> ## Documentation Index
> Fetch the complete documentation index at: https://docs.welesai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration and first setup

> Configure a Weles deployment: environment settings, PostgreSQL, Keycloak identity, encryption and licensing, AI models, and user access.

## Deployment configuration

Create a protected `.env` file using the vendor's instructions. Supply values for the registry and image version; PostgreSQL credentials and connection; Keycloak administrator and realm; internal and external Keycloak URLs; frontend URL; AI endpoint; shared and upload paths; and retention settings. For the included database, use the Compose service host `db` and container port `5432` for backend connections.

The supplied Compose file exposes service ports and starts Keycloak in development mode. Its realm contains example accounts and localhost-oriented client settings. Review and harden authentication, TLS, redirects, network access, and secrets with the vendor before production use. See [production installation](https://docs.welesai.com/quickstart.md).

## Encryption and licensing settings

* `SECRET_ENCRYPTION_KEY` protects values stored in the Secrets Vault. Generate and store a unique key securely, following the vendor's instructions. Provider API keys are stored separately in the application database; see [Configure AI providers](https://docs.welesai.com/administration/llm-providers.md).
* `LICENSE_FERNET_KEY` must be compatible with the keys issued by the licensing service. Obtain it through the vendor's secure provisioning process.
* `LICENSE_SERVER_URL` and `LICENSE_SERVER_API_KEY` identify and authenticate to the separately supplied licensing service. The license server is not part of the core production Compose stack.

> [!WARNING]
>
> Do not reuse sample keys or passwords, omit the license encryption key, or enable development mode in production. The current implementation can otherwise enable a development license. Never publish `.env` files, keys, or credentials.

Back up encryption keys securely with the data they protect. Losing or changing a key without a supported migration may make existing encrypted data unreadable.

## First setup in Weles

1. Sign in with an administrator account provisioned in the configured Keycloak realm. Review user roles and remove or secure example accounts.
2. Open **License** and [activate a valid license](https://docs.welesai.com/administration/licensing.md).
3. Open **LLM Config** and follow [Configure AI providers](https://docs.welesai.com/administration/llm-providers.md) to add and test providers and select active LLM, embedding, and OCR defaults.
4. Review data retention, storage, and access settings against your organization's policies.
5. Create document types and workflows, then assign appropriate workflow access under **User Config**.
6. Submit a non-sensitive test document and verify extraction, review, and export before processing production data.

An external provider may receive document contents or prompts. Model or provider overrides can exist at document-type or workflow-stage level; check both the global configuration and the relevant workflow when troubleshooting.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.