Guide · Administrators
Planning an installation in your infrastructure
Components, external services, secrets, network exposure and backups — the checklist before installing EasyRag.
This guide lists everything you need to gather before installing the EasyRag platform on your servers. It does not replace the documentation in the EasyRag wiki (in French): it helps you prepare the environment.
Components
| Container | Role |
|---|---|
| Application API (NestJS) | Accounts, roles, assistants, corpora, channels, monitoring — port 3000 |
| RAG service (Python) | Extraction, vectorization, search, agent — internal |
| Web interface (Flutter, nginx) | Administration, portal, public pages |
| PostgreSQL 16 | Application database |
| PostgreSQL + pgvector | Document index |
| Redis 7 | Processing queues, rate limits |
The API, RAG service and interface images are published on Docker Hub (bpmconseil/easyrag-backend, bpmconseil/easyrag-llm, bpmconseil/easyrag-webapp).
External services
- Required: an OpenAI or Mistral key for vectorization and internal processing.
- For each assistant: a generation model (cloud provider, or internal Ollama / vLLM server).
- Recommended: an SMTP server (sign-up verification, passwords, alerts).
- As needed: Mistral OCR, Serper (web search), identity provider (OIDC, FranceConnect+, Google).
Secrets to generate
| Secret | Purpose |
|---|---|
JWT_SECRET, JWT_REFRESH_SECRET |
Session signing |
ENCRYPTION_KEY |
Credential encryption (32 bytes, base64-encoded) |
| PostgreSQL passwords | Application and vector databases |
INTERNAL_LLM_API_KEY |
Internal OpenAI or Mistral key |
Generate them randomly (for example openssl rand -base64 32) and keep them out of the code, in your secrets vault.
Network exposure
- Put the interface and the API behind an HTTPS reverse proxy.
- Set
CLIENT_ORIGINto the exact address of the interface: without this value, the API accepts all origins. - Decide whether to open self-service sign-up and whether to automatically create accounts via SSO (
SSO_AUTO_PROVISION). - If needed, restrict access to
/api/v1/docs(API documentation) and/metrics. - The RAG service and the databases must not be exposed.
Operations
- Backups: both PostgreSQL databases and the volume of imported documents.
- Monitoring: the API’s
/healthand/readyprobes; Prometheus metrics; OpenTelemetry traces (optional). - Updates: back up, replace the images, restart, check the probes.
- Environments: the migration module transfers assistants, corpora and settings from a staging instance to production, with dry run and rollback.
- Scaling: a single instance of the application API (some state is kept in memory).
License
Without a license, the platform runs in a limited free mode (one corpus, five documents). A free Registered license is obtained through email verification; the Pro license is available from the EasyRag community. Contact us to plan your installation.