clickhouse-cloud-credentials

name	clickhouse-cloud-credentials
description	Store ClickHouse Cloud credentials in Doppler + 1Password for gapless-crypto-clickhouse. Use when setting up new services, rotating credentials, or backing up authentication material. Covers API keys, connection details, and database password storage.

ClickHouse Cloud Credentials

Establish dual credential storage pattern (Doppler + 1Password) for ClickHouse Cloud authentication.

Purpose

Store and backup ClickHouse Cloud credentials in two secure locations:

1. Doppler (aws-credentials/prd project) - Runtime environment variables
2. 1Password (Engineering vault) - Secure backup and team access

This skill guides the workflow of storing 8 required credentials for gapless-crypto-clickhouse service.

When to Use

Use this skill when:

• New service setup: Initial credential storage for new ClickHouse Cloud service
• Credential rotation: Updating API keys or database passwords
• Backup verification: Ensuring credentials exist in both storage locations
• Team onboarding: Documenting required credentials for new team members

Triggers: User mentions "store credentials", "Doppler", "1Password", "ClickHouse API keys", "credential rotation"

Prerequisites

Credentials to Store:

• API Key ID and Secret (from ClickHouse Cloud console)
• Organization ID (from ClickHouse Cloud API)
• Service ID (gapless-crypto-clickhouse service)
• Connection parameters (host, port, user, password)

Required Access:

• Doppler CLI access to aws-credentials/prd project
• 1Password CLI (op) access to Engineering vault

Credential Schema

Doppler Secrets (aws-credentials/prd)

8 required secrets:

Secret Name	Description	Example Format
CLICKHOUSE_CLOUD_KEY_ID	API Key ID	xnIdJM3n42LDImsZ9zzg
CLICKHOUSE_CLOUD_KEY_SECRET	API Key Secret	(secured, ~40 chars)
CLICKHOUSE_CLOUD_ORG_ID	Organization UUID	<CLICKHOUSE_ORG_ID>
CLICKHOUSE_CLOUD_SERVICE_ID	Service UUID	<CLICKHOUSE_SERVICE_ID>
CLICKHOUSE_HOST	Service hostname	<CLICKHOUSE_SERVICE_HOST>
CLICKHOUSE_PORT	HTTPS port	8443
CLICKHOUSE_USER	Database user	default
CLICKHOUSE_PASSWORD	Database password	(secured, from console)

See: references/doppler-schema.md for detailed descriptions

1Password Item (Engineering Vault)

Vault: Engineering (<OP_VAULT_ID>) Item Title: "<OP_ITEM_TITLE>"

8 required fields:

Field Name	Type	Description
username	text	API Key ID
credential	concealed	API Key Secret
organization_id	text	Organization UUID
organization_name	text	"<CLICKHOUSE_ORG_NAME>"
service_id	text	Service UUID
service_name	text	"gapless-crypto-cli"
database_password	password	Database password
console_url	url	https://clickhouse.cloud/

See: references/onepassword-schema.md for detailed specifications

Workflow

Step 1: Store API Credentials in Doppler

# Store API Key ID and Secret
doppler secrets set CLICKHOUSE_CLOUD_KEY_ID "<key_id>" --project aws-credentials --config prd
doppler secrets set CLICKHOUSE_CLOUD_KEY_SECRET "<key_secret>" --project aws-credentials --config prd

Step 2: Store Organization and Service Metadata in Doppler

# Store IDs
doppler secrets set CLICKHOUSE_CLOUD_ORG_ID "<org_id>" --project aws-credentials --config prd
doppler secrets set CLICKHOUSE_CLOUD_SERVICE_ID "<CLICKHOUSE_SERVICE_ID>" --project aws-credentials --config prd

Step 3: Store Connection Details in Doppler

# Store connection parameters
doppler secrets set CLICKHOUSE_HOST "<CLICKHOUSE_SERVICE_HOST>" --project aws-credentials --config prd
doppler secrets set CLICKHOUSE_PORT "8443" --project aws-credentials --config prd
doppler secrets set CLICKHOUSE_USER "default" --project aws-credentials --config prd
doppler secrets set CLICKHOUSE_PASSWORD "<db_password>" --project aws-credentials --config prd

Step 4: Backup Credentials in 1Password

# Create 1Password item with all fields
op item create --vault Engineering \
  --category "API Credential" \
  --title "<OP_ITEM_TITLE>" \
  username="<key_id>" \
  credential="<key_secret>" \
  "organization_id[text]=<org_id>" \
  "organization_name[text]=<CLICKHOUSE_ORG_NAME>" \
  "service_id[text]=<CLICKHOUSE_SERVICE_ID>" \
  "service_name[text]=gapless-crypto-cli" \
  "database_password[password]=<db_password>" \
  "console_url[url]=https://clickhouse.cloud/"

Step 5: Verify Storage

# Verify Doppler secrets (names only)
doppler secrets --project aws-credentials --config prd --only-names | grep CLICKHOUSE

# Verify 1Password item
op item get "<OP_ITEM_TITLE>" --vault Engineering

Success Criteria

• ✅ All 8 secrets stored in Doppler (aws-credentials/prd)
• ✅ All 8 fields stored in 1Password (Engineering vault)
• ✅ No plaintext credentials in version control
• ✅ Credentials accessible via Doppler CLI
• ✅ Backup accessible via 1Password CLI

Security Notes

1. No secrets in code: Reference Doppler key names, never hardcode values
2. Dual storage: Doppler for runtime, 1Password for backup and team access
3. Credential rotation: Update both Doppler and 1Password when rotating
4. Access control: Doppler and 1Password enforce team-based access controls
5. Audit trail: Both systems log credential access for security monitoring

Troubleshooting

Issue: "Doppler secrets not found"

• Check: Verify project name aws-credentials and config prd
• Verify: doppler projects list shows project exists

Issue: "1Password vault not accessible"

• Check: Engineering vault ID: <OP_VAULT_ID>
• Verify: op vault list shows Engineering vault

Issue: "Credential format incorrect"

• Check: API Key ID format (example: xnIdJM3n42LDImsZ9zzg)
• Verify: UUIDs are valid format (8-4-4-4-12 hex digits)

References

• Doppler Schema: references/doppler-schema.md
• 1Password Schema: references/onepassword-schema.md
• Doppler Dashboard: https://dashboard.doppler.com/workplace/13e9e4203ede563b1d37/projects/aws-credentials
• ClickHouse Console: https://clickhouse.cloud/ (API Keys → Settings)

Next Steps

After credential storage, proceed to:

1. clickhouse-cloud-connection - Test connection using stored credentials