feat(charts)!: add matomo and clickhouse

charts/clickhouse/.helmignore

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: Apache-2.0
+.DS_Store
+Thumbs.db
+.git/
+.gitignore
+.gitattributes
+.helmignore
+.vscode/
+.idea/
+*.orig
+*.rej
+*.swp
+*.tmp
+*.log

charts/clickhouse/Chart.yaml

@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: Apache-2.0
+apiVersion: v2
+name: clickhouse
+description: Fast column-oriented OLAP database with production-safe standalone defaults
+type: application
+version: 0.1.0
+appVersion: "25.8.28.1"
+kubeVersion: ">=1.26.0-0"
+maintainers:
+  - name: helmforgedev
+  - name: mberlofa
+keywords:
+  - clickhouse
+  - database
+  - olap
+  - analytics
+  - kubernetes
+home: https://helmforge.dev/docs/charts/clickhouse
+sources:
+  - https://github.com/helmforgedev/charts
+  - https://github.com/ClickHouse/ClickHouse
+  - https://hub.docker.com/r/clickhouse/clickhouse-server
+icon: https://helmforge.dev/icons/charts/clickhouse.png
+annotations:
+  artifacthub.io/changes: |
+    - kind: added
+      description: "add production-ready ClickHouse chart (#705)"
+  artifacthub.io/maintainers: |
+    - name: HelmForge
+      email: berlofa@helmforge.dev
+    - name: Maicon Berlofa
+      email: maicon.berloffa@gmail.com
+  helmforge.dev/maturity: beta
+  helmforge.dev/signed: gpg+cosign
+  artifacthub.io/signKey: |
+    fingerprint: 6748042FBAD8C2E11C65E564170D55148EB88A9D
+    url: https://repo.helmforge.dev/pgp-public-key.asc
+  helmforge.dev/repository: https://repo.helmforge.dev
+  artifacthub.io/license: Apache-2.0
+  artifacthub.io/category: database
+  artifacthub.io/links: |
+    - name: Official Website
+      url: https://clickhouse.com
+    - name: Documentation
+      url: https://helmforge.dev/docs/charts/clickhouse
+    - name: Source
+      url: https://github.com/helmforgedev/charts/tree/main/charts/clickhouse
+    - name: support
+      url: https://github.com/helmforgedev/charts/issues

charts/clickhouse/DESIGN.md

@@ -0,0 +1,37 @@
+# ClickHouse Chart Design
+
+## Scope
+
+This chart deploys the official ClickHouse server image as a single StatefulSet
+with persistent data, headless and client Services, optional Prometheus metrics,
+External Secrets support, NetworkPolicy, and Helm test coverage.
+
+## Differentiation
+
+- Uses official `clickhouse/clickhouse-server` full-version tags.
+- Blocks unsafe `replicaCount > 1` and directs users to the ClickHouse Operator
+  for replicated topologies.
+- Enables built-in Prometheus metrics without sidecar images.
+- Keeps data and logs persistence separate.
+- Includes ESO, dual-stack Service fields, NetworkPolicy, and k3d validation.
+
+## Non-goals
+
+- The chart does not implement shards, replicas, Keeper, or ZooKeeper.
+- It does not render ClickHouse Operator CRDs.
+- It does not automate cluster backup/restore because full backups require
+  filesystem-local access and topology-specific restore procedures.
+
+<!-- @AI-METADATA
+type: chart-design
+title: ClickHouse Chart Design
+description: Design decisions for the ClickHouse HelmForge chart
+keywords: clickhouse, design, statefulset
+purpose: Capture chart scope and trade-offs
+scope: Chart
+relations:
+  - charts/clickhouse/values.yaml
+path: charts/clickhouse/DESIGN.md
+version: 1.0
+date: 2026-07-06
+-->

charts/clickhouse/README.md

@@ -0,0 +1,116 @@
+# ClickHouse
+
+Fast column-oriented OLAP database with production-safe standalone defaults.
+
+## Installation
+
+```bash
+helm repo add helmforge https://repo.helmforge.dev
+helm install clickhouse helmforge/clickhouse
+```
+
+```bash
+helm install clickhouse oci://ghcr.io/helmforgedev/helm/clickhouse
+```
+
+## Features
+
+- Official ClickHouse image pinned to `25.8.28.1`.
+- StatefulSet with persistent data volume.
+- Client Service exposing HTTP `8123` and native TCP `9000`.
+- Headless Service for stable pod DNS.
+- Built-in Prometheus metrics endpoint.
+- ServiceMonitor support.
+- External Secrets integration for the initial password.
+- NetworkPolicy and dual-stack Service fields.
+- Explicit guardrail blocking unsafe Helm-only replication.
+
+## Quick Start
+
+```yaml
+persistence:
+  size: 20Gi
+```
+
+## Production Example
+
+```yaml
+clickhouse:
+  database: analytics
+  user: analytics
+  existingSecret: clickhouse-auth
+persistence:
+  size: 200Gi
+metrics:
+  enabled: true
+  serviceMonitor:
+    enabled: true
+networkPolicy:
+  enabled: true
+```
+
+## Configuration
+
+| Parameter | Description | Default |
+| --- | --- | --- |
+| `replicaCount` | ClickHouse pod count. Must remain `1` | `1` |
+| `image.repository` | Official image repository | `docker.io/clickhouse/clickhouse-server` |
+| `image.tag` | Official full-version tag | `25.8.28.1` |
+| `clickhouse.database` | Initial database | `default` |
+| `clickhouse.user` | Initial user | `default` |
+| `clickhouse.password` | Initial password | `""` |
+| `persistence.enabled` | Persist data volume | `true` |
+| `persistence.size` | Data PVC size | `20Gi` |
+| `metrics.enabled` | Built-in Prometheus endpoint | `false` |
+| `networkPolicy.enabled` | Render NetworkPolicy | `false` |
+| `service.ipFamilyPolicy` | Service dual-stack policy | `""` |
+
+## Examples
+
+- [Standalone](examples/standalone.yaml)
+- [Production](examples/production.yaml)
+- [External Secrets](examples/external-secrets.yaml)
+- [Metrics](examples/metrics.yaml)
+
+## Architecture Guides
+
+- [Production](docs/production.md)
+- [Observability](docs/observability.md)
+- [External Secrets](docs/external-secrets.md)
+
+## Security Scan
+
+### Security Scan: `clickhouse`
+
+| Framework | Score |
+|---|---|
+| MITRE + NSA + SOC2 | **89.39%** |
+
+Security posture acceptable.
+
+Local details:
+
+- Tool: Kubescape v4.0.9
+- Command: `kubescape scan framework mitre,nsa,soc2 .tmp/clickhouse-render.yaml`
+- Result: 0 critical failed resources, resource summary score 89.39%.
+
+## Operator Boundary
+
+ClickHouse replication needs Keeper or ZooKeeper, cluster definitions, and
+cluster-aware operations. This chart intentionally blocks `replicaCount > 1`.
+Use the ClickHouse Operator or Altinity operator stack for sharded or replicated
+clusters.
+
+<!-- @AI-METADATA
+type: chart-readme
+title: ClickHouse Chart
+description: Production-ready standalone ClickHouse Helm chart
+keywords: clickhouse, database, olap, prometheus
+purpose: Chart usage documentation
+scope: Chart
+relations:
+  - charts/clickhouse/values.yaml
+path: charts/clickhouse/README.md
+version: 1.0
+date: 2026-07-06
+-->

charts/clickhouse/ci/auth-values.yaml

@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: Apache-2.0
+clickhouse:
+  user: analytics
+  password: test-password
+  database: analytics

charts/clickhouse/ci/default-values.yaml

@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: Apache-2.0
+clickhouse:
+  database: default

charts/clickhouse/ci/dual-stack.yaml

@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: Apache-2.0
+service:
+  ipFamilyPolicy: PreferDualStack

charts/clickhouse/ci/ephemeral-values.yaml

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: Apache-2.0
+persistence:
+  enabled: false
+logs:
+  persistence:
+    enabled: false

charts/clickhouse/ci/external-secrets-values.yaml

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: Apache-2.0
+clickhouse:
+  existingSecret: clickhouse-auth
+externalSecrets:
+  enabled: true
+  refreshInterval: 30m
+  items:
+    - fullnameOverride: clickhouse-auth
+      spec:
+        secretStoreRef:
+          name: helmforge-fake-store
+          kind: ClusterSecretStore
+        target:
+          name: clickhouse-auth
+          creationPolicy: Owner
+        data:
+          - secretKey: clickhouse-password
+            remoteRef:
+              key: test/password

charts/clickhouse/ci/metrics-values.yaml

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: Apache-2.0
+metrics:
+  enabled: true
+  serviceMonitor:
+    enabled: true
+    labels:
+      release: prometheus

charts/clickhouse/ci/network-policy-values.yaml

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: Apache-2.0
+metrics:
+  enabled: true
+networkPolicy:
+  enabled: true
+  egress:
+    enabled: true
+    extraEgress:
+      - to:
+          - ipBlock:
+              cidr: 10.0.0.0/8
+        ports:
+          - protocol: TCP
+            port: 443

charts/clickhouse/ci/production-values.yaml

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: Apache-2.0
+clickhouse:
+  database: analytics
+  user: analytics
+  password: test-password
+metrics:
+  enabled: true
+persistence:
+  size: 50Gi
+logs:
+  persistence:
+    enabled: true
+resources:
+  requests:
+    cpu: "1"
+    memory: 2Gi
+  limits:
+    memory: 4Gi

charts/clickhouse/docs/external-secrets.md

@@ -0,0 +1,42 @@
+# External Secrets
+
+The chart implements the HelmForge canonical `externalSecrets.items[]` contract.
+Use it to source the ClickHouse password from an external secret manager.
+
+```yaml
+clickhouse:
+  existingSecret: clickhouse-auth
+externalSecrets:
+  enabled: true
+  items:
+    - fullnameOverride: clickhouse-auth
+      spec:
+        secretStoreRef:
+          name: prod-secrets
+          kind: ClusterSecretStore
+        target:
+          name: clickhouse-auth
+          creationPolicy: Owner
+        data:
+          - secretKey: clickhouse-password
+            remoteRef:
+              key: prod/clickhouse/password
+```
+
+The official image reads `CLICKHOUSE_PASSWORD` only during first initialization
+of an empty data directory. Rotate passwords with SQL once a data volume already
+exists.
+
+<!-- @AI-METADATA
+type: chart-docs
+title: ClickHouse External Secrets Guide
+description: External Secrets integration for ClickHouse credentials
+keywords: clickhouse, external-secrets, credentials
+purpose: Explain secret projection
+scope: Chart
+relations:
+  - charts/clickhouse/templates/externalsecret.yaml
+path: charts/clickhouse/docs/external-secrets.md
+version: 1.0
+date: 2026-07-06
+-->

charts/clickhouse/docs/observability.md

@@ -0,0 +1,31 @@
+# Observability
+
+ClickHouse includes a built-in Prometheus endpoint. Set `metrics.enabled=true`
+to render config under `config.d/helmforge.xml` and expose the metrics port on
+the Service.
+
+## ServiceMonitor
+
+Set `metrics.serviceMonitor.enabled=true` when the Prometheus Operator CRDs are
+installed in the cluster. The chart keeps labels and namespace selectors
+customizable for common Prometheus deployments.
+
+## Useful Signals
+
+Track query latency, background merges, part counts, memory usage, disk usage,
+replication queue health when using external replicated topologies, and HTTP or
+native TCP availability.
+
+<!-- @AI-METADATA
+type: chart-docs
+title: ClickHouse Observability Guide
+description: Prometheus monitoring for ClickHouse
+keywords: clickhouse, prometheus, servicemonitor, metrics
+purpose: Explain metrics configuration
+scope: Chart
+relations:
+  - charts/clickhouse/templates/servicemonitor.yaml
+path: charts/clickhouse/docs/observability.md
+version: 1.0
+date: 2026-07-06
+-->