Metabase + Kamal

.env

POSTGRES_PASSWORD=xxxx
MB_DB_CONNECTION_URI=postgres://metabase:xxxx@your.server.ip.address:5432/metabase
KAMAL_REGISTRY_PASSWORD=xxxxx
S3_ACCESS_KEY_ID=xxxxx
S3_SECRET_ACCESS_KEY=xxxxx

deploy.yml

service: metabase
image: your_username/metabase

servers:
  web:
    hosts:
      - your.server.ip.address
    labels:
      traefik.http.routers.blog.entrypoints: websecure
      traefik.http.routers.blog.rule: Host(`your.domain`)
      traefik.http.routers.blog.tls.certresolver: letsencrypt

registry:
  username: your_username
  password:
    - KAMAL_REGISTRY_PASSWORD

env:
  clear:
    MB_DB_TYPE: postgres
    MB_JETTY_PORT: 3000
    JAVA_OPTS: -Xmx2g
  secret:
    - MB_DB_CONNECTION_URI

healthcheck:
  path: /api/health
  max_attempts: 20

accessories:
  pg:
    image: postgres:16.1-alpine
    host: your.server.ip.address
    port: 5432
    directories:
      - data:/var/lib/postgresql/data
    env:
      clear:
        POSTGRES_USER: metabase
        POSTGRES_DB: metabase
      secret:
        - POSTGRES_PASSWORD
  s3_backup:
    image: eeshugerman/postgres-backup-s3:16
    host: your.server.ip.address
    env:
      clear:
        SCHEDULE: '@daily'
        BACKUP_KEEP_DAYS: 30
        S3_REGION: your-s3-region
        S3_BUCKET: your-s3-bucket
        S3_PREFIX: backups
        POSTGRES_HOST: your.server.ip.address
        POSTGRES_DATABASE: metabase
        POSTGRES_USER: metabase
      secret:
        - POSTGRES_PASSWORD
        - S3_ACCESS_KEY_ID
        - S3_SECRET_ACCESS_KEY

# From https://guillaumebriday.fr/how-to-deploy-rails-with-kamal-and-ssl-certificate-on-vps

# Configure custom arguments for Traefik
traefik:
  options:
    publish:
      - "443:443"
    volume:
      - "/letsencrypt/acme.json:/letsencrypt/acme.json" # To save the configuration file.
  args:
    entryPoints.web.address: ":80"
    entryPoints.websecure.address: ":443"
    entryPoints.web.http.redirections.entryPoint.to: websecure # We want to force https
    entryPoints.web.http.redirections.entryPoint.scheme: https
    entryPoints.web.http.redirections.entrypoint.permanent: true
    certificatesResolvers.letsencrypt.acme.email: "your@email"
    certificatesResolvers.letsencrypt.acme.storage: "/letsencrypt/acme.json" # Must match the path in `volume`
    certificatesResolvers.letsencrypt.acme.httpchallenge: true
    certificatesResolvers.letsencrypt.acme.httpchallenge.entrypoint: web # Must match the role in `servers`

Dockerfile

FROM metabase/metabase:v0.48.1