fix: ClickHouse URL secure parameter handling in goose migrations and replication clients

Author: samadrehman

apps/webapp/app/routes/admin.api.v1.runs-replication.create.ts

@@ -57,8 +57,13 @@ export async function action({ request }: ActionFunctionArgs) {
 }
 
 function createRunReplicationService(params: CreateRunReplicationServiceParams) {
+  const url = new URL(env.RUN_REPLICATION_CLICKHOUSE_URL);
+
+  // Remove secure param
+  url.searchParams.delete("secure");
+
   const clickhouse = new ClickHouse({
-    url: env.RUN_REPLICATION_CLICKHOUSE_URL,
+    url: url.toString(),
     name: params.name,
     keepAlive: {
       enabled: params.keepAliveEnabled,

apps/webapp/app/services/runsReplicationInstance.server.ts

@@ -22,8 +22,13 @@ function initializeRunsReplicationInstance() {
 
   console.log("🗃️  Runs replication service enabled");
 
+  const url = new URL(env.RUN_REPLICATION_CLICKHOUSE_URL);
+
+  // Remove secure param
+  url.searchParams.delete("secure");
+
   const clickhouse = new ClickHouse({
-    url: env.RUN_REPLICATION_CLICKHOUSE_URL,
+    url: url.toString(),
     name: "runs-replication",
     keepAlive: {
       enabled: env.RUN_REPLICATION_KEEP_ALIVE_ENABLED === "1",

docker/scripts/entrypoint.sh

@@ -18,17 +18,12 @@ if [ -n "$CLICKHOUSE_URL" ] && [ "$SKIP_CLICKHOUSE_MIGRATIONS" != "1" ]; then
   echo "Running ClickHouse migrations..."
   export GOOSE_DRIVER=clickhouse
 
-  # Ensure secure=true is in the connection string
-  if echo "$CLICKHOUSE_URL" | grep -q "secure="; then
-    # secure parameter already exists, use as is
-    export GOOSE_DBSTRING="$CLICKHOUSE_URL"
-  elif echo "$CLICKHOUSE_URL" | grep -q "?"; then
-    # URL has query parameters, append secure=true
-    export GOOSE_DBSTRING="${CLICKHOUSE_URL}&secure=true"
-  else
-    # URL has no query parameters, add secure=true
-    export GOOSE_DBSTRING="${CLICKHOUSE_URL}?secure=true"
-  fi
+  # Strip secure parameter from URL before passing to goose
+  # The scheme (http:// vs https://) already encodes TLS choice, so secure param is redundant
+  export GOOSE_DBSTRING="$(echo "$CLICKHOUSE_URL" | sed 's/[?&]secure=[^&]*//g')"
+  
+  # Remove trailing ? or & if present after stripping secure param
+  export GOOSE_DBSTRING="$(echo "$GOOSE_DBSTRING" | sed 's/[?&]$//')"
 
   export GOOSE_MIGRATION_DIR=/triggerdotdev/internal-packages/clickhouse/schema
   /usr/local/bin/goose up