The PostgreSQL source

eodia insights reads eodia analytics data like any other database: through a PostgreSQL source, with a read-only role that sees only the analytics schema. No code in insights: its screens, its SQL editor and its AI assistant find the views, with their labels and descriptions.

The eodia_analytics role

The eodia analytics migrations create an eodia_analytics role:

• USAGE on the analytics schema and SELECT on its views, including those generated later (evt_*, cls_*);
• nothing on public (the configuration) or on collect (the raw data): privileges there are explicitly revoked.

It can only sign in if READER_PASSWORD is set: at startup, the API gives it this password; without it, the role stays NOLOGIN. In development, the password is eodia-analytics.

Administration › Settings › Read role shows whether the role exists, whether it can sign in, how many views analytics contains, and gives the connection string to paste into insights (without the password).

Managed database

If the application user is not allowed to create a role, the migration reports it: create it by hand. See the managed database.

Adding the source in insights

In eodia insights, Data sources › New source › PostgreSQL:

Field	Value
Host, port	the address of the analytics database (localhost:55436 in development)
Database	analytics
User	eodia_analytics
Password	the value of READER_PASSWORD
Excluded schemas	public, collect (the source’s excluded_schemas option)

Then synchronize the schema. The Structure screen shows the analytics views, with the labels and descriptions taken from the SQL comments.

Exclude public and collect

PostgreSQL lets any role see the names of the tables in other schemas, never their contents. Exclude public and collect from the source so that their names do not clutter the Structure screen or the assistant’s context: the role has no right to read them anyway.

The metadata that travels

Everything you describe in eodia analytics reaches insights through PostgreSQL comments (COMMENT ON VIEW, COMMENT ON COLUMN), which the insights synchronization already reads:

• every view and every fixed column has its comment, in French;
• a declared event becomes an evt_<name> view where each column carries the label and the description of the property;
• a classification becomes a cls_<name> view whose comment states the join to make.

The comments are written in French, as stored in the database:

COMMENT ON COLUMN analytics.evt_newsletter_signup.placement IS
  'Emplacement — Où se trouvait le formulaire : footer, popup, article. (propriété placement, texte).';

The insights assistant has them in its context: asked “which placement of the signup form converts best?”, it finds the view, the column and what it means.

The network

insights (its engine, Trino) must be able to reach the analytics database:

• on the same host, a shared Docker network between the two stacks is enough;
• on two hosts, publish the PostgreSQL port while restricting it to the insights address (pg_hba.conf, firewall) and enable TLS.

The eodia_analytics role reads only views: even when reachable, it sees neither people, nor secrets, nor raw data.

Next

To open insights dashboards from each site, locked to it: see the Statistics button.