Skip to main content
A ClickHouse connection authenticates Infisical to your ClickHouse server with the username and password of a ClickHouse user, so Infisical can change the passwords of other ClickHouse users.
This guide only authenticates Infisical with ClickHouse. Once the app connection is ready, you can use it to set up integrations.

​
Prerequisites

  • A ClickHouse user that can create users and grant privileges, such as default
  • Network access from Infisical to the HTTP interface of your ClickHouse server, or a Gateway that can reach it

​
Step 1: Create a ClickHouse user for Infisical

Infisical needs a ClickHouse user with the ALTER USER privilege, which lets it change the passwords of other users.
1
Connect to ClickHouse as a user that can create users and grant privileges, such as default, and create a user for Infisical:
2
Grant the user the ALTER USER privilege:

​
Step 2: Create the app connection

Next, create the app connection in Infisical.
To create the connection using the API, use the Create ClickHouse Connection endpoint.
1
In the sidebar, select Integrations, then open the App Connections tab.App Connections Tab
2
Select Add Connection and choose ClickHouse.
3
Fill out the form’s fields:
  • Name: A descriptive name for the connection
  • Description (optional): A note for future reference
  • Gateway (optional): The Gateway Infisical connects through, if Infisical can’t reach your ClickHouse server directly, such as when the server is in a private network
  • Method: Username & Password
  • Host: The hostname or IP address of your ClickHouse server, without https:// or a port, such as <your-service>.us-east-1.aws.clickhouse.cloud
  • Database Name: The database Infisical connects to, such as default
  • Port: The port of the ClickHouse HTTP interface (usually 8443 for HTTPS, including ClickHouse Cloud, and 8123 for HTTP)
  • Username: The user you created in Step 1
  • Password: The password of that user
  • Enable SSL: On the SSL tab, whether Infisical connects over HTTPS (on by default; turn it off for an HTTP port such as 8123)
  • SSL Certificate (optional): On the SSL tab, the CA certificate in PEM format that signed your server’s TLS certificate (ClickHouse Cloud doesn’t need one)
  • Reject Unauthorized: On the SSL tab, whether Infisical refuses to connect when it can’t verify the server’s TLS certificate (on by default; for a self-signed certificate, enter its CA certificate in SSL Certificate instead of turning this off)
Then, select Connect to Database.
When you select Connect to Database, Infisical signs in to ClickHouse with the username and password, and doesn’t save the connection if ClickHouse rejects them. Infisical doesn’t check the ALTER USER privilege until you create a rotation.
Your ClickHouse app connection is ready to use.

​
Step 3: Configure integrations

Now that your ClickHouse app connection is configured, you can use it to set up the following integrations:

ClickHouse credentials

Rotate the passwords of two ClickHouse users on a schedule.