Observed Signal · Jul 2, 2026 · Technical Guide · Source: DEV Community · Impact: 2/5 · Sentiment: Positive
Infrastructure Market: Use Cloudflare Tunnel to Connect Vercel to Private ClickHouse
This technical walkthrough explains how to let a program hosted on Vercel securely read a private ClickHouse instance running on an EC2 server by using Cloudflare Tunnel. The guide covers registering a throwaway domain on Cloudflare, creating a tunnel and installing the cloudflared connector as a background service on the EC2 host, adding a published route that forwards ch.test.com to ClickHouse on localhost:8123, and setting up a read-only ClickHouse account with query quotas. It also shows how to add Cloudflare Access service tokens for a second layer of authentication and how to supply the Vercel app with the required environment variables (including CF Access credentials). The article includes a security checklist and a troubleshooting note about forcing http2 if outbound UDP/QUIC is blocked.
Practical, actionable guide for securely exposing private analytics databases to serverless apps; useful to engineering teams handling data access and secure integrations but not industry-shifting.
Key Takeaways & Evidence Grounding
- Cloudflare Tunnel (cloudflared) enables an outbound-only connection from a private EC2 host to Cloudflare, avoiding opening incoming firewall ports.
- ClickHouse's HTTP interface commonly listens on port 8123; the tunnel routes an HTTPS hostname (e.g., ch.test.com) to http://localhost:8123 on the server.
- The guide recommends creating a least-privilege read-only ClickHouse user (example: agent_ro) and applying a query/result quota to limit abuse.
- Cloudflare Access service tokens (Client ID + Client Secret) can be used as a second machine-to-machine authentication layer in front of the tunneled hostname.
- Vercel apps do not have fixed outbound IP addresses, so IP-based firewall whitelisting is not a reliable approach for serverless consumers.
Connected Companies & Entities
5 Entities mappedVercel
Frontend cloud platform for deploying and scaling modern web applications.
“On the other side is a program hosted somewhere else: an app on Vercel, a serverless function, a scheduled job, a third party tool, or an AI...”
ClickHouse
Open-source analytics database with managed cloud and observability.
“We run a ClickHouse database on an EC2 server that is not reachable from the public internet, and we need a program hosted on Vercel to read...”
Namecheap
Domain registrar and hosting platform for websites and online presence.
“Go to your domain registrar (where you bought the domain, for example Namecheap), find the nameserver setting, switch it from the registrar'...”
Cloudflare
Cloud platform for security, performance, and edge application delivery.
“One of its free products is Cloudflare Tunnel....”
Amazon Web Services (AWS)
Cloud infrastructure, platform and AI services for enterprises and developers.
“EC2: a virtual server you rent from Amazon Web Services (AWS)....”
Ontology Mapping & Concepts
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.