diff --git a/docs/src/reference/options.md b/docs/src/reference/options.md
index 9962cead5..dc2e4153d 100644
--- a/docs/src/reference/options.md
+++ b/docs/src/reference/options.md
@@ -27242,6 +27242,78 @@ Which http port to run clickhouse on.
 
 
 
+## services.clickhouse.keeper.enable
+
+
+
+Whether to enable keeper_server in ClickHouse.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+
+```nix
+false
+```
+
+*Declared by:*
+ - [https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+## services.clickhouse.keeperPort
+
+
+
+Which port to run clickhouse keeper service on.
+
+
+
+*Type:*
+16 bit unsigned integer; between 0 and 65535 (both inclusive)
+
+
+
+*Default:*
+
+```nix
+9181
+```
+
+*Declared by:*
+ - [https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+## services.clickhouse.macros.enable
+
+
+
+Whether to enable macros in ClickHouse.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+
+```nix
+false
+```
+
+*Declared by:*
+ - [https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
 ## services.clickhouse.port
 
 
@@ -27266,6 +27338,122 @@ Which port to run clickhouse on.
 
 
 
+## services.clickhouse.raftPort
+
+
+
+Which http port to use clickhouse keeper for raft consensus.
+
+
+
+*Type:*
+16 bit unsigned integer; between 0 and 65535 (both inclusive)
+
+
+
+*Default:*
+
+```nix
+9234
+```
+
+*Declared by:*
+ - [https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+## services.clickhouse.remoteServers.enable
+
+
+
+Whether to enable remote_servers in ClickHouse.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+
+```nix
+false
+```
+
+*Declared by:*
+ - [https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+## services.clickhouse.timezone
+
+
+
+Which timezone to use for ClickHouse.
+
+
+
+*Type:*
+null or string
+
+
+
+*Default:*
+
+```nix
+null
+```
+
+*Declared by:*
+ - [https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+## services.clickhouse.usersConfig
+
+
+
+Your ` users.yaml ` as a Nix attribute set.
+Check the [documentation](https://clickhouse.com/docs/operations/configuration-files\#user-settings)
+for possible options.
+
+
+
+*Type:*
+YAML 1.1 value
+
+
+
+*Default:*
+
+```nix
+{ }
+```
+
+
+
+*Example:*
+
+````nix
+{
+  profiles = {};
+
+  users = {
+    default = {
+      profile = "default";
+      password_sha256_hex = "36dd292533174299fb0c34665df468bb881756ca9eaf9757d0cfde38f9ededa1";  # `echo -n verysecret | sha256sum`
+    };
+  };
+}
+
+````
+
+*Declared by:*
+ - [https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
 ## services.cockroachdb.enable
 
 
diff --git a/docs/src/services/clickhouse.md b/docs/src/services/clickhouse.md
index 290a81363..ab46024f8 100644
--- a/docs/src/services/clickhouse.md
+++ b/docs/src/services/clickhouse.md
@@ -99,6 +99,78 @@ Which http port to run clickhouse on\.
 
 
 
+### services\.clickhouse\.keeper\.enable
+
+
+
+Whether to enable keeper_server in ClickHouse\.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+
+```nix
+false
+```
+
+*Declared by:*
+ - [https://github\.com/cachix/devenv/blob/main/src/modules/services/clickhouse\.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+### services\.clickhouse\.keeperPort
+
+
+
+Which port to run clickhouse keeper service on\.
+
+
+
+*Type:*
+16 bit unsigned integer; between 0 and 65535 (both inclusive)
+
+
+
+*Default:*
+
+```nix
+9181
+```
+
+*Declared by:*
+ - [https://github\.com/cachix/devenv/blob/main/src/modules/services/clickhouse\.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+### services\.clickhouse\.macros\.enable
+
+
+
+Whether to enable macros in ClickHouse\.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+
+```nix
+false
+```
+
+*Declared by:*
+ - [https://github\.com/cachix/devenv/blob/main/src/modules/services/clickhouse\.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
 ### services\.clickhouse\.port
 
 
@@ -120,3 +192,119 @@ Which port to run clickhouse on\.
 
 *Declared by:*
  - [https://github\.com/cachix/devenv/blob/main/src/modules/services/clickhouse\.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+### services\.clickhouse\.raftPort
+
+
+
+Which http port to use clickhouse keeper for raft consensus\.
+
+
+
+*Type:*
+16 bit unsigned integer; between 0 and 65535 (both inclusive)
+
+
+
+*Default:*
+
+```nix
+9234
+```
+
+*Declared by:*
+ - [https://github\.com/cachix/devenv/blob/main/src/modules/services/clickhouse\.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+### services\.clickhouse\.remoteServers\.enable
+
+
+
+Whether to enable remote_servers in ClickHouse\.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+
+```nix
+false
+```
+
+*Declared by:*
+ - [https://github\.com/cachix/devenv/blob/main/src/modules/services/clickhouse\.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+### services\.clickhouse\.timezone
+
+
+
+Which timezone to use for ClickHouse\.
+
+
+
+*Type:*
+null or string
+
+
+
+*Default:*
+
+```nix
+null
+```
+
+*Declared by:*
+ - [https://github\.com/cachix/devenv/blob/main/src/modules/services/clickhouse\.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
+
+
+
+### services\.clickhouse\.usersConfig
+
+
+
+Your ` users.yaml ` as a Nix attribute set\.
+Check the [documentation](https://clickhouse\.com/docs/operations/configuration-files\#user-settings)
+for possible options\.
+
+
+
+*Type:*
+YAML 1\.1 value
+
+
+
+*Default:*
+
+```nix
+{ }
+```
+
+
+
+*Example:*
+
+````nix
+{
+  profiles = {};
+
+  users = {
+    default = {
+      profile = "default";
+      password_sha256_hex = "36dd292533174299fb0c34665df468bb881756ca9eaf9757d0cfde38f9ededa1";  # `echo -n verysecret | sha256sum`
+    };
+  };
+}
+
+````
+
+*Declared by:*
+ - [https://github\.com/cachix/devenv/blob/main/src/modules/services/clickhouse\.nix](https://github.com/cachix/devenv/blob/main/src/modules/services/clickhouse.nix)
diff --git a/src/modules/services/clickhouse.nix b/src/modules/services/clickhouse.nix
index 0a1873aad..0fc9c1e1f 100644
--- a/src/modules/services/clickhouse.nix
+++ b/src/modules/services/clickhouse.nix
@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 
 let
   cfg = config.services.clickhouse;
@@ -7,8 +12,14 @@ let
   # Port allocation
   basePort = cfg.port;
   baseHttpPort = cfg.httpPort;
+  baseKeeperPort = cfg.keeperPort;
+  baseRaftPort = cfg.raftPort;
   allocatedPort = config.processes.clickhouse-server.ports.main.value;
   allocatedHttpPort = config.processes.clickhouse-server.ports.http.value;
+  allocatedKeeperPort = config.processes.clickhouse-server.ports.keeper.value;
+  allocatedRaftPort = config.processes.clickhouse-server.ports.raft.value;
+
+  format = pkgs.formats.yaml { };
 in
 {
   options.services.clickhouse = {
@@ -33,10 +44,68 @@ in
       default = 8123;
     };
 
+    keeperPort = lib.mkOption {
+      type = types.port;
+      description = "Which port to run clickhouse keeper service on.";
+      default = 9181;
+    };
+
+    raftPort = lib.mkOption {
+      type = types.port;
+      description = "Which http port to use clickhouse keeper for raft consensus.";
+      default = 9234;
+    };
+
+    timezone = lib.mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Which timezone to use for ClickHouse.";
+    };
+
+    macros.enable = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to enable macros in ClickHouse.";
+    };
+
+    remoteServers.enable = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to enable remote_servers in ClickHouse.";
+    };
+
+    keeper.enable = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to enable keeper_server in ClickHouse.";
+    };
+
     config = lib.mkOption {
       type = types.lines;
       description = "ClickHouse configuration in YAML.";
     };
+
+    usersConfig = lib.mkOption {
+      type = format.type;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          profiles = {};
+
+          users = {
+            default = {
+              profile = "default";
+              password_sha256_hex = "36dd292533174299fb0c34665df468bb881756ca9eaf9757d0cfde38f9ededa1";  # `echo -n verysecret | sha256sum`
+            };
+          };
+        }
+      '';
+      description = ''
+        Your `users.yaml` as a Nix attribute set.
+        Check the [documentation](https://clickhouse.com/docs/operations/configuration-files#user-settings)
+        for possible options.
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -45,6 +114,7 @@ in
       logger:
         level: warning
         console: 1
+      ${lib.optionalString (cfg.timezone != null) "timezone: ${cfg.timezone}"}
       tcp_port: ${toString allocatedPort}
       http_port: ${toString allocatedHttpPort}
       default_profile: default
@@ -53,17 +123,68 @@ in
       tmp_path: ${config.env.DEVENV_STATE}/clickhouse/tmp
       user_files_path: ${config.env.DEVENV_STATE}/clickhouse/user_files
       format_schema_path: ${config.env.DEVENV_STATE}/clickhouse/format_schemas
+      access_control_path: ${config.env.DEVENV_STATE}/clickhouse/access
+      custom_cached_disks_base_directory: ${config.env.DEVENV_STATE}/clickhouse/caches
       user_directories:
         users_xml:
-          path: ${cfg.package}/etc//clickhouse-server/users.xml
+          path: ${config.env.DEVENV_STATE}/clickhouse/server/users.xml
+        local_directory:
+          path: ${config.env.DEVENV_STATE}/clickhouse/access
+
+      ${lib.optionalString cfg.macros.enable ''
+        macros:
+          shard: 1
+          replica: localhost
+      ''}
+
+      ${lib.optionalString cfg.remoteServers.enable ''
+        remote_servers:
+          default:
+            shard:
+              replica:
+                host: localhost
+                port: ${toString allocatedPort}
+      ''}
+
+      ${lib.optionalString cfg.keeper.enable ''
+        keeper_server:
+          tcp_port: ${toString allocatedKeeperPort}
+          server_id: 1
+          log_storage_path: ${config.env.DEVENV_STATE}/clickhouse/coordination/log
+          snapshot_storage_path: ${config.env.DEVENV_STATE}/clickhouse/coordination/snapshots
+          raft_configuration:
+            server:
+              id: 1
+              hostname: localhost
+              port: ${toString allocatedRaftPort}
+      ''}
     '';
+
+    tasks."devenv:clickhouse:setup" = {
+      description = "Setup ClickHouse";
+      exec = ''
+        mkdir -p ${config.env.DEVENV_STATE}/clickhouse/{server/config.d,server/users.d,tmp,user_files,format_schemas,access,caches,coordination/snapshots,coordination/log}
+        install -m 644 ${cfg.package}/etc/clickhouse-server/users.xml ${config.env.DEVENV_STATE}/clickhouse/server/users.xml
+        install -m 644 ${cfg.package}/etc/clickhouse-server/config.xml ${config.env.DEVENV_STATE}/clickhouse/server/config.xml
+        install -m 644 ${pkgs.writeText "clickhouse-config.yaml" cfg.config} ${config.env.DEVENV_STATE}/clickhouse/server/config.d/clickhouse-config.yaml
+        install -m 644 ${format.generate "users.yaml" cfg.usersConfig} ${config.env.DEVENV_STATE}/clickhouse/server/users.d/users.yaml
+      '';
+      before = [ "devenv:processes:clickhouse-server" ];
+    };
+
     processes.clickhouse-server = {
       ports.main.allocate = basePort;
       ports.http.allocate = baseHttpPort;
-      exec = "exec clickhouse-server --config-file=${pkgs.writeText "clickhouse-config.yaml" cfg.config}";
+      ports.keeper.allocate = baseKeeperPort;
+      ports.raft.allocate = baseRaftPort;
+      exec = "exec clickhouse-server --config-file=${config.env.DEVENV_STATE}/clickhouse/server/config.xml";
 
       ready = {
-        exec = "${cfg.package}/bin/clickhouse-client --port ${toString allocatedPort} -q 'SELECT 1'";
+        exec = "${cfg.package}/bin/clickhouse-client --port ${toString allocatedPort} --user default ${
+          lib.optionalString (
+            config.services.clickhouse.usersConfig.users.default ? password
+          ) "--password ${config.services.clickhouse.usersConfig.users.default.password}"
+        } -q 'SELECT 1'";
         initial_delay = 2;
         probe_timeout = 4;
         failure_threshold = 5;