Blazer SQL BI Dashboard on AWS User Guide

Overview

This guide covers the deployment and configuration of Blazer on AWS using cloudimg AWS Marketplace AMIs. Blazer is an open source, self-hosted business-intelligence tool by Andrew Kane. You write SQL queries, turn them into charts and dashboards, and schedule data checks that alert you when a result looks wrong. The image ships populated with a sample dataset and a set of example queries and a dashboard, so the query editor, chart results and dashboards render real content the moment you sign in.

The cloudimg image ships the free and open source, MIT-licensed Blazer 3.4.0 application, run the officially supported way as the upstream ankane/blazer container, backed by a bundled PostgreSQL 16 database. Because Blazer has no authentication of its own (it expects the host application to protect it), this image fronts it with an nginx reverse proxy on port 80 that gates every path behind HTTP Basic authentication. Nothing ships with a known secret: a unique admin password, a unique Rails application secret and a unique database password are generated for each instance on first boot, before the application is reachable, and the admin password is written to a root-only file. Backed by 24/7 cloudimg support.

Blazer is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by the Blazer project or Andrew Kane. It ships the free and open source MIT-licensed self-hosted software, unmodified.

What is included:

• Blazer 3.4.0 (the MIT-licensed SQL and business-intelligence application), run as the official ankane/blazer container
• A bundled PostgreSQL 16 database, listening on the loopback interface only, holding Blazer's own metadata and a seeded sample dataset
• A sample dataset (users, orders and events) plus four example queries, a Sales Overview dashboard and a data check, so the UI is populated out of the box
• Docker Engine, with the Blazer container reachable only through the nginx reverse proxy
• nginx on port 80 as the single public front door, gating every path behind HTTP Basic auth (with an unauthenticated /healthz endpoint for load-balancer probes)
• docker.service, postgresql@16-main.service, blazer-firstboot.service, blazer.service and nginx.service as systemd units, enabled and active on boot
• A unique admin password, a unique Rails application secret and a unique database password generated per instance on first boot, never baked into the image
• No default login and no shipped secret: the built image carries no working credential
• Ubuntu 24.04 LTS base with latest security patches applied at build time
• 24/7 cloudimg support with a guaranteed 24-hour response SLA

Prerequisites

• An active AWS account and an EC2 key pair in your target region
• A subscription to the Blazer listing on AWS Marketplace
• A VPC and subnet, and a security group allowing inbound 22/tcp (SSH, from your admin network) and 80/tcp (the web interface, from the networks that use it). Add 443/tcp if you enable HTTPS.

Recommended instance type: m5.large (2 vCPU, 8 GB RAM) is a sensible starting point. Blazer and its bundled database are lightweight, so a general-purpose instance is ample; size up for very large result sets or many concurrent users.

Connecting to your instance

This listing offers one or more operating-system variants. Connect over SSH as that variant's default login user, using your EC2 key pair:

Step 1: Subscribe and launch from AWS Marketplace

Sign in to the AWS Marketplace, search for Blazer by cloudimg, and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch. Pick your region, the m5.large instance type, your VPC and subnet, your EC2 key pair, and a security group that allows SSH (22) from your admin network and HTTP (80) from the networks that use the app. Launch the instance.

Step 2: Launch from the AWS CLI

You can also launch the AMI directly. Resolve the product AMI id for your region from the listing, then:

REGION="us-east-1"
AMI_ID="<ami-id>"          # the Blazer AMI id for your region
KEY_NAME="your-key"
SG_ID="sg-xxxxxxxx"         # allows 22 from <your-mgmt-cidr> and 80 from your users
SUBNET_ID="subnet-xxxxxxxx"
aws ec2 run-instances --region "$REGION" \
  --image-id "$AMI_ID" --instance-type m5.large \
  --key-name "$KEY_NAME" --security-group-ids "$SG_ID" --subnet-id "$SUBNET_ID" \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=blazer}]'

The image resolves its public URL from EC2 instance metadata (IMDSv2) on first boot, so the interface is reachable at the instance's public address with no extra configuration.

Step 3: Connect to your instance

ssh -i your-key.pem ubuntu@<public-ip>

Step 4: Confirm the services are running

Blazer runs as a container under blazer.service, backed by the bundled PostgreSQL database and fronted by nginx. Confirm the services are active and see the container:

sudo systemctl is-active docker postgresql@16-main nginx blazer
sudo docker ps --format 'table {{.Image}}\t{{.Status}}\t{{.Names}}'

Expected output:

active
active
active
active
IMAGE                  STATUS         NAMES
ankane/blazer:latest   Up 3 minutes   blazer

The Blazer container is published inside the host network namespace on 127.0.0.1:8080, and PostgreSQL listens on 127.0.0.1:5432; neither is reachable from the network. nginx on :80 is the single public front door.

Step 5: Read the per-instance credentials

A unique admin password, a unique Rails application secret and a unique database password were generated for this instance on the first boot, before the application was reachable, and the admin password was written to a root-only file. Read it:

sudo cat /root/blazer-credentials.txt

You will see the instance URL and the admin login:

BLAZER_URL=http://<instance-public-ip>/
BLAZER_ADMIN_USER=admin
BLAZER_ADMIN_PASSWORD=<generated-on-first-boot>

Keep this password safe. It is unique to this instance and is the credential nginx checks for HTTP Basic authentication.

Step 6: Sign in to Blazer

Browse to http://<instance-public-ip>/. Your browser will prompt for HTTP Basic authentication: enter admin and the password from Step 5. Blazer opens on its home view, listing the seeded example queries and the Sales Overview dashboard.

Step 7: Run a query

Open Revenue by Status. Blazer runs the saved SQL, shows the results table and, because the result has a category column and a numeric column, renders a chart automatically. Every saved query works the same way: write SQL, run it, and Blazer visualises the result.

Step 8: Open a dashboard

Open the Sales Overview dashboard from the home view. A dashboard combines several queries into one page, so you can watch related metrics together. This one pairs a time-series of orders per month with revenue by status and users by city, all over the bundled sample dataset.

Step 9: Write your own query

Choose New Query (or Edit on an existing one) to open the query editor. It has SQL syntax highlighting, a schema browser and a Run button; save a query to add it to the home list, and add it to a dashboard or attach a data check.

Step 10: Connect your own database (with a read-only role)

Out of the box, Blazer queries its bundled database (the main data source), which also holds the sample dataset. To report on your own data, add a data source that points at your database.

Blazer runs arbitrary SQL, so connect it with a read-only database role, and widen the permissions deliberately only if you need to. On PostgreSQL, for example, create a read-only role on your target database:

CREATE ROLE blazer_ro LOGIN PASSWORD 'choose-a-strong-password';
GRANT CONNECT ON DATABASE yourdb TO blazer_ro;
GRANT USAGE ON SCHEMA public TO blazer_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO blazer_ro;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO blazer_ro;

Then add the data source to Blazer's configuration. Edit /opt/blazer/blazer.yml inside the container's config, or mount your own blazer.yml, adding a named data source with the read-only connection string, and restart Blazer with sudo systemctl restart blazer.

New queries can then select your data source from the editor. Keeping the role read-only means a query can never modify or drop data in your database.

Security model

• nginx is the only public listener. Blazer (127.0.0.1:8080) and PostgreSQL (127.0.0.1:5432) bind to the loopback interface only and are never exposed to the network.
• Every path requires authentication. Because Blazer has no built-in auth, nginx gates every path behind HTTP Basic auth. The only exception is the static /healthz endpoint, which returns 200 for load-balancer probes and exposes nothing.
• No shipped secret. The admin password, the Rails application secret and the database password are all generated per instance on first boot; the built image carries only placeholders. Confirm the negatives yourself:

# unauthenticated request is refused
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/queries      # -> 401
# the static health endpoint is open
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/healthz      # -> 200

To change the admin password, rewrite the htpasswd entry and reload nginx:

sudo htpasswd -b /etc/nginx/.htpasswd admin '<new-password>'
sudo systemctl reload nginx

Enabling HTTPS

For production, terminate TLS in front of Blazer. The simplest options are:

• An AWS Application Load Balancer with an ACM certificate, forwarding to the instance on port 80. Open 443 on the load balancer and restrict the instance security group to the load balancer.
• On the instance with Certbot, if the instance has a public DNS name:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Open 443/tcp in the security group when you enable HTTPS.

Managing the service

Check status and view logs:

sudo systemctl status blazer --no-pager
sudo docker logs blazer --tail 20

To restart the application after a configuration change, run sudo systemctl restart blazer; to restart the front door, run sudo systemctl restart nginx.

File locations

Troubleshooting

The browser does not prompt for a password / returns 401

nginx gates every path behind HTTP Basic auth. Enter admin and the password from /root/blazer-credentials.txt. A 401 means the credentials were wrong or absent; that is the correct, secure behaviour for an unauthenticated request.

Blazer shows a 502 or does not load after signing in

The Blazer container may still be starting. Check it is up and healthy:

sudo systemctl is-active blazer
sudo docker logs blazer --tail 20
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/health   # -> 200 when ready

First boot did not generate credentials

Check the first-boot service and its log:

sudo systemctl status blazer-firstboot
sudo cat /var/log/blazer-firstboot.log

Support

For assistance, contact cloudimg support:

• Email: support@cloudimg.co.uk
• Response Time: 24/7 with a guaranteed 24-hour response SLA
• Website: https://www.cloudimg.co.uk