> ## Documentation Index
> Fetch the complete documentation index at: https://docs.varios-ai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# System Requirements

> What you need to provide to run VARIOS AI: host system, network, certificate, identity provider and model access

VARIOS AI runs as a Docker installation, either hosted by VARIOS AI or self-hosted in your environment. This page lists what you need to provide for a self-hosted installation. For a hosted installation, the sections on host system, network and certificate do not apply.

## Host system

| Requirement      | Minimum                                                                       |
| ---------------- | ----------------------------------------------------------------------------- |
| Processor        | x86-64 with 4 cores and AVX2                                                  |
| Memory           | 8 GB                                                                          |
| Disk             | 80 GB SSD                                                                     |
| Operating system | Current Linux distribution with Docker support, such as Ubuntu 24.04 or 26.04 |
| Software         | Docker Engine with Docker Compose v2                                          |

AVX2 is mandatory; the vector database does not start without this instruction set extension, which all x86-64 processors since about 2015 support. ARM processors are not supported. A GPU is not required; the language models run at your model provider. The minimum values are sufficient for up to 100 employees; values for larger installations are in the [Sizing Guide](/en/extended-support/operations/sizing).

## Network and domain

* A **domain or subdomain** for VARIOS AI with a DNS record pointing to the server.
* A **static IP address** for the server, internal or public.

Firewall rules by scenario:

| Source              | Destination                  | Port                      | Purpose                                                                                       |
| ------------------- | ---------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
| Users' workstations | VARIOS AI                    | 443                       | Using VARIOS AI                                                                               |
| Users' workstations | VARIOS AI                    | 80                        | Redirect to HTTPS when users enter the address without `https://`, optional                   |
| Internet            | VARIOS AI                    | 80, 443                   | Certificate via Let's Encrypt, only with automatic certificate                                |
| Microsoft Entra ID  | VARIOS AI                    | 443                       | User synchronization via SCIM, only if Entra ID pushes the data to VARIOS AI                  |
| VARIOS AI           | VARIOS AI container registry | 443                       | Installation and updates                                                                      |
| VARIOS AI           | Model provider               | 443                       | Chat and embedding models                                                                     |
| VARIOS AI           | Identity provider            | 443                       | Sign-in; with Entra ID also Microsoft Graph for users, groups and the Microsoft 365 assistant |
| VARIOS AI           | Let's Encrypt                | 443                       | Issuing and renewing the certificate                                                          |
| VARIOS AI           | Connected services           | 443                       | Connectors such as Confluence, MCP servers or web search, only if used                        |
| VARIOS AI           | SMTP server                  | 25 or 587                 | E-mail notifications, optional                                                                |
| VARIOS AI           | Syslog target                | 514                       | Log forwarding, optional                                                                      |
| VARIOS AI           | Domain controllers           | 636 (LDAPS) or 389 (LDAP) | Sign-in and user lookup against Active Directory, only with Keycloak on the VARIOS AI server  |
| Users' workstations | Keycloak server              | 443                       | Sign-in page, only with Keycloak on a separate server                                         |
| VARIOS AI           | Keycloak server              | 443                       | Verifying the sign-in, only with Keycloak on a separate server                                |
| Keycloak server     | Domain controllers           | 636 (LDAPS) or 389 (LDAP) | Sign-in and user lookup, only with Keycloak on a separate server                              |

<Note>
  If a firewall or proxy with TLS inspection breaks up outbound traffic, VARIOS AI must know its certificate authority. See [Setting Up Trusted Certificate Authorities](/en/extended-support/security/custom-tls-certificates).
</Note>

## Certificate

By default, VARIOS AI obtains the HTTPS certificate automatically from Let's Encrypt. This requires the server to be reachable from the internet under its domain on ports 80 and 443. If this is not possible or not desired, provide your own certificate, see [Configuring a Custom HTTPS Certificate](/en/extended-support/security/traefik-certificates).

## Identity provider

Sign-in uses OpenID Connect, for example with Microsoft Entra ID or Keycloak. You need:

* An **app registration** at the identity provider with the redirect URL of VARIOS AI, client ID and client secret.
* **Roles or groups** at the identity provider for administrators, super administrators and compliance administrators.
* For automatic **user and group synchronization** with Microsoft Entra ID: users can be synchronized with any Entra edition, groups require **Microsoft Entra ID P1** or higher. If VARIOS AI reads the data itself via Microsoft Graph, application permissions with admin consent are needed in addition.
* For the Microsoft 365 assistant, additional Graph permissions, see [Microsoft 365 Assistant](/en/extended-support/admin/global-assistants/microsoft365assistant).

### Without an OpenID Connect capable identity provider

If only an on-premises Active Directory without OpenID Connect is available, a **Keycloak** container is installed in addition as a bridge. Keycloak handles sign-in against Active Directory via LDAP and provides the OpenID Connect interface for VARIOS AI. For this you need:

* A **dedicated subdomain** for Keycloak with a DNS record pointing to the same server and a certificate, analogous to the VARIOS AI domain. The sign-in page is reachable via port 443; no additional inbound rule is needed.
* A **service account** in Active Directory with read access to the users and groups that should be able to sign in.
* Reachability of the **domain controllers** via LDAPS from the VARIOS AI server, see firewall rules.

If Keycloak runs on a separate server, the following rules apply instead: the users' workstations reach Keycloak via port 443 for the sign-in page, VARIOS AI reaches Keycloak via port 443 to verify the sign-in, and Keycloak reaches the domain controllers via LDAPS.

## Language models

Access to at least one chat model and one embedding model via an API, such as Azure OpenAI, OpenAI, Anthropic or Google, or your own model server with an OpenAI-compatible interface. The DLP check for sensitive content does not need an external service; it runs entirely on the server.

<Note>
  Some model providers accept credit card payment only. Clarify contract and payment method with the provider before the installation; otherwise access to the model is missing in the end.
</Note>

## Provided by VARIOS AI

* Credentials for the container registry.
* License key for the installation.

## Checklist before installation

* Server with Docker according to the minimum values or the sizing guide
* Domain with DNS record and static IP address
* Firewall rules set up according to the table above
* Certificate via Let's Encrypt possible or own certificate available
* App registration at the identity provider with roles created
* For Entra ID with group synchronization: Entra ID P1 license available
* Without an OpenID Connect provider: subdomain for Keycloak, AD service account and LDAPS access to the domain controllers
* API access to chat and embedding model, payment method clarified with the provider
* Registry credentials and license key received from the VARIOS AI team