3. **otel-collector 不健康**：可能正在等待迁移完成，通过 `docker compose logs signoz-telemetrystore-migrator` 检查
+4. **无数据显示**：验证 OTel Collector 配置和应用程序的 OpenTelemetry 仪器化
 
 ## 参考资料
 
diff --git a/src/signoz/clickhouse/cluster.xml b/src/signoz/clickhouse/cluster.xml
new file mode 100644
index 0000000..8b475ff
--- /dev/null
+++ b/src/signoz/clickhouse/cluster.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0"?>
+<clickhouse>
+    <!-- ZooKeeper is used to store metadata about replicas, when using Replicated tables.
+         Optional. If you don't use replicated tables, you could omit that.
+
+         See https://clickhouse.com/docs/en/engines/table-engines/mergetree-family/replication/
+      -->
+    <zookeeper>
+        <node index="1">
+            <host>zookeeper-1</host>
+            <port>2181</port>
+        </node>
+        <!-- <node index="2">
+            <host>zookeeper-2</host>
+            <port>2181</port>
+        </node>
+        <node index="3">
+            <host>zookeeper-3</host>
+            <port>2181</port>
+        </node> -->
+    </zookeeper>
+
+    <!-- Configuration of clusters that could be used in Distributed tables.
+         https://clickhouse.com/docs/en/operations/table_engines/distributed/
+      -->
+    <remote_servers>
+        <cluster>
+            <!-- Inter-server per-cluster secret for Distributed queries
+                 default: no secret (no authentication will be performed)
+
+                 If set, then Distributed queries will be validated on shards, so at least:
+                 - such cluster should exist on the shard,
+                 - such cluster should have the same secret.
+
+                 And also (and which is more important), the initial_user will
+                 be used as current user for the query.
+
+                 Right now the protocol is pretty simple and it only takes into account:
+                 - cluster name
+                 - query
+
+                 Also it will be nice if the following will be implemented:
+                 - source hostname (see interserver_http_host), but then it will depends from DNS,
+                   it can use IP address instead, but then the you need to get correct on the initiator node.
+                 - target hostname / ip address (same notes as for source hostname)
+                 - time-based security tokens
+            -->
+            <!-- <secret></secret> -->
+            <shard>
+                <!-- Optional. Whether to write data to just one of the replicas. Default: false (write data to all replicas). -->
+                <!-- <internal_replication>false</internal_replication> -->
+                <!-- Optional. Shard weight when writing data. Default: 1. -->
+                <!-- <weight>1</weight> -->
+                <replica>
+                    <host>clickhouse</host>
+                    <port>9000</port>
+                    <!-- Optional. Priority of the replica for load_balancing. Default: 1 (less value has more priority). -->
+                    <!-- <priority>1</priority> -->
+                </replica>
+            </shard>
+            <!-- <shard>
+                <replica>
+                    <host>clickhouse-2</host>
+                    <port>9000</port>
+                </replica>
+            </shard>
+            <shard>
+                <replica>
+                    <host>clickhouse-3</host>
+                    <port>9000</port>
+                </replica>
+            </shard> -->
+        </cluster>
+    </remote_servers>
+</clickhouse>
diff --git a/src/signoz/clickhouse/config.xml b/src/signoz/clickhouse/config.xml
new file mode 100644
index 0000000..1965ac3
--- /dev/null
+++ b/src/signoz/clickhouse/config.xml
@@ -0,0 +1,1142 @@
+<?xml version="1.0"?>
+<!--
+  NOTE: User and query level settings are set up in "users.xml" file.
+  If you have accidentally specified user-level settings here, server won't start.
+  You can either move the settings to the right place inside "users.xml" file
+   or add <skip_check_for_incorrect_settings>1</skip_check_for_incorrect_settings> here.
+-->
+<clickhouse>
+    <logger>
+        <!-- Possible levels [1]:
+
+          - none (turns off logging)
+          - fatal
+          - critical
+          - error
+          - warning
+          - notice
+          - information
+          - debug
+          - trace
+          - test (not for production usage)
+
+            [1]: https://github.com/pocoproject/poco/blob/poco-1.9.4-release/Foundation/include/Poco/Logger.h#L105-L114
+        -->
+        <level>information</level>
+        <formatting>
+            <type>json</type>
+        </formatting>
+        <log>/var/log/clickhouse-server/clickhouse-server.log</log>
+        <errorlog>/var/log/clickhouse-server/clickhouse-server.err.log</errorlog>
+        <!-- Rotation policy
+             See https://github.com/pocoproject/poco/blob/poco-1.9.4-release/Foundation/include/Poco/FileChannel.h#L54-L85
+          -->
+        <size>1000M</size>
+        <count>10</count>
+        <!-- <console>1</console> --> <!-- Default behavior is autodetection (log to console if not daemon mode and is tty) -->
+
+        <!-- Per level overrides (legacy):
+
+        For example to suppress logging of the ConfigReloader you can use:
+        NOTE: levels.logger is reserved, see below.
+        -->
+        <!--
+        <levels>
+          <ConfigReloader>none</ConfigReloader>
+        </levels>
+        -->
+
+        <!-- Per level overrides:
+
+        For example to suppress logging of the RBAC for default user you can use:
+        (But please note that the logger name maybe changed from version to version, even after minor upgrade)
+        -->
+        <!--
+        <levels>
+          <logger>
+            <name>ContextAccess (default)</name>
+            <level>none</level>
+          </logger>
+          <logger>
+            <name>DatabaseOrdinary (test)</name>
+            <level>none</level>
+          </logger>
+        </levels>
+        -->
+    </logger>
+
+    <!-- Add headers to response in options request. OPTIONS method is used in CORS preflight requests. -->
+    <!-- It is off by default. Next headers are obligate for CORS.-->
+    <!-- http_options_response>
+        <header>
+            <name>Access-Control-Allow-Origin</name>
+            <value>*</value>
+        </header>
+        <header>
+            <name>Access-Control-Allow-Headers</name>
+            <value>origin, x-requested-with</value>
+        </header>
+        <header>
+            <name>Access-Control-Allow-Methods</name>
+            <value>POST, GET, OPTIONS</value>
+        </header>
+        <header>
+            <name>Access-Control-Max-Age</name>
+            <value>86400</value>
+        </header>
+    </http_options_response -->
+
+    <!-- It is the name that will be shown in the clickhouse-client.
+         By default, anything with "production" will be highlighted in red in query prompt.
+    -->
+    <!--display_name>production</display_name-->
+
+    <!-- Port for HTTP API. See also 'https_port' for secure connections.
+         This interface is also used by ODBC and JDBC drivers (DataGrip, Dbeaver, ...)
+         and by most of web interfaces (embedded UI, Grafana, Redash, ...).
+      -->
+    <http_port>8123</http_port>
+
+    <!-- Port for interaction by native protocol with:
+         - clickhouse-client and other native ClickHouse tools (clickhouse-benchmark, clickhouse-copier);
+         - clickhouse-server with other clickhouse-servers for distributed query processing;
+         - ClickHouse drivers and applications supporting native protocol
+         (this protocol is also informally called as "the TCP protocol");
+         See also 'tcp_port_secure' for secure connections.
+    -->
+    <tcp_port>9000</tcp_port>
+
+    <!-- Compatibility with MySQL protocol.
+         ClickHouse will pretend to be MySQL for applications connecting to this port.
+    -->
+    <mysql_port>9004</mysql_port>
+
+    <!-- Compatibility with PostgreSQL protocol.
+         ClickHouse will pretend to be PostgreSQL for applications connecting to this port.
+    -->
+    <postgresql_port>9005</postgresql_port>
+
+    <!-- HTTP API with TLS (HTTPS).
+         You have to configure certificate to enable this interface.
+         See the openSSL section below.
+    -->
+    <!-- <https_port>8443</https_port> -->
+
+    <!-- Native interface with TLS.
+         You have to configure certificate to enable this interface.
+         See the openSSL section below.
+    -->
+    <!-- <tcp_port_secure>9440</tcp_port_secure> -->
+
+    <!-- Native interface wrapped with PROXYv1 protocol
+         PROXYv1 header sent for every connection.
+         ClickHouse will extract information about proxy-forwarded client address from the header.
+    -->
+    <!-- <tcp_with_proxy_port>9011</tcp_with_proxy_port> -->
+
+    <!-- Port for communication between replicas. Used for data exchange.
+         It provides low-level data access between servers.
+         This port should not be accessible from untrusted networks.
+         See also 'interserver_http_credentials'.
+         Data transferred over connections to this port should not go through untrusted networks.
+         See also 'interserver_https_port'.
+      -->
+    <interserver_http_port>9009</interserver_http_port>
+
+    <!-- Port for communication between replicas with TLS.
+         You have to configure certificate to enable this interface.
+         See the openSSL section below.
+         See also 'interserver_http_credentials'.
+      -->
+    <!-- <interserver_https_port>9010</interserver_https_port> -->
+
+    <!-- Hostname that is used by other replicas to request this server.
+         If not specified, then it is determined analogous to 'hostname -f' command.
+         This setting could be used to switch replication to another network interface
+         (the server may be connected to multiple networks via multiple addresses)
+      -->
+
+    <!--
+    <interserver_http_host>example.clickhouse.com</interserver_http_host>
+    -->
+
+    <!-- You can specify credentials for authenthication between replicas.
+         This is required when interserver_https_port is accessible from untrusted networks,
+         and also recommended to avoid SSRF attacks from possibly compromised services in your network.
+      -->
+    <!--<interserver_http_credentials>
+        <user>interserver</user>
+        <password></password>
+    </interserver_http_credentials>-->
+
+    <!-- Listen specified address.
+         Use :: (wildcard IPv6 address), if you want to accept connections both with IPv4 and IPv6 from everywhere.
+         Notes:
+         If you open connections from wildcard address, make sure that at least one of the following measures applied:
+         - server is protected by firewall and not accessible from untrusted networks;
+         - all users are restricted to subset of network addresses (see users.xml);
+         - all users have strong passwords, only secure (TLS) interfaces are accessible, or connections are only made via TLS interfaces.
+         - users without password have readonly access.
+         See also: https://www.shodan.io/search?query=clickhouse
+      -->
+    <!-- <listen_host>::</listen_host> -->
+
+
+    <!-- Same for hosts without support for IPv6: -->
+    <!-- <listen_host>0.0.0.0</listen_host> -->
+
+    <!-- Default values - try listen localhost on IPv4 and IPv6. -->
+    <!--
+    <listen_host>::1</listen_host>
+    <listen_host>127.0.0.1</listen_host>
+    -->
+
+    <!-- Don't exit if IPv6 or IPv4 networks are unavailable while trying to listen. -->
+    <!-- <listen_try>0</listen_try> -->
+
+    <!-- Allow multiple servers to listen on the same address:port. This is not recommended.
+      -->
+    <!-- <listen_reuse_port>0</listen_reuse_port> -->
+
+    <!-- <listen_backlog>4096</listen_backlog> -->
+
+    <max_connections>4096</max_connections>
+
+    <!-- For 'Connection: keep-alive' in HTTP 1.1 -->
+    <keep_alive_timeout>3</keep_alive_timeout>
+
+    <!-- gRPC protocol (see src/Server/grpc_protos/clickhouse_grpc.proto for the API) -->
+    <!-- <grpc_port>9100</grpc_port> -->
+    <grpc>
+        <enable_ssl>false</enable_ssl>
+
+        <!-- The following two files are used only if enable_ssl=1 -->
+        <ssl_cert_file>/path/to/ssl_cert_file</ssl_cert_file>
+        <ssl_key_file>/path/to/ssl_key_file</ssl_key_file>
+
+        <!-- Whether server will request client for a certificate -->
+        <ssl_require_client_auth>false</ssl_require_client_auth>
+
+        <!-- The following file is used only if ssl_require_client_auth=1 -->
+        <ssl_ca_cert_file>/path/to/ssl_ca_cert_file</ssl_ca_cert_file>
+
+        <!-- Default transport compression type (can be overridden by client, see the transport_compression_type field in QueryInfo).
+             Supported algorithms: none, deflate, gzip, stream_gzip -->
+        <transport_compression_type>none</transport_compression_type>
+
+        <!-- Default transport compression level. Supported levels: 0..3 -->
+        <transport_compression_level>0</transport_compression_level>
+
+        <!-- Send/receive message size limits in bytes. -1 means unlimited -->
+        <max_send_message_size>-1</max_send_message_size>
+        <max_receive_message_size>-1</max_receive_message_size>
+
+        <!-- Enable if you want very detailed logs -->
+        <verbose_logs>false</verbose_logs>
+    </grpc>
+
+    <!-- Used with https_port and tcp_port_secure. Full ssl options list: https://github.com/ClickHouse-Extras/poco/blob/master/NetSSL_OpenSSL/include/Poco/Net/SSLManager.h#L71 -->
+    <openSSL>
+        <server> <!-- Used for https server AND secure tcp port -->
+            <!-- openssl req -subj "/CN=localhost" -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout /etc/clickhouse-server/server.key -out /etc/clickhouse-server/server.crt -->
+            <!-- <certificateFile>/etc/clickhouse-server/server.crt</certificateFile> -->
+            <!-- <privateKeyFile>/etc/clickhouse-server/server.key</privateKeyFile> -->
+            <!-- dhparams are optional. You can delete the <dhParamsFile> element.
+                 To generate dhparams, use the following command:
+                  openssl dhparam -out /etc/clickhouse-server/dhparam.pem 4096
+                 Only file format with BEGIN DH PARAMETERS is supported.
+              -->
+            <!-- <dhParamsFile>/etc/clickhouse-server/dhparam.pem</dhParamsFile>-->
+            <verificationMode>none</verificationMode>
+            <loadDefaultCAFile>true</loadDefaultCAFile>
+            <cacheSessions>true</cacheSessions>
+            <disableProtocols>sslv2,sslv3</disableProtocols>
+            <preferServerCiphers>true</preferServerCiphers>
+        </server>
+
+        <client> <!-- Used for connecting to https dictionary source and secured Zookeeper communication -->
+            <loadDefaultCAFile>true</loadDefaultCAFile>
+            <cacheSessions>true</cacheSessions>
+            <disableProtocols>sslv2,sslv3</disableProtocols>
+            <preferServerCiphers>true</preferServerCiphers>
+            <!-- Use for self-signed: <verificationMode>none</verificationMode> -->
+            <invalidCertificateHandler>
+                <!-- Use for self-signed: <name>AcceptCertificateHandler</name> -->
+                <name>RejectCertificateHandler</name>
+            </invalidCertificateHandler>
+        </client>
+    </openSSL>
+
+    <!-- Default root page on http[s] server. For example load UI from https://tabix.io/ when opening http://localhost:8123 -->
+    <!--
+    <http_server_default_response><![CDATA[<html ng-app="SMI2"><head><base href="http://ui.tabix.io/"></head><body><div ui-view="" class="content-ui"></div><script src="http://loader.tabix.io/master.js"></script></body></html>]]></http_server_default_response>
+    -->
+
+    <!-- Maximum number of concurrent queries. -->
+    <max_concurrent_queries>100</max_concurrent_queries>
+
+    <!-- Maximum memory usage (resident set size) for server process.
+         Zero value or unset means default. Default is "max_server_memory_usage_to_ram_ratio" of available physical RAM.
+         If the value is larger than "max_server_memory_usage_to_ram_ratio" of available physical RAM, it will be cut down.
+
+         The constraint is checked on query execution time.
+         If a query tries to allocate memory and the current memory usage plus allocation is greater
+          than specified threshold, exception will be thrown.
+
+         It is not practical to set this constraint to small values like just a few gigabytes,
+          because memory allocator will keep this amount of memory in caches and the server will deny service of queries.
+      -->
+    <max_server_memory_usage>0</max_server_memory_usage>
+
+    <!-- Maximum number of threads in the Global thread pool.
+    This will default to a maximum of 10000 threads if not specified.
+    This setting will be useful in scenarios where there are a large number
+    of distributed queries that are running concurrently but are idling most
+    of the time, in which case a higher number of threads might be required.
+    -->
+
+    <max_thread_pool_size>10000</max_thread_pool_size>
+
+    <!-- Number of workers to recycle connections in background (see also drain_timeout).
+         If the pool is full, connection will be drained synchronously. -->
+    <!-- <max_threads_for_connection_collector>10</max_threads_for_connection_collector> -->
+
+    <!-- On memory constrained environments you may have to set this to value larger than 1.
+      -->
+    <max_server_memory_usage_to_ram_ratio>0.9</max_server_memory_usage_to_ram_ratio>
+
+    <!-- Simple server-wide memory profiler. Collect a stack trace at every peak allocation step (in bytes).
+         Data will be stored in system.trace_log table with query_id = empty string.
+         Zero means disabled.
+      -->
+    <total_memory_profiler_step>4194304</total_memory_profiler_step>
+
+    <!-- Collect random allocations and deallocations and write them into system.trace_log with 'MemorySample' trace_type.
+         The probability is for every alloc/free regardless to the size of the allocation.
+         Note that sampling happens only when the amount of untracked memory exceeds the untracked memory limit,
+          which is 4 MiB by default but can be lowered if 'total_memory_profiler_step' is lowered.
+         You may want to set 'total_memory_profiler_step' to 1 for extra fine grained sampling.
+      -->
+    <total_memory_tracker_sample_probability>0</total_memory_tracker_sample_probability>
+
+    <!-- Set limit on number of open files (default: maximum). This setting makes sense on Mac OS X because getrlimit() fails to retrieve
+         correct maximum value. -->
+    <!-- <max_open_files>262144</max_open_files> -->
+
+    <!-- Size of cache of uncompressed blocks of data, used in tables of MergeTree family.
+         In bytes. Cache is single for server. Memory is allocated only on demand.
+         Cache is used when 'use_uncompressed_cache' user setting turned on (off by default).
+         Uncompressed cache is advantageous only for very short queries and in rare cases.
+
+         Note: uncompressed cache can be pointless for lz4, because memory bandwidth
+         is slower than multi-core decompression on some server configurations.
+         Enabling it can sometimes paradoxically make queries slower.
+      -->
+    <uncompressed_cache_size>8589934592</uncompressed_cache_size>
+
+    <!-- Approximate size of mark cache, used in tables of MergeTree family.
+         In bytes. Cache is single for server. Memory is allocated only on demand.
+         You should not lower this value.
+      -->
+    <mark_cache_size>5368709120</mark_cache_size>
+
+
+    <!-- If you enable the `min_bytes_to_use_mmap_io` setting,
+         the data in MergeTree tables can be read with mmap to avoid copying from kernel to userspace.
+         It makes sense only for large files and helps only if data reside in page cache.
+         To avoid frequent open/mmap/munmap/close calls (which are very expensive due to consequent page faults)
+         and to reuse mappings from several threads and queries,
+         the cache of mapped files is maintained. Its size is the number of mapped regions (usually equal to the number of mapped files).
+         The amount of data in mapped files can be monitored
+         in system.metrics, system.metric_log by the MMappedFiles, MMappedFileBytes metrics
+         and in system.asynchronous_metrics, system.asynchronous_metrics_log by the MMapCacheCells metric,
+         and also in system.events, system.processes, system.query_log, system.query_thread_log, system.query_views_log by the
+         CreatedReadBufferMMap, CreatedReadBufferMMapFailed, MMappedFileCacheHits, MMappedFileCacheMisses events.
+         Note that the amount of data in mapped files does not consume memory directly and is not accounted
+         in query or server memory usage - because this memory can be discarded similar to OS page cache.
+         The cache is dropped (the files are closed) automatically on removal of old parts in MergeTree,
+         also it can be dropped manually by the SYSTEM DROP MMAP CACHE query.
+      -->
+    <mmap_cache_size>1000</mmap_cache_size>
+
+    <!-- Cache size in bytes for compiled expressions.-->
+    <compiled_expression_cache_size>134217728</compiled_expression_cache_size>
+
+    <!-- Cache size in elements for compiled expressions.-->
+    <compiled_expression_cache_elements_size>10000</compiled_expression_cache_elements_size>
+
+    <!-- Path to data directory, with trailing slash. -->
+    <path>/var/lib/clickhouse/</path>
+
+    <!-- Path to temporary data for processing hard queries. -->
+    <tmp_path>/var/lib/clickhouse/tmp/</tmp_path>
+
+    <!-- Disable AuthType plaintext_password and no_password for ACL. -->
+    <!-- <allow_plaintext_password>0</allow_plaintext_password> -->
+    <!-- <allow_no_password>0</allow_no_password> -->`
+
+    <!-- Policy from the <storage_configuration> for the temporary files.
+         If not set <tmp_path> is used, otherwise <tmp_path> is ignored.
+
+         Notes:
+         - move_factor              is ignored
+         - keep_free_space_bytes    is ignored
+         - max_data_part_size_bytes is ignored
+         - you must have exactly one volume in that policy
+    -->
+    <!-- <tmp_policy>tmp</tmp_policy> -->
+
+    <!-- Directory with user provided files that are accessible by 'file' table function. -->
+    <user_files_path>/var/lib/clickhouse/user_files/</user_files_path>
+
+    <!-- LDAP server definitions. -->
+    <ldap_servers>
+        <!-- List LDAP servers with their connection parameters here to later 1) use them as authenticators for dedicated local users,
+              who have 'ldap' authentication mechanism specified instead of 'password', or to 2) use them as remote user directories.
+             Parameters:
+                host - LDAP server hostname or IP, this parameter is mandatory and cannot be empty.
+                port - LDAP server port, default is 636 if enable_tls is set to true, 389 otherwise.
+                bind_dn - template used to construct the DN to bind to.
+                        The resulting DN will be constructed by replacing all '{user_name}' substrings of the template with the actual
+                         user name during each authentication attempt.
+                user_dn_detection - section with LDAP search parameters for detecting the actual user DN of the bound user.
+                        This is mainly used in search filters for further role mapping when the server is Active Directory. The
+                         resulting user DN will be used when replacing '{user_dn}' substrings wherever they are allowed. By default,
+                         user DN is set equal to bind DN, but once search is performed, it will be updated with to the actual detected
+                         user DN value.
+                    base_dn - template used to construct the base DN for the LDAP search.
+                            The resulting DN will be constructed by replacing all '{user_name}' and '{bind_dn}' substrings
+                             of the template with the actual user name and bind DN during the LDAP search.
+                    scope - scope of the LDAP search.
+                            Accepted values are: 'base', 'one_level', 'children', 'subtree' (the default).
+                    search_filter - template used to construct the search filter for the LDAP search.
+                            The resulting filter will be constructed by replacing all '{user_name}', '{bind_dn}', and '{base_dn}'
+                             substrings of the template with the actual user name, bind DN, and base DN during the LDAP search.
+                            Note, that the special characters must be escaped properly in XML.
+                verification_cooldown - a period of time, in seconds, after a successful bind attempt, during which a user will be assumed
+                         to be successfully authenticated for all consecutive requests without contacting the LDAP server.
+                        Specify 0 (the default) to disable caching and force contacting the LDAP server for each authentication request.
+                enable_tls - flag to trigger use of secure connection to the LDAP server.
+                        Specify 'no' for plain text (ldap://) protocol (not recommended).
+                        Specify 'yes' for LDAP over SSL/TLS (ldaps://) protocol (recommended, the default).
+                        Specify 'starttls' for legacy StartTLS protocol (plain text (ldap://) protocol, upgraded to TLS).
+                tls_minimum_protocol_version - the minimum protocol version of SSL/TLS.
+                        Accepted values are: 'ssl2', 'ssl3', 'tls1.0', 'tls1.1', 'tls1.2' (the default).
+                tls_require_cert - SSL/TLS peer certificate verification behavior.
+                        Accepted values are: 'never', 'allow', 'try', 'demand' (the default).
+                tls_cert_file - path to certificate file.
+                tls_key_file - path to certificate key file.
+                tls_ca_cert_file - path to CA certificate file.
+                tls_ca_cert_dir - path to the directory containing CA certificates.
+                tls_cipher_suite - allowed cipher suite (in OpenSSL notation).
+             Example:
+                <my_ldap_server>
+                    <host>localhost</host>
+                    <port>636</port>
+                    <bind_dn>uid={user_name},ou=users,dc=example,dc=com</bind_dn>
+                    <verification_cooldown>300</verification_cooldown>
+                    <enable_tls>yes</enable_tls>
+                    <tls_minimum_protocol_version>tls1.2</tls_minimum_protocol_version>
+                    <tls_require_cert>demand</tls_require_cert>
+                    <tls_cert_file>/path/to/tls_cert_file</tls_cert_file>
+                    <tls_key_file>/path/to/tls_key_file</tls_key_file>
+                    <tls_ca_cert_file>/path/to/tls_ca_cert_file</tls_ca_cert_file>
+                    <tls_ca_cert_dir>/path/to/tls_ca_cert_dir</tls_ca_cert_dir>
+                    <tls_cipher_suite>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:AES256-GCM-SHA384</tls_cipher_suite>
+                </my_ldap_server>
+             Example (typical Active Directory with configured user DN detection for further role mapping):
+                <my_ad_server>
+                    <host>localhost</host>
+                    <port>389</port>
+                    <bind_dn>EXAMPLE\{user_name}</bind_dn>
+                    <user_dn_detection>
+                        <base_dn>CN=Users,DC=example,DC=com</base_dn>
+                        <search_filter>(&amp;(objectClass=user)(sAMAccountName={user_name}))</search_filter>
+                    </user_dn_detection>
+                    <enable_tls>no</enable_tls>
+                </my_ad_server>
+        -->
+    </ldap_servers>
+
+    <!-- To enable Kerberos authentication support for HTTP requests (GSS-SPNEGO), for those users who are explicitly configured
+          to authenticate via Kerberos, define a single 'kerberos' section here.
+         Parameters:
+            principal - canonical service principal name, that will be acquired and used when accepting security contexts.
+                    This parameter is optional, if omitted, the default principal will be used.
+                    This parameter cannot be specified together with 'realm' parameter.
+            realm - a realm, that will be used to restrict authentication to only those requests whose initiator's realm matches it.
+                    This parameter is optional, if omitted, no additional filtering by realm will be applied.
+                    This parameter cannot be specified together with 'principal' parameter.
+         Example:
+            <kerberos />
+         Example:
+            <kerberos>
+                <principal>HTTP/clickhouse.example.com@EXAMPLE.COM</principal>
+            </kerberos>
+         Example:
+            <kerberos>
+                <realm>EXAMPLE.COM</realm>
+            </kerberos>
+    -->
+
+    <!-- Sources to read users, roles, access rights, profiles of settings, quotas. -->
+    <user_directories>
+        <users_xml>
+            <!-- Path to configuration file with predefined users. -->
+            <path>users.xml</path>
+        </users_xml>
+        <local_directory>
+            <!-- Path to folder where users created by SQL commands are stored. -->
+            <path>/var/lib/clickhouse/access/</path>
+        </local_directory>
+
+        <!-- To add an LDAP server as a remote user directory of users that are not defined locally, define a single 'ldap' section
+              with the following parameters:
+                server - one of LDAP server names defined in 'ldap_servers' config section above.
+                        This parameter is mandatory and cannot be empty.
+                roles - section with a list of locally defined roles that will be assigned to each user retrieved from the LDAP server.
+                        If no roles are specified here or assigned during role mapping (below), user will not be able to perform any
+                         actions after authentication.
+                role_mapping - section with LDAP search parameters and mapping rules.
+                        When a user authenticates, while still bound to LDAP, an LDAP search is performed using search_filter and the
+                         name of the logged in user. For each entry found during that search, the value of the specified attribute is
+                         extracted. For each attribute value that has the specified prefix, the prefix is removed, and the rest of the
+                         value becomes the name of a local role defined in ClickHouse, which is expected to be created beforehand by
+                         CREATE ROLE command.
+                        There can be multiple 'role_mapping' sections defined inside the same 'ldap' section. All of them will be
+                         applied.
+                    base_dn - template used to construct the base DN for the LDAP search.
+                            The resulting DN will be constructed by replacing all '{user_name}', '{bind_dn}', and '{user_dn}'
+                             substrings of the template with the actual user name, bind DN, and user DN during each LDAP search.
+                    scope - scope of the LDAP search.
+                            Accepted values are: 'base', 'one_level', 'children', 'subtree' (the default).
+                    search_filter - template used to construct the search filter for the LDAP search.
+                            The resulting filter will be constructed by replacing all '{user_name}', '{bind_dn}', '{user_dn}', and
+                             '{base_dn}' substrings of the template with the actual user name, bind DN, user DN, and base DN during
+                             each LDAP search.
+                            Note, that the special characters must be escaped properly in XML.
+                    attribute - attribute name whose values will be returned by the LDAP search. 'cn', by default.
+                    prefix - prefix, that will be expected to be in front of each string in the original list of strings returned by
+                             the LDAP search. Prefix will be removed from the original strings and resulting strings will be treated
+                             as local role names. Empty, by default.
+             Example:
+                <ldap>
+                    <server>my_ldap_server</server>
+                    <roles>
+                        <my_local_role1 />
+                        <my_local_role2 />
+                    </roles>
+                    <role_mapping>
+                        <base_dn>ou=groups,dc=example,dc=com</base_dn>
+                        <scope>subtree</scope>
+                        <search_filter>(&amp;(objectClass=groupOfNames)(member={bind_dn}))</search_filter>
+                        <attribute>cn</attribute>
+                        <prefix>clickhouse_</prefix>
+                    </role_mapping>
+                </ldap>
+             Example (typical Active Directory with role mapping that relies on the detected user DN):
+                <ldap>
+                    <server>my_ad_server</server>
+                    <role_mapping>
+                        <base_dn>CN=Users,DC=example,DC=com</base_dn>
+                        <attribute>CN</attribute>
+                        <scope>subtree</scope>
+                        <search_filter>(&amp;(objectClass=group)(member={user_dn}))</search_filter>
+                        <prefix>clickhouse_</prefix>
+                    </role_mapping>
+                </ldap>
+        -->
+    </user_directories>
+
+    <!-- Default profile of settings. -->
+    <default_profile>default</default_profile>
+
+    <!-- Comma-separated list of prefixes for user-defined settings. -->
+    <custom_settings_prefixes></custom_settings_prefixes>
+
+    <!-- System profile of settings. This settings are used by internal processes (Distributed DDL worker and so on). -->
+    <!-- <system_profile>default</system_profile> -->
+
+    <!-- Buffer profile of settings.
+         This settings are used by Buffer storage to flush data to the underlying table.
+         Default: used from system_profile directive.
+    -->
+    <!-- <buffer_profile>default</buffer_profile> -->
+
+    <!-- Default database. -->
+    <default_database>default</default_database>
+
+    <!-- Server time zone could be set here.
+
+         Time zone is used when converting between String and DateTime types,
+          when printing DateTime in text formats and parsing DateTime from text,
+          it is used in date and time related functions, if specific time zone was not passed as an argument.
+
+         Time zone is specified as identifier from IANA time zone database, like UTC or Africa/Abidjan.
+         If not specified, system time zone at server startup is used.
+
+         Please note, that server could display time zone alias instead of specified name.
+         Example: Zulu is an alias for UTC.
+    -->
+    <!-- <timezone>UTC</timezone> -->
+
+    <!-- You can specify umask here (see "man umask"). Server will apply it on startup.
+         Number is always parsed as octal. Default umask is 027 (other users cannot read logs, data files, etc; group can only read).
+    -->
+    <!-- <umask>022</umask> -->
+
+    <!-- Perform mlockall after startup to lower first queries latency
+          and to prevent clickhouse executable from being paged out under high IO load.
+         Enabling this option is recommended but will lead to increased startup time for up to a few seconds.
+    -->
+    <mlock_executable>true</mlock_executable>
+
+    <!-- Reallocate memory for machine code ("text") using huge pages. Highly experimental. -->
+    <remap_executable>false</remap_executable>
+
+    <![CDATA[
+         Uncomment below in order to use JDBC table engine and function.
+
+         To install and run JDBC bridge in background:
+         * [Debian/Ubuntu]
+           export MVN_URL=https://repo1.maven.org/maven2/ru/yandex/clickhouse/clickhouse-jdbc-bridge
+           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')
+           wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge_$PKG_VER-1_all.deb
+           apt install --no-install-recommends -f ./clickhouse-jdbc-bridge_$PKG_VER-1_all.deb
+           clickhouse-jdbc-bridge &
+
+         * [CentOS/RHEL]
+           export MVN_URL=https://repo1.maven.org/maven2/ru/yandex/clickhouse/clickhouse-jdbc-bridge
+           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')
+           wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm
+           yum localinstall -y clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm
+           clickhouse-jdbc-bridge &
+
+         Please refer to https://github.com/ClickHouse/clickhouse-jdbc-bridge#usage for more information.
+    ]]>
+    <!--
+    <jdbc_bridge>
+        <host>127.0.0.1</host>
+        <port>9019</port>
+    </jdbc_bridge>
+    -->
+
+    <!-- The list of hosts allowed to use in URL-related storage engines and table functions.
+        If this section is not present in configuration, all hosts are allowed.
+    -->
+    <!--<remote_url_allow_hosts>-->
+        <!-- Host should be specified exactly as in URL. The name is checked before DNS resolution.
+            Example: "clickhouse.com", "clickhouse.com." and "www.clickhouse.com" are different hosts.
+                    If port is explicitly specified in URL, the host:port is checked as a whole.
+                    If host specified here without port, any port with this host allowed.
+                    "clickhouse.com" -> "clickhouse.com:443", "clickhouse.com:80" etc. is allowed, but "clickhouse.com:80" -> only "clickhouse.com:80" is allowed.
+            If the host is specified as IP address, it is checked as specified in URL. Example: "[2a02:6b8:a::a]".
+            If there are redirects and support for redirects is enabled, every redirect (the Location field) is checked.
+            Host should be specified using the host xml tag:
+                    <host>clickhouse.com</host>
+        -->
+
+        <!-- Regular expression can be specified. RE2 engine is used for regexps.
+            Regexps are not aligned: don't forget to add ^ and $. Also don't forget to escape dot (.) metacharacter
+            (forgetting to do so is a common source of error).
+        -->
+    <!--</remote_url_allow_hosts>-->
+
+    <!-- If element has 'incl' attribute, then for it's value will be used corresponding substitution from another file.
+         By default, path to file with substitutions is /etc/metrika.xml. It could be changed in config in 'include_from' element.
+         Values for substitutions are specified in /clickhouse/name_of_substitution elements in that file.
+      -->
+
+    <!-- Substitutions for parameters of replicated tables.
+          Optional. If you don't use replicated tables, you could omit that.
+
+         See https://clickhouse.com/docs/en/engines/table-engines/mergetree-family/replication/#creating-replicated-tables
+      -->
+
+    <macros>
+        <shard>01</shard>
+        <replica>example01-01-1</replica>
+    </macros>
+
+
+
+    <!-- Reloading interval for embedded dictionaries, in seconds. Default: 3600. -->
+    <builtin_dictionaries_reload_interval>3600</builtin_dictionaries_reload_interval>
+
+
+    <!-- Maximum session timeout, in seconds. Default: 3600. -->
+    <max_session_timeout>3600</max_session_timeout>
+
+    <!-- Default session timeout, in seconds. Default: 60. -->
+    <default_session_timeout>60</default_session_timeout>
+
+    <!-- Sending data to Graphite for monitoring. Several sections can be defined. -->
+    <!--
+        interval - send every X second
+        root_path - prefix for keys
+        hostname_in_path - append hostname to root_path (default = true)
+        metrics - send data from table system.metrics
+        events - send data from table system.events
+        asynchronous_metrics - send data from table system.asynchronous_metrics
+    -->
+    <!--
+    <graphite>
+        <host>localhost</host>
+        <port>42000</port>
+        <timeout>0.1</timeout>
+        <interval>60</interval>
+        <root_path>one_min</root_path>
+        <hostname_in_path>true</hostname_in_path>
+
+        <metrics>true</metrics>
+        <events>true</events>
+        <events_cumulative>false</events_cumulative>
+        <asynchronous_metrics>true</asynchronous_metrics>
+    </graphite>
+    <graphite>
+        <host>localhost</host>
+        <port>42000</port>
+        <timeout>0.1</timeout>
+        <interval>1</interval>
+        <root_path>one_sec</root_path>
+
+        <metrics>true</metrics>
+        <events>true</events>
+        <events_cumulative>false</events_cumulative>
+        <asynchronous_metrics>false</asynchronous_metrics>
+    </graphite>
+    -->
+
+    <!-- Serve endpoint for Prometheus monitoring. -->
+    <!--
+        endpoint - mertics path (relative to root, statring with "/")
+        port - port to setup server. If not defined or 0 than http_port used
+        metrics - send data from table system.metrics
+        events - send data from table system.events
+        asynchronous_metrics - send data from table system.asynchronous_metrics
+        status_info - send data from different component from CH, ex: Dictionaries status
+    -->
+
+    <prometheus>
+        <endpoint>/metrics</endpoint>
+        <port>9363</port>
+
+        <metrics>true</metrics>
+        <events>true</events>
+        <asynchronous_metrics>true</asynchronous_metrics>
+        <status_info>true</status_info>
+    </prometheus>
+
+    <!-- Query log. Used only for queries with setting log_queries = 1. -->
+    <query_log>
+        <!-- What table to insert data. If table is not exist, it will be created.
+             When query log structure is changed after system update,
+              then old table will be renamed and new table will be created automatically.
+        -->
+        <database>system</database>
+        <table>query_log</table>
+        <!--
+            PARTITION BY expr: https://clickhouse.com/docs/en/table_engines/mergetree-family/custom_partitioning_key/
+            Example:
+                event_date
+                toMonday(event_date)
+                toYYYYMM(event_date)
+                toStartOfHour(event_time)
+        -->
+        <partition_by>toYYYYMM(event_date)</partition_by>
+        <!--
+            Table TTL specification: https://clickhouse.com/docs/en/engines/table-engines/mergetree-family/mergetree/#mergetree-table-ttl
+            Example:
+                event_date + INTERVAL 1 WEEK
+                event_date + INTERVAL 7 DAY DELETE
+                event_date + INTERVAL 2 WEEK TO DISK 'bbb'
+
+        <ttl>event_date + INTERVAL 30 DAY DELETE</ttl>
+        -->
+
+        <!-- Instead of partition_by, you can provide full engine expression (starting with ENGINE = ) with parameters,
+             Example: <engine>ENGINE = MergeTree PARTITION BY toYYYYMM(event_date) ORDER BY (event_date, event_time) SETTINGS index_granularity = 1024</engine>
+          -->
+
+        <!-- Interval of flushing data. -->
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+    </query_log>
+
+    <!-- Trace log. Stores stack traces collected by query profilers.
+         See query_profiler_real_time_period_ns and query_profiler_cpu_time_period_ns settings. -->
+    <trace_log>
+        <database>system</database>
+        <table>trace_log</table>
+
+        <partition_by>toYYYYMM(event_date)</partition_by>
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+    </trace_log>
+
+    <!-- Query thread log. Has information about all threads participated in query execution.
+         Used only for queries with setting log_query_threads = 1. -->
+    <query_thread_log>
+        <database>system</database>
+        <table>query_thread_log</table>
+        <partition_by>toYYYYMM(event_date)</partition_by>
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+    </query_thread_log>
+
+    <!-- Query views log. Has information about all dependent views associated with a query.
+         Used only for queries with setting log_query_views = 1. -->
+    <query_views_log>
+        <database>system</database>
+        <table>query_views_log</table>
+        <partition_by>toYYYYMM(event_date)</partition_by>
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+    </query_views_log>
+
+    <!-- Uncomment if use part log.
+         Part log contains information about all actions with parts in MergeTree tables (creation, deletion, merges, downloads).-->
+    <part_log>
+        <database>system</database>
+        <table>part_log</table>
+        <partition_by>toYYYYMM(event_date)</partition_by>
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+    </part_log>
+
+    <!-- Uncomment to write text log into table.
+         Text log contains all information from usual server log but stores it in structured and efficient way.
+         The level of the messages that goes to the table can be limited (<level>), if not specified all messages will go to the table.
+    <text_log>
+        <database>system</database>
+        <table>text_log</table>
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+        <level></level>
+    </text_log>
+    -->
+
+    <!-- Metric log contains rows with current values of ProfileEvents, CurrentMetrics collected with "collect_interval_milliseconds" interval. -->
+    <metric_log>
+        <database>system</database>
+        <table>metric_log</table>
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+        <collect_interval_milliseconds>1000</collect_interval_milliseconds>
+    </metric_log>
+
+    <!--
+        Asynchronous metric log contains values of metrics from
+        system.asynchronous_metrics.
+    -->
+    <asynchronous_metric_log>
+        <database>system</database>
+        <table>asynchronous_metric_log</table>
+        <!--
+            Asynchronous metrics are updated once a minute, so there is
+            no need to flush more often.
+        -->
+        <flush_interval_milliseconds>7000</flush_interval_milliseconds>
+    </asynchronous_metric_log>
+
+    <!--
+        OpenTelemetry log contains OpenTelemetry trace spans.
+    -->
+    <opentelemetry_span_log>
+        <!--
+            The default table creation code is insufficient, this <engine> spec
+            is a workaround. There is no 'event_time' for this log, but two times,
+            start and finish. It is sorted by finish time, to avoid inserting
+            data too far away in the past (probably we can sometimes insert a span
+            that is seconds earlier than the last span in the table, due to a race
+            between several spans inserted in parallel). This gives the spans a
+            global order that we can use to e.g. retry insertion into some external
+            system.
+        -->
+        <engine>
+            engine MergeTree
+            partition by toYYYYMM(finish_date)
+            order by (finish_date, finish_time_us, trace_id)
+        </engine>
+        <database>system</database>
+        <table>opentelemetry_span_log</table>
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+    </opentelemetry_span_log>
+
+
+    <!-- Crash log. Stores stack traces for fatal errors.
+         This table is normally empty. -->
+    <crash_log>
+        <database>system</database>
+        <table>crash_log</table>
+
+        <partition_by />
+        <flush_interval_milliseconds>1000</flush_interval_milliseconds>
+    </crash_log>
+
+    <!-- Session log. Stores user log in (successful or not) and log out events.
+
+        Note: session log has known security issues and should not be used in production.
+    -->
+    <!-- <session_log>
+        <database>system</database>
+        <table>session_log</table>
+
+        <partition_by>toYYYYMM(event_date)</partition_by>
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+    </session_log> -->
+
+    <!-- Profiling on Processors level. -->
+    <processors_profile_log>
+        <database>system</database>
+        <table>processors_profile_log</table>
+
+        <partition_by>toYYYYMM(event_date)</partition_by>
+        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+    </processors_profile_log>
+
+    <!-- <top_level_domains_path>/var/lib/clickhouse/top_level_domains/</top_level_domains_path> -->
+    <!-- Custom TLD lists.
+         Format: <name>/path/to/file</name>
+
+         Changes will not be applied w/o server restart.
+         Path to the list is under top_level_domains_path (see above).
+    -->
+    <top_level_domains_lists>
+        <!--
+        <public_suffix_list>/path/to/public_suffix_list.dat</public_suffix_list>
+        -->
+    </top_level_domains_lists>
+
+    <!-- Configuration of external dictionaries. See:
+         https://clickhouse.com/docs/en/sql-reference/dictionaries/external-dictionaries/external-dicts
+    -->
+    <dictionaries_config>*_dictionary.xml</dictionaries_config>
+
+    <!-- Configuration of user defined executable functions -->
+    <user_defined_executable_functions_config>*function.xml</user_defined_executable_functions_config>
+    <user_scripts_path>/var/lib/clickhouse/user_scripts/</user_scripts_path>
+
+    <!-- Uncomment if you want data to be compressed 30-100% better.
+         Don't do that if you just started using ClickHouse.
+      -->
+    <!--
+    <compression>
+        <!- - Set of variants. Checked in order. Last matching case wins. If nothing matches, lz4 will be used. - ->
+        <case>
+
+            <!- - Conditions. All must be satisfied. Some conditions may be omitted. - ->
+            <min_part_size>10000000000</min_part_size>        <!- - Min part size in bytes. - ->
+            <min_part_size_ratio>0.01</min_part_size_ratio>   <!- - Min size of part relative to whole table size. - ->
+
+            <!- - What compression method to use. - ->
+            <method>zstd</method>
+        </case>
+    </compression>
+    -->
+
+    <!-- Configuration of encryption. The server executes a command to
+         obtain an encryption key at startup if such a command is
+         defined, or encryption codecs will be disabled otherwise. The
+         command is executed through /bin/sh and is expected to write
+         a Base64-encoded key to the stdout. -->
+    <encryption_codecs>
+        <!-- aes_128_gcm_siv -->
+            <!-- Example of getting hex key from env -->
+            <!-- the code should use this key and throw an exception if its length is not 16 bytes -->
+            <!--key_hex from_env="..."></key_hex -->
+
+            <!-- Example of multiple hex keys. They can be imported from env or be written down in config-->
+            <!-- the code should use these keys and throw an exception if their length is not 16 bytes -->
+            <!-- key_hex id="0">...</key_hex -->
+            <!-- key_hex id="1" from_env=".."></key_hex -->
+            <!-- key_hex id="2">...</key_hex -->
+            <!-- current_key_id>2</current_key_id -->
+
+            <!-- Example of getting hex key from config -->
+            <!-- the code should use this key and throw an exception if its length is not 16 bytes -->
+            <!-- key>...</key -->
+
+            <!-- example of adding nonce -->
+            <!-- nonce>...</nonce -->
+
+        <!-- /aes_128_gcm_siv -->
+    </encryption_codecs>
+
+    <!-- Allow to execute distributed DDL queries (CREATE, DROP, ALTER, RENAME) on cluster.
+         Works only if ZooKeeper is enabled. Comment it if such functionality isn't required. -->
+    <distributed_ddl>
+        <!-- Path in ZooKeeper to queue with DDL queries -->
+        <path>/clickhouse/task_queue/ddl</path>
+
+        <!-- Settings from this profile will be used to execute DDL queries -->
+        <!-- <profile>default</profile> -->
+
+        <!-- Controls how much ON CLUSTER queries can be run simultaneously. -->
+        <!-- <pool_size>1</pool_size> -->
+
+        <!--
+             Cleanup settings (active tasks will not be removed)
+        -->
+
+        <!-- Controls task TTL (default 1 week) -->
+        <!-- <task_max_lifetime>604800</task_max_lifetime> -->
+
+        <!-- Controls how often cleanup should be performed (in seconds) -->
+        <!-- <cleanup_delay_period>60</cleanup_delay_period> -->
+
+        <!-- Controls how many tasks could be in the queue -->
+        <!-- <max_tasks_in_queue>1000</max_tasks_in_queue> -->
+    </distributed_ddl>
+
+    <!-- Settings to fine tune MergeTree tables. See documentation in source code, in MergeTreeSettings.h -->
+    <!--
+    <merge_tree>
+        <max_suspicious_broken_parts>5</max_suspicious_broken_parts>
+    </merge_tree>
+    -->
+
+    <!-- Protection from accidental DROP.
+         If size of a MergeTree table is greater than max_table_size_to_drop (in bytes) than table could not be dropped with any DROP query.
+         If you want do delete one table and don't want to change clickhouse-server config, you could create special file <clickhouse-path>/flags/force_drop_table and make DROP once.
+         By default max_table_size_to_drop is 50GB; max_table_size_to_drop=0 allows to DROP any tables.
+         The same for max_partition_size_to_drop.
+         Uncomment to disable protection.
+    -->
+    <!-- <max_table_size_to_drop>0</max_table_size_to_drop> -->
+    <!-- <max_partition_size_to_drop>0</max_partition_size_to_drop> -->
+
+    <!-- Example of parameters for GraphiteMergeTree table engine -->
+    <graphite_rollup_example>
+        <pattern>
+            <regexp>click_cost</regexp>
+            <function>any</function>
+            <retention>
+                <age>0</age>
+                <precision>3600</precision>
+            </retention>
+            <retention>
+                <age>86400</age>
+                <precision>60</precision>
+            </retention>
+        </pattern>
+        <default>
+            <function>max</function>
+            <retention>
+                <age>0</age>
+                <precision>60</precision>
+            </retention>
+            <retention>
+                <age>3600</age>
+                <precision>300</precision>
+            </retention>
+            <retention>
+                <age>86400</age>
+                <precision>3600</precision>
+            </retention>
+        </default>
+    </graphite_rollup_example>
+
+    <!-- Directory in <clickhouse-path> containing schema files for various input formats.
+         The directory will be created if it doesn't exist.
+      -->
+    <format_schema_path>/var/lib/clickhouse/format_schemas/</format_schema_path>
+
+    <!-- Default query masking rules, matching lines would be replaced with something else in the logs
+        (both text logs and system.query_log).
+        name - name for the rule (optional)
+        regexp - RE2 compatible regular expression (mandatory)
+        replace - substitution string for sensitive data (optional, by default - six asterisks)
+    -->
+    <query_masking_rules>
+        <rule>
+            <name>hide encrypt/decrypt arguments</name>
+            <regexp>((?:aes_)?(?:encrypt|decrypt)(?:_mysql)?)\s*\(\s*(?:'(?:\\'|.)+'|.*?)\s*\)</regexp>
+            <!-- or more secure, but also more invasive:
+                (aes_\w+)\s*\(.*\)
+            -->
+            <replace>\1(???)</replace>
+        </rule>
+    </query_masking_rules>
+
+    <!-- Uncomment to use custom http handlers.
+        rules are checked from top to bottom, first match runs the handler
+            url - to match request URL, you can use 'regex:' prefix to use regex match(optional)
+            methods - to match request method, you can use commas to separate multiple method matches(optional)
+            headers - to match request headers, match each child element(child element name is header name), you can use 'regex:' prefix to use regex match(optional)
+        handler is request handler
+            type - supported types: static, dynamic_query_handler, predefined_query_handler
+            query - use with predefined_query_handler type, executes query when the handler is called
+            query_param_name - use with dynamic_query_handler type, extracts and executes the value corresponding to the <query_param_name> value in HTTP request params
+            status - use with static type, response status code
+            content_type - use with static type, response content-type
+            response_content - use with static type, Response content sent to client, when using the prefix 'file://' or 'config://', find the content from the file or configuration send to client.
+
+    <http_handlers>
+        <rule>
+            <url>/</url>
+            <methods>POST,GET</methods>
+            <headers><pragma>no-cache</pragma></headers>
+            <handler>
+                <type>dynamic_query_handler</type>
+                <query_param_name>query</query_param_name>
+            </handler>
+        </rule>
+
+        <rule>
+            <url>/predefined_query</url>
+            <methods>POST,GET</methods>
+            <handler>
+                <type>predefined_query_handler</type>
+                <query>SELECT * FROM system.settings</query>
+            </handler>
+        </rule>
+
+        <rule>
+            <handler>
+                <type>static</type>
+                <status>200</status>
+                <content_type>text/plain; charset=UTF-8</content_type>
+                <response_content>config://http_server_default_response</response_content>
+            </handler>
+        </rule>
+    </http_handlers>
+    -->
+
+    <send_crash_reports>
+        <!-- Changing <enabled> to true allows sending crash reports to -->
+        <!-- the ClickHouse core developers team via Sentry https://sentry.io -->
+        <!-- Doing so at least in pre-production environments is highly appreciated -->
+        <enabled>false</enabled>
+        <!-- Change <anonymize> to true if you don't feel comfortable attaching the server hostname to the crash report -->
+        <anonymize>false</anonymize>
+        <!-- Default endpoint should be changed to different Sentry DSN only if you have -->
+        <!-- some in-house engineers or hired consultants who're going to debug ClickHouse issues for you -->
+        <endpoint>https://6f33034cfe684dd7a3ab9875e57b1c8d@o388870.ingest.sentry.io/5226277</endpoint>
+    </send_crash_reports>
+
+    <!-- Uncomment to disable ClickHouse internal DNS caching. -->
+    <!-- <disable_internal_dns_cache>1</disable_internal_dns_cache> -->
+
+    <!-- You can also configure rocksdb like this: -->
+    <!--
+    <rocksdb>
+        <options>
+            <max_background_jobs>8</max_background_jobs>
+        </options>
+        <column_family_options>
+            <num_levels>2</num_levels>
+        </column_family_options>
+        <tables>
+            <table>
+                <name>TABLE</name>
+                <options>
+                    <max_background_jobs>8</max_background_jobs>
+                </options>
+                <column_family_options>
+                    <num_levels>2</num_levels>
+                </column_family_options>
+            </table>
+        </tables>
+    </rocksdb>
+    -->
+
+    <!-- Uncomment if enable merge tree metadata cache -->
+    <merge_tree_metadata_cache>
+        <lru_cache_size>268435456</lru_cache_size>
+        <continue_if_corrupted>true</continue_if_corrupted>
+    </merge_tree_metadata_cache>
+</clickhouse>
diff --git a/src/signoz/clickhouse/custom-function.xml b/src/signoz/clickhouse/custom-function.xml
new file mode 100644
index 0000000..b2b3f91
--- /dev/null
+++ b/src/signoz/clickhouse/custom-function.xml
@@ -0,0 +1,21 @@
+<functions>
+    <function>
+        <type>executable</type>
+        <name>histogramQuantile</name>
+        <return_type>Float64</return_type>
+        <argument>
+            <type>Array(Float64)</type>
+            <name>buckets</name>
+        </argument>
+        <argument>
+            <type>Array(Float64)</type>
+            <name>counts</name>
+        </argument>
+        <argument>
+            <type>Float64</type>
+            <name>quantile</name>
+        </argument>
+        <format>CSV</format>
+        <command>./histogramQuantile</command>
+    </function>
+</functions>
diff --git a/src/signoz/clickhouse/users.xml b/src/signoz/clickhouse/users.xml
new file mode 100644
index 0000000..f185620
--- /dev/null
+++ b/src/signoz/clickhouse/users.xml
@@ -0,0 +1,123 @@
+<?xml version="1.0"?>
+<clickhouse>
+    <!-- See also the files in users.d directory where the settings can be overridden. -->
+
+    <!-- Profiles of settings. -->
+    <profiles>
+        <!-- Default settings. -->
+        <default>
+            <!-- Maximum memory usage for processing single query, in bytes. -->
+            <max_memory_usage>10000000000</max_memory_usage>
+
+            <!-- How to choose between replicas during distributed query processing.
+                 random - choose random replica from set of replicas with minimum number of errors
+                 nearest_hostname - from set of replicas with minimum number of errors, choose replica
+                  with minimum number of different symbols between replica's hostname and local hostname
+                  (Hamming distance).
+                 in_order - first live replica is chosen in specified order.
+                 first_or_random - if first replica one has higher number of errors, pick a random one from replicas with minimum number of errors.
+            -->
+            <load_balancing>random</load_balancing>
+        </default>
+
+        <!-- Profile that allows only read queries. -->
+        <readonly>
+            <readonly>1</readonly>
+        </readonly>
+    </profiles>
+
+    <!-- Users and ACL. -->
+    <users>
+        <!-- If user name was not specified, 'default' user is used. -->
+        <default>
+            <!-- See also the files in users.d directory where the password can be overridden.
+
+                 Password could be specified in plaintext or in SHA256 (in hex format).
+
+                 If you want to specify password in plaintext (not recommended), place it in 'password' element.
+                 Example: <password>qwerty</password>.
+                 Password could be empty.
+
+                 If you want to specify SHA256, place it in 'password_sha256_hex' element.
+                 Example: <password_sha256_hex>65e84be33532fb784c48129675f9eff3a682b27168c0ea744b2cf58ee02337c5</password_sha256_hex>
+                 Restrictions of SHA256: impossibility to connect to ClickHouse using MySQL JS client (as of July 2019).
+
+                 If you want to specify double SHA1, place it in 'password_double_sha1_hex' element.
+                 Example: <password_double_sha1_hex>e395796d6546b1b65db9d665cd43f0e858dd4303</password_double_sha1_hex>
+
+                 If you want to specify a previously defined LDAP server (see 'ldap_servers' in the main config) for authentication,
+                  place its name in 'server' element inside 'ldap' element.
+                 Example: <ldap><server>my_ldap_server</server></ldap>
+
+                 If you want to authenticate the user via Kerberos (assuming Kerberos is enabled, see 'kerberos' in the main config),
+                  place 'kerberos' element instead of 'password' (and similar) elements.
+                 The name part of the canonical principal name of the initiator must match the user name for authentication to succeed.
+                 You can also place 'realm' element inside 'kerberos' element to further restrict authentication to only those requests
+                  whose initiator's realm matches it.
+                 Example: <kerberos />
+                 Example: <kerberos><realm>EXAMPLE.COM</realm></kerberos>
+
+                 How to generate decent password:
+                 Execute: PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha256sum | tr -d '-'
+                 In first line will be password and in second - corresponding SHA256.
+
+                 How to generate double SHA1:
+                 Execute: PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha1sum | tr -d '-' | xxd -r -p | sha1sum | tr -d '-'
+                 In first line will be password and in second - corresponding double SHA1.
+            -->
+            <password></password>
+
+            <!-- List of networks with open access.
+
+                 To open access from everywhere, specify:
+                    <ip>::/0</ip>
+
+                 To open access only from localhost, specify:
+                    <ip>::1</ip>
+                    <ip>127.0.0.1</ip>
+
+                 Each element of list has one of the following forms:
+                 <ip> IP-address or network mask. Examples: 213.180.204.3 or 10.0.0.1/8 or 10.0.0.1/255.255.255.0
+                     2a02:6b8::3 or 2a02:6b8::3/64 or 2a02:6b8::3/ffff:ffff:ffff:ffff::.
+                 <host> Hostname. Example: server01.clickhouse.com.
+                     To check access, DNS query is performed, and all received addresses compared to peer address.
+                 <host_regexp> Regular expression for host names. Example, ^server\d\d-\d\d-\d\.clickhouse\.com$
+                     To check access, DNS PTR query is performed for peer address and then regexp is applied.
+                     Then, for result of PTR query, another DNS query is performed and all received addresses compared to peer address.
+                     Strongly recommended that regexp is ends with $
+                 All results of DNS requests are cached till server restart.
+            -->
+            <networks>
+                <ip>::/0</ip>
+            </networks>
+
+            <!-- Settings profile for user. -->
+            <profile>default</profile>
+
+            <!-- Quota for user. -->
+            <quota>default</quota>
+
+            <!-- User can create other users and grant rights to them. -->
+            <!-- <access_management>1</access_management> -->
+        </default>
+    </users>
+
+    <!-- Quotas. -->
+    <quotas>
+        <!-- Name of quota. -->
+        <default>
+            <!-- Limits for time interval. You could specify many intervals with different limits. -->
+            <interval>
+                <!-- Length of interval. -->
+                <duration>3600</duration>
+
+                <!-- No limits. Just calculate resource usage for time interval. -->
+                <queries>0</queries>
+                <errors>0</errors>
+                <result_rows>0</result_rows>
+                <read_rows>0</read_rows>
+                <execution_time>0</execution_time>
+            </interval>
+        </default>
+    </quotas>
+</clickhouse>
diff --git a/src/signoz/docker-compose.yaml b/src/signoz/docker-compose.yaml
index d87e390..58d89e4 100644
--- a/src/signoz/docker-compose.yaml
+++ b/src/signoz/docker-compose.yaml
@@ -3,61 +3,199 @@ x-defaults: &defaults
   logging:
     driver: json-file
     options:
-      max-size: 100m
+      max-size: 50m
       max-file: '3'
 
 x-clickhouse-defaults: &clickhouse-defaults
-  restart: on-failure
-  logging:
-    driver: json-file
-    options:
-      max-size: 100m
-      max-file: '3'
+  <<: *defaults
+  image: ${GLOBAL_REGISTRY:-}clickhouse/clickhouse-server:${SIGNOZ_CLICKHOUSE_VERSION:-25.5.6}
+  depends_on:
+    init-clickhouse:
+      condition: service_completed_successfully
+    zookeeper-1:
+      condition: service_healthy
   healthcheck:
-    test: [CMD, wget, --spider, -q, 'localhost:8123/ping']
+    test: [CMD, wget, --spider, -q, '0.0.0.0:8123/ping']
     interval: 30s
     timeout: 5s
     retries: 3
-  deploy:
-    resources:
-      limits:
-        cpus: ${SIGNOZ_CLICKHOUSE_CPU_LIMIT:-2.0}
-        memory: ${SIGNOZ_CLICKHOUSE_MEMORY_LIMIT:-4G}
-      reservations:
-        cpus: ${SIGNOZ_CLICKHOUSE_CPU_RESERVATION:-0.5}
-        memory: ${SIGNOZ_CLICKHOUSE_MEMORY_RESERVATION:-1G}
+  ulimits:
+    nproc: 65535
+    nofile:
+      soft: 262144
+      hard: 262144
+
+x-db-depend: &db-depend
+  <<: *defaults
+  depends_on:
+    clickhouse:
+      condition: service_healthy
 
 services:
+  # One-shot init: downloads histogramQuantile UDF binary into the shared volume
+  init-clickhouse:
+    image: ${GLOBAL_REGISTRY:-}clickhouse/clickhouse-server:${SIGNOZ_CLICKHOUSE_VERSION:-25.5.6}
+    restart: on-failure
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: '1'
+    command:
+      - bash
+      - -c
+      - |
+        version="v0.0.1"
+        node_os=$$(uname -s | tr '[:upper:]' '[:lower:]')
+        node_arch=$$(uname -m | sed s/aarch64/arm64/ | sed s/x86_64/amd64/)
+        echo "Fetching histogram-binary for $${node_os}/$${node_arch}"
+        cd /tmp
+        wget -O histogram-quantile.tar.gz "https://github.com/SigNoz/signoz/releases/download/histogram-quantile%2F$${version}/histogram-quantile_$${node_os}_$${node_arch}.tar.gz"
+        tar -xvzf histogram-quantile.tar.gz
+        mv histogram-quantile /var/lib/clickhouse/user_scripts/histogramQuantile
+        echo "Done."
+    volumes:
+      - clickhouse_user_scripts:/var/lib/clickhouse/user_scripts/
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 256M
+
+  # ZooKeeper for ClickHouse replication metadata
+  zookeeper-1:
+    <<: *defaults
+    image: ${GLOBAL_REGISTRY:-}signoz/zookeeper:${SIGNOZ_ZOOKEEPER_VERSION:-3.7.1}
+    user: root
+    environment:
+      - TZ=${TZ:-UTC}
+      - ZOO_SERVER_ID=1
+      - ALLOW_ANONYMOUS_LOGIN=yes
+      - ZOO_AUTOPURGE_INTERVAL=1
+      - ZOO_ENABLE_PROMETHEUS_METRICS=yes
+      - ZOO_PROMETHEUS_METRICS_PORT_NUMBER=9141
+    volumes:
+      - zookeeper_data:/bitnami/zookeeper
+    healthcheck:
+      test: [CMD-SHELL, 'curl -s -m 2 http://localhost:8080/commands/ruok | grep error | grep null']
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    deploy:
+      resources:
+        limits:
+          cpus: ${SIGNOZ_ZOOKEEPER_CPU_LIMIT:-0.5}
+          memory: ${SIGNOZ_ZOOKEEPER_MEMORY_LIMIT:-512M}
+        reservations:
+          cpus: ${SIGNOZ_ZOOKEEPER_CPU_RESERVATION:-0.1}
+          memory: ${SIGNOZ_ZOOKEEPER_MEMORY_RESERVATION:-128M}
+
   # ClickHouse for storing traces, metrics and logs
   clickhouse:
     <<: *clickhouse-defaults
-    image: ${GLOBAL_REGISTRY:-}clickhouse/clickhouse-server:${SIGNOZ_CLICKHOUSE_VERSION:-24.11.1-alpine}
-    user: '101:101' # ClickHouse user
-    volumes:
-      - clickhouse_data:/var/lib/clickhouse
-      - ./clickhouse-config.xml:/etc/clickhouse-server/config.d/logging.xml:ro
-      - ./clickhouse-users.xml:/etc/clickhouse-server/users.d/logging.xml:ro
     environment:
       - TZ=${TZ:-UTC}
-      - CLICKHOUSE_DB=${SIGNOZ_CLICKHOUSE_DB:-signoz}
+      - CLICKHOUSE_SKIP_USER_SETUP=1
+    volumes:
+      - clickhouse_data:/var/lib/clickhouse/
+      - clickhouse_user_scripts:/var/lib/clickhouse/user_scripts/
+      - ./clickhouse/config.xml:/etc/clickhouse-server/config.xml:ro
+      - ./clickhouse/users.xml:/etc/clickhouse-server/users.xml:ro
+      - ./clickhouse/custom-function.xml:/etc/clickhouse-server/custom-function.xml:ro
+      - ./clickhouse/cluster.xml:/etc/clickhouse-server/config.d/cluster.xml:ro
+    deploy:
+      resources:
+        limits:
+          cpus: ${SIGNOZ_CLICKHOUSE_CPU_LIMIT:-2.0}
+          memory: ${SIGNOZ_CLICKHOUSE_MEMORY_LIMIT:-4G}
+        reservations:
+          cpus: ${SIGNOZ_CLICKHOUSE_CPU_RESERVATION:-0.5}
+          memory: ${SIGNOZ_CLICKHOUSE_MEMORY_RESERVATION:-1G}
+
+  # One-shot migration: bootstraps and runs schema migrations
+  signoz-telemetrystore-migrator:
+    <<: *db-depend
+    image: ${GLOBAL_REGISTRY:-}signoz/signoz-otel-collector:${SIGNOZ_OTEL_COLLECTOR_VERSION:-v0.144.2}
+    restart: on-failure
+    environment:
+      - TZ=${TZ:-UTC}
+      - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_DSN=tcp://clickhouse:9000
+      - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_CLUSTER=cluster
+      - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_REPLICATION=true
+      - SIGNOZ_OTEL_COLLECTOR_TIMEOUT=10m
+    entrypoint: [/bin/sh]
+    command:
+      - -c
+      - |
+        /signoz-otel-collector migrate bootstrap &&
+        /signoz-otel-collector migrate sync up &&
+        /signoz-otel-collector migrate async up
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 512M
+
+  # SigNoz all-in-one backend + frontend + alertmanager
+  signoz:
+    <<: *db-depend
+    image: ${GLOBAL_REGISTRY:-}signoz/signoz:${SIGNOZ_VERSION:-v0.118.0}
+    ports:
+      - '${SIGNOZ_PORT_OVERRIDE:-8080}:8080'
+    volumes:
+      - signoz_data:/var/lib/signoz/
+    environment:
+      - TZ=${TZ:-UTC}
+      - SIGNOZ_ALERTMANAGER_PROVIDER=signoz
+      - SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN=tcp://clickhouse:9000
+      - SIGNOZ_SQLSTORE_SQLITE_PATH=/var/lib/signoz/signoz.db
+      - SIGNOZ_TOKENIZER_JWT_SECRET=${SIGNOZ_JWT_SECRET:-please-change-this-secret}
+    healthcheck:
+      test: [CMD, wget, --spider, -q, 'localhost:8080/api/v1/health']
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 60s
+    deploy:
+      resources:
+        limits:
+          cpus: ${SIGNOZ_CPU_LIMIT:-1.0}
+          memory: ${SIGNOZ_MEMORY_LIMIT:-2G}
+        reservations:
+          cpus: ${SIGNOZ_CPU_RESERVATION:-0.25}
+          memory: ${SIGNOZ_MEMORY_RESERVATION:-256M}
 
   # OTel Collector for receiving telemetry data
   otel-collector:
-    <<: *defaults
-    image: ${GLOBAL_REGISTRY:-}signoz/signoz-otel-collector:${SIGNOZ_OTEL_COLLECTOR_VERSION:-0.102.8}
+    <<: *db-depend
+    image: ${GLOBAL_REGISTRY:-}signoz/signoz-otel-collector:${SIGNOZ_OTEL_COLLECTOR_VERSION:-v0.144.2}
+    entrypoint: [/bin/sh]
     command:
-      - --config=/etc/otel-collector-config.yaml
+      - -c
+      - |
+        /signoz-otel-collector migrate sync check &&
+        /signoz-otel-collector --config=/etc/otel-collector-config.yaml --manager-config=/etc/manager-config.yaml --copy-path=/var/tmp/collector-config.yaml
     volumes:
       - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro
+      - ./signoz/otel-collector-opamp-config.yaml:/etc/manager-config.yaml:ro
     environment:
       - TZ=${TZ:-UTC}
-      - OTEL_RESOURCE_ATTRIBUTES=${SIGNOZ_OTEL_RESOURCE_ATTRIBUTES:-host.name=signoz-host}
+      - OTEL_RESOURCE_ATTRIBUTES=${SIGNOZ_OTEL_RESOURCE_ATTRIBUTES:-host.name=signoz-host,os.type=linux}
+      - LOW_CARDINAL_EXCEPTION_GROUPING=${SIGNOZ_LOW_CARDINAL_EXCEPTION_GROUPING:-false}
+      - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_DSN=tcp://clickhouse:9000
+      - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_CLUSTER=cluster
+      - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_REPLICATION=true
+      - SIGNOZ_OTEL_COLLECTOR_TIMEOUT=10m
     ports:
       - '${SIGNOZ_OTEL_GRPC_PORT_OVERRIDE:-4317}:4317' # OTLP gRPC receiver
       - '${SIGNOZ_OTEL_HTTP_PORT_OVERRIDE:-4318}:4318' # OTLP HTTP receiver
-    depends_on:
-      clickhouse:
-        condition: service_healthy
+    healthcheck:
+      test: [CMD, bash, -c, echo > /dev/tcp/localhost/13133]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     deploy:
       resources:
         limits:
@@ -66,133 +204,9 @@ services:
         reservations:
           cpus: ${SIGNOZ_OTEL_COLLECTOR_CPU_RESERVATION:-0.25}
           memory: ${SIGNOZ_OTEL_COLLECTOR_MEMORY_RESERVATION:-512M}
-    healthcheck:
-      test:
-        - CMD
-        - wget
-        - --no-verbose
-        - --tries=1
-        - --spider
-        - 'http://localhost:13133/'
-
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-
-  # Query Service for querying data
-  query-service:
-    <<: *defaults
-    image: ${GLOBAL_REGISTRY:-}signoz/query-service:${SIGNOZ_QUERY_SERVICE_VERSION:-0.55.0}
-    command:
-      - -config=/root/config/prometheus.yml
-    volumes:
-      - ./query-service/prometheus.yml:/root/config/prometheus.yml:ro
-      - signoz_data:/var/lib/signoz
-    environment:
-      - TZ=${TZ:-UTC}
-      - ClickHouseUrl=${SIGNOZ_CLICKHOUSE_URL:-tcp://clickhouse:9000/?database=signoz}
-      - STORAGE=${SIGNOZ_STORAGE:-clickhouse}
-      - GODEBUG=${SIGNOZ_GODEBUG:-netdns=go}
-      - TELEMETRY_ENABLED=${SIGNOZ_TELEMETRY_ENABLED:-true}
-      - DEPLOYMENT_TYPE=${SIGNOZ_DEPLOYMENT_TYPE:-docker-standalone-amd}
-    depends_on:
-      clickhouse:
-        condition: service_healthy
-    deploy:
-      resources:
-        limits:
-          cpus: ${SIGNOZ_QUERY_SERVICE_CPU_LIMIT:-1.0}
-          memory: ${SIGNOZ_QUERY_SERVICE_MEMORY_LIMIT:-1G}
-        reservations:
-          cpus: ${SIGNOZ_QUERY_SERVICE_CPU_RESERVATION:-0.25}
-          memory: ${SIGNOZ_QUERY_SERVICE_MEMORY_RESERVATION:-256M}
-    healthcheck:
-      test:
-        - CMD
-        - wget
-        - --no-verbose
-        - --tries=1
-        - --spider
-        - 'http://localhost:8080/api/v1/health'
-
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-
-  # Frontend for the UI
-  frontend:
-    <<: *defaults
-    image: ${GLOBAL_REGISTRY:-}signoz/frontend:${SIGNOZ_FRONTEND_VERSION:-0.55.0}
-    ports:
-      - '${SIGNOZ_PORT_OVERRIDE:-3301}:3301'
-    volumes:
-      - ./frontend/nginx-config.conf:/etc/nginx/conf.d/default.conf:ro
-    environment:
-      - TZ=${TZ:-UTC}
-    depends_on:
-      query-service:
-        condition: service_healthy
-    deploy:
-      resources:
-        limits:
-          cpus: ${SIGNOZ_FRONTEND_CPU_LIMIT:-0.5}
-          memory: ${SIGNOZ_FRONTEND_MEMORY_LIMIT:-512M}
-        reservations:
-          cpus: ${SIGNOZ_FRONTEND_CPU_RESERVATION:-0.1}
-          memory: ${SIGNOZ_FRONTEND_MEMORY_RESERVATION:-128M}
-    healthcheck:
-      test:
-        - CMD
-        - wget
-        - --no-verbose
-        - --tries=1
-        - --spider
-        - 'http://localhost:3301/api/v1/health'
-
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 10s
-
-  # Alert Manager for managing alerts
-  alertmanager:
-    <<: *defaults
-    image: ${GLOBAL_REGISTRY:-}signoz/alertmanager:${SIGNOZ_ALERTMANAGER_VERSION:-0.23.5}
-    command:
-      - --queryService.url=http://query-service:8080
-      - --storage.path=/data
-    volumes:
-      - alertmanager_data:/data
-    environment:
-      - TZ=${TZ:-UTC}
-    depends_on:
-      query-service:
-        condition: service_healthy
-    deploy:
-      resources:
-        limits:
-          cpus: ${SIGNOZ_ALERTMANAGER_CPU_LIMIT:-0.5}
-          memory: ${SIGNOZ_ALERTMANAGER_MEMORY_LIMIT:-512M}
-        reservations:
-          cpus: ${SIGNOZ_ALERTMANAGER_CPU_RESERVATION:-0.1}
-          memory: ${SIGNOZ_ALERTMANAGER_MEMORY_RESERVATION:-128M}
-    healthcheck:
-      test:
-        - CMD
-        - wget
-        - --no-verbose
-        - --tries=1
-        - --spider
-        - 'http://localhost:9093/-/healthy'
-
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 10s
 
 volumes:
   clickhouse_data:
+  clickhouse_user_scripts:
   signoz_data:
-  alertmanager_data:
+  zookeeper_data:
diff --git a/src/signoz/otel-collector-config.yaml b/src/signoz/otel-collector-config.yaml
new file mode 100644
index 0000000..3964dc5
--- /dev/null
+++ b/src/signoz/otel-collector-config.yaml
@@ -0,0 +1,114 @@
+connectors:
+  signozmeter:
+    metrics_flush_interval: 1h
+    dimensions:
+      - name: service.name
+      - name: deployment.environment
+      - name: host.name
+receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: 0.0.0.0:4317
+      http:
+        endpoint: 0.0.0.0:4318
+  prometheus:
+    config:
+      global:
+        scrape_interval: 60s
+      scrape_configs:
+        - job_name: otel-collector
+          static_configs:
+            - targets:
+                - localhost:8888
+              labels:
+                job_name: otel-collector
+processors:
+  batch:
+    send_batch_size: 10000
+    send_batch_max_size: 11000
+    timeout: 10s
+  batch/meter:
+    send_batch_max_size: 25000
+    send_batch_size: 20000
+    timeout: 1s
+  resourcedetection:
+    detectors: [env, system]
+    timeout: 2s
+  signozspanmetrics/delta:
+    metrics_exporter: signozclickhousemetrics
+    metrics_flush_interval: 60s
+    latency_histogram_buckets: [100us, 1ms, 2ms, 6ms, 10ms, 50ms, 100ms, 250ms, 500ms, 1000ms, 1400ms, 2000ms, 5s, 10s, 20s, 40s, 60s]
+    dimensions_cache_size: 100000
+    aggregation_temporality: AGGREGATION_TEMPORALITY_DELTA
+    enable_exp_histogram: true
+    dimensions:
+      - name: service.namespace
+        default: default
+      - name: deployment.environment
+        default: default
+      - name: signoz.collector.id
+      - name: service.version
+      - name: browser.platform
+      - name: browser.mobile
+      - name: k8s.cluster.name
+      - name: k8s.node.name
+      - name: k8s.namespace.name
+      - name: host.name
+      - name: host.type
+      - name: container.name
+extensions:
+  health_check:
+    endpoint: 0.0.0.0:13133
+  pprof:
+    endpoint: 0.0.0.0:1777
+exporters:
+  clickhousetraces:
+    datasource: tcp://clickhouse:9000/signoz_traces
+    low_cardinal_exception_grouping: ${env:LOW_CARDINAL_EXCEPTION_GROUPING}
+    use_new_schema: true
+  signozclickhousemetrics:
+    dsn: tcp://clickhouse:9000/signoz_metrics
+  clickhouselogsexporter:
+    dsn: tcp://clickhouse:9000/signoz_logs
+    timeout: 10s
+    use_new_schema: true
+  signozclickhousemeter:
+    dsn: tcp://clickhouse:9000/signoz_meter
+    timeout: 45s
+    sending_queue:
+      enabled: false
+  metadataexporter:
+    cache:
+      provider: in_memory
+    dsn: tcp://clickhouse:9000/signoz_metadata
+    enabled: true
+    timeout: 45s
+service:
+  telemetry:
+    logs:
+      encoding: json
+  extensions:
+    - health_check
+    - pprof
+  pipelines:
+    traces:
+      receivers: [otlp]
+      processors: [signozspanmetrics/delta, batch]
+      exporters: [clickhousetraces, metadataexporter, signozmeter]
+    metrics:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [signozclickhousemetrics, metadataexporter, signozmeter]
+    metrics/prometheus:
+      receivers: [prometheus]
+      processors: [batch]
+      exporters: [signozclickhousemetrics, metadataexporter, signozmeter]
+    logs:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [clickhouselogsexporter, metadataexporter, signozmeter]
+    metrics/meter:
+      receivers: [signozmeter]
+      processors: [batch/meter]
+      exporters: [signozclickhousemeter]
diff --git a/src/signoz/signoz/otel-collector-opamp-config.yaml b/src/signoz/signoz/otel-collector-opamp-config.yaml
new file mode 100644
index 0000000..7267607
--- /dev/null
+++ b/src/signoz/signoz/otel-collector-opamp-config.yaml
@@ -0,0 +1 @@
+server_endpoint: ws://signoz:4320/v1/opamp