Reach prod ClickHouse through your bastion
Your production ClickHouse doesn't sit on the public internet. It lives inside a private network, and the only way in is a jump host. ProbeDeck opens a TCP tunnel over SSH straight from your iPhone to that bastion and forwards to the cluster's HTTP or HTTPS port, so you can watch health and running queries from anywhere. No VPN app, no relay, no extra infrastructure. Because monitoring is free, you can prove it works on your own bastion before you ever pay.
An SSH tunnel from the phone, not a VPN
ProbeDeck reaches a cluster behind a VPN or private network by opening an SSH tunnel directly from the device to your jump host, then forwarding the connection to ClickHouse's HTTP interface on 8123 or the TLS interface on 8443. There is no VPN app to install and no side service to run. You enter the bastion address, the ClickHouse host and port it can reach, and ProbeDeck does the port forwarding itself. From there the monitoring dashboard, running queries, and replica lag all load as they would on a direct connection.
Key or password auth, with a verified fingerprint
Authenticate to the bastion with a password or an Ed25519 or RSA private key, whichever your jump host expects. Before it opens the tunnel, ProbeDeck shows the server's host key fingerprint and verifies it, so it catches a swapped or spoofed host instead of silently trusting it. Private keys are held in the device's Secure Enclave; passwords and other connection credentials live in the iOS Keychain. Nothing about the connection syncs to an external service.
SSH is on the free tier on purpose
The people who need this are the ones sitting behind a bastion, and a locked-away tunnel would stop them before they could try read-only monitoring. SSH sits in the free tier, not behind a Pro upsell. You can wire ProbeDeck to your production jump host, watch system.metrics and system.processes, and decide on your own infrastructure whether the app earns a place on your on-call phone, without spending anything first.
Your device, your bastion, your server, not through us
The tunnel runs from your iPhone to your bastion to your ClickHouse server. Nothing is proxied or relayed through the developer at any point. There is no middleman host in the path and no copy of your traffic anywhere but your own network. It rides over an ordinary SSH connection, so it works over cellular too, and you can reach prod during an incident from wherever you happen to be.
Get ProbeDeck
ProbeDeck is an iOS 17+ app by Vladimir Chemeris. Monitoring, including SSH-tunnel access through your bastion, is free forever; a one-time Pro unlock ($19.99) adds the write operations and the AI assistant. No subscription.
$19.99 · Free monitoring · One-time Pro unlock · No subscription
See the full ClickHouse monitoring app for iPhone, learn about the ClickHouse Cloud client for iOS, or read the guide to ClickHouse over an SSH tunnel on iOS.
ClickHouse is a registered trademark of ClickHouse, Inc. ProbeDeck is not affiliated with, endorsed by, or sponsored by ClickHouse, Inc.