ClickHouse data stack

Read references/configuration.md before changing desired state or running a real lifecycle operation.

The package creates three ClickHouse/Keeper nodes and one Metabase/Postgres server. Cloudflare names resolve to WireGuard addresses. ClickHouse and Metabase service ports are never public. Local dbt seeds and tests a replicated sample model, registers ClickHouse in Metabase, runs end-to-end acceptance checks, and proves every OpenTofu state has no remaining drift.

Safety