DOCSEARCHbyAlgolia
Submit Docs

DataLens Documentation

repository·main·Indexed 23 days ago

https://github.com/datalens-tech/datalens

A modern business intelligence and data visualization system for connecting to various data sources and creating interactive dashboards. Available as an open-source project and a managed service in Yandex Cloud, DataLens includes components for UI, Backend, UnitedStorage, Auth, and MetaManager. Documentation covers installation via Docker Compose and Helm, production configuration with secure secrets, external PostgreSQL integration, and role-based access control.

Tokens
4.5K
Snippets
11
Records
24
Agent score
33%

What's inside DataLens

  1. Understand DataLens architecture components

    main

    DataLens is composed of several specialized services:

    • UI: A SPA (Single Page Application) with a Node.js backend. It handles the user interface, proxies requests, and performs light data post-processing.
    • Backend: Python applications responsible for connecting to data sources, generating queries, and calculating formulas.
    • UnitedStorage (US): A Node.js service using PostgreSQL to store metadata and configuration for all DataLens objects.
    • Auth: A Node.js service providing the authentication and authorization layer.
    • MetaManager: A Node.js service providing workflow workers for importing and exporting workbooks.

  2. Manage DataLens user roles and permissions

    main

    DataLens uses a role-based access control system. By default, users have the datalens.viewer role. Roles can be managed via the admin control panel at http://localhost:8080/.

    Available roles:

    • datalens.viewer: Can view all collections and workbooks in read-only mode. Cannot create or modify objects.
    • datalens.editor: Includes datalens.viewer permissions and allows creating, editing, and deleting any object.
    • datalens.admin: Currently equivalent to datalens.editor. Future updates will allow system-wide setting management and administrative functions.

  3. Disable workbook export feature

    main

    To save resources or simplify deployment, you can disable the workbook export to JSON feature. This removes the meta-manager and ui-api services from the deployment.

    ./init.sh --disable-workbook-export --up

    ./init.sh --disable-workbook-export --up

  4. Update DataLens installation

    main

    To update to the latest version, pull the latest changes from the git repository and restart the containers. Your data (connections, objects, settings) is preserved because it is stored in the db-postgres docker volume.

    git pull

# If using base compose file
docker compose up

# If using init.sh script
./init.sh --up

  5. Deploy DataLens with Helm in Kubernetes

    main

    Deploy DataLens to a Kubernetes cluster using the official Helm chart from the OCI registry. Note that you must manually generate RSA keys for the Auth service and Temporal before running the helm upgrade command, as the Helm template engine does not support key generation.

    # 1. Generate RSA keys (example for one service)
AUTH_TOKEN_PRIVATE_KEY=$(openssl genpkey -algorithm RSA -pkeyopt "rsa_keygen_bits:4096" 2>/dev/null)
AUTH_TOKEN_PUBLIC_KEY=$(echo "${AUTH_TOKEN_PRIVATE_KEY}" | openssl rsa -pubout 2>/dev/null)

# ... repeat for TEMPORAL_AUTH, BI_DYNAMIC_US_AUTH, and UI_DYNAMIC_US_AUTH ...

# 2. Install/Upgrade via Helm
helm upgrade --install datalens oci://ghcr.io/datalens-tech/helm/datalens \
--namespace datalens --create-namespace \
--set "secrets.AUTH_TOKEN_PRIVATE_KEY=${AUTH_TOKEN_PRIVATE_KEY}" \
--set "secrets.AUTH_TOKEN_PUBLIC_KEY=${AUTH_TOKEN_PUBLIC_KEY}" \
--set "secrets.TEMPORAL_AUTH_PRIVATE_KEY=${TEMPORAL_AUTH_PRIVATE_KEY}" \
--set "secrets.TEMPORAL_AUTH_PUBLIC_KEY=${TEMPORAL_AUTH_PUBLIC_KEY}" \
--set "secrets.BI_DYNAMIC_US_AUTH_PRIVATE_KEY=${BI_DYNAMIC_US_AUTH_PRIVATE_KEY}" \
--set "secrets.BI_DYNAMIC_US_AUTH_PUBLIC_KEY=${BI_DYNAMIC_US_AUTH_PUBLIC_KEY}" \
--set "secrets.UI_DYNAMIC_US_AUTH_PRIVATE_KEY=${UI_DYNAMIC_US_AUTH_PRIVATE_KEY}" \
--set "secrets.UI_DYNAMIC_US_AUTH_PUBLIC_KEY=${UI_DYNAMIC_US_AUTH_PUBLIC_KEY}"

  7. Disable Temporal service for resource-constrained systems

    main

    On systems with limited resources, you can disable the Temporal workflow service. Note that disabling Temporal also automatically disables the workbook export feature, as the latter depends on Temporal workflows.

    ./init.sh --disable-temporal --up

    ./init.sh --disable-temporal --up

  8. Quick start DataLens with Docker Compose

    main
    To run a local instance of DataLens for testing or development, clone the repository and use docker compose up. By default, the UI is available at http://localhost:8080 with the credentials admin / admin.

  10. Run DataLens in production mode with secure secrets

    main

    For production environments, do not use the default credentials. Instead, use the ./init.sh script to generate random secrets, store them in a .env file, and prepare a production-ready compose template. This process generates a secure admin password which will be printed to the terminal and saved in .env.

    # Option 1: Generate secrets and prepare template, then run manually
./init.sh --hc
docker compose -f ./docker-compose.production.yaml up -d

# Option 2: Generate and run in one command
./init.sh --hc --up

  11. Disable authentication for development

    main

    To run DataLens without authentication (useful for development or testing), use the --disable-auth flag. This generates a compose file that removes the authentication service, allowing direct access without login credentials.

    ./init.sh --disable-auth --up

    ./init.sh --disable-auth --up

  12. Configure a custom domain or IP for the UI endpoint

    main

    When using a reverse proxy with HTTPS or a custom domain, you can generate the Docker Compose file using the ./init.sh script with specific flags.

    To use a custom domain and HTTPS: ./init.sh --domain <domain> --https

    To use a specific IP address as the endpoint: ./init.sh --ip <ip>

    ./init.sh --domain <domain> --https
./init.sh --ip <ip>