FumeNodes/tabby-web
1
0
Fork 0
mirror of https://github.com/Eugeny/tabby-web.git synced 2026-08-16 22:36:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: Azure AD single-tenant support + system requirements

Browse Source 
- Add Azure AD Tenant provider for organizations that want to restrict
  login to a specific Entra ID tenant (vs allowing any Microsoft account)
- Add system requirements documentation (RAM, CPU, disk) for Docker builds
- Addresses issue where frontend build fails on memory-constrained systems

Closes #120, closes #132

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Brian Olson
2025-12-31 16:32:54 -05:00
parent 33628af31f
commit cfc46590bb
3 changed files with 45 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
README.md
View File

@@ -16,10 +16,27 @@ Tabby Web serves the [Tabby Terminal](https://github.com/Eugeny/tabby) as a web
# Requirements
## Runtime Requirements
* Python 3.7+
* A database server supported by Django (MariaDB, Postgres, SQLite, etc.)
* Storage for distribution files - local, S3, GCS or others supported by `fsspec`
## Docker Build Requirements
Building the Docker image requires significant resources due to the frontend compilation:
| Resource | Minimum | Recommended |
|----------|---------|-------------|
| RAM | 2 GB | 4 GB |
| CPU | 2 cores | 4 cores |
| Disk | 5 GB | 10 GB |
**Note:** The frontend build (webpack/Angular) is memory-intensive. If building on constrained systems (like Oracle Cloud Always Free tier with 1GB RAM), consider:
- Using pre-built images from a CI/CD pipeline
- Building on a larger machine and pushing to a registry
- Adding swap space (not recommended for production)
# Quickstart (using `docker-compose`)
You'll need:
@@ -50,7 +67,8 @@ Only providers with credentials configured will appear as login options. Set the
| GitHub | `SOCIAL_AUTH_GITHUB_KEY`, `SOCIAL_AUTH_GITHUB_SECRET` |
| GitLab | `SOCIAL_AUTH_GITLAB_KEY`, `SOCIAL_AUTH_GITLAB_SECRET` |
| Google | `SOCIAL_AUTH_GOOGLE_OAUTH2_KEY`, `SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET` |
| Microsoft | `SOCIAL_AUTH_MICROSOFT_GRAPH_KEY`, `SOCIAL_AUTH_MICROSOFT_GRAPH_SECRET` |
| Microsoft (multi-tenant) | `SOCIAL_AUTH_MICROSOFT_GRAPH_KEY`, `SOCIAL_AUTH_MICROSOFT_GRAPH_SECRET` |
| Azure AD (single-tenant) | `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY`, `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET`, `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID` |
| Auth0 | `SOCIAL_AUTH_AUTH0_DOMAIN`, `SOCIAL_AUTH_AUTH0_KEY`, `SOCIAL_AUTH_AUTH0_SECRET` |
| Generic OIDC | `SOCIAL_AUTH_OIDC_OIDC_ENDPOINT`, `SOCIAL_AUTH_OIDC_KEY`, `SOCIAL_AUTH_OIDC_SECRET` |
@@ -75,6 +93,18 @@ Set the callback URL to: `https://your-domain/api/1/auth/social/complete/oidc/`
**Note on MFA:** Multi-factor authentication is handled by your identity provider. Enable MFA in Authentik, Authelia, or your chosen provider to require 2FA for Tabby Web logins.
### Azure AD Single-Tenant
For organizations that want to restrict login to a specific Azure AD/Entra ID tenant (instead of allowing any Microsoft account), use the Azure AD single-tenant provider:
- `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY`: Application (client) ID from Azure portal
- `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET`: Client secret
- `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID`: Directory (tenant) ID
Set the callback URL to: `https://your-domain/api/1/auth/social/complete/azuread-tenant-oauth2/`
When registering your app in Azure portal, select "Accounts in this organizational directory only" for supported account types.
## Adding Tabby app versions
* `docker-compose run tabby /manage.sh add_version 1.0.163`