From 683ec1a80e1039e535531b3208665fdb2f3ffd8e Mon Sep 17 00:00:00 2001
From: Warren Lee <5959690+wrn14897@users.noreply.github.com>
Date: Tue, 3 Feb 2026 00:13:56 +0100
Subject: [PATCH] fix: add TLS parameters for https ClickHouse endpoints in
 goose DB string (#1689)

Need to add `secure=true&skip_verify=false` TLS params for https (CHC)

Ref: https://github.com/pressly/goose/pull/796/changes
---
 .changeset/odd-maps-drive.md        | 5 +++++
 docker/otel-collector/entrypoint.sh | 7 +++++--
 2 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/odd-maps-drive.md

diff --git a/.changeset/odd-maps-drive.md b/.changeset/odd-maps-drive.md
new file mode 100644
index 00000000..0535ee39
--- /dev/null
+++ b/.changeset/odd-maps-drive.md
@@ -0,0 +1,5 @@
+---
+"@hyperdx/otel-collector": patch
+---
+
+fix: add TLS parameters for https ClickHouse endpoints in goose DB string
diff --git a/docker/otel-collector/entrypoint.sh b/docker/otel-collector/entrypoint.sh
index 6e96546e..c004ed28 100644
--- a/docker/otel-collector/entrypoint.sh
+++ b/docker/otel-collector/entrypoint.sh
@@ -16,9 +16,12 @@ if [ "$HYPERDX_OTEL_EXPORTER_CREATE_LEGACY_SCHEMA" != "true" ]; then
   # Build goose connection string from environment variables
   # CLICKHOUSE_ENDPOINT format: tcp://host:port, http://host:port, or https://host:port
   # Note: database is not specified here since SQL files use ${DATABASE} prefix explicitly
+  # For https:// endpoints, add secure=true&skip_verify=false for TLS as required by the goose ClickHouse driver
   case "$CLICKHOUSE_ENDPOINT" in
-    *\?*) GOOSE_DBSTRING="${CLICKHOUSE_ENDPOINT}&username=${DB_USER}&password=${DB_PASSWORD}" ;;
-    *)    GOOSE_DBSTRING="${CLICKHOUSE_ENDPOINT}?username=${DB_USER}&password=${DB_PASSWORD}" ;;
+    https://*\?*) GOOSE_DBSTRING="${CLICKHOUSE_ENDPOINT}&username=${DB_USER}&password=${DB_PASSWORD}&secure=true&skip_verify=false" ;;
+    https://*)    GOOSE_DBSTRING="${CLICKHOUSE_ENDPOINT}?username=${DB_USER}&password=${DB_PASSWORD}&secure=true&skip_verify=false" ;;
+    *\?*)         GOOSE_DBSTRING="${CLICKHOUSE_ENDPOINT}&username=${DB_USER}&password=${DB_PASSWORD}" ;;
+    *)            GOOSE_DBSTRING="${CLICKHOUSE_ENDPOINT}?username=${DB_USER}&password=${DB_PASSWORD}" ;;
   esac
 
   # Create temporary directory for processed SQL files