[{"data":1,"prerenderedAt":1265},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fconnections":3,"docs-nav":1065},{"id":4,"title":5,"body":6,"description":1056,"extension":1057,"meta":1058,"navigation":1060,"path":1061,"seo":1062,"stem":1063,"__hash__":1064},"docs\u002Fdocs\u002Fconnections\u002FREADME.md","Connections",{"type":7,"value":8,"toc":1040},"minimark",[9,13,26,31,318,331,345,349,354,377,384,392,398,404,411,415,423,426,442,452,459,467,471,487,497,501,508,592,595,599,602,605,609,612,642,735,746,750,772,776,787,868,899,902,964,968,979,983,1036],[10,11,5],"h1",{"id":12},"connections",[14,15,16,17,21,22,25],"p",{},"A ",[18,19,20],"strong",{},"connection"," holds the address and the credentials of a system outside Tabularia —\na database, a bucket, a mail server, an SFTP server, a SharePoint site, an HTTP API, a\nGoogle account for spreadsheets — so\nthat datasources, flows, SQL scripts and flow groups can read from it or write to it\nwithout anyone typing a password twice. It lives in a folder, it is used by whoever has\nthe ",[18,23,24],{},"CONNECT"," permission there, and its secret is encrypted and never shown again.\nThis page maps every type and the rules they share; each type has its own page.",[27,28,30],"h2",{"id":29},"every-type-at-a-glance","Every type at a glance",[32,33,34,59],"table",{},[35,36,37],"thead",{},[38,39,40,44,47,50,53,56],"tr",{},[41,42,43],"th",{},"Type (as in the form)",[41,45,46],{},"Reads into Tabularia",[41,48,49],{},"Writes or sends out",[41,51,52],{},"Default port",[41,54,55],{},"Authentication",[41,57,58],{},"Page",[60,61,62,87,107,126,146,165,185,208,231,254,275,296],"tbody",{},[38,63,64,68,71,74,77,80],{},[65,66,67],"td",{},"PostgreSQL",[65,69,70],{},"a datasource from a table or a SQL query; SQL scripts",[65,72,73],{},"Output node «Database table»",[65,75,76],{},"5432",[65,78,79],{},"user and password",[65,81,82],{},[83,84,86],"a",{"href":85},"\u002Fdocs\u002Fconnections\u002Fdatabases#postgresql","Databases",[38,88,89,92,95,97,100,102],{},[65,90,91],{},"MySQL, MariaDB",[65,93,94],{},"as PostgreSQL",[65,96,94],{},[65,98,99],{},"3306",[65,101,79],{},[65,103,104],{},[83,105,86],{"href":106},"\u002Fdocs\u002Fconnections\u002Fdatabases#mysql-and-mariadb",[38,108,109,112,114,116,119,121],{},[65,110,111],{},"ClickHouse",[65,113,94],{},[65,115,94],{},[65,117,118],{},"8123 (HTTP); 8443 for HTTPS",[65,120,79],{},[65,122,123],{},[83,124,86],{"href":125},"\u002Fdocs\u002Fconnections\u002Fdatabases#clickhouse",[38,127,128,131,133,135,138,141],{},[65,129,130],{},"Trino",[65,132,94],{},[65,134,94],{},[65,136,137],{},"8080",[65,139,140],{},"user; with a password, HTTPS and basic authentication",[65,142,143],{},[83,144,86],{"href":145},"\u002Fdocs\u002Fconnections\u002Fdatabases#trino",[38,147,148,151,153,155,158,160],{},[65,149,150],{},"Oracle",[65,152,94],{},[65,154,94],{},[65,156,157],{},"1521",[65,159,79],{},[65,161,162],{},[83,163,86],{"href":164},"\u002Fdocs\u002Fconnections\u002Fdatabases#oracle",[38,166,167,170,173,175,178,180],{},[65,168,169],{},"Microsoft SQL Server",[65,171,172],{},"as PostgreSQL, once the driver is added",[65,174,172],{},[65,176,177],{},"1433",[65,179,79],{},[65,181,182],{},[83,183,86],{"href":184},"\u002Fdocs\u002Fconnections\u002Fdatabases#sql-server",[38,186,187,190,193,196,199,202],{},[65,188,189],{},"S3 \u002F object storage",[65,191,192],{},"a datasource «S3 folder»",[65,194,195],{},"Output node «File on S3 \u002F object storage»; the copy of a datasource Output to S3",[65,197,198],{},"the endpoint URL's",[65,200,201],{},"access key ID and secret access key",[65,203,204],{},[83,205,207],{"href":206},"\u002Fdocs\u002Fconnections\u002Fs3","S3",[38,209,210,213,216,219,222,225],{},[65,211,212],{},"SMTP \u002F email",[65,214,215],{},"—",[65,217,218],{},"Output node «Email with attachment»; Pushmail cells of flow groups; failure notices of scheduled flows; data contract notifications",[65,220,221],{},"587",[65,223,224],{},"user and password, optional",[65,226,227],{},[83,228,230],{"href":229},"\u002Fdocs\u002Fconnections\u002Fsmtp","SMTP",[38,232,233,236,239,242,245,248],{},[65,234,235],{},"SFTP (files)",[65,237,238],{},"a datasource «SFTP folder»",[65,240,241],{},"Output node «SFTP server (file)»",[65,243,244],{},"22",[65,246,247],{},"password or private key, and the server's host key",[65,249,250],{},[83,251,253],{"href":252},"\u002Fdocs\u002Fsftp","SFTP",[38,255,256,259,262,264,267,270],{},[65,257,258],{},"SharePoint",[65,260,261],{},"a datasource from Excel files of a document library",[65,263,215],{},[65,265,266],{},"HTTPS (Microsoft Graph)",[65,268,269],{},"an app registered in Entra ID: client ID and secret",[65,271,272],{},[83,273,258],{"href":274},"\u002Fdocs\u002Fsources\u002Fsharepoint",[38,276,277,280,283,285,288,291],{},[65,278,279],{},"Google Sheets",[65,281,282],{},"a datasource from one tab of a spreadsheet",[65,284,215],{},[65,286,287],{},"HTTPS (Google APIs)",[65,289,290],{},"a service account's JSON key, read-only",[65,292,293],{},[83,294,279],{"href":295},"\u002Fdocs\u002Fsources\u002Fgoogle-sheets",[38,297,298,301,304,306,309,312],{},[65,299,300],{},"HTTP API (REST\u002FJSON)",[65,302,303],{},"a datasource «API call»",[65,305,215],{},[65,307,308],{},"the base URL's",[65,310,311],{},"none, API key, bearer token, basic, OAuth2 client credentials",[65,313,314],{},[83,315,317],{"href":316},"\u002Fdocs\u002Fapi-datasource","HTTP APIs",[14,319,320,321,325,326,330],{},"All the destinations of an Output node, with an example each, are on\n",[83,322,324],{"href":323},"\u002Fdocs\u002Fconnections\u002Fdestinations","Writing data out",". The sources, connection-based or not (uploaded files,\ndatasources published by flows), are on ",[83,327,329],{"href":328},"\u002Fdocs\u002Fsources","Sources",".",[14,332,333,336,337,340,341,330],{},[18,334,335],{},"Container registries are not connections."," The registries the Container node pulls\nimages from are defined by an administrator in ",[18,338,339],{},"Administration → Container\nregistries",", granted to groups and users rather than living in a folder, tested from the\ngateway, and their images are downloaded by the cluster's nodes. See\n",[83,342,344],{"href":343},"\u002Fdocs\u002Fcontainer-registries","Container registries",[27,346,348],{"id":347},"how-it-works","How it works",[350,351,353],"h3",{"id":352},"where-a-connection-lives","Where a connection lives",[14,355,356,357,360,361,364,365,368,369,372,373,376],{},"A connection is created from a folder in Explore: ",[18,358,359],{},"New → New connection",", shown only\nwhere you have CONNECT. The form asks for a ",[18,362,363],{},"Name"," (unique in the folder), the\n",[18,366,367],{},"Connection type",", the fields of that type and an optional ",[18,370,371],{},"Description",". The ",[18,374,375],{},"(i)","\nbeside the type, «Example of the fields», shows every field of the type filled with\nmade-up values and a tip; nothing is copied into the form.",[14,378,379],{},[380,381],"img",{"alt":382,"src":383},"The New connection dialog for PostgreSQL with example values and the password hidden","\u002Fmedia\u002Fguide\u002Fconnections\u002Fnew-connection-postgres.png",[14,385,386],{},[387,388,389,391],"em",{},[18,390,359],{},": the name, the type, the type's fields. A secret is shown as dots and never comes back from the server.",[14,393,394,395,397],{},"The ",[18,396,5],{}," page of the main menu lists every connection you may use, from every\nfolder, with a search over name, host and database; from there a connection is tested,\nedited or deleted. A connection is moved to another folder like any object of Explore,\nand duplicated there as «name (1)»: the copy keeps the stored secret.",[14,399,400],{},[380,401],{"alt":402,"src":403},"The Connections page listing six connections of different types with their host and folder","\u002Fmedia\u002Fguide\u002Fconnections\u002Fconnections-page.png",[14,405,406],{},[387,407,394,408,410],{},[18,409,5],{}," page: every connection you may use, from every folder, with a search.",[350,412,414],{"id":413},"the-connect-permission","The CONNECT permission",[14,416,417,418,422],{},"A connection can point at any host the workers reach, so CONNECT is given on purpose, by\nan administrator or by whoever has MANAGE on the folder. A person's\n",[83,419,421],{"href":420},"\u002Fdocs\u002Fgovernance\u002Fpermissions#personal-folders","personal folder"," does not include it.",[14,424,425],{},"CONNECT is a permission of its own, beside VIEW \u003C RUN \u003C EDIT \u003C MANAGE: EDIT does not\ninclude it, MANAGE does. Like every permission it is given on a folder and holds for the\nfolders below it; administrators have it everywhere. With CONNECT on a connection's folder\nyou can:",[427,428,429,433,436,439],"ul",{},[430,431,432],"li",{},"see the connection in Explore and on the Connections page (without it, it is invisible);",[430,434,435],{},"create, test, edit, move, duplicate and delete the connections of that folder;",[430,437,438],{},"choose it where a connection is chosen: a datasource from a database, an Output node,\na SQL script, a Pushmail cell, the failure notice of a schedule, the notifications of a\ndata contract;",[430,440,441],{},"run what uses it: refreshing its datasources, a flow whose Output writes through it, a\nSQL script on it.",[14,443,444,445,448,449,451],{},"What CONNECT does ",[18,446,447],{},"not"," do: it never shows the secret. And what does ",[18,450,447],{}," need it:\nreading a datasource imported through a connection is a matter of VIEW on the\ndatasource's folder, like any datasource.",[14,453,454,455,458],{},"The rights are checked again when something runs on its own. A scheduled refresh whose\nauthor lost CONNECT is switched off, saying why; a scheduled flow or flow group is\nchecked the same way when it fires, and does not start without it. Use is use: ",[18,456,457],{},"whoever can use a\nconnection reads (or writes) everything its credentials allow",". Give the connection a\ndatabase user, a bucket key or a mail account with the least rights the job needs, and\ngive CONNECT to the people who may move data through it.",[14,460,461,462,466],{},"See ",[83,463,465],{"href":464},"\u002Fdocs\u002Fgovernance\u002Fpermissions","Permissions"," for the whole model.",[350,468,470],{"id":469},"secrets","Secrets",[14,472,473,474,478,479,482,483,486],{},"The password, secret key, client secret, API token, SFTP private key (with its\npassphrase) or Google service account key is encrypted with Fernet under ",[475,476,477],"code",{},"SECURITY__FERNET_KEY"," the moment it is saved.\nThe API never returns it: a connection says only ",[475,480,481],{},"has_password"," (and ",[475,484,485],{},"has_private_key","\nfor SFTP). It reaches the engine still encrypted, and the worker decrypts it only to\nopen the connection. When you edit a connection, an empty password field keeps the\nstored secret. Moving an SFTP connection to another host, port or user, or an HTTP API\nconnection to another host, needs the secret typed again: a stored secret never follows a\nconnection to another server.",[14,488,489,490,492,493,330],{},"Keep ",[475,491,477],{}," with your backups and never change it once connections are\nsaved: without it they cannot be decrypted. See ",[83,494,496],{"href":495},"\u002Fdocs\u002Fconfiguration","Configuration",[350,498,500],{"id":499},"test-connection","«Test connection»",[14,502,503,504,507],{},"The form's ",[18,505,506],{},"Test connection"," tries the connection before it is saved, with the secret\ntyped in the form, and stores nothing. On the Connections page it tests a saved\nconnection. What it does:",[32,509,510,520],{},[35,511,512],{},[38,513,514,517],{},[41,515,516],{},"Type",[41,518,519],{},"The test",[60,521,522,537,544,551,561,568,578],{},[38,523,524,526],{},[65,525,86],{},[65,527,528,529,532,533,536],{},"opens a connection and runs ",[475,530,531],{},"SELECT 1"," (Oracle: ",[475,534,535],{},"SELECT 1 FROM DUAL",")",[38,538,539,541],{},[65,540,207],{},[65,542,543],{},"lists one object of the default bucket, or the buckets when there is no default",[38,545,546,548],{},[65,547,230],{},[65,549,550],{},"connects, encrypts as chosen and signs in; it sends nothing",[38,552,553,555],{},[65,554,253],{},[65,556,557,558,536],{},"reads the server's host key and, once the key is accepted, signs in (",[83,559,253],{"href":560},"\u002Fdocs\u002Fsftp#the-host-key-trust-on-first-use",[38,562,563,565],{},[65,564,258],{},[65,566,567],{},"gets a token from Entra ID, then finds the site and its document library",[38,569,570,572],{},[65,571,279],{},[65,573,574,575,536],{},"gets a token with the service account's key, checks that the Google Sheets API is enabled, and counts the spreadsheets shared with the account (",[83,576,279],{"href":577},"\u002Fdocs\u002Fsources\u002Fgoogle-sheets#the-connection",[38,579,580,583],{},[65,581,582],{},"HTTP API",[65,584,585,586,589,590,536],{},"a ",[475,587,588],{},"GET"," of the base URL, or of the test path when one is set, with the credentials (",[83,591,317],{"href":316},[14,593,594],{},"A failure shows the server's own message (refused, wrong password, unknown database,\ncertificate not trusted).",[350,596,598],{"id":597},"deleting-and-moving","Deleting and moving",[14,600,601],{},"A connection cannot be deleted while a datasource reads from it, nor while a flow sends\nits failure notices through it: the refusal says which. Nothing else is checked: a flow\nwhose Output node writes through it, a SQL script on it, a Pushmail cell or a data\ncontract's notifications stop working at their next run, which is refused because the\nconnection is missing.",[14,603,604],{},"Moving a connection to another folder needs CONNECT on both. Its datasources and the\nflows that use it keep referring to it; what changes is who can use it. A schedule whose\nauthor has no CONNECT on the new folder stops at its next firing, as above.",[350,606,608],{"id":607},"network","Network",[14,610,611],{},"Tabularia's engine opens every connection, never the browser and never the gateway: the\nengine API for tests and table lists, the workers for imports, outputs, emails and SQL\nscripts. These pods must reach the host and port of every connection.",[427,613,614,628],{},[430,615,616,619,620,623,624,627],{},[18,617,618],{},"Docker Compose",": the services share the ",[475,621,622],{},"dataprep-network"," network. A host name is\nresolved from inside the containers, so ",[475,625,626],{},"localhost"," is the container itself: use the\ndatabase's name on that network, or an address the containers can reach.",[430,629,630,633,634,637,638,641],{},[18,631,632],{},"Kubernetes with the chart's network policy",": with ",[475,635,636],{},"networkPolicy.egressCIDRs"," or\n",[475,639,640],{},"networkPolicy.egressNamespaces"," set, the engine, the workers and beat may reach only\nwhat is listed there (plus DNS, their own namespace and the namespaces of the broker,\nthe storage and ClickHouse when those are cluster Services). Every database, bucket,\nmail server, SFTP server and API your connections use must then be in one of the two\nlists; the cloud metadata address is always carved out. With both lists empty there is\nno egress policy and the workers reach anything.",[643,644,649],"pre",{"className":645,"code":646,"language":647,"meta":648,"style":648},"language-yaml shiki shiki-themes github-dark-dimmed github-light","# values.yaml\nnetworkPolicy:\n  enabled: true\n  egressCIDRs:\n    - 10.20.0.0\u002F16        # the company's databases and SFTP server\n    - 203.0.113.25\u002F32     # the mail relay\n  egressNamespaces:\n    - databases           # a PostgreSQL running in this cluster\n","yaml","",[475,650,651,660,671,684,692,705,716,724],{"__ignoreMap":648},[652,653,656],"span",{"class":654,"line":655},"line",1,[652,657,659],{"class":658},"sgHix","# values.yaml\n",[652,661,663,667],{"class":654,"line":662},2,[652,664,666],{"class":665},"shb1k","networkPolicy",[652,668,670],{"class":669},"ssh_m",":\n",[652,672,674,677,680],{"class":654,"line":673},3,[652,675,676],{"class":665},"  enabled",[652,678,679],{"class":669},": ",[652,681,683],{"class":682},"swcJU","true\n",[652,685,687,690],{"class":654,"line":686},4,[652,688,689],{"class":665},"  egressCIDRs",[652,691,670],{"class":669},[652,693,695,698,702],{"class":654,"line":694},5,[652,696,697],{"class":669},"    - ",[652,699,701],{"class":700},"sXfbr","10.20.0.0\u002F16",[652,703,704],{"class":658},"        # the company's databases and SFTP server\n",[652,706,708,710,713],{"class":654,"line":707},6,[652,709,697],{"class":669},[652,711,712],{"class":700},"203.0.113.25\u002F32",[652,714,715],{"class":658},"     # the mail relay\n",[652,717,719,722],{"class":654,"line":718},7,[652,720,721],{"class":665},"  egressNamespaces",[652,723,670],{"class":669},[652,725,727,729,732],{"class":654,"line":726},8,[652,728,697],{"class":669},[652,730,731],{"class":700},"databases",[652,733,734],{"class":658},"           # a PostgreSQL running in this cluster\n",[14,736,737,738,741,742,330],{},"Container registries are the exception: their ",[18,739,740],{},"Test"," runs from the gateway, and their\nimages are downloaded by the cluster's nodes. See\n",[83,743,745],{"href":744},"\u002Fdocs\u002Fdeploy\u002Fkubernetes#networking","Deploying on Kubernetes",[350,747,749],{"id":748},"audit","Audit",[14,751,752,753,755,756,759,760,763,764,767,768,771],{},"Creating, changing and deleting a connection is in ",[18,754,749],{}," (",[475,757,758],{},"connection.create",",\n",[475,761,762],{},"connection.update",", ",[475,765,766],{},"connection.delete","), with who did it and, at creation, the type and\nthe host; accepting an SFTP host key is ",[475,769,770],{},"connection.host_key_accept",", with the fingerprint.\nSecrets never appear there, nor in error messages or the run history.",[27,773,775],{"id":774},"example-the-sample-connections","Example: the sample connections",[14,777,778,779,782,783,786],{},"The sample data of the Docker Compose stack (the ",[475,780,781],{},"samples"," profile) creates two\nconnections in the folder ",[18,784,785],{},"Sample",", both reachable on the stack's network:",[32,788,789,812],{},[35,790,791],{},[38,792,793,795,797,800,803,806,809],{},[41,794,363],{},[41,796,516],{},[41,798,799],{},"Host",[41,801,802],{},"Port",[41,804,805],{},"Username",[41,807,808],{},"Database",[41,810,811],{},"Schema",[60,813,814,842],{},[38,815,816,819,821,826,828,833,837],{},[65,817,818],{},"Sample ERP (Postgres)",[65,820,67],{},[65,822,823],{},[475,824,825],{},"sampledb-postgres",[65,827,76],{},[65,829,830],{},[475,831,832],{},"shop",[65,834,835],{},[475,836,832],{},[65,838,839],{},[475,840,841],{},"vendite",[38,843,844,847,849,854,857,862,866],{},[65,845,846],{},"Sample CRM (ClickHouse)",[65,848,111],{},[65,850,851],{},[475,852,853],{},"sampledb-clickhouse",[65,855,856],{},"8123",[65,858,859],{},[475,860,861],{},"analytics",[65,863,864],{},[475,865,861],{},[65,867],{},[14,869,870,871,874,875,878,879,882,883,763,886,882,889,892,893,895,896,898],{},"Eleven datasources of ",[18,872,873],{},"Sample \u002F Private tables"," and ",[18,876,877],{},"Sample \u002F Public tables"," are\nimported through them (",[475,880,881],{},"vendite.ordini"," as ",[387,884,885],{},"orders",[475,887,888],{},"clienti",[387,890,891],{},"customers",", …). To let\na colleague build flows on those datasources, VIEW on ",[18,894,785],{}," is enough; to let them\nrefresh the datasources or query the ERP from a SQL script, give them CONNECT on\n",[18,897,785],{}," as well.",[27,900,465],{"id":901},"permissions",[32,903,904,914],{},[35,905,906],{},[38,907,908,911],{},[41,909,910],{},"To",[41,912,913],{},"You need",[60,915,916,924,932,940,948,956],{},[38,917,918,921],{},[65,919,920],{},"see, create, test, edit, duplicate or delete a connection",[65,922,923],{},"CONNECT on its folder",[38,925,926,929],{},[65,927,928],{},"move it",[65,930,931],{},"CONNECT on both folders",[38,933,934,937],{},[65,935,936],{},"create or refresh a datasource through it",[65,938,939],{},"CONNECT on the connection's folder, and EDIT (to create) or RUN (to refresh) on the datasource's folder",[38,941,942,945],{},[65,943,944],{},"run a flow whose Output writes through it",[65,946,947],{},"RUN on the flow, CONNECT on the connection",[38,949,950,953],{},[65,951,952],{},"read a datasource imported through it",[65,954,955],{},"VIEW on the datasource's folder",[38,957,958,961],{},[65,959,960],{},"manage container registries",[65,962,963],{},"an administrator",[27,965,967],{"id":966},"limits-and-good-to-know","Limits and good to know",[427,969,970,973,976],{},[430,971,972],{},"Any host is allowed: Tabularia does not filter the addresses a connection may reach.\nCONNECT, the credentials' own rights and, on Kubernetes, the network policy are the\nbarriers.",[430,974,975],{},"A connection's name is unique within its folder, not across folders: pickers show\nthe folder of each connection.",[430,977,978],{},"The secret is never shown again. To change it, type a new one; to remove it, clear it\nand save.",[27,980,982],{"id":981},"related","Related",[427,984,985,1006,1010,1018,1032],{},[430,986,987,763,990,763,992,763,994,759,996,763,998,763,1000,759,1002],{},[83,988,86],{"href":989},"\u002Fdocs\u002Fconnections\u002Fdatabases",[83,991,207],{"href":206},[83,993,230],{"href":229},[83,995,253],{"href":252},[83,997,258],{"href":274},[83,999,279],{"href":295},[83,1001,317],{"href":316},[83,1003,1005],{"href":1004},"\u002Fdocs\u002Fsqlserver","SQL Server driver",[430,1007,1008],{},[83,1009,324],{"href":323},[430,1011,1012,763,1014],{},[83,1013,329],{"href":328},[83,1015,1017],{"href":1016},"\u002Fdocs\u002Fsources\u002Fdatabases","Database sources",[430,1019,1020,763,1024,759,1028],{},[83,1021,1023],{"href":1022},"\u002Fdocs\u002Fsql-scripts","SQL scripts",[83,1025,1027],{"href":1026},"\u002Fdocs\u002Fcapabilities\u002Fflows","Flows",[83,1029,1031],{"href":1030},"\u002Fdocs\u002Fcapabilities\u002Fflow-groups","Flow groups",[430,1033,1034],{},[83,1035,344],{"href":343},[1037,1038,1039],"style",{},"html pre.shiki code .sgHix, html code.shiki .sgHix{--shiki-default:#768390;--shiki-light:#6A737D}html pre.shiki code .shb1k, html code.shiki .shb1k{--shiki-default:#8DDB8C;--shiki-light:#22863A}html pre.shiki code .ssh_m, html code.shiki .ssh_m{--shiki-default:#ADBAC7;--shiki-light:#24292E}html pre.shiki code .swcJU, html code.shiki .swcJU{--shiki-default:#6CB6FF;--shiki-light:#005CC5}html pre.shiki code .sXfbr, html code.shiki .sXfbr{--shiki-default:#96D0FF;--shiki-light:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":648,"searchDepth":662,"depth":673,"links":1041},[1042,1043,1052,1053,1054,1055],{"id":29,"depth":662,"text":30},{"id":347,"depth":662,"text":348,"children":1044},[1045,1046,1047,1048,1049,1050,1051],{"id":352,"depth":673,"text":353},{"id":413,"depth":673,"text":414},{"id":469,"depth":673,"text":470},{"id":499,"depth":673,"text":500},{"id":597,"depth":673,"text":598},{"id":607,"depth":673,"text":608},{"id":748,"depth":673,"text":749},{"id":774,"depth":662,"text":775},{"id":901,"depth":662,"text":465},{"id":966,"depth":662,"text":967},{"id":981,"depth":662,"text":982},"A connection holds the address and the credentials of a system outside Tabularia —\na database, a bucket, a mail server, an SFTP server, a SharePoint site, an HTTP API, a\nGoogle account for spreadsheets — so\nthat datasources, flows, SQL scripts and flow groups can read from it or write to it\nwithout anyone typing a password twice. It lives in a folder, it is used by whoever has\nthe CONNECT permission there, and its secret is encrypted and never shown again.\nThis page maps every type and the rules they share; each type has its own page.","md",{"source":1059},"docs\u002Fconnections\u002FREADME.md",true,"\u002Fdocs\u002Fconnections",{"title":5,"description":1056},"docs\u002Fconnections\u002FREADME","hHSpNsoLLkPHeRopdMzTp6nqNDlG_LYKSYIVw2Shze0",[1066,1085,1137,1160,1179,1208,1232,1257],{"title":1067,"icon":1068,"intro":1069,"items":1070},"Getting started","start","Install it on one machine, learn the few ideas everything else is built on, and run a first flow.",[1071,1073,1076,1079,1082],{"path":1072,"title":1067},"\u002Fdocs\u002Fgetting-started",{"path":1074,"title":1075},"\u002Fdocs\u002Fgetting-started-docker-compose","Walkthrough with Docker Compose",{"path":1077,"title":1078},"\u002Fdocs\u002Fdeploy\u002Fminikube","Try it on your computer (minikube)",{"path":1080,"title":1081},"\u002Fdocs\u002Fconcepts","Concepts",{"path":1083,"title":1084},"\u002Fdocs\u002Foverview","Overview (README)",{"title":1086,"icon":1087,"intro":1088,"items":1089},"Capabilities","capabilities","What you can build: visual flows, analysis on any step, AI questions, pixel-perfect reports, dashboards, Python, R and SQL scripts, containers and the orchestration that ties them together.",[1090,1093,1095,1098,1101,1104,1107,1110,1113,1114,1117,1120,1122,1125,1128,1131,1134],{"path":1091,"title":1092},"\u002Fdocs\u002Fcapabilities","All capabilities",{"path":1026,"title":1094},"Low-code flows",{"path":1096,"title":1097},"\u002Fdocs\u002Fcapabilities\u002Fpreview-and-analysis","Preview and analysis",{"path":1099,"title":1100},"\u002Fdocs\u002Fcapabilities\u002Fask-your-data","Ask your data with AI",{"path":1102,"title":1103},"\u002Fdocs\u002Fcapabilities\u002Freports","Pixel-perfect reports",{"path":1105,"title":1106},"\u002Fdocs\u002Fcapabilities\u002Freport-functions","Report functions",{"path":1108,"title":1109},"\u002Fdocs\u002Fcapabilities\u002Fdashboards","Dashboards",{"path":1111,"title":1112},"\u002Fdocs\u002Fscripting","Python and R",{"path":1022,"title":1023},{"path":1115,"title":1116},"\u002Fdocs\u002Fcapabilities\u002Fnotebooks","marimo notebooks as apps",{"path":1118,"title":1119},"\u002Fdocs\u002Fcontainer-node","Docker images in flows",{"path":1030,"title":1121},"Flow groups: orchestration",{"path":1123,"title":1124},"\u002Fdocs\u002Fcapabilities\u002Fscheduling","Scheduling",{"path":1126,"title":1127},"\u002Fdocs\u002Fpushmail","Pushmail: datasources, reports and dashboards by email",{"path":1129,"title":1130},"\u002Fdocs\u002Fplaceholders","Dynamic dates",{"path":1132,"title":1133},"\u002Fdocs\u002Fcapabilities\u002Fengines","Engines",{"path":1135,"title":1136},"\u002Fdocs\u002Fengines\u002Fengine-differences","Engine differences",{"title":329,"icon":1138,"intro":1139,"items":1140},"sources","Every way data comes in: files, databases, buckets, SFTP folders, HTTP APIs, SharePoint, Google Sheets, and the results of your own flows.",[1141,1143,1146,1148,1151,1153,1154,1156,1157],{"path":328,"title":1142},"All sources",{"path":1144,"title":1145},"\u002Fdocs\u002Fsources\u002Ffiles","Uploaded files",{"path":1016,"title":1147},"Database tables and queries",{"path":1149,"title":1150},"\u002Fdocs\u002Fs3-datasource","S3 buckets",{"path":252,"title":1152},"SFTP folders",{"path":316,"title":317},{"path":274,"title":1155},"Excel on SharePoint",{"path":295,"title":279},{"path":1158,"title":1159},"\u002Fdocs\u002Fsources\u002Fflow-outputs","Results of flows and scripts",{"title":5,"icon":12,"intro":1161,"items":1162},"The systems Tabularia reads from and writes to, how each connection is set up, and who may use it.",[1163,1165,1166,1168,1170,1172,1173,1174,1175,1177,1178],{"path":1061,"title":1164},"All connections",{"path":989,"title":86},{"path":1004,"title":1167},"Microsoft SQL Server driver",{"path":206,"title":1169},"S3 and compatible storage",{"path":252,"title":1171},"SFTP servers",{"path":316,"title":317},{"path":274,"title":258},{"path":295,"title":279},{"path":229,"title":1176},"SMTP email",{"path":343,"title":344},{"path":323,"title":324},{"title":1180,"icon":1181,"intro":1182,"items":1183},"Integrations","integrations","How Tabularia fits your stack: AI providers, the REST API and webhooks, dbt, OpenLineage, single sign-on, SIEM and monitoring.",[1184,1187,1190,1193,1196,1199,1202,1205],{"path":1185,"title":1186},"\u002Fdocs\u002Fintegrations","All integrations",{"path":1188,"title":1189},"\u002Fdocs\u002Fintegrations\u002Fai","AI: where it is used",{"path":1191,"title":1192},"\u002Fdocs\u002Fapi","API, tokens and webhooks",{"path":1194,"title":1195},"\u002Fdocs\u002Fdbt-export","Export to dbt",{"path":1197,"title":1198},"\u002Fdocs\u002Fopenlineage","OpenLineage",{"path":1200,"title":1201},"\u002Fdocs\u002Fsso-keycloak","Single sign-on with Keycloak",{"path":1203,"title":1204},"\u002Fdocs\u002Fsiem-splunk","Audit log to Splunk",{"path":1206,"title":1207},"\u002Fdocs\u002Fintegrations\u002Fmonitoring","Monitoring",{"title":1209,"icon":1210,"intro":1211,"items":1212},"Security & governance","governance","Who may see and do what, what is recorded, and how data quality and personal data are kept in check.",[1213,1216,1217,1220,1223,1226,1229],{"path":1214,"title":1215},"\u002Fdocs\u002Fgovernance","Overview",{"path":464,"title":465},{"path":1218,"title":1219},"\u002Fdocs\u002Fgovernance\u002Faudit-log","Audit log",{"path":1221,"title":1222},"\u002Fdocs\u002Fgovernance\u002Fdata-contracts","Data contracts",{"path":1224,"title":1225},"\u002Fdocs\u002Fdesign\u002Fsso-group-mapping","SSO and group mapping",{"path":1227,"title":1228},"\u002Fdocs\u002Fexamples\u002Fkeycloak","Keycloak example on a laptop",{"path":1230,"title":1231},"\u002Fdocs\u002Fengines\u002Fclickhouse-ai-user","A ClickHouse user for the AI assistant",{"title":1233,"icon":1234,"intro":1235,"items":1236},"Install & operate","operate","Run it in production on Kubernetes, configure it, upgrade it and keep it healthy.",[1237,1240,1243,1246,1249,1251,1254],{"path":1238,"title":1239},"\u002Fdocs\u002Fdeploy\u002Fkubernetes","Kubernetes and Helm",{"path":1241,"title":1242},"\u002Fdocs\u002Fdeploy\u002Fkind","A company-like cluster on one computer (kind)",{"path":1244,"title":1245},"\u002Fdocs\u002Fdeploy\u002Fupgrading","Upgrading, backups and restore",{"path":1247,"title":1248},"\u002Fdocs\u002Fdeploy\u002Frelease-checklist","Install and upgrade checklist",{"path":495,"title":1250},"Configuration reference",{"path":1252,"title":1253},"\u002Fdocs\u002Fengine-settings","Settings from the panel",{"path":1255,"title":1256},"\u002Fdocs\u002Fdatabase-migrations","Database migrations",{"title":1258,"icon":1259,"intro":1260,"items":1261},"Reference","reference","Release process and the remaining reference pages.",[1262],{"path":1263,"title":1264},"\u002Fdocs\u002Frelease-process","Release process",1793656371955]