Host system
AVX2 is mandatory; the vector database does not start without this instruction set extension, which all x86-64 processors since about 2015 support. ARM processors are not supported. A GPU is not required; the language models run at your model provider. The minimum values are sufficient for up to 100 employees; values for larger installations are in the Sizing Guide.
Network and domain
- A domain or subdomain for VARIOS AI with a DNS record pointing to the server.
- A static IP address for the server, internal or public.
If a firewall or proxy with TLS inspection breaks up outbound traffic, VARIOS AI must know its certificate authority. See Setting Up Trusted Certificate Authorities.
Certificate
By default, VARIOS AI obtains the HTTPS certificate automatically from Let’s Encrypt. This requires the server to be reachable from the internet under its domain on ports 80 and 443. If this is not possible or not desired, provide your own certificate, see Configuring a Custom HTTPS Certificate.Identity provider
Sign-in uses OpenID Connect, for example with Microsoft Entra ID or Keycloak. You need:- An app registration at the identity provider with the redirect URL of VARIOS AI, client ID and client secret.
- Roles or groups at the identity provider for administrators, super administrators and compliance administrators.
- For automatic user and group synchronization with Microsoft Entra ID: users can be synchronized with any Entra edition, groups require Microsoft Entra ID P1 or higher. If VARIOS AI reads the data itself via Microsoft Graph, application permissions with admin consent are needed in addition.
- For the Microsoft 365 assistant, additional Graph permissions, see Microsoft 365 Assistant.
Without an OpenID Connect capable identity provider
If only an on-premises Active Directory without OpenID Connect is available, a Keycloak container is installed in addition as a bridge. Keycloak handles sign-in against Active Directory via LDAP and provides the OpenID Connect interface for VARIOS AI. For this you need:- A dedicated subdomain for Keycloak with a DNS record pointing to the same server and a certificate, analogous to the VARIOS AI domain. The sign-in page is reachable via port 443; no additional inbound rule is needed.
- A service account in Active Directory with read access to the users and groups that should be able to sign in.
- Reachability of the domain controllers via LDAPS from the VARIOS AI server, see firewall rules.
Language models
Access to at least one chat model and one embedding model via an API, such as Azure OpenAI, OpenAI, Anthropic or Google, or your own model server with an OpenAI-compatible interface. The DLP check for sensitive content does not need an external service; it runs entirely on the server.Some model providers accept credit card payment only. Clarify contract and payment method with the provider before the installation; otherwise access to the model is missing in the end.
Provided by VARIOS AI
- Credentials for the container registry.
- License key for the installation.
Checklist before installation
- Server with Docker according to the minimum values or the sizing guide
- Domain with DNS record and static IP address
- Firewall rules set up according to the table above
- Certificate via Let’s Encrypt possible or own certificate available
- App registration at the identity provider with roles created
- For Entra ID with group synchronization: Entra ID P1 license available
- Without an OpenID Connect provider: subdomain for Keycloak, AD service account and LDAPS access to the domain controllers
- API access to chat and embedding model, payment method clarified with the provider
- Registry credentials and license key received from the VARIOS AI team