Sign inSign up

jumpasaservice/tabularia-gateway

By jumpasaservice

•Updated 1 day ago

Gateway of Tabularia (self hosted data preparation/data analysis tool) in Python FastAPI

Image
Security
Integration & delivery
API management
1

2.5K

jumpasaservice/tabularia-gateway repository overview

Tabularia — Messy in. Trusted out.

⁠Tabularia AI service (formerly the gateway)

Tabularia is an open-source, self-hosted data preparation platform: people build data flows visually — joins, filters, pivots, SQL, Python and R — on data from databases, files, SFTP, S3, APIs and SharePoint, run them on the engine that fits (Polars, DuckDB, chDB, an external ClickHouse, BigQuery), and publish trusted datasets, pixel-perfect reports and live dashboards. Permissions, data contracts, lineage and an audit trail come with it from the first day.

Since 1.4.0 the gateway is a new image: jumpasaservice/tabularia-gateway-go⁠. This image stays, with a narrower job: it is the AI service, started with APP__ROLE=ai, and every installation needs it. Up to 1.3 it was the whole gateway; its 1.3.x tags still are.

⁠What it does from 1.4.0

  • The AI assistant: the chat on the data, the assistants that build flows and write scripts, the comments the AI writes on reports and dashboards, with spending caps and a metadata-only mode. The gateway forwards these requests to it.
  • The SQL parsing and the script checks the gateway and the orchestrator ask for while they work, on an internal API that answers only calls signed with the installation's key.
  • The database's schema: the migrations (python -m app.db.migra), the first administrator from the environment, and at start the production guard, which refuses development secrets.

It is never exposed and does no background work: only the gateway and the orchestrator call it. Without it the gateway does not start, and with no AI provider configured the assistant simply stays off.

⁠The images of an installation

ImageWhat it is
jumpasaservice/tabularia-gateway-go⁠the control plane: API, sign-in, permissions, orchestration
jumpasaservice/tabularia-gateway⁠the AI service, the SQL parsing and the migrations (this image, APP__ROLE=ai)
jumpasaservice/tabularia-backend⁠the engine API and its workers: where the data is read, transformed and written
jumpasaservice/tabularia-frontend⁠the web app

With PostgreSQL, Valkey (or Redis) and an S3-compatible object storage.

⁠Tags

TagMeaning
1.4.0one release, for linux/amd64 and linux/arm64: the AI service
1.4the latest 1.4.x
latestthe latest stable release
1.4.0-amd64, 1.4.0-arm64one architecture only
1.3.0 and olderthe whole gateway, before the Go one

Pin an exact version in production and upgrade all the images together, following the upgrade guide⁠. Every release is described in the changelog⁠.

⁠Getting started

  • Production on Kubernetes: the Helm chart in the repository installs every image, with the AI service as its own workload (and this image again as the init container that migrates the schema), network policies and a read-only root filesystem — Kubernetes and Helm⁠.
  • Try it on your computer: three commands with Docker Compose — getting started⁠ — or a local Kubernetes with minikube⁠.
  • Upgrading from 1.3: the chart and the compose file add the Go gateway and turn this image into the AI service for you; the environment variables stay the same.

⁠Configuration

Settings are environment variables, the same the gateway reads; the ones the AI service needs first:

VariableWhat it is
APP__ROLE=aimakes it the AI service
APP__ENV_NAME=productionturns on the production guard: it refuses to start with development secrets
DB__HOST, DB__PORT, DB__USER, DB__PASSWORD, DB__NAME (or DB__URL)the PostgreSQL metadata database
JWT__SECRETat least 32 characters, the same as the gateway's
SECURITY__FERNET_KEYencrypts the saved credentials and signs the internal calls; the same key in the gateway, the AI service and the engine, kept with the backups
ENGINE__BASE_URLthe engine API's internal address, for example http://backend:8000
AUTH__ADMIN_EMAIL, AUTH__ADMIN_PASSWORDthe administrator created at the first start
DB__AUTO_MIGRATEtrue migrates the schema at start; otherwise run python -m app.db.migra first (the Helm chart does, in an init container)
AI__BASE_URL, AI__SECRET_KEYthe AI provider (any OpenAI-compatible endpoint); more providers, Anthropic among them, are added from the panel

All of them, with defaults and the Helm values that set them: configuration reference⁠. The models that may be used and the spending caps are set from the administration panel.

⁠The container

  • Listens on port 8000; GET /health answers while the app is serving (a liveness check).
  • Runs as an unprivileged user (uid 10001), writes only to /tmp, and works with a read-only root filesystem.
  • Python 3.12 on Debian bookworm slim.

Before a release is pushed, its images are built for both architectures, started for a smoke test, checked for the licences of the packages they hold, and scanned for secrets (the maintainers' fingerprints and TruffleHog's verified credentials). The process is described in the repository: release process⁠.

Tag summary

Content type

Image

Digest

sha256:712f50124…

Size

101.5 MB

Last updated

1 day ago

docker pull jumpasaservice/tabularia-gateway