Add metabase stack

Author: YuryHrytsuk

services/metabase/.gitignore

@@ -0,0 +1,2 @@
+configure_metabase.sql
+docker-compose.yml

services/metabase/Makefile

@@ -8,3 +8,10 @@ up: ${TEMP_COMPOSE}  ## Deploys metabase stack
 
 ${TEMP_COMPOSE}: docker-compose.yml .env
 	@${REPO_BASE_DIR}/scripts/docker-stack-config.bash -e .env $< > $@
+
+docker-compose.yml: docker-compose.yml.j2 .env .venv
+	@$(call jinja, $<, .env, $@)
+
+configure_metabase.sql: .env
+	@set -o allexport; source $<; set +o allexport; \
+	envsubst < $@.template > $@

services/metabase/configure_metabase.sql.template

@@ -0,0 +1,7 @@
+CREATE USER ${METABASE_POSTGRES_USER} WITH PASSWORD '${METABASE_POSTGRES_PASSWORD}';
+
+-- relies on readonly role aldready existing in the database
+GRANT ${POSTGRES_DB}_readonly TO ${METABASE_POSTGRES_USER};
+
+CREATE DATABASE ${METABASE_POSTGRES_DB}
+    WITH OWNER ${METABASE_POSTGRES_USER};

services/metabase/docker-compose.yml renamed to services/metabase/docker-compose.yml.j2

@@ -8,16 +8,20 @@ services:
       - public
       - monitored
     environment:
+      # Metabase logsd doc: https://www.metabase.com/docs/v0.54/configuring-metabase/log-configuration
+      - JAVA_OPTS=-Dlog4j.configurationFile=file:/tmp/my_log4j2.xml
       # https://www.metabase.com/docs/v0.54/installation-and-operation/configuring-application-database
       - MB_DB_TYPE=postgres
       - MB_DB_DBNAME=metabase
       - MB_DB_HOST=${POSTGRES_HOST}
       - MB_DB_PORT=${POSTGRES_PORT}
-      - MB_DB_USER=${POSTGRES_USER}
-      - MB_DB_PASS=${POSTGRES_PASSWORD}
+      - MB_DB_USER=${METABASE_POSTGRES_USER}
+      - MB_DB_PASS=${METABASE_POSTGRES_PASSWORD}
       # https://www.metabase.com/docs/v0.54/installation-and-operation/running-metabase-on-docker#setting-the-java-timezone
       - JAVA_TIMEZONE=UTC
     deploy:
+      # we do not need high availability. This service is not critical
+      replicas: 1
       update_config:
         parallelism: 1
         order: start-first
@@ -27,6 +31,7 @@ services:
         constraints:
           - node.labels.ops==true
       labels:
+        # TODO: add prometheus metrics
         - traefik.enable=true
         - traefik.docker.network=${PUBLIC_NETWORK}
         # router
@@ -37,18 +42,31 @@ services:
         - traefik.http.routers.metabase.middlewares=ops_whitelist_ips@swarm, ops_gzip@swarm, ops_auth@swarm, metabase_stripprefixregex
         # service
         - traefik.http.services.metabase.loadbalancer.server.port=3000
-      # resources:
-      #     limits:
-      #         memory: 512M
-      #         cpus: "1.0"
-      #     reservations:
-      #         memory: 128M
-      #         cpus: "0.2"
+        - traefik.http.services.metabase.loadbalancer.healthcheck.path=/api/health
+        - traefik.http.services.metabase.loadbalancer.healthcheck.interval=5s
+        - traefik.http.services.metabase.loadbalancer.healthcheck.timeout=1s
+
+      # https://www.metabase.com/learn/metabase-basics/administration/administration-and-operation/metabase-in-production
+      resources:
+          limits:
+              memory: 2G
+              cpus: "2.0"
+          reservations:
+              memory: 1G
+              cpus: "1.0"
     healthcheck:
       test: curl --fail -I http://localhost:3000/api/health || exit 1
       interval: 15s
       timeout: 5s
       retries: 5
+    configs:
+      - source: logging_configuration
+        target: /tmp/my_log4j2.xml
+
+configs:
+  logging_configuration:
+    file: ./logging_configuration.xml
+    name: {{ STACK_NAME }}_logging_configuration_{{ "./logging_configuration.xml" | sha256file | substring(0,10) }}
 
 networks:
   public:

services/metabase/logging_configuration.xml

@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Original file: https://github.com/metabase/metabase/blob/v0.54.14.3/resources/log4j2.xml -->
+
+<Configuration>
+  <Appenders>
+    <Console name="STDOUT" target="SYSTEM_OUT" follow="true">
+      <PatternLayout pattern="%date %level %logger{2} :: %message %notEmpty{%X}%n%throwable">
+        <replace regex=":basic-auth \\[.*\\]" replacement=":basic-auth [redacted]"/>
+      </PatternLayout>
+    </Console>
+
+    <!-- This file appender is provided as an example -->
+    <!--
+    <RollingFile name="FILE" fileName="${logfile.path}/metabase.log" filePattern="${logfile.path}/metabase.log.%i">
+      <Policies>
+        <SizeBasedTriggeringPolicy size="500 MB"/>
+      </Policies>
+      <DefaultRolloverStrategy max="2"/>
+      <PatternLayout pattern="%d [%t] %-5p%c - %m%n">
+        <replace regex=":basic-auth \\[.*\\]" replacement=":basic-auth [redacted]"/>
+      </PatternLayout>
+    </RollingFile>
+    -->
+  </Appenders>
+
+  <Loggers>
+    <Logger name="com.mchange" level="ERROR"/>
+    <Logger name="liquibase" level="INFO"/>
+    <Logger name="metabase" level="INFO"/>
+    <Logger name="metabase-enterprise" level="INFO"/>
+    <Logger name="metabase.metabot" level="INFO"/>
+    <Logger name="metabase.plugins" level="INFO"/>
+    <Logger name="metabase.query-processor.async" level="INFO"/>
+    <Logger name="metabase.server.middleware" level="INFO"/>
+    <Logger name="org.quartz" level="INFO"/>
+    <Logger name="net.snowflake.client.jdbc.SnowflakeConnectString" level="ERROR"/>
+    <Logger name="net.snowflake.client.core.SessionUtil" level="FATAL"/>
+
+    <Root level="WARN">
+      <AppenderRef ref="STDOUT"/>
+    </Root>
+  </Loggers>
+</Configuration>

services/metabase/template.env

@@ -1,8 +1,13 @@
+STACK_NAME=${STACK_NAME}
+
 PUBLIC_NETWORK=${PUBLIC_NETWORK}
 MONITORED_NETWORK=${MONITORED_NETWORK}
 ADMIN_DOMAIN=${ADMIN_DOMAIN}
 
 POSTGRES_HOST=${POSTGRES_HOST}
 POSTGRES_PORT=${POSTGRES_PORT}
-POSTGRES_USER=${POSTGRES_USER}
-POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+POSTGRES_DB=${POSTGRES_DB}
+
+METABASE_POSTGRES_USER=${METABASE_POSTGRES_USER}
+METABASE_POSTGRES_PASSWORD=${METABASE_POSTGRES_PASSWORD}
+METABASE_POSTGRES_DB=${METABASE_POSTGRES_DB}