Deployment guide

Datasette

Overview

Datasette is an open-source tool, created by Simon Willison, for exploring and publishing data. Point it at one or more SQLite databases and it serves an instant web UI and JSON API over them. Faceted browsing, full-text search and ad-hoc SQL queries are built in, with no schema design or front-end work required.

The SecureAnyCloud image installs Datasette 0.65.2 into a Python virtualenv at /opt/datasette/venv. It runs as a dedicated datasette system user, bound to loopback behind an nginx reverse proxy on TCP 80 with HTTP Basic auth. A unique web password is generated on the first boot of every VM.

What you get:

Datasette 0.65.2 in a virtualenv at /opt/datasette/venv, plus the datasette-vega charting plugin
The Datasette web UI and JSON API, fronted by nginx on :80
nginx HTTP Basic auth (Datasette has no built-in authentication) with a per-VM password in a root-only file
A dedicated Azure data disk at /var/lib/datasette that holds all SQLite databases. It is separate from the OS disk and re-provisioned with every VM
A bundled demo.db sample database (countries, cities and a sensor time series), so the UI shows real data immediately
datasette.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region
A VM size of Standard_B2ms (2 vCPU / 8 GiB RAM) as a good starting point. Scale up for larger databases and more concurrent users
NSG inbound rules that allow 22/tcp from your management network and 80/tcp for the web UI and API. For public exposure, front the VM with TLS (see Enabling HTTPS)

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal and choose Create a resource. Search the Marketplace for Datasette by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab. Then select Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:datasette-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name datasette \
  --image sac1647283583153:datasette-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name datasette --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active datasette.service nginx.service

Both services report active. Datasette starts in seconds and immediately serves every *.db file under /var/lib/datasette.

Step 5 - Retrieve your web password

The admin password is generated uniquely on the first boot of your VM and written to a root-only file. Read the file with:

sudo cat /root/datasette-credentials.txt

The file contains DATASETTE_ADMIN_USER (admin) and DATASETTE_ADMIN_PASSWORD, plus the URLs for the web UI and API. Store the password somewhere safe.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Query it with:

curl -s http://localhost/health

It returns ok.

Step 7 - Open the web UI

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5. The image ships a demo.db sample database with three tables: countries, cities and sensor_readings. The UI shows real data out of the box.

Click demo to see its tables and row counts:

Open the countries table. Datasette's faceted browsing lets you click a column (here continent) to see counts per value and filter instantly. The column headers sort, and the results stay shareable as a URL:

The Custom SQL query box runs any read-only SELECT against the database. It returns a result table that you can export as JSON or CSV:

With the bundled datasette-vega plugin, you can render any table or query result as a chart. Open sensor_readings and click Show charting options. Then plot the time series as a line chart coloured by host:

Step 8 - Query the JSON API

Every page in Datasette has a JSON equivalent. Add .json to the URL. The API is behind the same Basic auth.

Confirm that Datasette is serving and report its version:

curl -s -u admin:<DATASETTE_ADMIN_PASSWORD> http://localhost/-/versions.json; echo

The response is a JSON object whose datasette.version field carries the running version (0.65.2). Fetch rows from a table as a JSON array:

curl -s -u admin:<DATASETTE_ADMIN_PASSWORD> 'http://localhost/demo/countries.json?_shape=array&_size=2'; echo

Each object is one row. Use _size to page, _sort/_sort_desc to order, and ?<column>=<value> to filter.

The API rejects requests without credentials (401) and returns the rows when you supply them (200):

Step 9 - Run SQL through the API

Run an arbitrary read-only SELECT through the API by passing it as the sql parameter on the database's JSON endpoint:

curl -s -u admin:<DATASETTE_ADMIN_PASSWORD> 'http://localhost/demo.json?sql=select+count(*)+as+n+from+cities&_shape=array'; echo

The response is [{"n": 14}]. Datasette permits only read-only queries, so the API is safe to expose to analysts behind the auth wall.

Step 10 - Add your own databases

Datasette serves every .db file in /var/lib/datasette. To publish your own data, copy a SQLite database onto the data disk and restart the service. From your workstation, run:

scp mydata.db azureuser@<vm-public-ip>:/tmp/mydata.db

Then run this on the VM:

sudo install -o datasette -g datasette -m 0644 /tmp/mydata.db /var/lib/datasette/mydata.db
sudo systemctl restart datasette.service

The new database appears in the web UI and at http://<vm-public-ip>/mydata within a couple of seconds.

You can also build a database in place under /var/lib/datasette with the sqlite3 CLI (installed on the image), or generate one with tools such as sqlite-utils.

Step 11 - Confirm data lives on the dedicated disk

All databases are stored on the dedicated Azure data disk, so they survive OS changes and can be resized independently. Confirm the mount with:

findmnt /var/lib/datasette

The mount is backed by a separate Azure data disk. The disk is captured into the image and re-provisioned on every VM.

Enabling HTTPS

The nginx reverse proxy serves plain HTTP on port 80. For public exposure, put a certificate in front of it. The simplest approach is to add a DNS name for the VM and use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy.

Alternatively, install certbot and extend the existing nginx site (/etc/nginx/sites-available/sac-datasette) with a "listen 443 ssl;" server block and your certificate paths. Keep Datasette itself bound to loopback, so the only public surface is the authenticated, TLS-terminated proxy.

Maintenance

Configuration: the service launches Datasette through /opt/datasette/launch.sh. That script serves every *.db under /var/lib/datasette with the metadata in /opt/datasette/metadata.json. Edit those files, then run sudo systemctl restart datasette to apply changes.
Changing the web password: rewrite the htpasswd entry with sudo htpasswd -b /etc/nginx/.htpasswd admin '<new-password>', then run sudo systemctl reload nginx.
Backups: snapshot the /var/lib/datasette data disk, or copy individual .db files to Azure Blob Storage.
Upgrades: upgrade in the virtualenv with sudo /opt/datasette/venv/bin/pip install -U datasette, then restart the service.
Security patches: unattended-upgrades stays enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Datasette is an open-source project created by Simon Willison and distributed under the Apache License 2.0. This image is produced by SecureAnyCloud and is not affiliated with or endorsed by the Datasette project.

Deploy on Azure

Launch Datasette on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Datasette is an open-source tool for exploring and publishing data. It takes one or more SQLite databases and publishes them as a browsable, searchable web interface with a faceted UI. A full JSON API covers every table and custom query, so anyone can explore your data in a browser or query it programmatically.

This SecureAnyCloud image runs Datasette 0.65.2 on AWS, with HTTP Basic authentication in front of it.

What you get:

Datasette 0.65.2 installed into a dedicated Python virtual environment under /opt/datasette, run by an unprivileged datasette system account under a systemd service that starts it on boot and restarts it on failure
A served databases directory at /var/lib/datasette, which holds the SQLite files Datasette publishes. It is a dedicated, independently resizable EBS data volume that survives an operating system disk reimage
A demo SQLite database at /var/lib/datasette/demo.db with continents, countries and cities tables and sample rows, so the interface has data out of the box and you have a working example to explore
A runtime bound to the loopback interface only (127.0.0.1:8001) and never exposed directly, because Datasette ships with no built-in authentication
An nginx reverse proxy that publishes the interface on port 80 behind HTTP Basic authentication
An admin password generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a password. It is written to /root/datasette-credentials.txt with mode 0600, so only the root user can read it

Prerequisites

Before you deploy this image, make sure you have:

An AWS account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the Datasette interface
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Datasette. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the Datasette interface. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass. This is when the per-instance admin password is generated.

Launch the instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Datasette Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, and <key-name> with your EC2 key pair name.

Replace <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=datasette}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. Find it in the EC2 console or with aws ec2 describe-instances.

Connect to your instance

Connect over SSH using your key pair. The SSH login user for the Ubuntu 24.04 variant is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the admin password

The admin password is unique to your instance and was generated on first boot. Read the credentials file as root:

sudo cat /root/datasette-credentials.txt

The file lists the interface URL, the admin user (admin) and the generated password. It also includes hints for adding your own databases and installing plugins. Keep the password somewhere safe.

Sign in to the Datasette interface

nginx serves the Datasette interface on port 80. It proxies to the runtime on 127.0.0.1:8001 behind HTTP Basic authentication. In a browser, go to:

http://<instance-public-ip>/

The nginx proxy prompts you for credentials. Sign in as admin with the password from the credentials file. The home page then loads and lists the bundled demo database and its tables.

Click the demo database, then a table such as countries, to open the table view. Datasette renders the table as a filterable, sortable web page. Use the facet panel to break the rows down by a column value, for example by continent.

You can also query every table with custom SQL. Open the demo database page and use the SQL editor to run an arbitrary read-only query against the data. The results render as a table, and the same data is one click away as JSON or CSV.

Confirm Datasette is running

Over SSH, confirm that the runtime and the nginx proxy are active and that the health endpoint answers:

sudo systemctl is-active datasette nginx

curl -s http://127.0.0.1:8001/-/versions.json | head -c 200

Both services report active. The /-/versions.json endpoint returns a JSON document with the Datasette, Python and SQLite versions.

The runtime listens on 127.0.0.1:8001 (loopback only), and nginx publishes it on port 80 behind the login.

Confirm the installed Datasette version with:

/opt/datasette/venv/bin/datasette --version

Publish your own databases

Datasette serves every .db file in /var/lib/datasette. The image ships a demo database at /var/lib/datasette/demo.db, so the interface has data out of the box.

To publish your own data, copy your SQLite databases into that directory and restart the service. Copy your file onto the instance (for example with scp), move it into place, then restart:

sudo systemctl restart datasette.service

After the restart, reload the interface in your browser. Your database appears on the home page alongside the demo.

The service runs datasette serve /var/lib/datasette/*.db bound to loopback. Every database in the directory is served on port 80 through the same authenticating proxy. Keep the files owned by the datasette user so the service can read them.

Databases are served read-only by default, which is the safe model for a published data appliance.

Call the JSON API

Datasette exposes the same data the web interface renders as a JSON API. Append .json to any table or query URL.

On the instance, you can call the loopback runtime directly with the admin credentials. Read the generated password into a shell variable and query the demo database:

PASS=$(sudo grep '^datasette.admin.pass=' /root/datasette-credentials.txt | cut -d= -f2-)
curl -s -u "admin:${PASS}" 'http://127.0.0.1/demo/countries.json?_size=3' | head -c 400; echo

From outside the instance, send the same request to http://<instance-public-ip>/demo/countries.json with basic auth user admin and the generated password.

Any custom SQL query is also available as JSON when you append .json to the query URL. Datasette doubles as an instant read-only API over your SQLite data.

Install plugins

Datasette and its dependencies are installed into a dedicated virtual environment at /opt/datasette/venv. Extend Datasette with plugins, for charting, mapping, full-text search and authentication, by installing them into that same virtual environment so the service picks them up.

Install a plugin with the bundled Datasette command, sudo /opt/datasette/venv/bin/datasette install <plugin-name>. Choose a plugin such as datasette-vega from the Datasette plugin directory, then restart the service:

sudo systemctl restart datasette.service

After the restart, reload the interface to see the plugin in effect.

Review the data volume

The served databases directory lives on a dedicated EBS volume mounted at /var/lib/datasette. This keeps your SQLite databases off the operating system disk and lets you resize or snapshot them independently. Confirm the mount with:

df -h /var/lib/datasette

To grow the directory, expand the EBS volume in the AWS console. Then grow the filesystem on the instance with sudo resize2fs on the underlying device.

This volume holds the demo database and any databases you add, so a snapshot of it captures the complete published data set.

Enable HTTPS

nginx serves the Datasette interface over plain HTTP on port 80. For production use, place it behind TLS.

Obtain a certificate for your domain, for example a managed certificate on an Application Load Balancer in front of the instance, or Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:8001, exactly as the bundled site does for port 80. Keep the HTTP Basic authentication in place.

Restrict the security group so that ports 80 and 443 are reachable only from the networks that need the interface.

Back up and maintain the deployment

Back up your deployment by snapshotting the /var/lib/datasette EBS volume. The snapshot captures the demo database and every database you have published. You can also copy the individual .db files off the instance.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade. Reboot when a new kernel is installed. Datasette and nginx start automatically on boot.

Support

This image is published and supported by SecureAnyCloud. Support covers deployment, publishing your own databases, plugins, faceting and full-text search, the JSON API, the authenticating proxy, TLS, authentication and performance tuning. Contact SecureAnyCloud through the support channel listed on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Datasette on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS