Metabase On-Prem Installation Steps

 ========================================================

METABASE ON-PREM INSTALLATION SOP (NO DOCKER)

WITH NGINX + PUBLIC IP (PRODUCTION READY)

========================================================


DOCUMENT VERSION : 1.0

STATUS           : VERIFIED WORKING

OS               : Ubuntu 22.04 / 24.04

JAVA             : OpenJDK 21

METADATA DB      : PostgreSQL

ACCESS           : Nginx Reverse Proxy (Public IP)

METABASE PORT    : 3000 (localhost only)

NGINX PORT       : 80 / 443

========================================================



===========================

1. SYSTEM PRE-REQUISITES

===========================


Run as root or sudo user.


sudo apt update && sudo apt upgrade -y


Install required packages:


sudo apt install -y \

openjdk-21-jdk \

postgresql postgresql-contrib \

nginx \

curl unzip



Verify Java version:


java -version


Expected:

openjdk version "21"



===========================

2. CREATE METABASE USER

===========================


sudo useradd -r -s /bin/false metabase

sudo mkdir -p /opt/metabase

sudo chown metabase:metabase /opt/metabase



===========================

3. DOWNLOAD METABASE

===========================


cd /opt/metabase

sudo wget https://downloads.metabase.com/latest/metabase.jar

sudo chown metabase:metabase metabase.jar



===========================

4. POSTGRESQL METADATA DB

===========================


sudo -u postgres psql


CREATE DATABASE metabase;

CREATE USER metabase_user WITH PASSWORD 'strongpassword';

ALTER DATABASE metabase OWNER TO metabase_user;

GRANT ALL PRIVILEGES ON DATABASE metabase TO metabase_user;

GRANT ALL ON SCHEMA public TO metabase_user;

ALTER USER metabase_user WITH SUPERUSER;

\q



===========================

5. METABASE ENV CONFIG

===========================


sudo nano /etc/metabase.env



---------------------------

openssl rand -hex 32

MB_ENCRYPTION_SECRET_KEY=PASTE_GENERATED_KEY_HERE

---------------------------


----- /etc/metabase.env -----


MB_DB_TYPE=postgres

MB_DB_DBNAME=metabase

MB_DB_PORT=5432

MB_DB_USER=metabase_user

MB_DB_PASS=StrongPassword

MB_DB_HOST=localhost


MB_JETTY_HOST=127.0.0.1

MB_JETTY_PORT=3000


MB_SITE_URL=http://PUBLIC-IP


JAVA_OPTS=-Xms1g -Xmx2g


MB_ENCRYPTION_SECRET_KEY=GENERATE_32_CHAR_RANDOM_KEY


----------------------------



Secure file:

sudo chmod 600 /etc/metabase.env



===========================

6. SYSTEMD SERVICE

===========================


sudo nano /etc/systemd/system/metabase.service



----- metabase.service -----


[Unit]

Description=Metabase Server

After=network.target postgresql.service


[Service]

User=metabase

Group=metabase

EnvironmentFile=/etc/metabase.env

ExecStart=/usr/lib/jvm/java-21-openjdk-amd64/bin/java \

$JAVA_OPTS \

-jar /opt/metabase/metabase.jar

Restart=always

SuccessExitStatus=143


[Install]

WantedBy=multi-user.target


----------------------------



Enable & start:


sudo systemctl daemon-reload

sudo systemctl enable metabase

sudo systemctl start metabase

sudo systemctl status metabase



===========================

7. VERIFY METABASE

===========================


Check listening port:


ss -lntp | grep 3000


Expected:

127.0.0.1:3000



===========================

8. NGINX REVERSE PROXY

===========================


sudo nano /etc/nginx/sites-available/metabase



----- nginx config -----


server {

    listen 80 default_server;

    server_name _;


    client_max_body_size 50M;


    location / {

        proxy_pass http://127.0.0.1:3000;

        proxy_http_version 1.1;


        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;


        proxy_read_timeout 300;

        proxy_connect_timeout 300;

        proxy_send_timeout 300;

    }

}


--------------------------



Enable site:


sudo rm -f /etc/nginx/sites-enabled/default

sudo ln -s /etc/nginx/sites-available/metabase /etc/nginx/sites-enabled/


Test & reload:


sudo nginx -t

sudo systemctl reload nginx



===========================

9. FIREWALL & CLOUD RULES

===========================


Local firewall:


sudo ufw allow 80/tcp

sudo ufw deny 3000/tcp

sudo ufw enable


Cloud / AWS Security Group:

Allow:

- TCP 80 from 0.0.0.0/0

(Optional: 443 for HTTPS)



===========================

10. ACCESS METABASE

===========================


Open browser:


http://PUBLIC-IP


Metabase UI should load.



===========================

11. LOGS & TROUBLESHOOTING

===========================


Live logs:


journalctl -u metabase -f


Nginx logs:


/var/log/nginx/access.log

/var/log/nginx/error.log



===========================

12. BACKUP (RECOMMENDED)

===========================


pg_dump metabase > metabase_backup.sql



===========================

13. SECURITY HARDENING

===========================


- Keep port 3000 internal only

- Use HTTPS (Let’s Encrypt)

- Use read-only DB users for data sources

- Backup metadata DB daily

- Do not run Metabase as root



========================================================

END OF SOP

========================================================


Comments

Post a Comment

Popular posts from this blog

Install & Configure GLPI on Ubuntu (Nginx + MariaDB + PHP 8.3) — Full SOP 2025

🧭 Install & Configure GLPI on Ubuntu (Nginx + MariaDB + PHP 8.3) — Full SOP 2025 Comprehensive setup guide for GLPI 10.x using Nginx , MariaDB , and PHP 8.3 on Ubuntu 22.04/24.04 LTS. 📋 1. Prerequisites Ubuntu 22.04/24.04 with sudo/root privileges DNS record or hostname (e.g. glpi.localhost or glpi.example.com ) Updated system packages sudo apt update && sudo apt upgrade -y ⚙️ 2. Install Required Packages 2.1 Nginx Web Server sudo apt install -y nginx sudo nano /etc/nginx/sites-available/glpi.conf server { listen 80; listen [::]:80; server_name glpi.localhost; root /var/www/glpi/public; location / { try_files $uri /index.php$is_args$args; } location ~ ^/index\.php$ { fastcgi_pass unix:/run/php/php8.3-fpm.sock; fastcgi_split_path_info ^(.+\.php)(/.*)$; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } } sudo ln -s /etc/...
Read more

Basic Linux Commands

🐧 Linux Basic Commands — Quick Reference A comprehensive yet compact beginner's guide to Linux file system, commands, permissions, networking, users, and more. 📘 Why Learn Linux? Linux powers everything from servers and clouds to IoT devices. Whether you’re a developer, sysadmin, or cloud engineer, Linux skills are essential . Works seamlessly with Windows and macOS. Hosts most cloud workloads and containers. Open source, modular, and secure. 📂 1. Linux File System Hierarchy / ├── bin ├── boot ├── dev ├── etc ├── home │ ├── alice │ ├── bob │ └── eve ├── root ├── run ├── sbin ├── tmp ├── usr │ ├── bin │ ├── local │ │ ├── bin │ │ ├── sbin │ └── sbin └── var /boot – Kernel & bootloader files /etc – System configuration /home – User directories /usr – Installed software /var – Logs, spools /tmp – Temporary data 📁 2. File Management & Navigation Absolute vs Relative Paths Absolute: /var/log/syslog Relative: log/s...
Read more

Secure Ollama API Deployment with Nginx Reverse Proxy

🚀 Secure Ollama API with Nginx — Deployment Guide Deploy Ollama behind Nginx with HTTPS (SSL) and Basic Authentication using Docker Compose. 🔧 Step 1: Create Certificates and Auth mkdir -p nginx/certs nginx/auth openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ -keyout nginx/certs/server.key \ -out nginx/certs/server.crt \ -subj "/CN=192.168.0.6" htpasswd -cb nginx/auth/.htpasswd admin yourpassword 🧩 Step 2: Nginx Configuration events {} http { server { listen 443 ssl; ssl_certificate /etc/nginx/certs/server.crt; ssl_certificate_key /etc/nginx/certs/server.key; auth_basic "Restricted"; auth_basic_user_file /etc/nginx/auth/.htpasswd; location / { proxy_pass http://ollama:11434; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } } 📦 Step 3: Dock...
Read more