> ## Documentation Index
> Fetch the complete documentation index at: https://docs.genloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# ClickHouse

> Connect a ClickHouse database to Genloop over HTTP or HTTPS with host, port, and read-only credentials, optionally through an SSH tunnel.

Genloop connects to ClickHouse over its HTTP interface using a read-only user. By default the connection is encrypted (HTTPS).

## Before you connect

* A ClickHouse user with read access to the tables you want to query.
* Whether the server uses a secure (HTTPS) or plain (HTTP) interface.
* Network access from Genloop. If the server is behind a firewall, allow Genloop's regional IP address. See [Before you begin](/using-genloop/connections/connect-a-database#before-you-begin).

## Connection fields

| Field               | Description                                                                                                                                              |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Connection name** | A name to identify this connection in Genloop                                                                                                            |
| **Host**            | Hostname or IP address of your ClickHouse server                                                                                                         |
| **Port**            | Port of your ClickHouse HTTP interface. Defaults to `8443`. Commonly `8443` for HTTPS or `8123` for HTTP, but use whatever your server is configured for |
| **Database**        | Name of the database to query                                                                                                                            |
| **Username**        | ClickHouse user Genloop connects as                                                                                                                      |
| **Password**        | Password for that user                                                                                                                                   |
| **Secure**          | Use HTTPS. Enabled by default. Disable only for a plain HTTP endpoint                                                                                    |

## Encryption (TLS)

Keep **Secure** turned on to connect over HTTPS. This is the recommended setting and keeps traffic encrypted. Turn it off only when your server's HTTP interface is not encrypted, for example inside a trusted private network.

Set **Port** to match the interface you use. The port does not change automatically when you toggle **Secure**, so make sure it points at your server's actual HTTP or HTTPS port.

## Connect through an SSH tunnel

If the server is not reachable directly, reach it through a bastion or jump host. Turn on **Connect via SSH tunnel** in the connection form and complete these fields.

| Field                   | Description                                                                             |
| ----------------------- | --------------------------------------------------------------------------------------- |
| **SSH host**            | Public IP or DNS of the bastion. Cannot be `localhost`                                  |
| **SSH port**            | SSH port on the bastion. Default is `22`                                                |
| **SSH username**        | User Genloop signs in to the bastion as                                                 |
| **PEM key**             | Your private key file. Sent encrypted with the rest of the credentials                  |
| **Remote bind address** | Server host as seen from the bastion. Use `127.0.0.1` if the server runs on the bastion |
| **Remote bind port**    | Server port as reached from the bastion                                                 |

## Permissions

Genloop only reads your data and never writes to your database. You can connect with any user that already has read access to the tables you select.

If you want a dedicated read-only user for Genloop, ask your database administrator to set one up.

<Accordion title="Minimal read-only grant (for your database administrator)">
  Run this in your ClickHouse database:

  ```sql theme={null}
  GRANT SELECT ON your_database.* TO genloop_user;
  ```
</Accordion>

## Next steps

<CardGroup cols={2}>
  <Card title="Connect a database" icon="database" href="/using-genloop/connections/connect-a-database">
    Back to the full connection flow.
  </Card>

  <Card title="Context Hub" icon="brain" href="/using-genloop/context-hub">
    View and edit the memory built from your connection.
  </Card>
</CardGroup>