Magnum BI Alpha

Platform owner guide

For system owners: set up organisations so their admins can take it from there. Magnum BI is running? If not, start with the infrastructure guide.

What a platform owner does

System owners run Magnum BI for everyone: they create organisations (a company, a department, a customer), give each its own database, decide what each may use, and name each one's admins. Inside an organisation, its Org admins take over: data, models, dashboards, people.

The first system owners are named by the server's setting (MAGNUM_SYSTEM_OWNERS, or the admin email in Compose and Helm); after that, on Settings › Organisations › System owners. The home page's Get started list shows what's left to do; Show me on a step points at the control to use. The top bar groups the pages: Discover, Data and Settings.

Create an organisation

  1. Open Settings › Organisations, then + Add organisation.
  2. Give it an id (lowercase, permanent, e.g. acme) and a name.
  3. Email domains (optional): anyone from those domains joins it automatically, with its default role.
  4. Models: the platform's models it may use (or all). Its own models, made by its Org admins, are always its own.
  5. Organisation filters (optional): rows everyone in it is limited to, Org admins included.
  6. Save.

Organisations never see each other's members, data or dashboards.

Give it its own database

Each organisation keeps its dashboards, connections, models, themes and cache in its own ScramDB. Until it has one, its people can't open dashboards.

  1. Start a ScramDB for it (on a server, or make org-db ORG=acme PORT=55433 on a development machine).
  2. On Settings › Organisations, its card, Database › Set…: paste its address (postgresql://user:password@host:5432/scramdb). Magnum BI tests it, sets it up and moves the organisation's dashboards there.

The address is stored encrypted with the secret key. From the server's command line: echo "postgresql://…" | magnum-bi org set-database acme. If an organisation's database is down, only that organisation is affected.

Name its Org admins

  1. On Settings › Organisations, its card, Open: you're now inside the organisation (the picker at the top says which).
  2. Settings › Members › People: add the person's email with the role Org admin, and Save.
  3. If they'll sign in with a password: One-time password… makes one to hand over; they choose their own at their first sign-in. With Google or the organisation's single sign-on, nothing else is needed.

From there, the Org admin guide is theirs.

Sign-in rules

On Settings › Organisations › Sign-in, choose how everyone may sign in (passwords, authenticator codes, passkeys, Google, organisations' own single sign-on, API tokens), and on each organisation's card, stricter rules for that organisation. Its Org admins can only tighten them further, never loosen them. Stricter rules sign out sessions that no longer meet them.

Shared models

Models made in the platform workspace are the platform's: shared master data, for example, that several organisations read from their own databases.

  1. In the platform workspace (no organisation chosen), add the connection on Data › Connections, under the name organisations use for theirs (e.g. warehouse).
  2. Data › Models › + New model: pick the connection and a table; Magnum BI proposes the fields from its columns. Adjust them and Save model.
  3. On Settings › Organisations, tick it under each organisation's Models (or give them all).

Each organisation then reads it on its own connection of that name, with its own credentials and its organisation filters. An organisation's own model with the same name keeps it there. Models in project/models (YAML in git) work the same way.

Templates and the demo

  • The platform workspace (no organisation chosen) has the platform's dashboards: templates. Publish… on one copies it into organisations.
  • Demo data at the bottom of Settings › Organisations loads the NYC taxi × weather demo into an organisation (about 60 MB a month of trips): a quick way to show Magnum BI.

Usage, sharing and keeping watch

  • Settings › Usage shows the whole platform (or one organisation): who looks at what, queries, how long they take, failures, and admin actions.
  • Org admins can share dashboards publicly (from a cache) and Power users with guests (link + password, at most 14 days). MAGNUM_PUBLIC_LINKS=0 turns public links off for the server.
  • System owners can open any organisation and work inside it, with every permission.

Email and webhooks

  • Settings › Email & webhooks, in the platform workspace, sets the platform workspace's own mail server and webhooks, for reports on its dashboards.
  • They aren't shared. Each organisation sets up its own on its Settings › Email & webhooks page, kept in its own database; an organisation without one can't send email, and nothing falls back to the platform's.
  • Mail servers and webhooks go through the same network guard as connections: private addresses only where the server allows them (MAGNUM_ALLOW_PRIVATE_CONNECTIONS, MAGNUM_CONNECTION_ALLOWED_HOSTS).