Set Up Self-Hosted BI (Metabase or Superset)

Metabase and Apache Superset are powerful, mature open-source business intelligence platforms used by thousands of companies—including Airbnb (Superset's origin), Dropbox, and Netflix—to power internal and customer-facing analytics. The fundamental appeal is clear: both platforms connect directly to your existing data warehouse, require no per-seat query licensing, and offer SQL Lab query environments, no-code dashboard builders, and embedded analytics APIs.

However, "open-source" does not mean "zero effort to deploy." A naive Docker Compose installation on a $5 VPS with the default H2 in-memory database, self-signed SSL certificates, and no authentication is not a production deployment—it is a security liability. A correct enterprise deployment requires a dedicated PostgreSQL metadata database, nginx reverse proxy with valid Let's Encrypt or corporate SSL certificates, SAML or LDAP SSO integration, properly tuned async query workers, and row-level security rules that prevent unauthorized cross-team data access.

Codersarts provides end-to-end Metabase and Apache Superset deployment consulting. We architect, install, secure, and configure your self-hosted BI environment to enterprise standards—connecting to your data warehouse, setting up corporate authentication, building your first dashboards, and training your analytics team.

Get a Free Quote | Book a Free Consultation

Is This You?

Organizations evaluating or struggling with self-hosted BI platforms face consistent deployment challenges:

• "We installed Metabase via Docker Compose but it is running on an internal port with no authentication."

  
  

  You have a development instance, not a production deployment; you need nginx reverse proxy, SSL termination, PostgreSQL metadata storage, and user authentication before it is safe for organizational use.

• "Our Superset installation crashes randomly and loses dashboard configuration."

  
  

  You are running Superset with the default SQLite metadata database which is not production-safe; you need to migrate to a persistent PostgreSQL backend and configure Celery async workers.

• "We want employees to log in to Metabase using their Google Workspace or Microsoft Entra ID accounts."

  
  

  You need SAML SSO or OAuth2 configured in Metabase Pro or Metabase Enterprise to eliminate separate credential management.

• "Our Superset queries time out against our Snowflake or BigQuery warehouse."

  
  

  Your Celery worker concurrency, query timeout parameters, and warehouse connection pool settings need tuning for the data volumes you are querying.

• "We need different user groups to see only their own department or regional data."

  
  

  You need Metabase's row-level permissions or Superset's Row-Level Security (RLS) rules configured against your database's security columns.

• "We want to embed Metabase or Superset dashboards inside our product for customers."

  
  

  You need Metabase's signed embedding URLs or Superset's embedded API with JWT authentication configured to serve analytics to external users.

The Cost of Inaction: An insecure or unstable BI deployment causes data leaks between departments, destroys analyst trust when dashboards return inconsistent results, and forces the organization to abandon the platform in favor of expensive proprietary alternatives.

What Professional Self-Hosted BI Setup Delivers

A secure, performant, enterprise-ready open-source analytics platform at a fraction of proprietary licensing costs:

• Production-Safe Infrastructure: PostgreSQL metadata storage, nginx reverse proxy, SSL/TLS certificates, and containerized deployment with automatic restarts.

• Corporate SSO Integration: Employees log in with their existing Google, Microsoft, Okta, or LDAP credentials—no separate BI password management.

• Granular Row-Level Security: Department managers and regional users see only their authorized data slice without needing separate databases or dataset copies.

• High-Performance Query Execution: Properly tuned Celery async workers and database connection pools preventing timeouts on complex analytical queries.

• Polished Executive Dashboards: Custom branded dashboards with interactive filters, cross-filter drill-downs, and scheduled email delivery.

• 100% Infrastructure Documentation: Complete runbooks, Docker Compose or Helm chart configurations, and operational procedures owned entirely by your team.

Our Metabase & Superset Deployment Services

We deliver complete self-hosted BI platform engineering from installation to production go-live:

1. Docker / Kubernetes Installation & Infrastructure Architecture

• Selecting and sizing the appropriate compute infrastructure: AWS EC2, ECS, GCP Cloud Run, Azure App Services, or on-premises virtual machines.

• Deploying Metabase or Superset using Docker Compose (single-server) or Helm charts on Kubernetes (high-availability multi-replica).

• Configuring a dedicated PostgreSQL metadata database (AWS RDS, Cloud SQL, or self-hosted) replacing default SQLite or H2 embedded databases.

• Setting up nginx or Caddy reverse proxy with automated Let's Encrypt SSL certificate provisioning, HTTP-to-HTTPS redirect, and gzip compression.

2. Data Source Connection & Warehouse Integration

• Connecting to all major data sources: Snowflake, BigQuery, Redshift, PostgreSQL, MySQL, SQL Server, ClickHouse, DuckDB, Athena, and Databricks SQL.

• Configuring connection pool settings (minimum, maximum pool size, connection timeout) appropriate for warehouse response latency and concurrent user load.

• Setting up SSH tunnels for connecting Metabase or Superset to privately networked on-premises databases without exposing direct inbound ports.

• Implementing virtual datasets in Superset (semantic layer SQL views) for reusable, certified metric definitions shared across dashboards.

3. SSO Authentication: SAML, OAuth2 & LDAP

• Configuring SAML 2.0 integration between Metabase Enterprise / Superset and corporate identity providers (Google Workspace, Microsoft Entra ID, Okta, Keycloak).

• Setting up OAuth2 social login (Google, GitHub, Azure AD) for Metabase Cloud or self-hosted instances.

• Configuring LDAP authentication in Superset's superset_config.py with group-to-role mapping for automatic BI role assignment on login.

• Implementing SCIM user provisioning for automatic account creation and deactivation synchronized with your HR identity provider.

4. Row-Level Security & Permission Management

• Implementing Metabase data permissions: database-level block access, schema-level permissions, table-level row restrictions, and collection-based content visibility.

• Configuring Superset Row-Level Security (RLS) rules using Jinja2-templated WHERE clause filter expressions tied to user attributes:

• # Superset RLS rule example

• [region] = '{{ current_user.get("region") }}'

• Mapping user roles and groups from SSO identity providers to Metabase permission groups or Superset role sets.

• Validating security enforcement by impersonating restricted users and confirming zero cross-tenant or cross-department data exposure.

5. Dashboard Development, Native Queries & Alerting

• Building polished executive dashboards using Metabase's no-code question builder and Superset's chart builder for common visualization types: time-series, bar, scatter, heatmap, funnel, and choropleth maps.

• Writing Superset SQL Lab native queries for complex multi-step analytical computations, CTEs, and window functions not expressible in the no-code UI.

• Implementing Metabase Alerts and Superset alerts configured to email or Slack specified users when KPIs cross defined thresholds.

• Configuring scheduled dashboard subscriptions delivering PDF snapshots to executive inboxes on weekly or monthly schedules.

6. Async Query Workers, Performance Tuning & Monitoring

• Configuring Celery distributed task queue with Redis broker for Superset to offload slow asynchronous queries from the web process.

• Tuning Metabase query caching (TTL-based and question-level cache invalidation) to serve repeated dashboard loads from memory.

• Setting up health check endpoints, uptime monitoring (UptimeRobot, Prometheus + Grafana), and Docker container restart policies.

• Configuring log aggregation to AWS CloudWatch, GCP Cloud Logging, or self-hosted ELK stack for operational visibility and security audit trails.

Common Use Cases We Build For

Our Metabase and Superset deployments power analytics across organizations unwilling to pay proprietary BI pricing:

• SaaS Startup Analytics Stack: Full Metabase setup on AWS for a seed-stage startup replacing manual Google Sheets reporting with live PostgreSQL and Stripe dashboards.

• Multi-Tenant Client Reporting Portal: Superset with row-level security serving isolated dashboards to 50 enterprise clients from a single deployment.

• Internal Operations Command Center: Metabase deployment for non-technical operations teams querying Snowflake with no-code drag-and-drop question builders.

• E-Commerce Revenue & Inventory Dashboard: Superset connected to BigQuery serving real-time GMV, margin, inventory turnover, and marketing attribution dashboards.

• Healthcare Analytics (On-Premises): Superset deployed on private hospital infrastructure with LDAP authentication and patient-level row security for HIPAA compliance.

• Embedded Product Analytics: Metabase signed URL embedding serving customer-facing usage dashboards inside a B2B SaaS portal without exposing raw data.

What You Get (Deliverables)

Every Codersarts Metabase or Superset engagement delivers a complete, production-ready BI environment:

• Production Deployment Configuration: Docker Compose or Kubernetes Helm chart files with all environment variables, volume mounts, and restart policies documented.

• Secured nginx / Caddy Reverse Proxy: SSL-terminated HTTPS configuration with HTTP redirect, security headers (HSTS, CSP), and gzip enabled.

• Configured Data Source Connections: All warehouse and database connections verified with appropriate pool sizes and SSH tunnel configurations.

• SSO Authentication Setup: Verified SAML/OAuth2/LDAP integration with identity provider, group-to-role mapping, and test user login confirmation.

• Row-Level Security Implementation: Deployed and validated RLS rules with documented security test cases confirming zero unauthorized data access.

• Starter Executive Dashboard Library: 3–5 production-quality dashboards covering your primary KPIs, built during the engagement as a template foundation.

• Operational Runbook & Admin Guide: Step-by-step procedures for adding users, creating new dashboards, connecting new data sources, and performing upgrades.

• 60-Minute Admin & Analyst Team Training: Live recorded walkthrough covering platform administration, dashboard creation, and ongoing maintenance procedures.

What We Need From You

To begin your Metabase or Superset deployment, we require:

• Target Infrastructure Details: Cloud provider (AWS, GCP, Azure) or on-premises server specifications, operating system, and available compute/memory resources.

• Data Source Connection Credentials: Database hostnames, ports, credentials, or warehouse API keys for all data sources to be connected.

• Identity Provider Details: SSO configuration (Google Workspace domain, Entra ID tenant ID, Okta domain) or LDAP server connection information.

• User Access & Permission Requirements: List of user groups, their roles (admin, analyst, viewer), and any row-level data restrictions required.

How It Works: Our 5-Step BI Deployment Process

We deliver a production-ready BI environment through a structured 5-step engagement:

• Step 1: Infrastructure Design & Platform Selection (Days 1–2)

  
  

  We assess your infrastructure, user scale, and security requirements, recommend Metabase vs. Superset based on your use case, and design the deployment architecture.

• Step 2: Docker / Kubernetes Deployment & PostgreSQL Setup (Days 3–4)

  
  

  We deploy the BI platform container, configure the external PostgreSQL metadata database, set up nginx reverse proxy with SSL, and verify the base installation.

• Step 3: Data Source Connection & SSO Integration (Days 5–7)

  
  

  We connect all data warehouse and database sources, configure SSO authentication with your identity provider, and map groups to permission roles.

• Step 4: Row-Level Security, Dashboards & Alerting (Days 8–11)

  
  

  We implement RLS rules, validate security enforcement, build the starter dashboard library, and configure scheduled email subscriptions and threshold alerts.

• Step 5: Performance Tuning, Monitoring & Handover (Days 12–14)

  
  

  We tune query caching and async workers, configure health monitoring, deliver the operational runbook, and host the live admin and analyst training session.

Book Your Free Scoping Call →

Security, Data Privacy & Confidentiality

Self-hosted BI deployments require rigorous infrastructure security:

• In-Tenant Deployment: The entire BI platform runs inside your cloud account or on-premises environment; no data touches Codersarts infrastructure.

• HTTPS Everywhere: nginx reverse proxy enforces SSL/TLS termination with HSTS headers; no unencrypted traffic is permitted.

• Secret Management: All database passwords, secret keys, and SSO client secrets stored in environment variables or cloud secret managers—never in Docker images.

• Principle of Least Privilege: User roles configured to grant minimum necessary database access; service accounts have read-only permissions on analytical schemas.

• Institutional NDA Protection: Comprehensive mutual Non-Disclosure Agreements signed before accessing your infrastructure credentials or database schemas.

• Complete Configuration Ownership: All Docker Compose files, Helm charts, nginx configs, and operational runbooks belong entirely to your organization.

Investment & Engagement Models

Transparent, milestone-based pricing with zero ongoing per-seat consulting fees:

Starter BI Deployment

Typical Scope: Single-server Docker deployment, 1–2 data source connections, basic user roles, SSL setup, 3 starter dashboards.

Timeline: 1–2 Weeks

Deliverables: Production Docker Compose deployment, SSL, data connections, role setup, starter dashboards, runbook.

Comprehensive Enterprise Setup

Typical Scope: Docker/K8s deployment, PostgreSQL metadata DB, SAML SSO, row-level security, 5+ dashboards, alerting, Celery workers.

Timeline: 2–3 Weeks

Deliverables: Full production environment, SSO integration, RLS rules, dashboard library, alerting setup, 60-min training.

Enterprise Multi-Tenant Platform

Typical Scope: Kubernetes HA deployment, multi-tenant RLS, embedded analytics API, custom Superset plugins, CI/CD upgrade pipeline.

Timeline: 3–4 Weeks

Deliverables: Enterprise HA deployment, embedding integration, multi-tenant security, upgrade CI/CD, team workshop.

What Drives the Cost?

• Infrastructure Complexity: Single Docker Compose on one VM vs. high-availability multi-replica Kubernetes deployment with load balancing.

• Authentication Scope: Simple password auth vs. SAML SSO with group-to-role mapping and SCIM automated provisioning.

• Security Architecture: Basic user roles vs. multi-dimensional row-level security across complex organizational hierarchies.

• Dashboard & Integration Scope: 3 starter dashboards vs. comprehensive dashboard library, embedded API integration, and Superset custom plugins.

Get Your Fixed Quote

Flexible Engagement Options

• Fixed-Price Project: Clear scope, fixed timeline, and guaranteed deliverables with zero billing surprises.

• BI Admin Retainer: Dedicated monthly engineering hours for platform upgrades, new data source connections, security audits, and user support. See Hire Developers.

Tech Stack & Tooling

• We deploy and configure using the official open-source BI platform ecosystem:

Why Choose Codersarts for Metabase & Superset Setup

• Production-First Deployment Philosophy: We never deliver toy Docker Compose configurations; every engagement produces a hardened, SSL-secured, PostgreSQL-backed production environment.

• Full-Stack Infrastructure Depth: We combine BI platform expertise with genuine cloud infrastructure engineering—nginx, Docker, Kubernetes, RDS, and IAM configuration.

• Security Architecture Specialists: We implement and verify row-level security before any user accesses the platform, not as an afterthought.

• Cost-Optimization Focus: Our goal is to maximize the business value of your open-source investment, saving you tens of thousands compared to proprietary alternatives.

• 100% Configuration Ownership: You receive every config file, Helm chart, and runbook with complete operational independence from Codersarts post-delivery.

• Rapid Turnaround & Fixed Pricing: Binding quotes and deployment plans delivered within 24 hours of reviewing your infrastructure requirements.

Where This Fits in Your AI Project

Self-hosted open-source BI provides the cost-effective analytics layer for data-driven organizations. Complementary Codersarts services:

• Build a Power BI Dashboard: Evaluate proprietary vs. open-source BI for your specific governance, embedding, and licensing requirements.

• Build a Tableau Dashboard: Compare Tableau's LOD expression power with Superset's SQL Lab flexibility for your analytical team.

• Speed Up Slow Data Processing: Optimize upstream database query performance before connecting to Metabase or Superset for faster dashboard loads.

• Clean & Prepare Messy Data: Standardize source warehouse tables before exposing them as Metabase models or Superset virtual datasets.

• Build a Streamlit Data App: Complement Metabase self-service exploration with custom Python Streamlit apps for specialized ML-powered analyses.

• Get an AI Architecture Review: Audit your full data and analytics stack for governance readiness, security hardening, and AI-powered analytics potential.

Need clean warehouse tables to report on? See Build dbt Models for Your Warehouse. Need data synced into the warehouse first? See Build an ELT Data Pipeline.

Frequently Asked Questions

How much does a Metabase or Superset setup service cost?

Pricing depends on the target infrastructure (single Docker server vs. Kubernetes HA cluster), the number of data source connections, whether SSO and row-level security are required, and the scope of initial dashboard development. Following an initial 30-minute scoping call, we provide a transparent, fixed-price quote within 24 hours.

How long does it take to set up Metabase or Superset?

A focused production deployment covering Docker installation, SSL setup, database connections, basic roles, and starter dashboards typically takes 1 to 2 weeks. A comprehensive enterprise deployment with Kubernetes, SAML SSO, row-level security, Celery async workers, and a full dashboard library takes 2 to 3 weeks.

What is the difference between Metabase and Apache Superset?

Metabase is designed for non-technical business users: its no-code question builder, simple data exploration UI, and clean design make it highly accessible to analysts without SQL skills. Apache Superset is more developer-oriented, with a powerful SQL Lab query environment, Superset Charts with extensive customization options, Jinja2-templated row-level security, and a more flexible plugin architecture for advanced use cases. We recommend Metabase for teams prioritizing self-service ease-of-use, and Superset for teams with SQL-proficient analysts needing maximum flexibility.

Why should we not use the default Docker Compose quickstart for production?

The official Metabase quickstart uses an embedded H2 in-memory database for metadata that loses all configuration on container restart, has no SSL, and exposes the application on an unprotected port. The Superset quickstart uses SQLite, which is not thread-safe for concurrent users. Neither is suitable for organizational use. We deploy with external PostgreSQL metadata databases, nginx SSL termination, and proper container orchestration from the start.

Can Metabase or Superset connect to our Snowflake / BigQuery data warehouse?

Yes. Both platforms have native connectors for Snowflake, BigQuery, Amazon Redshift, Databricks SQL, ClickHouse, PostgreSQL, MySQL, SQL Server, and dozens of other databases. We configure warehouse-optimized connection pool settings and query timeout parameters appropriate for your data volume and analyst concurrency.

How does row-level security work in Superset?

Superset RLS rules attach a Jinja2-templated WHERE clause to every query executed against a dataset. For example, a rule like region = '{{ current_user.get("region") }}' automatically appends a filter based on the logged-in user's attribute, restricting their query results to only their authorized region—regardless of which dashboard, chart, or SQL Lab query they run.

Can we embed Metabase dashboards inside our own web application?

Yes, using Metabase's signed URL embedding feature (available in Metabase Pro and Enterprise). The application backend generates a short-lived signed JWT URL for each user that embeds a specific Metabase dashboard with pre-set parameter values. Users see a fully interactive Metabase dashboard rendered inside an <iframe> without needing a Metabase login.

What happens if a Superset container crashes—will we lose our dashboards?

Not with a properly configured deployment. All Superset metadata (dashboards, charts, dataset definitions, users) is stored in the external PostgreSQL metadata database, not inside the container. If the container crashes and restarts, it reconnects to PostgreSQL and recovers the full configuration automatically.

How do we upgrade Metabase or Superset after you deliver the deployment?

We document a tested upgrade procedure in the operational runbook: pull the new Docker image, run database migration scripts (Metabase auto-migrates; Superset requires superset db upgrade), and restart containers. For Kubernetes deployments, we configure a CI/CD pipeline that automates rolling upgrades with zero downtime.

Want to learn how to set up Metabase or Superset yourself?

Read our technical guide: Metabase and Apache Superset self-hosted BI setup, Docker deployment, and row-level security configuration on the Codersarts Discuss forum.

Set Up Your Self-Hosted BI This Week

Get your Metabase or Apache Superset deployment configured, secured, and production-ready by Codersarts experts. Eliminate expensive proprietary licensing, lock down data access with row-level security, and empower your entire organization with enterprise-grade open-source analytics.

Get a Free Quote | Book a Free 15-Minute Review