Metabase - Hardened Business Intelligence and Analytics

What is Metabase

Metabase is a business intelligence and analytics platform that lets everyone in a team ask questions of company data without writing SQL. Point it at your databases and users build questions in a visual query builder, turn them into charts, and assemble dashboards with filters and drill-through. Analysts can drop into native SQL whenever they need to, save queries as reusable models, and share results by link, subscription or embedded iframe. Metabase connects to PostgreSQL, MySQL, SQL Server, ClickHouse, Snowflake, BigQuery, Redshift, MongoDB and more through its bundled drivers. Permissions are managed per group down to the table and column level, so one instance can serve both analysts and read-only business users.

Why self-host Metabase

Business intelligence sees everything: revenue, customers, headcount, unreleased product data. Self-hosting keeps that inside your own tenant, so query results and the credentials of every connected database stay under your control. It removes per-seat pricing as a limit on who may look at the numbers, keeps analytics in the region you choose for data-residency and GDPR purposes, and places the instance next to your warehouse instead of routing production data across the public internet.

What this VM image adds

Security hardening:

• No default administrator account - the image ships with no user at all; you create the first administrator in the setup wizard, and it closes itself as soon as that account exists
• PostgreSQL application database - Metabase's own data is stored in a bundled PostgreSQL on localhost, not the embedded file database that upstream supports for evaluation only
• Saved data-source credentials encrypted at rest - the encryption key is generated on your instance at first boot and never leaves it
• Loopback-only application server - Metabase listens on 127.0.0.1 and is reachable only through the TLS perimeter
• TLS from first boot - nginx terminates HTTPS with a self-signed certificate, and Certbot is preinstalled to switch to a CA-signed one in a single command
• CVE scan - every image is scanned for vulnerabilities with Trivy before release
• UFW firewall - only SSH, HTTP redirect and HTTPS reachable; the database port is closed externally
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Licence and source notice - /usr/share/doc/lynxroute/LICENSES.txt carries the AGPL-3.0 text and a written offer for the corresponding source

Quick Start

1. Deploy the VM from Azure Marketplace (Standard_D2s_v3 or larger recommended)
2. Restrict inbound 443 in the network security group to your own address before you continue
3. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
4. Check status: the login banner shows the Metabase version, service state and connect URL
5. Open https://<PUBLIC_IP>/ and accept the self-signed certificate. First boot takes 2-4 minutes while the application database initialises; a status page refreshes itself until Metabase is ready
6. Complete the setup wizard to create your administrator account, then add your databases from Admin settings, Databases, Add a database. A Sample Database is included so you can build a question straight away
7. Switch to a CA-signed certificate: sudo certbot --nginx -d yourdomain.com

The first person to reach the setup page becomes the administrator, so keep 443 restricted to your own address until you have completed step 6.