[{"data":1,"prerenderedAt":1076},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fdeploy\u002Frelease-checklist":3,"docs-nav":858},{"id":4,"title":5,"body":6,"description":849,"extension":850,"meta":851,"navigation":853,"path":854,"seo":855,"stem":856,"__hash__":857},"docs\u002Fdocs\u002Fdeploy\u002Frelease-checklist.md","Release checklist",{"type":7,"value":8,"toc":840},"minimark",[9,13,22,27,650,654,676,690,700,720,757,761,819,823],[10,11,5],"h1",{"id":12},"release-checklist",[14,15,16,17,21],"p",{},"What to do, in order, when installing or upgrading Tabularia. Written for whoever\nruns the deploy; the product changes are in ",[18,19,20],"code",{},"CHANGELOG.md",".",[23,24,26],"h2",{"id":25},"before","Before",[28,29,30,51,73,636],"ol",{},[31,32,33,37,38,41,42,45,46,21],"li",{},[34,35,36],"strong",{},"Schema."," Database migrations are a step of their own, run before the new\ngateways start: ",[18,39,40],{},"python -m app.db.migra"," from the new gateway image (the Helm\nchart runs it as an init container; in a compose deployment it is a one-shot\nservice the gateways wait for). It applies the Alembic revisions in one\ntransaction under a Postgres advisory lock, then checks the database against\nthe models and rolls everything back on any difference. A gateway refuses to\nstart on a database behind its code. Revisions go forward only and are written\nso the previous version keeps working during a rolling update; undoing a\nmigration means restoring the backup below. A database from before Alembic\n(until 2026-10) is adopted by the first run, nothing to do by hand. To\nrehearse an upgrade, restore the backup on a scratch database and run the step\nagainst it, then ",[18,43,44],{},"python -m app.db.migra controlla",". See\n",[47,48,50],"a",{"href":49},"\u002Fdocs\u002Fdatabase-migrations","database-migrations.md",[31,52,53,56,57,60,61,64,65,68,69,72],{},[34,54,55],{},"Backups."," Take a backup of the Postgres metadata database. Object storage\nis append-only by design (every refresh writes a new snapshot), but the\nmetadata is not. With the Compose stack of ",[18,58,59],{},"infrastructure\u002F",", back up its ",[18,62,63],{},"keys","\nvolume too when the encryption key was created there (no ",[18,66,67],{},"SECURITY__FERNET_KEY","\nin ",[18,70,71],{},".env","): without it the stored connection passwords cannot be read.",[31,74,75,78,79,82,83,87,88,91,92,95,96,99,100,103,104,107,108,111,112,115,116,119,120,123,124,127,128,131,132,135,136,115,139,142,143,146,147,150,151,154,155,158,159,162,163,166,167,170,171,174,175,178,179,182,183,186,187,190,191,195,196,199,200,203,204,182,207,210,211,214,215,218,219,103,222,225,226,229,230,233,234,237,238,242,243,246,247,250,251,254,255,258,259,262,263,266,267,270,271,275,276,280,281,284,285],{},[34,76,77],{},"Configuration."," Compare ",[18,80,81],{},"infrastructure\u002F.env.example"," with the deployed\nvalues; the ",[47,84,86],{"href":85},"\u002Fdocs\u002Fconfiguration","configuration reference"," has every variable of the\nrelease, its default and what must change before production. New in 1.0.0: ",[18,89,90],{},"INGEST__PARQUET_ROW_GROUP_ROWS"," (default 1,000,000 —\nraise the worker memory ceilings with it, they are documented next to it),\n",[18,93,94],{},"CLICKHOUSE_EXTERNAL__MATERIALIZE_MIN_ROWS"," (now ",[18,97,98],{},"0"," = off),\n",[18,101,102],{},"PREVIEW_WORKER_CONCURRENCY"," (4), ",[18,105,106],{},"SHAREPOINT__GRAPH_BASE"," \u002F\n",[18,109,110],{},"SHAREPOINT__LOGIN_BASE"," (only on a sovereign cloud).\n",[34,113,114],{},"New in 1.1.0:"," ",[18,117,118],{},"EXPORT__MAX_ROWS"," (default 5,000,000 rows per CSV\ndownload; 0 = no cap). And ",[18,121,122],{},"JWT__SECRET"," must be at least 32 characters in\nproduction: a shorter one now stops the gateway at startup — generate one with\n",[18,125,126],{},"openssl rand -hex 32"," before upgrading (everyone signs in again).\n",[18,129,130],{},"INGEST__DB_READ_TIMEOUT_SECONDS"," (default 3000): how long an import from\nClickHouse waits for the first rows; keep it below\n",[18,133,134],{},"CELERY__TASK_SOFT_TIME_LIMIT",".\n",[34,137,138],{},"New in 1.2.0:",[18,140,141],{},"AUTH__SESSION_IDLE_MINUTES"," (default 0 = off): minutes\nwithout activity after which a session closes. Sessions are now rows in the\nmetadata database (revision 0002 of the migration step): the upgrade ",[34,144,145],{},"signs\neveryone out once",", and the interface must keep reaching the gateway on the same\nsite (the session is an ",[18,148,149],{},"HttpOnly"," cookie the gateway writes).\nAPI tokens, service accounts and webhooks (revision 0003): ",[18,152,153],{},"AUTH__PERSONAL_TOKENS","\n(default ",[18,156,157],{},"true","), ",[18,160,161],{},"AUTH__API_TOKEN_MAX_DAYS"," (365), ",[18,164,165],{},"WEBHOOKS__RETENTION_DAYS","\n(30), ",[18,168,169],{},"WEBHOOKS__TIMEOUT_SECONDS"," (10). Webhook calls leave from the\norchestrators: if your network limits their egress, open it to the receivers.\nSFTP connections (revision 0011: three columns on ",[18,172,173],{},"connections",", empty for the\nexisting ones): ",[18,176,177],{},"SFTP__MAX_FILE_BYTES"," (512 MB per file), ",[18,180,181],{},"SFTP__MAX_FILES"," (500),\n",[18,184,185],{},"SFTP__MAX_TOTAL_BYTES"," (2 GB per refresh), ",[18,188,189],{},"SFTP__TIMEOUT_SECONDS"," (30) on the\nbackend and the workers, whose image now carries paramiko. Workers reach the SFTP servers: open their egress to them — see\n",[47,192,194],{"href":193},"\u002Fdocs\u002Fsftp","sftp.md",".\nHTTP API datasources (no schema change: the connection uses the existing columns):\n",[18,197,198],{},"API__TIMEOUT_SECONDS"," (30), ",[18,201,202],{},"API__MAX_PAGES"," (1000), ",[18,205,206],{},"API__MAX_CALLS",[18,208,209],{},"API__MAX_ROWS"," (2 000 000), ",[18,212,213],{},"API__MAX_RESPONSE_BYTES"," (100 MB),\n",[18,216,217],{},"API__MAX_TOTAL_BYTES"," (1 GB), ",[18,220,221],{},"API__MAX_RETRIES",[18,223,224],{},"API__MAX_RETRY_WAIT_SECONDS","\n(120), ",[18,227,228],{},"API__MAX_REDIRECTS"," (5), ",[18,231,232],{},"API__MAX_REQUEST_SECONDS"," (300), ",[18,235,236],{},"API__MIN_INTERVAL_SECONDS"," (0) on the backend and\nthe workers. Workers call the APIs: open their egress to them — see\n",[47,239,241],{"href":240},"\u002Fdocs\u002Fapi-datasource","api-datasource.md",".\nPlaceholders, ranges and the «S3 folder» datasource (revision 0012: a nullable\n",[18,244,245],{},"notes"," column on ",[18,248,249],{},"runs","): ",[18,252,253],{},"PLACEHOLDERS__MAX_VALUES"," (1000 values per range and\ncombinations per file datasource), ",[18,256,257],{},"S3_SOURCE__MAX_FILE_BYTES"," (512 MB),\n",[18,260,261],{},"S3_SOURCE__MAX_FILES"," (500), ",[18,264,265],{},"S3_SOURCE__MAX_TOTAL_BYTES"," (2 GB),\n",[18,268,269],{},"S3_SOURCE__MAX_LISTED"," (100 000) on the backend and the workers. Workers read the\nbuckets of the S3 connections: open their egress to the endpoints — see\n",[47,272,274],{"href":273},"\u002Fdocs\u002Fs3-datasource","s3-datasource.md"," and ",[47,277,279],{"href":278},"\u002Fdocs\u002Fplaceholders","placeholders.md",".\nRevision 0013 is a DATA migration: it writes the literal braces of the stored\ndefinitions (email subject and attachment name, S3 key and copy key, SFTP Output\nfolder, SFTP datasource folder and pattern, SharePoint path) as doubled braces, so\nthey keep their meaning under the placeholder language; its downgrade is a no-op —\nroll the code back only together with a database backup.\n",[34,282,283],{},"Update the workers (and the engine API) before the gateway"," this time. A worker\nof the previous version, under the new gateway, gets these wrong:\n",[286,287,288,295,298,301,304],"ul",{},[31,289,290,291,294],{},"an S3 key or copy key with placeholders is written literally (",[18,292,293],{},"exports\u002F{today}\u002Fx.csv",");",[31,296,297],{},"an email subject or attachment name with placeholders is sent literally;",[31,299,300],{},"the Output node's time zone is ignored (the SFTP file name is resolved in UTC);",[31,302,303],{},"a templated SFTP Output folder fails («not found»);",[31,305,306,309,310,313,314,317,318,320,321,324,325,328,329,332,333,115,336,339,340,343,344,346,347,350,351,354,355,358,359,362,363,366,367,320,369,371,372,375,376,379,380,383,384,387,388,394,395,397,398,401,402,404,405,407,408,411,412,414,415,418,419,422,423,425,426,275,429,432,433,436,437,440,441,444,445,448,449,452,453,457,458,461,462,465,466,468,469,472,473,476,477,480,481,484,485,488,489,492,493,496,497,500,501,504,505,508,509,512,513,516,517,520,521,524,525,528,529,532,533,536,537,536,540,543,544,547,548,551,552,555,556,275,559,397,562,565,566,569,570,572,573,575,576,579,580,582,583,275,586,589,590,592,593,596,597,600,601,605,606,609,610,613,614,617,618,620,621,536,624,627,628,631,632,635],{},[18,307,308],{},"mode: append"," of a file datasource is ignored: the refresh keeps only the window\njust read (a snapshot of the last days), and ",[18,311,312],{},"{last_refresh}","\u002Fthe variables of a\nfile datasource are not understood (the refresh fails on the braces).\nEngine settings from the panel (revision 0004): ",[18,315,316],{},"ENGINE__SETTINGS_PANEL"," (default\n",[18,319,157],{},"; ",[18,322,323],{},"false"," keeps the environment the only source, see\n",[18,326,327],{},"docs\u002Fengine-settings.md","). Audit log to Splunk (revision 0005): no variable, off\nuntil an administrator turns it on; the calls to Splunk leave from the\norchestrators like webhooks (",[18,330,331],{},"docs\u002Fsiem-splunk.md",").\n",[34,334,335],{},"The administrator's password has no default any more.",[18,337,338],{},"AUTH__ADMIN_PASSWORD","\nmust be set, at least 12 characters and not a published one (",[18,341,342],{},"admin",", the guides'\nexamples): the gateway refuses to start otherwise, in every environment. An\nadministrator still holding ",[18,345,342],{}," gets the configured password at the next start\nand its sessions close. ",[18,348,349],{},"AUTH__ALLOW_KNOWN_ADMIN_PASSWORD=true"," is for a local\ndevelopment stack only and is ignored with ",[18,352,353],{},"APP__ENV_NAME=production",". New\npasswords follow the same rule (12 characters, published ones refused); existing\nones keep working. Also new: ",[18,356,357],{},"UPLOAD__MAX_BYTES"," (1 GiB, 0 = none, on the gateway\nand the engine), ",[18,360,361],{},"AUDIT__IP_RETENTION_DAYS"," (90: client addresses are then emptied\nfrom audit entries, tokens and sessions), ",[18,364,365],{},"SMTP__VERIFY_TLS"," (",[18,368,157],{},[18,370,323],{}," only\nfor a relay with a self-signed certificate). The client address is the one uvicorn\nresolves: behind a reverse proxy set ",[18,373,374],{},"FORWARDED_ALLOW_IPS"," to the proxy's address\n(the chart's ",[18,377,378],{},"gateway.trustedProxies","), or every request shows the proxy's.\nRevision 0014 adds a nullable ",[18,381,382],{},"locale"," to ",[18,385,386],{},"users",": email notices go out in the\nrecipient's interface language, English for addresses that are not users.\n",[34,389,390,391,393],{},"New in 1.2.1, the Compose stack of ",[18,392,59],{}," only:"," it starts with no\n",[18,396,71],{},". ",[18,399,400],{},"SECURITY__KEYS_DIR"," (the ",[18,403,63],{}," volume) holds the encryption key created at\nthe first start when ",[18,406,67],{}," is empty, and ",[18,409,410],{},"AUTH__FIRST_RUN_SETUP","\nlets the sign-in page create the first administrator while no account exists. A\n",[18,413,71],{}," with its key and password keeps working as it is. The sample data is part of\nthe stack (",[18,416,417],{},"--scale sampledb-init=0 --scale sampledb-postgres=0 --scale sampledb-clickhouse=0"," leaves it out), and a one-shot ",[18,420,421],{},"keys-init"," container gives the\n",[18,424,63],{}," volume to the services. Upgrade with ",[18,427,428],{},"git pull",[18,430,431],{},"docker compose up -d --build",": without ",[18,434,435],{},"--build"," Compose keeps the images it has. Kubernetes and the chart\nare unchanged.\n",[34,438,439],{},"New in 1.2.1, Kubernetes:"," revisions 0015, 0016 and 0017 add the five tables\nof the scripting environments, empty, and two columns; 0018 adds the three tables of\nthe container registries, empty (Administration → Container registries, off until\n",[18,442,443],{},"containers.enabled","). Scripting stays off until\n",[18,446,447],{},"scripts.enabled",", which needs an image registry and creates three namespaces of its\nown: the scripts, their trials and the image builds (",[18,450,451],{},"SCRIPTS__*",", see\n",[47,454,456],{"href":455},"\u002Fdocs\u002Fscripting","scripting.md","). Every pod restarts once on this upgrade: they now\nalso roll when the chart's Secret changes. With ",[18,459,460],{},"networkPolicy.egressCIDRs"," set and\nthe broker or the storage in another namespace of the cluster, the workers could\nnot reach them before; they now can, from their host names.\n",[34,463,464],{},"New in 1.2.2:"," revision 0021 adds the one-row table of the database backups;\nrevisions 0019 and 0020 add the two tables of the saved scripts,\nempty, and a nullable column of ",[18,467,249],{}," (the saved script a run belongs to), with its\nindexes (Explore → New → Script, only where scripting is on). From this version the\norchestrators trim history every hour (runs' logs after 30 days, the latest 100\ncontract reports per datasource, the latest 50 versions of flows and saved scripts,\nassistant conversations untouched for 90 days) and vacuum what they touched: set the\nfour ",[18,470,471],{},"ORCHESTRATOR__*"," values (",[18,474,475],{},"orchestrator.*"," in the chart) to 0 to keep it all. The\nspace goes back to Postgres for new rows, not to the disk: ",[18,478,479],{},"VACUUM FULL"," (it locks\nthe tables) or ",[18,482,483],{},"pg_repack",", in a maintenance window, give it back to the disk. The\nchart adds a read-only Role (",[18,486,487],{},"…-cluster-view",") for Administration → Cluster\n(",[18,490,491],{},"clusterView.enabled",", on by default); the gateway now always gets its service\naccount's token on Kubernetes. On Kubernetes, the namespaces\nof the users' code (the scripts, their trials, the image builds, the Container nodes\nand their trials) get a network policy, on by default (",[18,494,495],{},"scripts.blockTabularia",",\n",[18,498,499],{},"containers.blockTabularia","): the code reaches the internet and the other namespaces\nof the cluster, not the release's namespace, the cloud metadata address nor the\nprivate ranges. ",[34,502,503],{},"Before upgrading",", list in ",[18,506,507],{},"networkPolicy.userCodePrivateCIDRs","\nthe private addresses the scripts, the image builds and the Container nodes must\nreach (the registry the builds push to, a scripts bucket on a private endpoint, a\ncompany database), or they stop reaching them. The orchestrator gets a service\naccount of its own (",[18,510,511],{},"…-orchestrator","), the only one that may create the image\nbuilds' Jobs.\n",[34,514,515],{},"New in 1.3.0:"," fifteen revisions, 0023 to 0037. They add the tables of the\nagents' instructions (0023), SQL scripts (0024, 0025: also a nullable\n",[18,518,519],{},"runs.sql_script_id","), notebooks (0026 to 0029, 0031), the agent's drafts and plans\n(0030), reports (0032, 0033), AI providers (0035), dashboards (0036) and AI comments\n(0037); 0034 changes only the grants of personal folders, which 1.2.2 did not have,\nso coming from it nothing changes. None renames or drops a column. There is no way\ndown: going back to 1.2.2 is restoring the backup of step 2. New variables, all with\ndefaults: ",[18,522,523],{},"REPORTS__*"," (rows, pages, the layout's memory and time, the API's wait),\n",[18,526,527],{},"DASHBOARDS__*"," (rows and the shared cache, which lives in Valkey and under ",[18,530,531],{},"cache\u002F"," in\nthe bucket), ",[18,534,535],{},"AI__COMMENT_*",", ",[18,538,539],{},"AI__METADATA_ONLY",[18,541,542],{},"MCP__*"," (the MCP server at ",[18,545,546],{},"\u002Fmcp","\nis ",[34,549,550],{},"on"," by default for API tokens: ",[18,553,554],{},"MCP__ENABLED=false"," to keep it off),\n",[18,557,558],{},"NOTEBOOKS__*",[18,560,561],{},"NUXT_PUBLIC_SOURCE_URL",[34,563,564],{},"Reports draw their charts with a small\nNode service from the frontend image",": in the Helm chart a native sidecar of the run\nworkers (",[18,567,568],{},"reports.chartRenderer",", on by default), which needs Kubernetes 1.29 or later\n(on an older cluster set it to ",[18,571,323],{},": a report with a chart then fails, saying so);\nin the Compose stack of ",[18,574,59],{}," a new ",[18,577,578],{},"chart-renderer"," service, built by\n",[18,581,431],{},". Size the workers for the reports and the preview\nworkers for the dashboards: a million rows of a dataset take some 500 MiB of the\nworker while it renders (see ",[18,584,585],{},"REPORTS__MAX_ROWS",[18,587,588],{},"DASHBOARDS__MAX_ROWS"," in the\n",[47,591,86],{"href":85},"). ",[34,594,595],{},"Notebooks"," (Kubernetes, with\nscripting on) open only from a host of their own: set ",[18,598,599],{},"scripts.notebooks.host",", with\nits DNS name and certificate, before people use them\n(",[47,602,604],{"href":603},"\u002Fdocs\u002Fcapabilities\u002Fnotebooks","notebooks.md",", «An address of their own»); an existing\nPython environment needs ",[34,607,608],{},"Build again"," to carry marimo. With the external ClickHouse\nbefore 25.3, a flow with a join on keys of two integer types writes the key column as\n",[18,611,612],{},"k"," instead of ",[18,615,616],{},"l.k"," at its next run: whatever reads its output by the old name has to\nchange (",[18,619,20],{},", 1.3.0). With the Helm chart, ",[18,622,623],{},"ai.max*",[18,625,626],{},"ai.comment*"," and\n",[18,629,630],{},"ai.commentModel"," now apply without ",[18,633,634],{},"ai.enabled"," too, to the providers added in\nAdministration → AI models.",[31,637,638,641,642,644,645,649],{},[34,639,640],{},"SQL Server."," The published backend images no longer contain the SQL Server\ndriver (since 1.1.1): it is Microsoft's, under Microsoft's licence, and an AGPL\nimage cannot carry it. If you have SQL Server connections, build or extend the\nbackend image with the driver ",[34,643,25],{}," upgrading, and run that image for the\nengine API, both workers and beat — see ",[47,646,648],{"href":647},"\u002Fdocs\u002Fsqlserver","sqlserver.md",". Without\nit, those connections and their datasources fail with «the SQL Server driver is\nnot installed», and nothing else is affected.",[23,651,653],{"id":652},"rollout-order","Rollout order",[14,655,656,659,660,662,663,665,666,668,669,671,672,675],{},[34,657,658],{},"From 1.2.2 to 1.3.0:"," the migration step, then the engine API, the workers and beat,\nthen the gateways and orchestrators, the interface last: the new gateway calls the\nengine's new endpoints (reports, dashboards, SQL on a connection, the SQL scripts'\nexports), and until the engine and its workers have rolled those features may fail; the\nrest of Tabularia goes on working. With Helm the pods roll together and this lasts\nminutes: try the new features once the rollout has ended. With the Compose stack of\n",[18,661,59],{},": ",[18,664,428],{},", then ",[18,667,431],{},"; it also builds the\nnew ",[18,670,578],{}," service and runs ",[18,673,674],{},"sampledb-init"," again, whose image changed: the\nsample data gains its dashboard and two reports, and nothing is duplicated. On kind, the\nguide's step 13, «Run it again», does the same.",[14,677,678,681,682,686,687,689],{},[34,679,680],{},"From 1.2.1 to 1.2.2:"," the migration step; nothing else depends on the order. An image\nbuild that starts while the old orchestrator is still running fails with ",[683,684,685],"em",{},"Forbidden","\n(its service account no longer creates builds): ",[34,688,608],{}," once the upgrade is done.",[14,691,692,695,696,699],{},[34,693,694],{},"From 1.2.0 to 1.2.1:"," the migration step, then the engine API and the workers, then\nthe gateways and orchestrators: the gateway's scripting environments and Container\nnodes call the engine's new ",[18,697,698],{},"\u002Fscripts"," endpoints. Nothing else depends on the order.",[14,701,702,705,706,709,710,662,712,715,716,719],{},[34,703,704],{},"From 1.1.x to 1.2.0:"," the migration step, then ",[34,707,708],{},"the workers, beat and the engine\nAPI",", then the gateways and orchestrators, the interface last (revision 0013 above:\nan old worker under a new gateway writes placeholders literally). With the compose of\n",[18,711,59],{},[18,713,714],{},"docker compose up -d backend worker preview-worker beat",", then\n",[18,717,718],{},"docker compose up -d"," (its gateway applies the migrations when it starts). The rule\nbelow, gateway first, is for an upgrade from 1.0.x.",[28,721,722,738,747],{},[31,723,724,727,728,665,731,733,734,737],{},[34,725,726],{},"The gateway first (and the orchestrators), then the workers, then the\nengine API."," From this release the engine API answers only requests that\ncarry the gateway's internal token: a new engine behind an old gateway\nrefuses everything (401) until the gateway is upgraded, while an old engine\nsimply ignores the token of a new gateway. Workers before the API, because a\nnew API talking to an old preview worker cancels previews with a signal the\nold worker does not clean up after. With compose: ",[18,729,730],{},"docker compose up -d gateway orchestrator",[18,732,718],{},"; with Helm, see the chart\nREADME → Upgrades. ",[34,735,736],{},"The interface last"," when upgrading past 1.1.0: it signs\nin with a cookie an older gateway does not read.",[31,739,740,366,743,746],{},[34,741,742],{},"Recreate, do not restart, the beat and worker containers",[18,744,745],{},"docker compose up -d --force-recreate"," or a rolling replacement of the pods): a restart\nkeeps the old code and the old memory limits.",[31,748,749,752,753,756],{},[34,750,751],{},"Refresh the large datasources once"," after the upgrade so their Parquet\nfiles are rewritten with the new row groups — and set ",[34,754,755],{},"sort keys"," on the\ncolumns people filter by (typically a date) while doing it. Until then those\nfiles keep their old layout and the old speed.",[23,758,760],{"id":759},"after","After",[28,762,763,770,773,776,783,790],{},[31,764,765,766,769],{},"Open the sign-in screen in the dark and light themes, sign in, check the\nversion in the settings menu (it comes from the gateway, so it is the\nversion actually running).\nOpen ",[34,767,768],{},"Your sessions"," in the same menu: this browser is listed as «this\ndevice». Sign out, then press Back: the app must not come back.",[31,771,772],{},"Open a flow with a large source and click through five or six nodes\nquickly: the preview of the last node should appear, the others should be\ncancelled, nothing should hang.",[31,774,775],{},"Refresh a datasource, change page and come back: the spinner must still be\nthere until the refresh ends.",[31,777,778,779,782],{},"Check the admin ",[34,780,781],{},"Performance"," page and the Grafana dashboard: the preview\npanels fill within a few minutes of use.",[31,784,785,786,789],{},"If the deployment uses the external ClickHouse: confirm no ",[18,787,788],{},"_mv_…"," tables are\nleft on it (the sweep runs every 30 minutes and now runs even with\nmaterialization off).",[31,791,792,795,796,799,800,803,804,807,808,811,812,814,815,818],{},[34,793,794],{},"From 1.3.0."," The settings menu says 1.3.0 «Catone». Open ",[34,797,798],{},"Analysis →\nDashboards"," and a dashboard (with the sample data, ",[18,801,802],{},"Sample"," → «Sales overview»):\nevery tile shows numbers, a click on a bar filters the others, ",[34,805,806],{},"PDF"," downloads\nwhat is on the screen. Open ",[34,809,810],{},"Analysis → Reports"," and a report («Margin review»): its pages\nshow with their charts (a report with charts that fails saying the chart service\ndoes not answer means the run workers' ",[18,813,578],{}," sidecar, or the Compose\nservice, is not running), and PDF and Excel download. Where an AI model is enabled, add an AI\ncomment to a copy of a dashboard and ",[34,816,817],{},"Try it",": a text marked as written by AI, or a\nline saying why there is none. Where scripting is on, open a notebook's app: it opens\non the notebooks' own host. With the external ClickHouse before 25.3, run once the\nflows with a join and check what reads their output (above).",[23,820,822],{"id":821},"known-limits-to-tell-users","Known limits to tell users",[286,824,825,828,834,837],{},[31,826,827],{},"Two people saving the same flow: last save wins. The editor says who else has\nit open; the version history keeps the overwritten work.",[31,829,830,831,833],{},"CSV export stops at ",[18,832,118],{}," (5,000,000 by default). Excel export stops\nat 1,048,575 rows.",[31,835,836],{},"The step cache in the editor materializes every intermediate step; on very\nlarge sources use the source node's development sample.",[31,838,839],{},"The external ClickHouse has a memory ceiling of its own (7 GiB on the current\ninstance): two heavy sorts over a 25M-row, 50-column table at once can hit it\nand fail with a clear error.",{"title":841,"searchDepth":842,"depth":843,"links":844},"",2,3,[845,846,847,848],{"id":25,"depth":842,"text":26},{"id":652,"depth":842,"text":653},{"id":759,"depth":842,"text":760},{"id":821,"depth":842,"text":822},"What to do, in order, when installing or upgrading Tabularia. Written for whoever\nruns the deploy; the product changes are in CHANGELOG.md.","md",{"source":852},"docs\u002Fdeploy\u002Frelease-checklist.md",true,"\u002Fdocs\u002Fdeploy\u002Frelease-checklist",{"title":5,"description":849},"docs\u002Fdeploy\u002Frelease-checklist","gSzN1Qtu6fv_CSTUXsEHFvvwsJ27pyS59DCIN89RmqA",[859,878,931,960,990,1019,1045,1068],{"title":860,"icon":861,"intro":862,"items":863},"Getting started","start","Install it on one machine, learn the few ideas everything else is built on, and run a first flow.",[864,866,869,872,875],{"path":865,"title":860},"\u002Fdocs\u002Fgetting-started",{"path":867,"title":868},"\u002Fdocs\u002Fgetting-started-docker-compose","Walkthrough with Docker Compose",{"path":870,"title":871},"\u002Fdocs\u002Fdeploy\u002Fminikube","Try it on your computer (minikube)",{"path":873,"title":874},"\u002Fdocs\u002Fconcepts","Concepts",{"path":876,"title":877},"\u002Fdocs\u002Foverview","Overview (README)",{"title":879,"icon":880,"intro":881,"items":882},"Capabilities","capabilities","What you can build: visual flows, analysis on any step, AI questions, pixel-perfect reports, dashboards, Python, R and SQL scripts, containers and the orchestration that ties them together.",[883,886,889,892,895,898,901,904,906,909,911,914,917,920,923,925,928],{"path":884,"title":885},"\u002Fdocs\u002Fcapabilities","All capabilities",{"path":887,"title":888},"\u002Fdocs\u002Fcapabilities\u002Fflows","Low-code flows",{"path":890,"title":891},"\u002Fdocs\u002Fcapabilities\u002Fpreview-and-analysis","Preview and analysis",{"path":893,"title":894},"\u002Fdocs\u002Fcapabilities\u002Fask-your-data","Ask your data with AI",{"path":896,"title":897},"\u002Fdocs\u002Fcapabilities\u002Freports","Pixel-perfect reports",{"path":899,"title":900},"\u002Fdocs\u002Fcapabilities\u002Freport-functions","Report functions",{"path":902,"title":903},"\u002Fdocs\u002Fcapabilities\u002Fdashboards","Dashboards",{"path":455,"title":905},"Python and R",{"path":907,"title":908},"\u002Fdocs\u002Fsql-scripts","SQL scripts",{"path":603,"title":910},"marimo notebooks as apps",{"path":912,"title":913},"\u002Fdocs\u002Fcontainer-node","Docker images in flows",{"path":915,"title":916},"\u002Fdocs\u002Fcapabilities\u002Fflow-groups","Flow groups: orchestration",{"path":918,"title":919},"\u002Fdocs\u002Fcapabilities\u002Fscheduling","Scheduling",{"path":921,"title":922},"\u002Fdocs\u002Fpushmail","Pushmail: datasources, reports and dashboards by email",{"path":278,"title":924},"Dynamic dates",{"path":926,"title":927},"\u002Fdocs\u002Fcapabilities\u002Fengines","Engines",{"path":929,"title":930},"\u002Fdocs\u002Fengines\u002Fengine-differences","Engine differences",{"title":932,"icon":933,"intro":934,"items":935},"Sources","sources","Every way data comes in: files, databases, buckets, SFTP folders, HTTP APIs, SharePoint, Google Sheets, and the results of your own flows.",[936,939,942,945,947,949,951,954,957],{"path":937,"title":938},"\u002Fdocs\u002Fsources","All sources",{"path":940,"title":941},"\u002Fdocs\u002Fsources\u002Ffiles","Uploaded files",{"path":943,"title":944},"\u002Fdocs\u002Fsources\u002Fdatabases","Database tables and queries",{"path":273,"title":946},"S3 buckets",{"path":193,"title":948},"SFTP folders",{"path":240,"title":950},"HTTP APIs",{"path":952,"title":953},"\u002Fdocs\u002Fsources\u002Fsharepoint","Excel on SharePoint",{"path":955,"title":956},"\u002Fdocs\u002Fsources\u002Fgoogle-sheets","Google Sheets",{"path":958,"title":959},"\u002Fdocs\u002Fsources\u002Fflow-outputs","Results of flows and scripts",{"title":961,"icon":173,"intro":962,"items":963},"Connections","The systems Tabularia reads from and writes to, how each connection is set up, and who may use it.",[964,967,970,972,975,977,978,980,981,984,987],{"path":965,"title":966},"\u002Fdocs\u002Fconnections","All connections",{"path":968,"title":969},"\u002Fdocs\u002Fconnections\u002Fdatabases","Databases",{"path":647,"title":971},"Microsoft SQL Server driver",{"path":973,"title":974},"\u002Fdocs\u002Fconnections\u002Fs3","S3 and compatible storage",{"path":193,"title":976},"SFTP servers",{"path":240,"title":950},{"path":952,"title":979},"SharePoint",{"path":955,"title":956},{"path":982,"title":983},"\u002Fdocs\u002Fconnections\u002Fsmtp","SMTP email",{"path":985,"title":986},"\u002Fdocs\u002Fcontainer-registries","Container registries",{"path":988,"title":989},"\u002Fdocs\u002Fconnections\u002Fdestinations","Writing data out",{"title":991,"icon":992,"intro":993,"items":994},"Integrations","integrations","How Tabularia fits your stack: AI providers, the REST API and webhooks, dbt, OpenLineage, single sign-on, SIEM and monitoring.",[995,998,1001,1004,1007,1010,1013,1016],{"path":996,"title":997},"\u002Fdocs\u002Fintegrations","All integrations",{"path":999,"title":1000},"\u002Fdocs\u002Fintegrations\u002Fai","AI: where it is used",{"path":1002,"title":1003},"\u002Fdocs\u002Fapi","API, tokens and webhooks",{"path":1005,"title":1006},"\u002Fdocs\u002Fdbt-export","Export to dbt",{"path":1008,"title":1009},"\u002Fdocs\u002Fopenlineage","OpenLineage",{"path":1011,"title":1012},"\u002Fdocs\u002Fsso-keycloak","Single sign-on with Keycloak",{"path":1014,"title":1015},"\u002Fdocs\u002Fsiem-splunk","Audit log to Splunk",{"path":1017,"title":1018},"\u002Fdocs\u002Fintegrations\u002Fmonitoring","Monitoring",{"title":1020,"icon":1021,"intro":1022,"items":1023},"Security & governance","governance","Who may see and do what, what is recorded, and how data quality and personal data are kept in check.",[1024,1027,1030,1033,1036,1039,1042],{"path":1025,"title":1026},"\u002Fdocs\u002Fgovernance","Overview",{"path":1028,"title":1029},"\u002Fdocs\u002Fgovernance\u002Fpermissions","Permissions",{"path":1031,"title":1032},"\u002Fdocs\u002Fgovernance\u002Faudit-log","Audit log",{"path":1034,"title":1035},"\u002Fdocs\u002Fgovernance\u002Fdata-contracts","Data contracts",{"path":1037,"title":1038},"\u002Fdocs\u002Fdesign\u002Fsso-group-mapping","SSO and group mapping",{"path":1040,"title":1041},"\u002Fdocs\u002Fexamples\u002Fkeycloak","Keycloak example on a laptop",{"path":1043,"title":1044},"\u002Fdocs\u002Fengines\u002Fclickhouse-ai-user","A ClickHouse user for the AI assistant",{"title":1046,"icon":1047,"intro":1048,"items":1049},"Install & operate","operate","Run it in production on Kubernetes, configure it, upgrade it and keep it healthy.",[1050,1053,1056,1059,1061,1063,1066],{"path":1051,"title":1052},"\u002Fdocs\u002Fdeploy\u002Fkubernetes","Kubernetes and Helm",{"path":1054,"title":1055},"\u002Fdocs\u002Fdeploy\u002Fkind","A company-like cluster on one computer (kind)",{"path":1057,"title":1058},"\u002Fdocs\u002Fdeploy\u002Fupgrading","Upgrading, backups and restore",{"path":854,"title":1060},"Install and upgrade checklist",{"path":85,"title":1062},"Configuration reference",{"path":1064,"title":1065},"\u002Fdocs\u002Fengine-settings","Settings from the panel",{"path":49,"title":1067},"Database migrations",{"title":1069,"icon":1070,"intro":1071,"items":1072},"Reference","reference","Release process and the remaining reference pages.",[1073],{"path":1074,"title":1075},"\u002Fdocs\u002Frelease-process","Release process",1793656372306]