197 lines
4.3 KiB
Markdown
197 lines
4.3 KiB
Markdown
# Tabby Web Service Module
|
|
|
|
This module provides a NixOS service for running the Tabby Web terminal application server.
|
|
|
|
## Features
|
|
|
|
- Systemd service with automatic startup
|
|
- User and group management
|
|
- Database migration on startup
|
|
- Configurable environment variables
|
|
- Security hardening
|
|
- Firewall integration
|
|
- Support for PostgreSQL and SQLite databases
|
|
- Social authentication configuration
|
|
|
|
## Basic Usage
|
|
|
|
```nix
|
|
{
|
|
mjallen.services.tabby-web = {
|
|
enable = true;
|
|
port = 9000;
|
|
openFirewall = true;
|
|
};
|
|
}
|
|
```
|
|
|
|
## Advanced Configuration
|
|
|
|
```nix
|
|
{
|
|
mjallen.services.tabby-web = {
|
|
enable = true;
|
|
port = 8080;
|
|
openFirewall = true;
|
|
|
|
# Use PostgreSQL instead of SQLite
|
|
databaseUrl = "postgresql://tabby:password@localhost:5432/tabby";
|
|
|
|
# Use S3 for app distribution storage
|
|
appDistStorage = "s3://my-bucket/tabby-dist";
|
|
|
|
# Configure social authentication
|
|
socialAuth = {
|
|
github = {
|
|
key = "your-github-oauth-key";
|
|
secret = "your-github-oauth-secret";
|
|
};
|
|
gitlab = {
|
|
key = "your-gitlab-oauth-key";
|
|
secret = "your-gitlab-oauth-secret";
|
|
};
|
|
};
|
|
|
|
# Performance tuning
|
|
workers = 8;
|
|
timeout = 300;
|
|
|
|
# Additional environment variables
|
|
extraEnvironment = {
|
|
DEBUG = "0";
|
|
LOG_LEVEL = "info";
|
|
};
|
|
};
|
|
}
|
|
```
|
|
|
|
## Configuration Options
|
|
|
|
### Basic Options
|
|
|
|
- `enable`: Enable the tabby-web service
|
|
- `port`: Port to run the server on (default: 9000)
|
|
- `openFirewall`: Whether to open the firewall port (default: false)
|
|
- `user`: User to run the service as (default: "tabby-web")
|
|
- `group`: Group to run the service as (default: "tabby-web")
|
|
- `dataDir`: Data directory (default: "/var/lib/tabby-web")
|
|
|
|
### Database Configuration
|
|
|
|
- `databaseUrl`: Database connection URL
|
|
- SQLite: `"sqlite:///var/lib/tabby-web/tabby.db"` (default)
|
|
- PostgreSQL: `"postgresql://user:password@host:port/database"`
|
|
|
|
### Storage Configuration
|
|
|
|
- `appDistStorage`: Storage URL for app distributions
|
|
- Local: `"file:///var/lib/tabby-web/dist"` (default)
|
|
- S3: `"s3://bucket-name/path"`
|
|
- GCS: `"gcs://bucket-name/path"`
|
|
|
|
### Social Authentication
|
|
|
|
Configure OAuth providers:
|
|
|
|
```nix
|
|
socialAuth = {
|
|
github = {
|
|
key = "oauth-key";
|
|
secret = "oauth-secret";
|
|
};
|
|
gitlab = {
|
|
key = "oauth-key";
|
|
secret = "oauth-secret";
|
|
};
|
|
microsoftGraph = {
|
|
key = "oauth-key";
|
|
secret = "oauth-secret";
|
|
};
|
|
googleOauth2 = {
|
|
key = "oauth-key";
|
|
secret = "oauth-secret";
|
|
};
|
|
};
|
|
```
|
|
|
|
### Performance Options
|
|
|
|
- `workers`: Number of gunicorn worker processes (default: 4)
|
|
- `timeout`: Worker timeout in seconds (default: 120)
|
|
|
|
### Additional Configuration
|
|
|
|
- `extraEnvironment`: Additional environment variables as an attribute set
|
|
|
|
## Service Management
|
|
|
|
```bash
|
|
# Start the service
|
|
sudo systemctl start tabby-web
|
|
|
|
# Enable automatic startup
|
|
sudo systemctl enable tabby-web
|
|
|
|
# Check service status
|
|
sudo systemctl status tabby-web
|
|
|
|
# View logs
|
|
sudo journalctl -u tabby-web -f
|
|
|
|
# Run management commands
|
|
sudo -u tabby-web tabby-web-manage migrate
|
|
sudo -u tabby-web tabby-web-manage add_version 1.0.156-nightly.2
|
|
```
|
|
|
|
## Security
|
|
|
|
The service runs with extensive security hardening:
|
|
|
|
- Dedicated user and group
|
|
- Restricted filesystem access
|
|
- No new privileges
|
|
- Protected system directories
|
|
- Private temporary directory
|
|
- Memory execution protection
|
|
- Namespace restrictions
|
|
|
|
## Database Setup
|
|
|
|
### PostgreSQL
|
|
|
|
If using PostgreSQL, ensure the database and user exist:
|
|
|
|
```sql
|
|
CREATE USER tabby WITH PASSWORD 'your-password';
|
|
CREATE DATABASE tabby OWNER tabby;
|
|
```
|
|
|
|
### SQLite
|
|
|
|
SQLite databases are created automatically in the data directory.
|
|
|
|
## Troubleshooting
|
|
|
|
1. **Service fails to start**: Check logs with `journalctl -u tabby-web`
|
|
2. **Database connection issues**: Verify database URL and credentials
|
|
3. **Permission errors**: Ensure data directory has correct ownership
|
|
4. **Port conflicts**: Check if another service is using the configured port
|
|
|
|
## Integration with Reverse Proxy
|
|
|
|
Example Nginx configuration:
|
|
|
|
```nginx
|
|
server {
|
|
listen 80;
|
|
server_name tabby.example.com;
|
|
|
|
location / {
|
|
proxy_pass http://localhost:9000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|