SecureAnyCloud
Deployment guide

Metabase

Overview

Metabase is a popular open source business intelligence platform. You connect a database, ask questions with a point-and-click query builder or SQL, build dashboards and charts, and share them across your team.

This SecureAnyCloud image installs Metabase Open Source Edition, the official metabase.jar on the OpenJDK 21 JRE, behind an nginx reverse proxy. PostgreSQL serves as Metabase's own application database, because the embedded H2 default is unsuitable for production.

What you get:

  • Metabase Open Source Edition 0.62 (/opt/metabase/metabase.jar) on the OpenJDK 21 JRE, listening on 127.0.0.1:3000
  • An nginx reverse proxy on :80 in front of the Metabase server, which is bound to loopback :3000
  • PostgreSQL as the Metabase application database, bound to the loopback interface only
  • Two dedicated Azure data disks, separate from the OS disk and re-provisioned with every VM: the PostgreSQL datadir at /var/lib/postgresql, and the Metabase application, plugins and logs at /opt/metabase
  • An encryption key that protects, at rest, the connection details of the databases you connect. A unique MB_ENCRYPTION_SECRET_KEY is generated on the first boot of every VM, so no two VMs share a key
  • A per-VM administrator account, created automatically on first boot with setup already completed, and recorded in /root/metabase-credentials.txt with mode 0600
  • metabase.service, postgresql.service and nginx.service as enabled, active systemd units
  • No connected data sources. You add your own after signing in
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size. Metabase runs on the JVM and benefits from memory, so scale up for more users or heavier queries.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. Also allow 80/tcp from the networks your users will reach Metabase on. For public exposure, put TLS in front of port 80 (see Enabling HTTPS).

You also need a database to analyse, such as PostgreSQL, MySQL, SQL Server or an Azure Database instance. Metabase includes a built-in Sample Database that you can explore first.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Metabase by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the two dedicated data disks on the Disks tab, then select Review + create and Create.

First-boot initialisation takes approximately two to four minutes after the VM starts. During that time Metabase runs its database migrations, completes setup and creates your administrator account.

Step 2 - Deploy from the Azure CLI

Run the following commands from a shell where the Azure CLI is signed in. They accept the Marketplace terms, create the VM and open port 80.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:metabase-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name metabase \
  --image sac1647283583153:metabase-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name metabase --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as azureuser, using the key pair you supplied.

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check the three services and the health endpoint:

systemctl is-active metabase.service postgresql.service nginx.service curl -fsS http://127.0.0.1/api/health

All three services report active and the health endpoint returns {"status":"ok"}. This confirms that the full stack is serving: nginx, the Metabase server and PostgreSQL.

Metabase is a JVM application. On the very first boot, allow a couple of minutes for migrations before the health endpoint reports ok.

Step 5 - Retrieve your administrator login

Read the credentials file with sudo. The administrator account is unique to your VM, and first boot writes it to a root-only file:

sudo cat /root/metabase-credentials.txt

The metabase.admin.email and metabase.admin.pass values are your sign-in. The file also records the per-VM PostgreSQL password.

Step 6 - Sign in for the first time

Browse to http://<vm-public-ip>/. First boot already completed the Metabase setup, so you go straight to the sign-in page.

Enter the email and password from /root/metabase-credentials.txt.

After you sign in, you reach the Metabase home page. It shows quick-start "x-rays", collections and your data sources in the sidebar.

Step 7 - Connect a data source

The image ships no connected data sources, although Metabase's built-in Sample Database is available to explore first. To analyse your own data, open the gear menu, choose Admin settings, then Databases, and select Add a database.

Metabase supports PostgreSQL, MySQL/MariaDB, SQL Server, Redshift, BigQuery, Snowflake, ClickHouse and more. For an Azure Database for PostgreSQL/MySQL instance or a database VM in the same VNet, enter its endpoint, database name and credentials. The credentials are encrypted at rest with this VM's unique key.

Metabase then syncs the schema so you can start querying.

Step 8 - Build questions and dashboards

Select + New to create a Question with the point-and-click query builder, or write SQL. Pick a visualization (table, line, bar, map and more) and save it to a collection.

Combine saved questions onto a Dashboard with filters for an at-a-glance view. Metabase's automatic x-rays generate a full dashboard from any table in one click.

To invite your team, open Admin settings, then People, then Invite someone.

Step 9 - Confirm the runtime and data tiers

The Metabase jar, plugins and logs live at /opt/metabase. The PostgreSQL datadir lives at /var/lib/postgresql. Each sits on its own dedicated Azure data disk. Confirm the Java version and both mounts:

java -version 2>&1 | head -1 findmnt -no SOURCE,SIZE,FSTYPE,TARGET /var/lib/postgresql findmnt -no SOURCE,SIZE,FSTYPE,TARGET /opt/metabase

Enabling HTTPS

For production, serve Metabase over HTTPS so that session tokens and data cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

These commands assume a DNS record that points your fully qualified domain name at the VM's public IP:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d metabase.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, set the site URL under Admin settings, then General, so Metabase generates correct links. Then restart the service with sudo systemctl restart metabase.

Backup and maintenance

Metabase keeps all of its state in its PostgreSQL application database on the dedicated data disk at /var/lib/postgresql. That state includes questions, dashboards, users, settings and connected-database definitions. Back it up regularly:

sudo -u postgres pg_dump metabaseapp > /tmp/metabase-appdb-$(date +%F).sql

Copy the dump to Azure Blob Storage or another object store. Alternatively, snapshot the two data disks in Azure for coordinated point-in-time backups.

Keep the OS patched with sudo apt update && sudo apt upgrade.

To upgrade Metabase itself, back up first. Then replace /opt/metabase/metabase.jar with a newer release and restart with sudo systemctl restart metabase. Metabase migrates the application database automatically.

Support

This image comes with 24/7 SecureAnyCloud support. Contact us by email and chat for help with deployment, data source configuration, upgrades, TLS termination and database administration. Email sales@secureanycloud.com.

For general Metabase questions, see the documentation at https://www.metabase.com/docs/latest/. Metabase is a trademark of Metabase, Inc. All product and company names are trademarks or registered trademarks of their respective holders. Their use here does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Metabase on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure