system tables, and running SQL. It connects to the ClickHouse HTTP interface over the device
network or through an SSH bastion; it doesn’t require a relay server.
Before you begin
- Install ProbeDeck from the App Store.
- Use iOS or iPadOS 17.0 or later.
- Allow the device to reach the ClickHouse HTTP or HTTPS endpoint over its network, a VPN, or an SSH bastion.
- Create a ClickHouse user with access to the databases you want to query.
- Grant the user
SELECTaccess to the relevantsystemtables for monitoring.
Some monitoring sections depend on optional log tables or newer system tables. For example,
system.server_settings, which ProbeDeck uses for the configured memory limit, requires ClickHouse
23.3 or later. ProbeDeck marks an affected section as limited when its source is unavailable.
How it works
- ProbeDeck sends SQL requests to the ClickHouse HTTP(S) endpoint.
- It reads monitoring data from
systemtables with the configured ClickHouse user. - The app shows query results and monitoring views on the device. An SSH bastion can carry the same HTTP(S) connection when the endpoint has no direct route from the device.
Connect to ClickHouse Cloud
1
Gather the service connection details
In the ClickHouse Cloud console, open your service, select Connect, and choose HTTPS.To connect to ClickHouse with HTTP(S) you need this information:
Choose HTTPS. Connection details are displayed in an example 
If you’re using self-managed ClickHouse, the connection details are set by your ClickHouse administrator.
The details for your ClickHouse Cloud service are available in the ClickHouse Cloud console.
Select a service and click Connect:

curl command.
2
Add the connection in ProbeDeck
- On the Connections screen, tap +.
- Enter a connection name and the host without
https://. - Set Port to
8443and turn on TLS. - Enter the database username and password from the Connect dialog. The database name is optional.
- Tap Test Connection. ProbeDeck shows the server version and round-trip time after a successful check.
- Tap Save.
Connect to self-hosted ClickHouse
1
Choose the HTTP endpoint
Use port
8123 for the default unencrypted HTTP interface. For HTTPS, turn on TLS and use the
port configured on your server; 8443 is a common choice.Ports
9000 and 9440 belong to the native ClickHouse protocol. ProbeDeck uses the HTTP(S)
interface, so enter the server’s HTTP port.2
Add and test the connection
- On the Connections screen, tap +.
- Enter the server host without a URL scheme.
- Set the HTTP(S) port and TLS option.
- Enter the ClickHouse username, password, and optional database.
- Tap Test Connection, then Save.
Connect through an SSH bastion
Turn on SSH Tunnel in the connection form and enter:- The bastion host and SSH port (
22by default). - The SSH username.
- Either an SSH password or a private key.
direct-tcpip channel from the bastion to the ClickHouse host and HTTP(S)
port in the Server section. On the first connection, compare the bastion’s SHA-256 host-key
fingerprint with a value from the server administrator before accepting it.
Configure authentication and TLS
ProbeDeck sends the database username and password in theX-ClickHouse-User and
X-ClickHouse-Key request headers. It doesn’t put credentials in the URL.
For mutual TLS, turn on TLS Client Certificate and import a PKCS#12 (.p12) file that contains
the client certificate and private key, then enter its passphrase.
When a self-hosted endpoint presents a self-signed certificate or a certificate from a private
CA, ProbeDeck shows its SHA-256 fingerprint, issuer, subject, and validity period. Compare the
fingerprint with the value from the server administrator before accepting it. ProbeDeck pins the
decision to that connection; a certificate change stops the connection until you review it.
ProbeDeck stores connection secrets and imported key material in the iOS Keychain on the device.
Monitor ClickHouse
Open the saved connection and select Monitor. The dashboard summarizes these sources:
Tap Running queries to sort active queries by elapsed time and inspect memory and rows read.
Query the UK property price dataset
This example uses the UK property price dataset. Load the dataset intouk_price_paid, then:
- Open the connection and select Data.
- Open the SQL editor.
- Run this bounded, read-only query:
Known limits
- ProbeDeck runs on iOS and iPadOS 17.0 or later.
- Free users can save one connection at a time. Deleting it frees the slot; ProbeDeck Pro allows unlimited saved connections.
- It supports the ClickHouse HTTP(S) interface, not the native protocol.
- ProbeDeck loads SQL results in pages of 200 rows and caps each request at 10,000 rows. Use a
selective
WHEREclause andLIMITfor large tables. - Monitoring visibility depends on the ClickHouse user’s grants and on optional log tables.
- The device needs a route to the endpoint over its network, a VPN, or the built-in SSH tunnel.
- Monitoring and read-only SQL do not require an in-app purchase.
KILL QUERY,KILL MUTATION, write and DDL statements, and other operational actions require ProbeDeck Pro.
Troubleshooting
Authentication failed
Authentication failed
Copy the database username and password again. For the ClickHouse Cloud service endpoint, use the
database credentials from the service’s Connect dialog. Do not substitute an organization-level
key from the ClickHouse Cloud API Keys page.
The connection was refused or timed out
The connection was refused or timed out
Confirm that the device can reach the host and HTTP(S) port. Check the Cloud IP access list, VPN,
firewall, and port mapping. Don’t use the native protocol ports
9000 or 9440.Monitoring shows limited permissions
Monitoring shows limited permissions
The ClickHouse user can’t read one or more required
system tables. Ask the server administrator
for the minimum SELECT grants required for the monitoring areas you intend to use, then reconnect.The TLS fingerprint changed
The TLS fingerprint changed
Ask the server administrator to confirm the certificate rotation before accepting the new
fingerprint. An unexpected change can indicate a different endpoint or TLS interception path.
Next steps
- See the ProbeDeck website for product-specific details.
- See the ClickHouse HTTP interface documentation for server configuration.