How to create a read-only user in ClickHouse

In ClickHouse, a settings profile is a collection of settings grouped under the same name. By default, there is a profile readonly that allows only read queries. This is from /etc/clickhouse-server/users.xml:

<yandex>
    <!-- Profiles of settings. -->
    <profiles>
        ...
        <!-- Profile that allows only read queries. -->
        <readonly>
            <readonly>1</readonly>
        </readonly>
    </profiles>
...

So to create a read-only user we just have to:

CREATE USER username IDENTIFIED WITH plaintext_password BY 'qwerty' SETTINGS PROFILE 'readonly'
GRANT SHOW TABLES, SELECT ON database.* TO username