diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 000000000..4181b9a99
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,70 @@
+name: Release
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  bumpversion:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.tag_version.outputs.new_version }}
+      previous_tag: ${{ steps.tag_version.outputs.previous_tag }}
+      bump_commit_sha: ${{ steps.bumpversion.outputs.commit_hash }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Get next version
+        id: tag_version
+        uses: mathieudutour/github-tag-action@v6.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          default_bump: false
+          default_prerelease_bump: false
+          dry_run: true
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+      - name: Create bumpversion
+        if: steps.tag_version.outputs.new_version
+        run: |
+          pip install bump2version
+          bump2version --new-version ${{ steps.tag_version.outputs.new_version }} setup.cfg
+      - name: Update Changelog
+        if: steps.tag_version.outputs.new_version
+        uses: stefanzweifel/changelog-updater-action@v1.6.2
+        with:
+          latest-version: ${{ steps.tag_version.outputs.new_tag }}
+          release-notes: ${{ steps.tag_version.outputs.changelog }}
+      - name: Commit bumpversion
+        id: bumpversion
+        if: steps.tag_version.outputs.new_version
+        uses: stefanzweifel/git-auto-commit-action@v4.14.1
+        with:
+          branch: ${{ github.ref }}
+          commit_message: "chore: preparing release ${{ steps.tag_version.outputs.new_version }}"
+          file_pattern: CHANGELOG.md setup.cfg tutoraspects/*
+  release:
+    needs: bumpversion
+    if: needs.bumpversion.outputs.version
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.tag_version.outputs.new_tag }}
+      changelog: ${{ steps.tag_version.outputs.changelog }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Create tag
+        id: tag_version
+        uses: mathieudutour/github-tag-action@v6.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          commit_sha: ${{ needs.bumpversion.outputs.bump_commit_sha }}
+          default_bump: false
+          default_prerelease_bump: false
+      - name: Create a GitHub release
+        if: steps.tag_version.outputs.new_tag
+        uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ steps.tag_version.outputs.new_tag }}
+          name: Release ${{ steps.tag_version.outputs.new_tag }}
+          body: ${{ steps.tag_version.outputs.changelog }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 000000000..1d013ff92
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,6 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
diff --git a/setup.cfg b/setup.cfg
new file mode 100644
index 000000000..92df64be1
--- /dev/null
+++ b/setup.cfg
@@ -0,0 +1,4 @@
+[bumpversion]
+current_version = 0.0.0
+commit = False
+tag = False
diff --git a/tutoraspects/patches/local-docker-compose-services b/tutoraspects/patches/local-docker-compose-services
index 6e4c1a59a..342389b02 100644
--- a/tutoraspects/patches/local-docker-compose-services
+++ b/tutoraspects/patches/local-docker-compose-services
@@ -81,7 +81,7 @@ superset-worker-beat:
 vector:
     image: {{ DOCKER_IMAGE_VECTOR }}
     volumes:
-        - ../../aspects/data/vector:/var/lib/vector
+        - ../../data/vector:/var/lib/vector
         - ../plugins/aspects/apps/vector/local.toml:/etc/vector/vector.toml:ro
         {% if ASPECTS_DOCKER_HOST_SOCK_PATH %}- {{ ASPECTS_DOCKER_HOST_SOCK_PATH }}:/var/run/docker.sock:ro{% endif %}
     environment:
diff --git a/tutoraspects/plugin.py b/tutoraspects/plugin.py
index 1b8ea3d7c..e4b5f55e1 100644
--- a/tutoraspects/plugin.py
+++ b/tutoraspects/plugin.py
@@ -31,10 +31,10 @@
         ("RUN_CLICKHOUSE", True),
         ("RUN_RALPH", True),
         ("RUN_SUPERSET", True),
-        ("DOCKER_IMAGE_ASPECTS", "python:3.8"),
+        ("DOCKER_IMAGE_ASPECTS", "edunext/aspects:{{ ASPECTS_VERSION }}"),
         ("DOCKER_IMAGE_CLICKHOUSE", "clickhouse/clickhouse-server:23.3"),
         ("DOCKER_IMAGE_RALPH", "fundocker/ralph:3.8.0"),
-        ("DOCKER_IMAGE_SUPERSET", "apache/superset:2.0.1"),
+        ("DOCKER_IMAGE_SUPERSET", "edunext/aspects-superset:{{ ASPECTS_VERSION }}"),
         ("DOCKER_IMAGE_VECTOR", "timberio/vector:0.30.0-alpine"),
         (
             "OPENEDX_EXTRA_PIP_REQUIREMENTS",
@@ -112,6 +112,7 @@
         ("SUPERSET_DB_PORT", "{{ MYSQL_PORT }}"),
         ("SUPERSET_DB_NAME", "superset"),
         ("SUPERSET_DB_USERNAME", "superset"),
+        ("SUPERSET_EXTRA_REQUIREMENTS", []),
         ("SUPERSET_OAUTH2_ACCESS_TOKEN_PATH", "/oauth2/access_token/"),
         ("SUPERSET_OAUTH2_AUTHORIZE_PATH", "/oauth2/authorize/"),
         (
@@ -160,7 +161,7 @@
         ("DBT_REPOSITORY_PATH", "aspects-dbt/aspects"),
         # This is a pip compliant list of Python packages to install to run dbt
         # make sure packages with versions are enclosed in double quotes
-        ("DBT_PACKAGES", '"dbt-core==1.4.0" "dbt-clickhouse==1.4.1"'),
+        ("EXTRA_DBT_PACKAGES", []),
         # If set, DDL/table operations will be executed with the `ON CLUSTER` clause
         # using this cluster. This has not been tested with Aspects and is unlikely to
         # work.
@@ -275,32 +276,10 @@
 # ("<service>", ("<path>", "<to>", "<script>", "<template>"))
 MY_INIT_TASKS: list[tuple[str, tuple[str, ...], int]] = [
     ("mysql", ("aspects", "jobs", "init", "superset", "init-mysql.sh"), 92),
-    ("superset", ("aspects", "jobs", "init", "superset", "init-superset.sh"), 93),
-    ("lms", ("aspects", "jobs", "init", "superset", "init-openedx.sh"), 94),
-    ("clickhouse", ("aspects", "jobs", "init", "clickhouse", "init-clickhouse.sh"), 95),
-    (
-        "clickhouse",
-        (
-            "aspects",
-            "jobs",
-            "init",
-            "clickhouse",
-            "aspects_init_schemas_tables_users.sh",
-        ),
-        96,
-    ),
-    ("aspects", ("aspects", "jobs", "init", "dbt", "init-dbt.sh"), 97),
-    (
-        "superset",
-        ("aspects", "jobs", "init", "superset", "superset-init-security.sh"),
-        99,
-    ),
-    ("lms", ("aspects", "jobs", "init", "lms", "configure-aspects-lms.sh"), 100),
-    (
-        "superset",
-        ("aspects", "jobs", "init", "superset", "superset-api-dashboard.sh"),
-        101,
-    ),
+    ("clickhouse", ("aspects", "jobs", "init", "clickhouse", "init-clickhouse.sh"), 93),
+    ("superset", ("aspects", "jobs", "init", "superset", "init-superset.sh"), 94),
+    ("lms", ("aspects", "jobs", "init", "superset", "init-openedx.sh"), 95),
+    ("aspects", ("aspects", "jobs", "init", "dbt", "init-dbt.sh"), 96),
 ]
 
 # For each task added to MY_INIT_TASKS, we load the task template
@@ -324,15 +303,18 @@
 #     ("<tutor_image_name>", ("path", "to", "build", "dir"), "<docker_image_tag>", "<build_args>")
 hooks.Filters.IMAGES_BUILD.add_items(
     [
-        # To build `myimage` with `tutor images build myimage`,
-        # you would add a Dockerfile to templates/aspects/build/myimage,
-        # and then write:
-        ### (
-        ###     "myimage",
-        ###     ("plugins", "aspects", "build", "myimage"),
-        ###     "docker.io/myimage:{{ ASPECTS_VERSION }}",
-        ###     (),
-        ### ),
+        (
+            "aspects-superset",
+            ("plugins", "aspects", "build", "aspects-superset"),
+            "{{DOCKER_IMAGE_SUPERSET}}",
+            (),
+        ),
+        (
+            "aspects",
+            ("plugins", "aspects", "build", "aspects"),
+            "{{DOCKER_IMAGE_ASPECTS}}",
+            (),
+        ),
     ]
 )
 
@@ -341,11 +323,14 @@
 #     ("<tutor_image_name>", "<docker_image_tag>")
 hooks.Filters.IMAGES_PULL.add_items(
     [
-        # To pull `myimage` with `tutor images pull myimage`, you would write:
-        ### (
-        ###     "myimage",
-        ###     "docker.io/myimage:{{ ASPECTS_VERSION }}",
-        ### ),
+        (
+            "aspects-superset",
+            "{{DOCKER_IMAGE_SUPERSET}}",
+        ),
+        (
+            "aspects",
+            "{{DOCKER_IMAGE_ASPECTS}}",
+        ),
     ]
 )
 
@@ -354,11 +339,14 @@
 #     ("<tutor_image_name>", "<docker_image_tag>")
 hooks.Filters.IMAGES_PUSH.add_items(
     [
-        # To push `myimage` with `tutor images push myimage`, you would write:
-        ### (
-        ###     "myimage",
-        ###     "docker.io/myimage:{{ ASPECTS_VERSION }}",
-        ### ),
+        (
+            "aspects-superset",
+            "{{DOCKER_IMAGE_SUPERSET}}",
+        ),
+        (
+            "aspects",
+            "{{DOCKER_IMAGE_ASPECTS}}",
+        ),
     ]
 )
 
diff --git a/tutoraspects/templates/aspects/apps/scripts/aspects/clickhouse-demo-xapi-data.sh b/tutoraspects/templates/aspects/apps/scripts/aspects/clickhouse-demo-xapi-data.sh
index 0e9eebcd2..24a08ccde 100755
--- a/tutoraspects/templates/aspects/apps/scripts/aspects/clickhouse-demo-xapi-data.sh
+++ b/tutoraspects/templates/aspects/apps/scripts/aspects/clickhouse-demo-xapi-data.sh
@@ -4,8 +4,6 @@ python3 -m venv virtualenv
 . virtualenv/bin/activate
 
 echo "Loading demo xAPI data..."
-pip install git+https://github.com/openedx/xapi-db-load@0.2#egg=xapi-db-load==0.2
-pip install pandas  # clickhouse_connect is missing this
 xapi-db-load --backend ralph_clickhouse \
     --num_batches $1 \
     --batch_size $2 \
diff --git a/tutoraspects/templates/aspects/apps/scripts/aspects/dbt.sh b/tutoraspects/templates/aspects/apps/scripts/aspects/dbt.sh
index 7906b3a23..7fce59c29 100644
--- a/tutoraspects/templates/aspects/apps/scripts/aspects/dbt.sh
+++ b/tutoraspects/templates/aspects/apps/scripts/aspects/dbt.sh
@@ -4,7 +4,8 @@ python3 -m venv virtualenv
 . virtualenv/bin/activate
 
 echo "Installing dbt packages..."
-pip install {{ DBT_PACKAGES }}
+
+pip install -r requirements.txt
 
 echo "Installing aspects-dbt"
 git clone -b {{ DBT_BRANCH }} {{ DBT_REPOSITORY }}
diff --git a/tutoraspects/templates/aspects/apps/scripts/aspects/requirements.txt b/tutoraspects/templates/aspects/apps/scripts/aspects/requirements.txt
new file mode 100644
index 000000000..95ffb56cc
--- /dev/null
+++ b/tutoraspects/templates/aspects/apps/scripts/aspects/requirements.txt
@@ -0,0 +1 @@
+{% for requirement in EXTRA_DBT_PACKAGES %}{{ requirement }}{% endfor %}
diff --git a/tutoraspects/templates/aspects/apps/superset/docker/requirements-local.txt b/tutoraspects/templates/aspects/apps/superset/docker/requirements-local.txt
index 6f59454c5..3df176908 100644
--- a/tutoraspects/templates/aspects/apps/superset/docker/requirements-local.txt
+++ b/tutoraspects/templates/aspects/apps/superset/docker/requirements-local.txt
@@ -1,4 +1 @@
-authlib  # OAuth2
-mysqlclient
-clickhouse-connect>0.5,<0.6
-sentry-sdk[flask]
+{% for requirement in SUPERSET_EXTRA_REQUIREMENTS %}{{ requirement }}{% endfor %}
diff --git a/tutoraspects/templates/aspects/jobs/init/superset/superset-init-security.sh b/tutoraspects/templates/aspects/apps/superset/pythonpath/create_row_level_security.py
similarity index 78%
rename from tutoraspects/templates/aspects/jobs/init/superset/superset-init-security.sh
rename to tutoraspects/templates/aspects/apps/superset/pythonpath/create_row_level_security.py
index 4398a180c..406940d7b 100644
--- a/tutoraspects/templates/aspects/jobs/init/superset/superset-init-security.sh
+++ b/tutoraspects/templates/aspects/apps/superset/pythonpath/create_row_level_security.py
@@ -1,23 +1,13 @@
-#!/usr/bin/env bash
-set -e
+from superset.app import create_app
 
-#
-# Always install local overrides first
-#
-/usr/bin/env bash /app/docker/docker-bootstrap.sh
+app = create_app()
+app.app_context().push()
 
-# Set up a Row-Level Security filter to enforce course-based access restrictions.
-# Note: there are no cli commands or REST API endpoints to help us with this,
-# so we have to pipe python code directly into the superset shell. Yuck!
-superset shell <<EOF
-from superset.connectors.sqla.models import (
-    RowLevelSecurityFilter,
-    RLSFilterRoles,
-    SqlaTable,
-)
-from superset.utils.core import RowLevelSecurityFilterType
+from superset.connectors.sqla.models import (RLSFilterRoles,
+                                             RowLevelSecurityFilter, SqlaTable)
 from superset.extensions import security_manager
 from superset.migrations.shared.security_converge import Role
+from superset.utils.core import RowLevelSecurityFilterType
 
 session = security_manager.get_session()
 
@@ -43,6 +33,7 @@
     ).filter(
         SqlaTable.table_name == table_name
     ).first()
+    print(table)
     assert table, f"{schema}.{table_name} table doesn't exist yet?"
     # See if the Row Level Security Filter already exists
     rlsf = (
@@ -90,7 +81,3 @@
         session.commit()
 
 print("Successfully create row-level security filters.")
-
-EOF
-# The blank line above EOF is critical -- don't remove it.
-# And we can't have any indented blank lines for some reason, with code piped into the superset shell
diff --git a/tutoraspects/templates/aspects/build/aspects-superset/Dockerfile b/tutoraspects/templates/aspects/build/aspects-superset/Dockerfile
new file mode 100644
index 000000000..52c379053
--- /dev/null
+++ b/tutoraspects/templates/aspects/build/aspects-superset/Dockerfile
@@ -0,0 +1,18 @@
+# Superset image with additional database drivers
+# https://hub.docker.com/r/apache/superset
+# https://github.com/apache/superset/releases
+# https://github.com/apache/superset/blob/master/Dockerfile
+# https://superset.apache.org/docs/databases/installing-database-drivers
+FROM apache/superset:2.0.1
+
+USER root
+
+COPY ./requirements.txt /app/requirements.txt
+
+RUN \
+    {% if is_buildkit_enabled() %}--mount=type=cache,target=/var/cache/apt \{% endif %}
+    apt-get update && apt-get install -y zip
+
+RUN \
+    {% if is_buildkit_enabled() %}--mount=type=cache,target=/root/.cache/pip,sharing=shared \{% endif %}
+    pip install -r /app/requirements.txt
diff --git a/tutoraspects/templates/aspects/build/aspects-superset/requirements.txt b/tutoraspects/templates/aspects/build/aspects-superset/requirements.txt
new file mode 100644
index 000000000..59c61f02b
--- /dev/null
+++ b/tutoraspects/templates/aspects/build/aspects-superset/requirements.txt
@@ -0,0 +1,3 @@
+authlib  # OAuth2
+clickhouse-connect>0.5,<0.6
+sentry-sdk[flask]
diff --git a/tutoraspects/templates/aspects/build/aspects/Dockerfile b/tutoraspects/templates/aspects/build/aspects/Dockerfile
new file mode 100644
index 000000000..33242b71a
--- /dev/null
+++ b/tutoraspects/templates/aspects/build/aspects/Dockerfile
@@ -0,0 +1,5 @@
+FROM python:3.8
+
+RUN pip install dbt-core==1.4.0 dbt-clickhouse==1.4.1
+
+RUN pip install git+https://github.com/openedx/xapi-db-load@0.2#egg=xapi-db-load==0.2
diff --git a/tutoraspects/templates/aspects/jobs/init/clickhouse/aspects_init_schemas_tables_users.sh b/tutoraspects/templates/aspects/jobs/init/clickhouse/aspects_init_schemas_tables_users.sh
deleted file mode 100644
index 91505ee56..000000000
--- a/tutoraspects/templates/aspects/jobs/init/clickhouse/aspects_init_schemas_tables_users.sh
+++ /dev/null
@@ -1,353 +0,0 @@
-echo "Running schema creation scripts..."
-clickhouse client --user "{{ CLICKHOUSE_ADMIN_USER }}" --password="{{ CLICKHOUSE_ADMIN_PASSWORD }}" --host "{{ CLICKHOUSE_HOST }}" {% if CLICKHOUSE_SECURE_CONNECTION %} --secure {% else %} --port {{ CLICKHOUSE_PORT }}{% endif %} --multiquery <<'EOF'
--- Allow JSON fields
-SET allow_experimental_object_type=1;
-
--- Create various non-admin users reporting users
-CREATE USER IF NOT EXISTS {{ ASPECTS_CLICKHOUSE_LRS_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_LRS_PASSWORD }}';
-CREATE USER IF NOT EXISTS {{ ASPECTS_CLICKHOUSE_VECTOR_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_VECTOR_PASSWORD }}';
-CREATE USER IF NOT EXISTS {{ ASPECTS_CLICKHOUSE_REPORT_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_REPORT_PASSWORD }}';
-CREATE USER IF NOT EXISTS {{ ASPECTS_CLICKHOUSE_CMS_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_CMS_PASSWORD }}';
-
--- Update user passwords if they do exist
-ALTER USER {{ ASPECTS_CLICKHOUSE_LRS_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_LRS_PASSWORD }}';
-ALTER USER {{ ASPECTS_CLICKHOUSE_VECTOR_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_VECTOR_PASSWORD }}';
-ALTER USER {{ ASPECTS_CLICKHOUSE_REPORT_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_REPORT_PASSWORD }}';
-ALTER USER {{ ASPECTS_CLICKHOUSE_CMS_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_CMS_PASSWORD }}';
-
--- Create the terrible user defined function to parse the org out of course URLs
--- if we need to update this just add a COALESCE around the whole thing and put in
--- additional cases wrapped in nullIf's until we get them all. Other things we may find in these URLs eventually:
--- i4x://{org}/{rest of key}  Old Mongo usage keys
--- c4x://{org}/{rest of key}  Old Mongo assets
--- {org}/{rest of key} Old Mongo course keys
-CREATE OR REPLACE FUNCTION get_org_from_course_url AS (course_url) ->
-  nullIf(EXTRACT(course_url, 'course-v1:([a-zA-Z0-9]*)'), '')
-;
-
--- Create the xapi schema if it doesn't exist
-CREATE DATABASE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }};
-
--- Raw table that Ralph writes to
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_RAW_XAPI_TABLE }}  (
-    event_id UUID NOT NULL,
-    emission_time DateTime64(6) NOT NULL,
-    event JSON NOT NULL,
-    event_str String NOT NULL
-) ENGINE MergeTree
-ORDER BY (emission_time, event_id)
-PRIMARY KEY (emission_time, event_id);
-
--- Processed table that Superset reads from
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }} (
-    event_id UUID NOT NULL,
-    verb_id String NOT NULL,
-    actor_id String NOT NULL,
-    object_id String NOT NULL,
-    org String NOT NULL,
-    course_id String NOT NULL,
-    emission_time DateTime64(6) NOT NULL,
-    event_str String NOT NULL
-) ENGINE MergeTree
-ORDER BY (org, course_id, verb_id, actor_id, emission_time, event_id)
-PRIMARY KEY (org, course_id, verb_id, actor_id, emission_time, event_id);
-
--- Materialized view that moves data from the raw table to processed table
-CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TRANSFORM_MV }}
-    TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }} AS
-    SELECT
-    event_id as event_id,
-    JSON_VALUE(event_str, '$.verb.id') as verb_id,
-    COALESCE(
-        NULLIF(JSON_VALUE(event_str, '$.actor.account.name'), ''),
-        NULLIF(JSON_VALUE(event_str, '$.actor.mbox'), ''),
-        JSON_VALUE(event_str, '$.actor.mbox_sha1sum')
-    ) as actor_id,
-    JSON_VALUE(event_str, '$.object.id') as object_id,
-    -- If the contextActivities parent is a course, use that. Otherwise use the object id for the course id
-    if(
-        JSON_VALUE(
-            event_str,
-            '$.context.contextActivities.parent[0].definition.type')
-                = 'http://adlnet.gov/expapi/activities/course',
-            JSON_VALUE(event_str, '$.context.contextActivities.parent[0].id'),
-            JSON_VALUE(event_str, '$.object.id')
-        ) as course_id,
-    get_org_from_course_url(course_id) as org,
-    emission_time as emission_time,
-    event_str as event_str
-    FROM {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_RAW_XAPI_TABLE }};
-
--- MV target table for enrollment xAPI events
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_ENROLLMENT_EVENTS_TABLE }} (
-    `event_id` UUID NOT NULL,
-    `emission_time` DateTime64(6) NOT NULL,
-    `actor_id` String NOT NULL,
-    `object_id` String NOT NULL,
-    `course_id` String NOT NULL,
-    `org` String NOT NULL,
-    `verb_id` LowCardinality(String) NOT NULL,
-    `enrollment_mode` LowCardinality(String)
-) ENGINE = MergeTree
-PRIMARY KEY (org, course_id)
-ORDER BY (org, course_id, actor_id, enrollment_mode, emission_time);
-
--- Materialized view that moves data from the processed xAPI table to
--- the enrollment events table
-CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_ENROLLMENT_TRANSFORM_MV }}
-    TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_ENROLLMENT_EVENTS_TABLE }} AS
-SELECT
-    event_id,
-    emission_time,
-    actor_id,
-    object_id,
-    course_id,
-    org,
-    verb_id,
-    JSON_VALUE(event_str, '$.object.definition.extensions."https://w3id.org/xapi/acrossx/extensions/type"') AS enrollment_mode
-FROM {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }}
-WHERE verb_id IN (
-  'http://adlnet.gov/expapi/verbs/registered',
-  'http://id.tincanapi.com/verb/unregistered'
-);
-
-
--- MV target table for video playback xAPI events
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_VIDEO_PLAYBACK_EVENTS_TABLE }} (
-    `event_id` UUID NOT NULL,
-    `emission_time` DateTime64(6) NOT NULL,
-    `actor_id` String NOT NULL,
-    `object_id` String NOT NULL,
-    `course_id` String NOT NULL,
-    `org` String NOT NULL,
-    `verb_id` LowCardinality(String) NOT NULL,
-    `video_position` Float32 NOT NULL
-) ENGINE = MergeTree
-PRIMARY KEY (org, course_id, verb_id)
-ORDER BY (org, course_id, verb_id, actor_id);
-
--- Materialized view that moves data from the processed xAPI table to
--- the video playback events table
-CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_VIDEO_PLAYBACK_TRANSFORM_MV }}
-    TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_VIDEO_PLAYBACK_EVENTS_TABLE }} AS
-SELECT
-    event_id,
-    emission_time,
-    actor_id,
-    object_id,
-    course_id,
-    org,
-    verb_id,
-    cast(coalesce(
-        nullif(JSON_VALUE(event_str, '$.result.extensions."https://w3id.org/xapi/video/extensions/time"'), ''),
-        nullif(JSON_VALUE(event_str, '$.result.extensions."https://w3id.org/xapi/video/extensions/time-from"'), ''),
-        '0.0'
-    ) as Float32) as video_position
-FROM {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }}
-WHERE verb_id IN (
-  'http://adlnet.gov/expapi/verbs/completed',
-  'http://adlnet.gov/expapi/verbs/initialized',
-  'http://adlnet.gov/expapi/verbs/terminated',
-  'https://w3id.org/xapi/video/verbs/paused',
-  'https://w3id.org/xapi/video/verbs/played',
-  'https://w3id.org/xapi/video/verbs/seeked'
-);
-
-
--- MV target table for problem interaction xAPI events
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_PROBLEM_EVENTS_TABLE }} (
-    `event_id` UUID NOT NULL,
-    `emission_time` DateTime64(6) NOT NULL,
-    `actor_id` String NOT NULL,
-    `object_id` String NOT NULL,
-    `course_id` String NOT NULL,
-    `org` String NOT NULL,
-    `verb_id` LowCardinality(String) NOT NULL,
-    `responses` String,
-    `scaled_score` String,
-    `success` Bool,
-    `interaction_type` LowCardinality(String),
-    `attempts` Int16
-) ENGINE = MergeTree
-PRIMARY KEY (org, course_id, verb_id)
-ORDER BY (org, course_id, verb_id, actor_id);
-
-
--- Materialized view that moves data from the processed xAPI table to
--- the problem events table
--- n.b. this query omits browser problem_checked events, as they do not
--- contain any information that the server events don't have and including
--- them would heavily skew the distribution of values in the problem
--- response fields (responses, scaled_score, etc)
-CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_PROBLEM_TRANSFORM_MV }}
-    TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_PROBLEM_EVENTS_TABLE }} AS
-select
-    event_id,
-    emission_time,
-    actor_id,
-    object_id,
-    course_id,
-    org,
-    verb_id,
-    JSON_VALUE(event_str, '$.result.response') as responses,
-    JSON_VALUE(event_str, '$.result.score.scaled') as scaled_score,
-    if(
-        verb_id = 'https://w3id.org/xapi/acrossx/verbs/evaluated',
-        cast(JSON_VALUE(event_str, '$.result.success') as Bool),
-        false
-    ) as success,
-    JSON_VALUE(event_str, '$.object.definition.interactionType') as interaction_type,
-    if(
-        verb_id = 'https://w3id.org/xapi/acrossx/verbs/evaluated',
-        cast(JSON_VALUE(event_str, '$.object.definition.extensions."http://id.tincanapi.com/extension/attempt-id"') as Int16),
-        0
-    ) as attempts
-from
-    {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }}
-where
-    verb_id in (
-        'https://w3id.org/xapi/acrossx/verbs/evaluated',
-        'http://adlnet.gov/expapi/verbs/passed',
-        'http://adlnet.gov/expapi/verbs/asked'
-    );
-
-
-
--- MV target table for navigation xAPI events
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_NAVIGATION_EVENTS_TABLE }} (
-    `event_id` UUID NOT NULL,
-    `emission_time` DateTime64(6) NOT NULL,
-    `actor_id` String NOT NULL,
-    `object_id` String NOT NULL,
-    `course_id` String NOT NULL,
-    `org` String NOT NULL,
-    `verb_id` LowCardinality(String) NOT NULL,
-    `object_type` LowCardinality(String) NOT NULL,
-    `starting_position` Int16,
-    `ending_point` String
-) ENGINE = MergeTree
-PRIMARY KEY (org, course_id, object_type)
-ORDER BY (org, course_id, object_type, actor_id);
-
-
--- Materialized view that moves data from the processed xAPI table to
--- the enrollment events table
-CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_NAVIGATION_TRANSFORM_MV }}
-TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_NAVIGATION_EVENTS_TABLE }} AS
-SELECT
-    event_id,
-    emission_time,
-    actor_id,
-    object_id,
-    course_id,
-    org,
-    verb_id,
-    JSON_VALUE(event_str, '$.object.definition.type') AS object_type,
-    -- clicking a link and selecting a module outline have no starting-position field
-    if (
-        object_type in (
-            'http://adlnet.gov/expapi/activities/link',
-            'http://adlnet.gov/expapi/activities/module'
-        ),
-        0,
-        cast(JSON_VALUE(
-            event_str,
-            '$.context.extensions."http://id.tincanapi.com/extension/starting-position"'
-        ) as Int16)
-    ) AS starting_position,
-    JSON_VALUE(
-        event_str,
-        '$.context.extensions."http://id.tincanapi.com/extension/ending-point"'
-    ) AS ending_point
-FROM
-    {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }}
-WHERE verb_id IN (
-    'https://w3id.org/xapi/dod-isd/verbs/navigated'
-);
-
-
-
--- Create the event sink schema if it doesn't exist
-CREATE DATABASE IF NOT EXISTS {{ ASPECTS_EVENT_SINK_DATABASE }};
-
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_EVENT_SINK_DATABASE }}.{{ ASPECTS_EVENT_SINK_OVERVIEWS_TABLE }}
-(
-    org String NOT NULL,
-    course_key String NOT NULL,
-    display_name String NOT NULL,
-    course_start String NOT NULL,
-    course_end String NOT NULL,
-    enrollment_start String NOT NULL,
-    enrollment_end String NOT NULL,
-    self_paced BOOL NOT NULL,
-    course_data_json String NOT NULL,
-    created String NOT NULL,
-    modified String NOT NULL,
-    dump_id UUID NOT NULL,
-    time_last_dumped String NOT NULL
-) engine = MergeTree
-    PRIMARY KEY (org, course_key, modified, time_last_dumped)
-    ORDER BY (org, course_key, modified, time_last_dumped);
-
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_EVENT_SINK_DATABASE }}.{{ ASPECTS_EVENT_SINK_NODES_TABLE }}
-(
-    org String NOT NULL,
-    course_key String NOT NULL,
-    location String NOT NULL,
-    display_name String NOT NULL,
-    xblock_data_json String NOT NULL,
-    order Int32 default 0,
-    edited_on String NOT NULL,
-    dump_id UUID NOT NULL,
-    time_last_dumped String NOT NULL
-) engine = MergeTree
-    PRIMARY KEY (org, course_key, location, edited_on)
-    ORDER BY (org, course_key, location, edited_on, order);
-
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_EVENT_SINK_DATABASE }}.{{ ASPECTS_EVENT_SINK_RELATIONSHIPS_TABLE }}
-(
-    course_key String NOT NULL,
-    parent_location String NOT NULL,
-    child_location String NOT NULL,
-    order Int32 NOT NULL,
-    dump_id UUID NOT NULL,
-    time_last_dumped String NOT NULL
-) engine = MergeTree
-    PRIMARY KEY (course_key, parent_location, child_location, time_last_dumped)
-    ORDER BY (course_key, parent_location, child_location, time_last_dumped, order);
-
-
--- Grant permissions to the users
-GRANT INSERT, SELECT ON {{ ASPECTS_XAPI_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_LRS_USER }}';
-GRANT SELECT ON {{ ASPECTS_XAPI_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_REPORT_USER }}';
-
-GRANT INSERT, SELECT ON {{ ASPECTS_EVENT_SINK_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_CMS_USER }}';
-GRANT SELECT ON {{ ASPECTS_EVENT_SINK_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_REPORT_USER }}';
-
--- Vector database and tables
--- This is just temporary so that Vector has a place to write. Once these are all Alembic migrations
--- it will be a lot more sane.
-CREATE DATABASE IF NOT EXISTS {{ ASPECTS_VECTOR_DATABASE }};
-
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_VECTOR_DATABASE }}.{{ ASPECTS_VECTOR_RAW_TRACKING_LOGS_TABLE }}
-(
-    `time` DateTime,
-    `message` String
-)
-ENGINE MergeTree
-ORDER BY time;
-
-CREATE TABLE IF NOT EXISTS {{ ASPECTS_VECTOR_DATABASE }}.{{ ASPECTS_VECTOR_RAW_XAPI_TABLE }}
-(
-    event_id      UUID,
-    emission_time DateTime64(6),
-    event_str     String
-)
-engine = MergeTree
-PRIMARY KEY (emission_time)
-ORDER BY (emission_time, event_id);
-
-GRANT INSERT, SELECT ON {{ ASPECTS_VECTOR_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_VECTOR_USER }}';
-GRANT SELECT ON {{ ASPECTS_VECTOR_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_REPORT_USER }}';
-
-EOF
diff --git a/tutoraspects/templates/aspects/jobs/init/clickhouse/init-clickhouse.sh b/tutoraspects/templates/aspects/jobs/init/clickhouse/init-clickhouse.sh
index 127abc884..18c0fb80d 100644
--- a/tutoraspects/templates/aspects/jobs/init/clickhouse/init-clickhouse.sh
+++ b/tutoraspects/templates/aspects/jobs/init/clickhouse/init-clickhouse.sh
@@ -13,3 +13,357 @@ do
     sleep 10
 done
 echo "Clickhouse is up and running"
+
+echo "Running schema creation scripts..."
+clickhouse client --user "{{ CLICKHOUSE_ADMIN_USER }}" --password="{{ CLICKHOUSE_ADMIN_PASSWORD }}" --host "{{ CLICKHOUSE_HOST }}" {% if CLICKHOUSE_SECURE_CONNECTION %} --secure {% else %} --port {{ CLICKHOUSE_PORT }}{% endif %} --multiquery <<'EOF'
+-- Allow JSON fields
+SET allow_experimental_object_type=1;
+
+-- Create various non-admin users reporting users
+CREATE USER IF NOT EXISTS {{ ASPECTS_CLICKHOUSE_LRS_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_LRS_PASSWORD }}';
+CREATE USER IF NOT EXISTS {{ ASPECTS_CLICKHOUSE_VECTOR_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_VECTOR_PASSWORD }}';
+CREATE USER IF NOT EXISTS {{ ASPECTS_CLICKHOUSE_REPORT_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_REPORT_PASSWORD }}';
+CREATE USER IF NOT EXISTS {{ ASPECTS_CLICKHOUSE_CMS_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_CMS_PASSWORD }}';
+
+-- Update user passwords if they do exist
+ALTER USER {{ ASPECTS_CLICKHOUSE_LRS_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_LRS_PASSWORD }}';
+ALTER USER {{ ASPECTS_CLICKHOUSE_VECTOR_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_VECTOR_PASSWORD }}';
+ALTER USER {{ ASPECTS_CLICKHOUSE_REPORT_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_REPORT_PASSWORD }}';
+ALTER USER {{ ASPECTS_CLICKHOUSE_CMS_USER }} IDENTIFIED WITH sha256_password BY '{{ ASPECTS_CLICKHOUSE_CMS_PASSWORD }}';
+
+-- Create the terrible user defined function to parse the org out of course URLs
+-- if we need to update this just add a COALESCE around the whole thing and put in
+-- additional cases wrapped in nullIf's until we get them all. Other things we may find in these URLs eventually:
+-- i4x://{org}/{rest of key}  Old Mongo usage keys
+-- c4x://{org}/{rest of key}  Old Mongo assets
+-- {org}/{rest of key} Old Mongo course keys
+CREATE OR REPLACE FUNCTION get_org_from_course_url AS (course_url) ->
+  nullIf(EXTRACT(course_url, 'course-v1:([a-zA-Z0-9]*)'), '')
+;
+
+-- Create the xapi schema if it doesn't exist
+CREATE DATABASE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }};
+
+-- Raw table that Ralph writes to
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_RAW_XAPI_TABLE }}  (
+    event_id UUID NOT NULL,
+    emission_time DateTime64(6) NOT NULL,
+    event JSON NOT NULL,
+    event_str String NOT NULL
+) ENGINE MergeTree
+ORDER BY (emission_time, event_id)
+PRIMARY KEY (emission_time, event_id);
+
+-- Processed table that Superset reads from
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }} (
+    event_id UUID NOT NULL,
+    verb_id String NOT NULL,
+    actor_id String NOT NULL,
+    object_id String NOT NULL,
+    org String NOT NULL,
+    course_id String NOT NULL,
+    emission_time DateTime64(6) NOT NULL,
+    event_str String NOT NULL
+) ENGINE MergeTree
+ORDER BY (org, course_id, verb_id, actor_id, emission_time, event_id)
+PRIMARY KEY (org, course_id, verb_id, actor_id, emission_time, event_id);
+
+-- Materialized view that moves data from the raw table to processed table
+CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TRANSFORM_MV }}
+    TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }} AS
+    SELECT
+    event_id as event_id,
+    JSON_VALUE(event_str, '$.verb.id') as verb_id,
+    COALESCE(
+        NULLIF(JSON_VALUE(event_str, '$.actor.account.name'), ''),
+        NULLIF(JSON_VALUE(event_str, '$.actor.mbox'), ''),
+        JSON_VALUE(event_str, '$.actor.mbox_sha1sum')
+    ) as actor_id,
+    JSON_VALUE(event_str, '$.object.id') as object_id,
+    -- If the contextActivities parent is a course, use that. Otherwise use the object id for the course id
+    if(
+        JSON_VALUE(
+            event_str,
+            '$.context.contextActivities.parent[0].definition.type')
+                = 'http://adlnet.gov/expapi/activities/course',
+            JSON_VALUE(event_str, '$.context.contextActivities.parent[0].id'),
+            JSON_VALUE(event_str, '$.object.id')
+        ) as course_id,
+    get_org_from_course_url(course_id) as org,
+    emission_time as emission_time,
+    event_str as event_str
+    FROM {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_RAW_XAPI_TABLE }};
+
+-- MV target table for enrollment xAPI events
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_ENROLLMENT_EVENTS_TABLE }} (
+    `event_id` UUID NOT NULL,
+    `emission_time` DateTime64(6) NOT NULL,
+    `actor_id` String NOT NULL,
+    `object_id` String NOT NULL,
+    `course_id` String NOT NULL,
+    `org` String NOT NULL,
+    `verb_id` LowCardinality(String) NOT NULL,
+    `enrollment_mode` LowCardinality(String)
+) ENGINE = MergeTree
+PRIMARY KEY (org, course_id)
+ORDER BY (org, course_id, actor_id, enrollment_mode, emission_time);
+
+-- Materialized view that moves data from the processed xAPI table to
+-- the enrollment events table
+CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_ENROLLMENT_TRANSFORM_MV }}
+    TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_ENROLLMENT_EVENTS_TABLE }} AS
+SELECT
+    event_id,
+    emission_time,
+    actor_id,
+    object_id,
+    course_id,
+    org,
+    verb_id,
+    JSON_VALUE(event_str, '$.object.definition.extensions."https://w3id.org/xapi/acrossx/extensions/type"') AS enrollment_mode
+FROM {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }}
+WHERE verb_id IN (
+  'http://adlnet.gov/expapi/verbs/registered',
+  'http://id.tincanapi.com/verb/unregistered'
+);
+
+
+-- MV target table for video playback xAPI events
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_VIDEO_PLAYBACK_EVENTS_TABLE }} (
+    `event_id` UUID NOT NULL,
+    `emission_time` DateTime64(6) NOT NULL,
+    `actor_id` String NOT NULL,
+    `object_id` String NOT NULL,
+    `course_id` String NOT NULL,
+    `org` String NOT NULL,
+    `verb_id` LowCardinality(String) NOT NULL,
+    `video_position` Float32 NOT NULL
+) ENGINE = MergeTree
+PRIMARY KEY (org, course_id, verb_id)
+ORDER BY (org, course_id, verb_id, actor_id);
+
+-- Materialized view that moves data from the processed xAPI table to
+-- the video playback events table
+CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_VIDEO_PLAYBACK_TRANSFORM_MV }}
+    TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_VIDEO_PLAYBACK_EVENTS_TABLE }} AS
+SELECT
+    event_id,
+    emission_time,
+    actor_id,
+    object_id,
+    course_id,
+    org,
+    verb_id,
+    cast(coalesce(
+        nullif(JSON_VALUE(event_str, '$.result.extensions."https://w3id.org/xapi/video/extensions/time"'), ''),
+        nullif(JSON_VALUE(event_str, '$.result.extensions."https://w3id.org/xapi/video/extensions/time-from"'), ''),
+        '0.0'
+    ) as Float32) as video_position
+FROM {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }}
+WHERE verb_id IN (
+  'http://adlnet.gov/expapi/verbs/completed',
+  'http://adlnet.gov/expapi/verbs/initialized',
+  'http://adlnet.gov/expapi/verbs/terminated',
+  'https://w3id.org/xapi/video/verbs/paused',
+  'https://w3id.org/xapi/video/verbs/played',
+  'https://w3id.org/xapi/video/verbs/seeked'
+);
+
+
+-- MV target table for problem interaction xAPI events
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_PROBLEM_EVENTS_TABLE }} (
+    `event_id` UUID NOT NULL,
+    `emission_time` DateTime64(6) NOT NULL,
+    `actor_id` String NOT NULL,
+    `object_id` String NOT NULL,
+    `course_id` String NOT NULL,
+    `org` String NOT NULL,
+    `verb_id` LowCardinality(String) NOT NULL,
+    `responses` String,
+    `scaled_score` String,
+    `success` Bool,
+    `interaction_type` LowCardinality(String),
+    `attempts` Int16
+) ENGINE = MergeTree
+PRIMARY KEY (org, course_id, verb_id)
+ORDER BY (org, course_id, verb_id, actor_id);
+
+
+-- Materialized view that moves data from the processed xAPI table to
+-- the problem events table
+-- n.b. this query omits browser problem_checked events, as they do not
+-- contain any information that the server events don't have and including
+-- them would heavily skew the distribution of values in the problem
+-- response fields (responses, scaled_score, etc)
+CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_PROBLEM_TRANSFORM_MV }}
+    TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_PROBLEM_EVENTS_TABLE }} AS
+select
+    event_id,
+    emission_time,
+    actor_id,
+    object_id,
+    course_id,
+    org,
+    verb_id,
+    JSON_VALUE(event_str, '$.result.response') as responses,
+    JSON_VALUE(event_str, '$.result.score.scaled') as scaled_score,
+    if(
+        verb_id = 'https://w3id.org/xapi/acrossx/verbs/evaluated',
+        cast(JSON_VALUE(event_str, '$.result.success') as Bool),
+        false
+    ) as success,
+    JSON_VALUE(event_str, '$.object.definition.interactionType') as interaction_type,
+    if(
+        verb_id = 'https://w3id.org/xapi/acrossx/verbs/evaluated',
+        cast(JSON_VALUE(event_str, '$.object.definition.extensions."http://id.tincanapi.com/extension/attempt-id"') as Int16),
+        0
+    ) as attempts
+from
+    {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }}
+where
+    verb_id in (
+        'https://w3id.org/xapi/acrossx/verbs/evaluated',
+        'http://adlnet.gov/expapi/verbs/passed',
+        'http://adlnet.gov/expapi/verbs/asked'
+    );
+
+
+
+-- MV target table for navigation xAPI events
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_NAVIGATION_EVENTS_TABLE }} (
+    `event_id` UUID NOT NULL,
+    `emission_time` DateTime64(6) NOT NULL,
+    `actor_id` String NOT NULL,
+    `object_id` String NOT NULL,
+    `course_id` String NOT NULL,
+    `org` String NOT NULL,
+    `verb_id` LowCardinality(String) NOT NULL,
+    `object_type` LowCardinality(String) NOT NULL,
+    `starting_position` Int16,
+    `ending_point` String
+) ENGINE = MergeTree
+PRIMARY KEY (org, course_id, object_type)
+ORDER BY (org, course_id, object_type, actor_id);
+
+
+-- Materialized view that moves data from the processed xAPI table to
+-- the enrollment events table
+CREATE MATERIALIZED VIEW IF NOT EXISTS {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_NAVIGATION_TRANSFORM_MV }}
+TO {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_NAVIGATION_EVENTS_TABLE }} AS
+SELECT
+    event_id,
+    emission_time,
+    actor_id,
+    object_id,
+    course_id,
+    org,
+    verb_id,
+    JSON_VALUE(event_str, '$.object.definition.type') AS object_type,
+    -- clicking a link and selecting a module outline have no starting-position field
+    if (
+        object_type in (
+            'http://adlnet.gov/expapi/activities/link',
+            'http://adlnet.gov/expapi/activities/module'
+        ),
+        0,
+        cast(JSON_VALUE(
+            event_str,
+            '$.context.extensions."http://id.tincanapi.com/extension/starting-position"'
+        ) as Int16)
+    ) AS starting_position,
+    JSON_VALUE(
+        event_str,
+        '$.context.extensions."http://id.tincanapi.com/extension/ending-point"'
+    ) AS ending_point
+FROM
+    {{ ASPECTS_XAPI_DATABASE }}.{{ ASPECTS_XAPI_TABLE }}
+WHERE verb_id IN (
+    'https://w3id.org/xapi/dod-isd/verbs/navigated'
+);
+
+
+
+-- Create the event sink schema if it doesn't exist
+CREATE DATABASE IF NOT EXISTS {{ ASPECTS_EVENT_SINK_DATABASE }};
+
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_EVENT_SINK_DATABASE }}.{{ ASPECTS_EVENT_SINK_OVERVIEWS_TABLE }}
+(
+    org String NOT NULL,
+    course_key String NOT NULL,
+    display_name String NOT NULL,
+    course_start String NOT NULL,
+    course_end String NOT NULL,
+    enrollment_start String NOT NULL,
+    enrollment_end String NOT NULL,
+    self_paced BOOL NOT NULL,
+    course_data_json String NOT NULL,
+    created String NOT NULL,
+    modified String NOT NULL,
+    dump_id UUID NOT NULL,
+    time_last_dumped String NOT NULL
+) engine = MergeTree
+    PRIMARY KEY (org, course_key, modified, time_last_dumped)
+    ORDER BY (org, course_key, modified, time_last_dumped);
+
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_EVENT_SINK_DATABASE }}.{{ ASPECTS_EVENT_SINK_NODES_TABLE }}
+(
+    org String NOT NULL,
+    course_key String NOT NULL,
+    location String NOT NULL,
+    display_name String NOT NULL,
+    xblock_data_json String NOT NULL,
+    order Int32 default 0,
+    edited_on String NOT NULL,
+    dump_id UUID NOT NULL,
+    time_last_dumped String NOT NULL
+) engine = MergeTree
+    PRIMARY KEY (org, course_key, location, edited_on)
+    ORDER BY (org, course_key, location, edited_on, order);
+
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_EVENT_SINK_DATABASE }}.{{ ASPECTS_EVENT_SINK_RELATIONSHIPS_TABLE }}
+(
+    course_key String NOT NULL,
+    parent_location String NOT NULL,
+    child_location String NOT NULL,
+    order Int32 NOT NULL,
+    dump_id UUID NOT NULL,
+    time_last_dumped String NOT NULL
+) engine = MergeTree
+    PRIMARY KEY (course_key, parent_location, child_location, time_last_dumped)
+    ORDER BY (course_key, parent_location, child_location, time_last_dumped, order);
+
+
+-- Grant permissions to the users
+GRANT INSERT, SELECT ON {{ ASPECTS_XAPI_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_LRS_USER }}';
+GRANT SELECT ON {{ ASPECTS_XAPI_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_REPORT_USER }}';
+
+GRANT INSERT, SELECT ON {{ ASPECTS_EVENT_SINK_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_CMS_USER }}';
+GRANT SELECT ON {{ ASPECTS_EVENT_SINK_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_REPORT_USER }}';
+
+-- Vector database and tables
+-- This is just temporary so that Vector has a place to write. Once these are all Alembic migrations
+-- it will be a lot more sane.
+CREATE DATABASE IF NOT EXISTS {{ ASPECTS_VECTOR_DATABASE }};
+
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_VECTOR_DATABASE }}.{{ ASPECTS_VECTOR_RAW_TRACKING_LOGS_TABLE }}
+(
+    `time` DateTime,
+    `message` String
+)
+ENGINE MergeTree
+ORDER BY time;
+
+CREATE TABLE IF NOT EXISTS {{ ASPECTS_VECTOR_DATABASE }}.{{ ASPECTS_VECTOR_RAW_XAPI_TABLE }}
+(
+    event_id      UUID,
+    emission_time DateTime64(6),
+    event_str     String
+)
+engine = MergeTree
+PRIMARY KEY (emission_time)
+ORDER BY (emission_time, event_id);
+
+GRANT INSERT, SELECT ON {{ ASPECTS_VECTOR_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_VECTOR_USER }}';
+GRANT SELECT ON {{ ASPECTS_VECTOR_DATABASE }}.* TO '{{ ASPECTS_CLICKHOUSE_REPORT_USER }}';
+
+EOF
diff --git a/tutoraspects/templates/aspects/jobs/init/dbt/init-dbt.sh b/tutoraspects/templates/aspects/jobs/init/dbt/init-dbt.sh
index 5193d436b..ff12e1829 100644
--- a/tutoraspects/templates/aspects/jobs/init/dbt/init-dbt.sh
+++ b/tutoraspects/templates/aspects/jobs/init/dbt/init-dbt.sh
@@ -4,7 +4,8 @@ python3 -m venv virtualenv
 . virtualenv/bin/activate
 
 echo "Installing dbt packages..."
-pip install {{ DBT_PACKAGES }}
+
+pip install -r /app/aspects/scripts/aspects/requirements.txt
 
 echo "Installing aspects-dbt"
 git clone -b {{ DBT_BRANCH }} {{ DBT_REPOSITORY }}
diff --git a/tutoraspects/templates/aspects/jobs/init/lms/configure-aspects-lms.sh b/tutoraspects/templates/aspects/jobs/init/lms/configure-aspects-lms.sh
deleted file mode 100644
index 144513b76..000000000
--- a/tutoraspects/templates/aspects/jobs/init/lms/configure-aspects-lms.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-cat > /tmp/erb_config.json <<EOF
-{
-  "model": "event_routing_backends.RouterConfiguration",
-  "data":
-  [
-    {
-      "enabled": true,
-      "backend_name": "xAPI",
-    "route_url": "{% if RUN_RALPH %}http://ralph:{{ RALPH_PORT }}{% else %}{% if RALPH_RUN_HTTPS %}https://{% else %}http://{% endif %}{{ RALPH_HOST }}{% endif %}/xAPI/",
-      "auth_scheme": "Basic",
-      "username": "{{ RALPH_LMS_USERNAME }}",
-      "password": "{{ RALPH_LMS_PASSWORD }}"
-    }
-  ]
-}
-EOF
-
-./manage.py lms manage_user tutor-contrib-aspects aspects@axim --unusable-password
-./manage.py lms populate_model -f /tmp/erb_config.json -u tutor-contrib-aspects
diff --git a/tutoraspects/templates/aspects/jobs/init/superset/init-openedx.sh b/tutoraspects/templates/aspects/jobs/init/superset/init-openedx.sh
index 8f4d35d74..30cef72ae 100644
--- a/tutoraspects/templates/aspects/jobs/init/superset/init-openedx.sh
+++ b/tutoraspects/templates/aspects/jobs/init/superset/init-openedx.sh
@@ -16,3 +16,23 @@
     --scopes "user_id" \
     --update \
     superset-sso-dev superset
+
+cat > /tmp/erb_config.json <<EOF
+{
+  "model": "event_routing_backends.RouterConfiguration",
+  "data":
+  [
+    {
+      "enabled": true,
+      "backend_name": "xAPI",
+    "route_url": "{% if RUN_RALPH %}http://ralph:{{ RALPH_PORT }}{% else %}{% if RALPH_RUN_HTTPS %}https://{% else %}http://{% endif %}{{ RALPH_HOST }}{% endif %}/xAPI/",
+      "auth_scheme": "Basic",
+      "username": "{{ RALPH_LMS_USERNAME }}",
+      "password": "{{ RALPH_LMS_PASSWORD }}"
+    }
+  ]
+}
+EOF
+
+./manage.py lms manage_user tutor-contrib-aspects aspects@axim --unusable-password
+./manage.py lms populate_model -f /tmp/erb_config.json -u tutor-contrib-aspects
diff --git a/tutoraspects/templates/aspects/jobs/init/superset/init-superset.sh b/tutoraspects/templates/aspects/jobs/init/superset/init-superset.sh
index 624b3d647..c7d788738 100755
--- a/tutoraspects/templates/aspects/jobs/init/superset/init-superset.sh
+++ b/tutoraspects/templates/aspects/jobs/init/superset/init-superset.sh
@@ -22,12 +22,7 @@
 
 set -e
 
-#
-# Always install local overrides first
-#
-/usr/bin/env bash /app/docker/docker-bootstrap.sh
-
-STEP_CNT=3
+STEP_CNT=5
 
 echo_step() {
 cat <<EOF
@@ -68,3 +63,31 @@ echo_step "2" "Complete" "Setting up admin user"
 echo_step "3" "Starting" "Setting up roles and perms"
 superset fab import-roles -p /app/security/roles.json
 echo_step "3" "Complete" "Setting up roles and perms"
+
+echo_step "4" "Starting" "Importing assets"
+
+cd /app/assets/
+rm -rf /app/assets/superset
+python /app/pythonpath/create_assets.py
+
+date=$(date -u +"%Y-%m-%dT%H:%M:%S.%6N+00:00") 
+
+echo "version: 1.0.0
+type: Dashboard
+timestamp: '$date'" > superset/metadata.yaml
+
+zip -r superset.zip superset
+
+echo "\n\nImporting zip file\n\n"
+superset import-dashboards -p superset.zip
+
+rm -rf /app/assets/superset
+rm -rf /app/assets/superset.zip
+echo_step "4" "Complete" "Importing assets"
+
+# Set up a Row-Level Security filter to enforce course-based access restrictions.
+# Note: there are no cli commands or REST API endpoints to help us with this,
+# so we have to pipe python code directly into the superset shell. Yuck!
+echo_step "5" "Starting" "Setup row level security filters"
+python /app/pythonpath/create_row_level_security.py
+echo_step "5" "Complete" "Setup row level security filters"
diff --git a/tutoraspects/templates/aspects/jobs/init/superset/superset-api-dashboard.sh b/tutoraspects/templates/aspects/jobs/init/superset/superset-api-dashboard.sh
deleted file mode 100644
index 365d70c88..000000000
--- a/tutoraspects/templates/aspects/jobs/init/superset/superset-api-dashboard.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-#
-# Always install local overrides first
-#
-/usr/bin/env bash /app/docker/docker-bootstrap.sh
-
-apt update
-apt install zip unzip
-
-rm -rf /app/assets/superset
-
-cd /app/assets/
-
-python /app/pythonpath/create_assets.py
-
-date=$(date -u +"%Y-%m-%dT%H:%M:%S.%6N+00:00") 
-
-echo "version: 1.0.0
-type: Dashboard
-timestamp: '$date'" > superset/metadata.yaml
-
-echo "\n\nCompressing superset folder\n\n"
-zip -r superset.zip superset
-
-echo "\n\nListing files in zip\n\n"
-unzip -l superset.zip
-
-echo "\n\nImporting zip file\n\n"
-superset import-dashboards -p superset.zip
-
-rm -rf /app/assets/superset
-rm -rf /app/assets/superset.zip
\ No newline at end of file