Observed Signal · Jul 2, 2026 · Technical Guide · Source: DEV Community · Impact: 2/5 · Sentiment: Positive
Infrastructure Market: Use Cloudflare Tunnel to Connect Vercel to Private ClickHouse
This technical walkthrough explains how to let a program hosted on Vercel securely read a private ClickHouse instance running on an EC2 server by using Cloudflare Tunnel. The guide covers registering a throwaway domain on Cloudflare, creating a tunnel and installing the cloudflared connector as a background service on the EC2 host, adding a published route that forwards ch.test.com to ClickHouse on localhost:8123, and setting up a read-only ClickHouse account with query quotas. It also shows how to add Cloudflare Access service tokens for a second layer of authentication and how to supply the Vercel app with the required environment variables (including CF Access credentials). The article includes a security checklist and a troubleshooting note about forcing http2 if outbound UDP/QUIC is blocked.
Practical, actionable guide for securely exposing private analytics databases to serverless apps; useful to engineering teams handling data access and secure integrations but not industry-shifting.
Wichtigste Kernpunkte & Evidenz
- Cloudflare Tunnel (cloudflared) enables an outbound-only connection from a private EC2 host to Cloudflare, avoiding opening incoming firewall ports.
- ClickHouse's HTTP interface commonly listens on port 8123; the tunnel routes an HTTPS hostname (e.g., ch.test.com) to http://localhost:8123 on the server.
- The guide recommends creating a least-privilege read-only ClickHouse user (example: agent_ro) and applying a query/result quota to limit abuse.
- Cloudflare Access service tokens (Client ID + Client Secret) can be used as a second machine-to-machine authentication layer in front of the tunneled hostname.
- Vercel apps do not have fixed outbound IP addresses, so IP-based firewall whitelisting is not a reliable approach for serverless consumers.
Verknüpfte Unternehmen
5 verknüpfte UnternehmenVercel
Frontend-Cloud-Plattform für das Deployment und die Skalierung moderner Webanwendungen.
“On the other side is a program hosted somewhere else: an app on Vercel, a serverless function, a scheduled job, a third party tool, or an AI...”
ClickHouse
Open-source analytics database with managed cloud and observability.
“We run a ClickHouse database on an EC2 server that is not reachable from the public internet, and we need a program hosted on Vercel to read...”
Namecheap
Domain-Registrar und Hosting-Plattform für Websites und Online-Präsenzen.
“Go to your domain registrar (where you bought the domain, for example Namecheap), find the nameserver setting, switch it from the registrar'...”
Cloudflare
Globale Cloud-Plattform für Sicherheit, Performance und Edge-Application-Delivery.
“One of its free products is Cloudflare Tunnel....”
Amazon Web Services (AWS)
Cloud infrastructure, platform and AI services for enterprises and developers.
“EC2: a virtual server you rent from Amazon Web Services (AWS)....”
Ontology Mapping & Concepts
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.