ClickHouse

Connect ClickHouse (ClickHouse Cloud or your own server) to Fresco BI. Fresco BI talks to the ClickHouse HTTPS interface, reads tables and views with read-only queries and loads them into a Data Table (Import).

Feature	Supported
Import	Yes
DirectQuery	No
SSL/TLS	Always on (verify-full)
SSH tunnel	No
Cloud	Yes
On-premises (via Gateway)	Yes

Prerequisites

• The ClickHouse HTTPS interface enabled with a valid certificate. The default port is 8443 (ClickHouse Cloud uses it; on your own server set https_port). The native TCP port (9000 / 9440) and plain HTTP (8123) are not used.
• An admin account that can run CREATE USER and GRANT.
• The name of the database you want to read.

Step 1: Create a read-only user

CREATE USER fresco_reader IDENTIFIED WITH sha256_password BY '<strong-password>';
GRANT SELECT ON <database>.* TO fresco_reader;

A grant on <database>.* also covers tables created later in that database. Repeat the GRANT for each database to read. Restrict where the user may log in from with HOST IP '<address>' in CREATE USER if you can.

Fresco BI sends every query with readonly = 2 and its own time and memory limits (4 GiB per query). If the user’s settings profile is readonly = 1, those settings are refused, so Fresco BI sends none: the server’s own limits apply and the test shows a warning. Both work.

Step 2: Allow network access

Pick one of these:

• Cloud (server reachable from the internet). Allow inbound connections from Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) on port 8443. In ClickHouse Cloud, add the addresses to the service’s IP access list. For your own server, open the port in the security group or firewall.
• On-premises (via Gateway). If the server sits inside a private network, choose On-premises (via Gateway) in the form. The panel switches to the Gateway guide when that option is picked.

SSH tunnels are not available for ClickHouse.

Step 3: Fill in the form

• Connection type: Cloud or On-premises (via Gateway). With On-premises, pick a Gateway cluster.
• Display name: the name shown in Fresco BI.
• Host: the server’s DNS name, for example abc123.eu-west-1.aws.clickhouse.cloud. It must match the name in the server certificate.
• Port: filled with 8443.
• Database: the database to read. Only this database is listed.
• User: fresco_reader.
• Password: the password from Step 1. It is stored encrypted and never shown again.
• SSL mode: locked to verify-full.
• CA certificate (PEM): leave empty for a server with a public certificate (ClickHouse Cloud). For a private or self-signed certificate, paste the CA (or the server’s certificate).

Click Test connection, then Save.

SSL modes

ClickHouse connections are always encrypted and verified (verify-full): the certificate chain and the host name are checked. The password travels in HTTP Basic auth, so plain HTTP is never offered.

Troubleshooting

• The server rejected the user name or password. Check the user and password, and any HOST restriction on the user.
• The database user cannot read this object. Run the GRANT SELECT from Step 1 for that database.
• The database or object was not found on the server. Check the Database field; names are case-sensitive.
• The source returned a data type this connector does not support. Array, Map, Tuple, Nested, JSON, Variant, Dynamic and aggregate-state columns are not supported; leave them out of the load. Tables with streaming engines (Kafka, RabbitMQ, NATS, FileLog, S3Queue, AzureQueue) are listed but never read.
• The SSL connection could not be set up with the chosen mode. Check the SSL mode and the CA certificate. Make sure the port is the HTTPS port (not 8123 or 9000), the host matches the certificate, and for a private CA paste it in CA certificate (PEM).
• No connection could be opened to this host and port. Check the host, the port, and that the firewall allows Fresco BI’s IP. Add Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) to the IP access list or firewall.
• The server did not answer in time. Usually a firewall that drops packets, or a wrong host or port. Check the firewall rules and the port.
• The host is in a blocked range (private, loopback or metadata). A database inside a private network needs an On-premises connection through a Gateway. Use the public host name, or On-premises (via Gateway).
• A size or concurrent-connection limit was exceeded. A query hit the 4 GiB memory limit or a server quota; load fewer or narrower tables, or raise the user’s quota.