Package com.cloudforgeci.api.application.analytics

Class MetabaseApplicationSpec

java.lang.Object

com.cloudforgeci.api.application.analytics.MetabaseApplicationSpec

All Implemented Interfaces:

ApplicationSpec, DatabaseSpec

@ApplicationPlugin(value="metabase",
                   category="analytics",
                   displayName="Metabase",
                   description="Business intelligence and analytics platform",
                   defaultCpu=1024,
                   defaultMemory=2048,
                   defaultInstanceType="t3.small",
                   supportsFargate=true,
                   supportsEc2=true,
                   supportsOidc=true,
                   supportsDatabase=true,
                   requiresDatabase=false)
public class MetabaseApplicationSpec
extends Object
implements ApplicationSpec, DatabaseSpec

Metabase Business Intelligence ApplicationSpec implementation.

Metabase is an open-source business intelligence tool for interactive dashboards and data visualization.

Database Configuration:

• Development/Staging: H2 embedded database (single instance only)
• Production: Use RDS PostgreSQL/MySQL for multi-instance deployments

IMPORTANT: H2 database cannot support multiple instances due to file locking. For high availability, configure maxInstanceCapacity=1 or use external RDS database.

RDS Configuration (Production):

Set environment variables:

• MB_DB_TYPE=postgres
• MB_DB_HOST=your-rds-endpoint.rds.amazonaws.com
• MB_DB_PORT=5432
• MB_DB_DBNAME=metabase
• MB_DB_USER=metabase_user
• MB_DB_PASS=from-secrets-manager

Use Cases:

• SOC2: Audit log analytics and security metrics
• GDPR: Data subject access request reporting
• PCI-DSS: Transaction monitoring dashboards
• Fintech: Fraud detection, revenue metrics, compliance reporting

See Also:

• Metabase Documentation

Nested Class Summary

Nested classes/interfaces inherited from interface com.cloudforge.core.interfaces.ApplicationSpec

ApplicationSpec.OptionalPort

Nested classes/interfaces inherited from interface com.cloudforge.core.interfaces.DatabaseSpec

DatabaseSpec.DatabaseConnection, DatabaseSpec.DatabaseRequirement

Field Summary

Fields

Modifier and Type	Field	Description
static final String	LICENSE_SECRET_SUFFIX	The Secrets Manager secret name for Metabase Pro/Enterprise license token.

Constructor Summary

Constructors

Constructor	Description
MetabaseApplicationSpec()

Method Summary

Modifier and Type	Method	Description
String	applicationId()	Returns a unique identifier for this application.
int	applicationPort()	Returns the primary application port.
void	configureUserData(UserDataBuilder builder, Ec2Context context)	Configure EC2 UserData script for application installation and setup.
String	containerDataPath()	Returns the container path where application data is stored.
Map<String,String>	containerEnvironmentVariables(String fqdn, boolean sslEnabled, String authMode)	Configures application-specific environment variables for the container.
Map<String,String>	containerEnvironmentVariables(String fqdn, boolean sslEnabled, String authMode, DatabaseSpec.DatabaseConnection dbConn)	Container environment variables with database connection support.
String	containerUser()	Returns the container user (UID:GID) to run as.
DatabaseSpec.DatabaseRequirement	databaseRequirement()	Database requirement for this application.
String	defaultContainerImage()	Returns the default container image for this application.
String	ebsDeviceName()	Returns the EBS device name for EC2 instances when not using EFS.
String	ec2DataPath()	Returns the EC2 data path where application stores persistent data.
List<String>	ec2LogPaths()	Returns CloudWatch log file paths for EC2 monitoring.
String	efsDataPath()	Returns the EFS path for this application's data.
String	efsPermissions()	Returns the EFS permissions for the access point.
String	getLicenseEnvVarName()	Get the environment variable name for the Metabase license token.
String	getLicenseSecretName(String stackName)	Get the Secrets Manager secret name for the Metabase license token.
OidcIntegration	getOidcIntegration()	Returns the OIDC integration handler for this application.
boolean	supportsOidcIntegration()	Returns whether this application supports OIDC integration.
String	toString()
String	volumeName()	Returns the volume name for this application.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface com.cloudforge.core.interfaces.ApplicationSpec

category, defaultCpu, defaultHealthCheckGracePeriod, defaultInstanceType, defaultMemory, description, displayName, getRecommendedAuthMode, getSupportedAuthModes, healthCheckPath, optionalPorts, protectedPaths, publicPaths, supportsEc2, supportsFargate

Methods inherited from interface com.cloudforge.core.interfaces.DatabaseSpec

backupRetentionDays, databaseInitScripts, databaseParameters, readReplicaCount, requiresReadReplicas

Field Details

LICENSE_SECRET_SUFFIX

public static final String LICENSE_SECRET_SUFFIX

The Secrets Manager secret name for Metabase Pro/Enterprise license token. Store the license token in this secret to unlock SAML, advanced permissions, audit logging, etc. The secret can be updated in AWS Console without redeploying the stack.

See Also:

• Constant Field Values

Constructor Details

MetabaseApplicationSpec

public MetabaseApplicationSpec()

Method Details

applicationId

public String applicationId()

Description copied from interface: ApplicationSpec

Returns a unique identifier for this application. Used for logging, metrics, and resource naming.

Specified by:

applicationId in interface ApplicationSpec

Returns:

application identifier (e.g., "jenkins", "gitlab", "vault")

defaultContainerImage

public String defaultContainerImage()

Description copied from interface: ApplicationSpec

Returns the default container image for this application. Can be overridden by deployment context configuration.

Specified by:

defaultContainerImage in interface ApplicationSpec

Returns:

container image string (e.g., "jenkins/jenkins:lts")

applicationPort

public int applicationPort()

Description copied from interface: ApplicationSpec

Returns the primary application port. This is the port the application listens on inside the container.

Specified by:

applicationPort in interface ApplicationSpec

Returns:

application port (e.g., 8080 for Jenkins)

containerDataPath

public String containerDataPath()

Description copied from interface: ApplicationSpec

Returns the container path where application data is stored. This is where the volume will be mounted inside the container.

Specified by:

containerDataPath in interface ApplicationSpec

Returns:

container mount path (e.g., "/var/jenkins_home")

efsDataPath

public String efsDataPath()

Description copied from interface: ApplicationSpec

Returns the EFS path for this application's data. This is the path within the EFS filesystem.

Specified by:

efsDataPath in interface ApplicationSpec

Returns:

EFS path (e.g., "/jenkins")

volumeName

public String volumeName()

Description copied from interface: ApplicationSpec

Returns the volume name for this application. Used to reference the volume in task definitions.

Specified by:

volumeName in interface ApplicationSpec

Returns:

volume name (e.g., "jenkinsHome")

containerUser

public String containerUser()

Description copied from interface: ApplicationSpec

Returns the container user (UID:GID) to run as. Important for file permissions when using EFS.

Specified by:

containerUser in interface ApplicationSpec

Returns:

user in format "UID:GID" (e.g., "1000:1000")

databaseRequirement

public DatabaseSpec.DatabaseRequirement databaseRequirement()

Description copied from interface: DatabaseSpec

Database requirement for this application.

Specified by:

databaseRequirement in interface DatabaseSpec

Returns:

database requirement (required, optional, or none)

containerEnvironmentVariables

public Map<String,String> containerEnvironmentVariables(String fqdn,
 boolean sslEnabled,
 String authMode)

Description copied from interface: ApplicationSpec

Configures application-specific environment variables for the container.

Applications can override this to provide custom environment variables based on deployment configuration (FQDN, SSL, authMode, etc.). The infrastructure passes the FQDN, SSL settings, and authentication mode for applications that need reverse proxy configuration or authentication-specific setup.

Example use cases:

• Jenkins: JAVA_OPTS, JENKINS_OPTS for reverse proxy configuration, skip setup wizard for application-oidc
• GitLab: GITLAB_OMNIBUS_CONFIG for external URL configuration and OIDC setup
• Vault: VAULT_ADDR for API endpoint configuration

Specified by:

containerEnvironmentVariables in interface ApplicationSpec

Parameters:

fqdn - The fully qualified domain name (may be null)

sslEnabled - Whether SSL is enabled

authMode - The authentication mode (may be null, e.g., "none", "alb-oidc", "application-oidc")

Returns:

Map of environment variable key-value pairs (never null, may be empty)

containerEnvironmentVariables

public Map<String,String> containerEnvironmentVariables(String fqdn,
 boolean sslEnabled,
 String authMode,
 DatabaseSpec.DatabaseConnection dbConn)

Container environment variables with database connection support.

If database connection is provided, configures Metabase to use RDS PostgreSQL. Otherwise, falls back to H2 embedded database (single instance only).

efsPermissions

public String efsPermissions()

Description copied from interface: ApplicationSpec

Returns the EFS permissions for the access point.

Specified by:

efsPermissions in interface ApplicationSpec

Returns:

permissions string (e.g., "750")

ebsDeviceName

public String ebsDeviceName()

Description copied from interface: ApplicationSpec

Returns the EBS device name for EC2 instances when not using EFS. This is the device that will be formatted and mounted for application data.

Specified by:

ebsDeviceName in interface ApplicationSpec

Returns:

EBS device path (e.g., "/dev/xvdh")

ec2DataPath

public String ec2DataPath()

Description copied from interface: ApplicationSpec

Returns the EC2 data path where application stores persistent data. This may differ from containerDataPath depending on application packaging.

Specified by:

ec2DataPath in interface ApplicationSpec

Returns:

EC2 mount path (e.g., "/var/lib/jenkins")

ec2LogPaths

public List<String> ec2LogPaths()

Description copied from interface: ApplicationSpec

Returns CloudWatch log file paths for EC2 monitoring. These files will be streamed to CloudWatch Logs for centralized logging.

Specified by:

ec2LogPaths in interface ApplicationSpec

Returns:

list of absolute log file paths (e.g., ["/var/log/jenkins/jenkins.log"])

configureUserData

public void configureUserData(UserDataBuilder builder,
 Ec2Context context)

Description copied from interface: ApplicationSpec

Configure EC2 UserData script for application installation and setup.

The implementation should use the UserDataBuilder to add application-specific installation commands while leveraging infrastructure helpers for storage mounting and CloudWatch configuration.

The infrastructure handles:

• System updates
• EFS vs EBS storage mounting (based on availability)
• CloudWatch Agent installation and configuration
• File permissions and ownership

The application provides:

• Application installation commands (yum/dnf install, etc.)
• Application configuration
• Service startup commands

Specified by:

configureUserData in interface ApplicationSpec

Parameters:

builder - The UserDataBuilder providing infrastructure helpers

context - The Ec2Context providing runtime information

supportsOidcIntegration

public boolean supportsOidcIntegration()

Description copied from interface: ApplicationSpec

Returns whether this application supports OIDC integration.

Applications with built-in OIDC support (GitLab, Grafana, SonarQube) or plugin support (Jenkins) should return true.

Specified by:

supportsOidcIntegration in interface ApplicationSpec

Returns:

true if application can integrate with OIDC providers

getOidcIntegration

public OidcIntegration getOidcIntegration()

Description copied from interface: ApplicationSpec

Returns the OIDC integration handler for this application.

This provides application-specific configuration for integrating with Cognito or IAM Identity Center OIDC.

Specified by:

getOidcIntegration in interface ApplicationSpec

Returns:

OIDC integration handler, or null if not supported

getLicenseSecretName

public String getLicenseSecretName(String stackName)

Get the Secrets Manager secret name for the Metabase license token.

The license token enables Pro/Enterprise features:

• SAML/SSO authentication
• Advanced permissions and sandboxing
• Audit logging
• Row-level permissions
• Interactive embedding

To add a license:

1. Go to AWS Secrets Manager in the AWS Console
2. Find the secret: {stackName}/metabase/license-token
3. Update the secret value with your Metabase license token
4. Restart the ECS task or wait for next deployment

Parameters:

stackName - the CloudFormation stack name

Returns:

the full secret name for the license token

getLicenseEnvVarName

public String getLicenseEnvVarName()

Get the environment variable name for the Metabase license token.

Returns:

MB_PREMIUM_EMBEDDING_TOKEN

toString

public String toString()

Overrides:

toString in class Object