ajeetraina777/clickhouse-kit:latest

schemaVersion: "2"
kind: mixin
name: clickhouse
displayName: ClickHouse (remote connector)
description: 'Connects an agent to a remote ClickHouse warehouse (ClickHouse Cloud or self-hosted) over the HTTP interface. The agent queries with curl; the password is injected by the sbx proxy into the X-ClickHouse-Key header, so it never lives inside the container. Edit the CLICKHOUSE_* values below for your warehouse; set the password with: sbx secret set clickhouse.'
agentInstructions:
    content: |
        ClickHouse remote warehouse over the HTTP interface. Query it with `curl`;
        the password is injected by the sbx proxy into the X-ClickHouse-Key header on
        requests to CLICKHOUSE_HOST, so it never appears in this container.

        Every request needs these two auth headers:
          -H "X-ClickHouse-User: $CLICKHOUSE_USER"
          -H "X-ClickHouse-Key:  $CLICKHOUSE_PASSWORD"   # sentinel 'proxy-managed'; the proxy swaps it

        Base URL: https://$CLICKHOUSE_HOST:$CLICKHOUSE_PORT/  (use http:// if CLICKHOUSE_SECURE=false)
        Pass `curl -k`: the proxy terminates TLS in-container with its own CA, but it
        still verifies TLS to the real warehouse, so the warehouse hop stays protected.

        Examples:
          # sanity check
          curl -sk -H "X-ClickHouse-User: $CLICKHOUSE_USER" -H "X-ClickHouse-Key: $CLICKHOUSE_PASSWORD" \
            "https://$CLICKHOUSE_HOST:$CLICKHOUSE_PORT/?query=SELECT%201"

          # list databases / tables
          curl -sk -H "X-ClickHouse-User: $CLICKHOUSE_USER" -H "X-ClickHouse-Key: $CLICKHOUSE_PASSWORD" \
            "https://$CLICKHOUSE_HOST:$CLICKHOUSE_PORT/?query=SHOW%20DATABASES"

          # run a read query — POST the SQL to avoid URL-encoding (add FORMAT for shape)
          curl -sk -H "X-ClickHouse-User: $CLICKHOUSE_USER" -H "X-ClickHouse-Key: $CLICKHOUSE_PASSWORD" \
            --data-binary "SELECT name, engine FROM system.tables LIMIT 10 FORMAT PrettyCompact" \
            "https://$CLICKHOUSE_HOST:$CLICKHOUSE_PORT/"

        Keep queries read-only (SELECT / SHOW / DESCRIBE). For a hard guarantee, use a
        read-only ClickHouse user, or append `&readonly=1` to the URL. The native
        protocol (clickhouse-client on 9000/9440) is NOT available — its auth cannot
        be proxy-injected; use the HTTP interface as above.
permissions:
    network:
        allow:
            - CHANGE_ME.clickhouse.cloud
credentials:
    - service: clickhouse
      description: 'ClickHouse password (set it with: sbx secret set clickhouse)'
      apiKey:
        name: CLICKHOUSE_PASSWORD
        inject:
            - domain: CHANGE_ME.clickhouse.cloud
              header: X-ClickHouse-Key
              format: '%s'
environment:
    variables:
        CLICKHOUSE_DATABASE: default
        CLICKHOUSE_HOST: CHANGE_ME.clickhouse.cloud
        CLICKHOUSE_PASSWORD: proxy-managed
        CLICKHOUSE_PORT: "8443"
        CLICKHOUSE_SECURE: "true"
        CLICKHOUSE_USER: default