How to Let a Vercel App Read a Private ClickHouse on EC2 (Using Cloudflare Tunnel)

A start to finish walkthrough, with every piece of jargon explained in plain language. Why you might need this Sooner or later, most teams end up with two things that need to talk to each other but live in different worlds. On one side is a private backend: a database, an internal API, an admin panel, or some other service running on a server you control (an EC2 box, a machine in your office, a virtual private cloud). You deliberately keep it locked away from the public internet, because it holds data that would be dangerous to expose. Locking it down is the right call for security. On the other side is a program hosted somewhere else: an app on Vercel, a serverless function, a scheduled job, a third party tool, or an AI agent. It needs to read from that private backend to do its work, but it runs outside your private network, so it has no way in. This is a genuinely awkward gap, and it shows up constantly: A dashboard or reporting app on Vercel needs to query a dat