Skip to main content
The supplied Compose deployment runs Weles from prebuilt images; no source build is needed. Contact the vendor for the deployment package, image registry, approved image version, registry credentials, licensing details, and deployment-specific configuration.
The supplied Compose file is a starting point, not a fully hardened production environment. It exposes several service ports and starts Keycloak in development mode. Its realm contains example accounts and localhost-oriented client settings. Before production use, replace default credentials, review the realm and clients, configure production-grade Keycloak and TLS, and restrict network access with your security team. Do not expose internal services to untrusted networks.

​
Prerequisites

  • Docker Engine and the Docker Compose plugin on the deployment host.
  • Access to the vendor’s registry and a separately provided license service.
  • A plan for persistent storage, capacity, backups, monitoring, recovery, DNS, TLS, proxies, and firewall rules.
  • Approved AI provider and OCR settings, including credentials when required.

​
Prepare the deployment

  1. Copy the vendor-supplied docker-compose.prod.yml, keycloak-realm.json, and keycloak-theme/weles directory into a protected deployment directory. Compose mounts the realm and theme from these paths.
  2. Create the shared directory for uploads, workflow file exchange, and license data.
  3. For the search profile, also provide searxng/settings.yml. For the Matrix profile, securely provide matrix_connector/.env.
  4. Create a protected .env file using the vendor’s instructions. Do not publish it or reuse example passwords and keys.
  5. Set the image registry, repository, and version, database credentials, Keycloak URLs and credentials, AI endpoint, storage paths, retention policy, encryption key, and license-service settings. See Configuration.
The image variables IMAGE_REGISTRY, IMAGE_REPO, and IMAGE_TAG form service-specific image names. Use the vendor-supplied registry and version; pinning an approved version helps make upgrades reproducible. The included PostgreSQL service is addressed as db on container port 5432; distinguish that internal port from a host-published port.

​
Pull and start

From the deployment directory, authenticate if the registry is private:
Confirm the containers are running, the frontend is reachable through the approved URL, Keycloak login works, and the application can reach the configured provider and licensing service. Container status alone does not prove that the system is ready.

​
Optional services

Available Compose profiles include search, matrix, vector_db, knowledge_graph, and mcp. Enable only the integrations you need and review their credentials, ports, storage, and network restrictions. For example:

​
Updates and data protection

Back up persistent data and configuration, follow the vendor’s release and migration guidance, select an approved image version, pull the images, and recreate the services. Validate the deployment afterward. Do not use down -v as a routine stop command: removing volumes can destroy data. Continue with first configuration and licensing.