Integrations
1-click apps: Metabase, Grafana, Umami, Windmill and more
Auto-installers connected to the project database: licenses, database roles, credentials, versions, billing, API, MCP and CLI.
In 1-click apps (owner/admin/developer role, Pro+ plan) you install ready-made open-source tools. Each app is a separate container with a RAM and CPU limit, a health check and an address https://<app>-<ref>.host.ulewicz.space with an HTTPS certificate. It connects to the database over the project's internal network exclusively with its own least-privilege role.
Catalog
| App | License | RAM | Net price / month | Database connection |
|---|---|---|---|---|
| Metabase | AGPL-3.0 | 1.5 GB | PLN 49 | own database + read-only role (data source added automatically) |
| Grafana | AGPL-3.0 | 512 MB | PLN 19 | own schema + read-only role (data source and starter dashboard) |
| Umami | MIT | 512 MB | PLN 19 | own schema |
| Windmill (CE) | AGPL-3.0 | 2 GB | PLN 69 | own database in the project cluster |
| pgAdmin | PostgreSQL | 512 MB | PLN 12 | read-only role (server added automatically) |
| Uptime Kuma | MIT | 384 MB | PLN 9 | none (SQLite on the app disk) |
| Typesense | GPL-3.0 | 512 MB | PLN 15 | none (index on the app disk) |
Licenses
We run AGPL/GPL apps unmodified from official images; for each app the dashboard shows the license, its text and a link to the source code. We do not offer apps whose license forbids hosting as a service or requires a revenue threshold: n8n (Sustainable Use License), Directus (BSL), MinIO (community edition without a console). We skip Appsmith, ToolJet and Plausible because of their memory requirements (MongoDB / ClickHouse / several services).
Database roles
The installer creates the role app_<app> (without superuser privileges, 40-connection limit) and its schema — the role cannot see other schemas. BI tools additionally get app_<app>_ro: SELECT only on the public schema (including new tables), read-only transactions and a 60 s query timeout. By default this role bypasses RLS so that dashboards can see data protected by policies — untick the option in the wizard if you do not want that. Removing the app deletes the role, schema and data.
Credentials and versions
We generate the administrator password during installation and store it encrypted (AES-256-GCM). The dashboard shows it only once; the API and CLI return it in the installation response. Versions are pinned — you choose one at installation, and "Upgrade" changes it deliberately (the app runs data migrations after startup).
Billing and notifications
The monthly (net) price is charged hourly from installation to removal and appears on the usage page as separate invoice line items. When an app stops responding (3 failed health checks), enters a restart loop or runs out of memory, you get a notification in the dashboard and by email.
# CLI
hostbase apps catalog
hostbase apps install metabase --admin-email you@company.com
hostbase apps logs metabase --follow
hostbase apps upgrade metabase v0.63.20.2
hostbase apps remove metabase --yes
# Management API
curl -X POST https://host.ulewicz.space/api/v1/projects/$REF/apps \
-H "Authorization: Bearer $HB_TOKEN" -H "Content-Type: application/json" \
-d '{"app":"grafana"}'The MCP server provides the tools list_app_catalog, list_apps, get_app, install_app, app_action, get_app_logs and remove_app.