Add mainnet Metabase Fly deployment config

Author: niteshbalusu11

fly/mainnet-metabase-setup.md

@@ -0,0 +1,110 @@
+# Mainnet Metabase Fly setup
+
+`fly/mainnet.metabase.fly.toml` is the Fly app config for the Noah mainnet
+Metabase instance.
+
+Metabase needs two Postgres connections:
+
+- an application database, where Metabase stores its own users, dashboards,
+  saved questions, permissions, and sync metadata
+- a read-only reporting connection to the existing Noah mainnet database
+
+The current Noah mainnet Managed Postgres cluster is:
+
+```text
+Cluster ID: 3x9jv02ywl6r6qp7
+Cluster name: noah-mainnet-db
+Database: fly-db
+Schema admin user: fly-user
+Region: iad
+Direct IP: fdaa:38:716f:0:1::4
+```
+
+Fly Managed Postgres roles are cluster-wide. A `schema_admin` user can read and
+write across the cluster, so the safest setup is to use a separate small Managed
+Postgres cluster for Metabase's application database and use a `reader` user on
+`noah-mainnet-db` only for reporting.
+
+## One-time setup
+
+Create the Metabase Fly app:
+
+```sh
+fly apps create noah-mainnet-metabase
+```
+
+Create a separate Managed Postgres cluster for Metabase's own application state:
+
+```sh
+fly mpg create \
+  --name noah-mainnet-metabase-db \
+  --region iad \
+  --plan Basic \
+  --volume-size 10 \
+  --pg-major-version 16
+```
+
+List the new cluster and save its ID:
+
+```sh
+fly mpg list personal
+```
+
+Attach the new Metabase database cluster to the Metabase app. This stores the
+Metabase application database connection string as the `MB_DB_CONNECTION_URI`
+secret:
+
+```sh
+fly mpg attach <metabase-cluster-id> \
+  --config fly/mainnet.metabase.fly.toml \
+  --database fly-db \
+  --username fly-user \
+  --variable-name MB_DB_CONNECTION_URI
+```
+
+`fly mpg attach` stores a normal Postgres URL. Metabase expects a JDBC URL for
+`MB_DB_CONNECTION_URI`, so replace that secret with a JDBC URL after attaching.
+Use the Metabase database cluster's Direct IP from `fly mpg status`:
+
+```sh
+fly secrets set -a noah-mainnet-metabase \
+  MB_DB_CONNECTION_URI='jdbc:postgresql://[<metabase-db-direct-ip>]:5432/fly-db?sslmode=disable' \
+  MB_DB_USER=fly-user \
+  MB_DB_PASS='<fly-user password from the attach URL>' \
+  MB_ENCRYPTION_SECRET_KEY='<random 32+ character secret>'
+```
+
+Create a read-only reporting user on the existing Noah mainnet cluster:
+
+```sh
+fly mpg users create 3x9jv02ywl6r6qp7 \
+  --username metabase-readonly \
+  --role reader
+```
+
+Deploy Metabase:
+
+```sh
+fly deploy --config fly/mainnet.metabase.fly.toml --remote-only
+```
+
+The first boot can be slow because Metabase creates and migrates its application
+database before `/api/health` returns healthy. The Fly config uses a longer
+deploy wait for that first start.
+
+After the first deploy, open Metabase and add the Noah mainnet database as a
+data source:
+
+```text
+Database type: PostgreSQL
+Host: fdaa:38:716f:0:1::4
+Port: 5432
+Database name: fly-db
+User: metabase-readonly
+Password: <metabase-readonly password from Fly>
+Use a secure connection: disabled
+```
+
+This keeps Metabase's own state outside the production Noah cluster while
+limiting reporting access to read-only queries against the production `fly-db`
+database.

fly/mainnet-setup.md

@@ -5,6 +5,10 @@
 There is intentionally no `fly/mainnet.postgres.toml`.
 Fly Managed Postgres is not deployed as a second app config like the legacy Signet Postgres machine. It is created and attached separately.
 
+Metabase for mainnet is configured separately in `fly/mainnet.metabase.fly.toml`.
+See `fly/mainnet-metabase-setup.md` for the Metabase app database and read-only
+reporting role setup.
+
 ## One-time setup
 
 Create the mainnet app:

fly/mainnet.metabase.fly.toml

@@ -0,0 +1,42 @@
+# Fly app configuration for Noah mainnet Metabase.
+#
+# Metabase stores its own users, dashboards, and settings in a separate app
+# database. The Noah mainnet database should be added inside the Metabase UI
+# with a read-only reporting role.
+
+app = "noah-mainnet-metabase"
+primary_region = "iad"
+
+[build]
+  image = "metabase/metabase:latest"
+
+[deploy]
+  strategy = "rolling"
+  wait_timeout = "30m"
+
+[env]
+  MB_DB_TYPE = "postgres"
+  MB_JETTY_HOST = "0.0.0.0"
+  MB_JETTY_PORT = "3000"
+  MB_LOAD_SAMPLE_CONTENT = "false"
+  MB_SITE_URL = "https://noah-mainnet-metabase.fly.dev"
+
+[http_service]
+  internal_port = 3000
+  force_https = true
+  auto_stop_machines = "off"
+  auto_start_machines = true
+  min_machines_running = 1
+  processes = ["app"]
+
+  [[http_service.checks]]
+    grace_period = "1m"
+    interval = "30s"
+    method = "GET"
+    timeout = "10s"
+    path = "/api/health"
+
+[[vm]]
+  memory = "4gb"
+  cpu_kind = "shared"
+  cpus = 2