QUANTAAIDASHBOARD
Self-hosted AI business intelligence in one command. A six-stage natural-language-to-SQL pipeline across four LLM providers — with SELECT-only safety gating, SSH bastion tunneling, AES-256-GCM credential vaulting, and end-to-end AI trace observability.
01 / Overview
"Ask your database a question in plain English — Quanta plans, writes, safety-checks, runs, and explains the SQL."
Teams are stuck between raw SQL tools that exclude most of the company and enterprise BI suites that route data through someone else's cloud. Quanta closes the gap: a self-hosted analytics platform where natural language is a first-class query interface — not a wrapper, but a six-stage pipeline (plan → clarify → generate → safety-gate → self-heal → summarize) that asks instead of guessing when a name is ambiguous. Four LLM providers sit behind one interface, every AI call is traced and cost-capped, generated SQL is provably read-only, and private databases behind SSH bastions are the normal case, not a deal-breaker.
Sole architect and engineer, end to end: FastAPI + SQLAlchemy 2 backend, React 19 + TypeScript SPA, and one-command Docker Compose deployment behind Nginx. Designed the staged NL→SQL pipeline across Gemini, OpenAI, Claude, and Groq; the security model (AES-256-GCM vaulting, SSH tunneling with TOFU host-key pinning, SELECT-only enforcement); and the trace-ID observability that follows every AI request from the browser into an admin trace explorer.
02 / System Architecture
hover to explore
QUANTA AI DASHBOARD system architecture: Browser (httpOnly · CSRF pair); React SPA (TanStack · Recharts); Nginx (serves /dist · proxy); AI Traces (trace-id · ai.log); FastAPI (JWT · slowapi · RBAC); Provider Reg. (runtime toggles · caps); AES Vault (AES-256-GCM creds); SSH Tunnel (paramiko · TOFU pin); App PostgreSQL (SQLAlchemy 2 · Alembic); User DBs (Postgres · MySQL · pvt); Gemini (google-genai SDK); OpenAI (GPT models); Claude (anthropic SDK); Groq (fast inference).
Connections: Browser → React SPA (HTTPS · SPA bundle); React SPA → Nginx (REST · Axios + RQ); Nginx → FastAPI (proxy_pass /api); FastAPI → App PostgreSQL (SQLAlchemy 2); FastAPI → AES Vault (decrypt creds); FastAPI → Provider Reg. (NL → SQL pipeline); FastAPI → AI Traces (per-stage trace-id); AES Vault → SSH Tunnel (SSH keys · secrets); SSH Tunnel → User DBs (bastion forward); Provider Reg. → Gemini (per-query pick); Provider Reg. → OpenAI; Provider Reg. → Claude; Provider Reg. → Groq.
03 / Features
Natural-Language Queries
Ask in plain English; a six-stage pipeline plans, asks clarifying questions when names are ambiguous, generates dialect-correct SQL, self-heals failures, and explains the answer.
SSH Bastion Tunneling
Reaches private-subnet databases most lightweight tools can't touch — encrypted key material, TOFU host-key pinning, and hard-fail on a swapped bastion key.
Four AI Providers
Gemini, OpenAI, Claude, and Groq behind one interface: users switch per query, admins toggle at runtime, every call metered against hard budget caps.
Dashboard Builder
12-column drag-and-drop grid, 11 chart types, autosaving layouts — and any AI answer becomes a live widget in one click.
AI Dashboard Recommendations
Point it at a schema and get a configured dashboard. Every suggestion is vetted against the cached schema, so a hallucinated table can never render.
Workspaces & Roles
Multi-tenant organizations with owner/member roles, one-click invite codes, and per-workspace monthly AI spend caps enforced server-side.
Explorer & Query Studio
Parameterized, injection-proof table browsing for non-SQL users; a raw SQL editor for the fluent — both behind the same read-only safety gate.
Public Dashboard Sharing
One toggle publishes a dashboard to an unguessable URL — strictly read-only, fresh data per view, zero credential surface.
AI Trace Observability
Trace IDs minted in the browser follow every request through each pipeline stage; support debugs any AI failure from one pasted ID.
Hardened Auth
HttpOnly JWT cookies, CSRF double-submit, hashed revocable refresh tokens, timing-safe login, and spoof-resistant rate limiting.
04 / Process
Security & Private-Network Layer
Built the layer most BI side projects never touch: paramiko SSH tunnels with trust-on-first-use host-key pinning, an SSRF split policy (backend dials only public bastions; private databases resolve bastion-side), and AES-256-GCM encryption on every stored credential.
The AI Pipeline & Cost Engineering
Designed the six-stage NL→SQL pipeline — plan, clarify, generate, safety-gate, self-heal, summarize — with static SELECT-only verification before anything executes. A two-tier schema serializer cut input-token cost 40–50%, measured and applied uniformly across all four providers.
Dashboards, Teams & Observability
Shipped the product around the pipeline: workspaces with roles and AI budgets, persistent chat sessions docked beside dashboards, public read-only sharing, and trace-ID observability running from the browser console to an admin trace explorer.