Self-hosted overview
What a self-hosted ACOG installation runs, what it needs from your environment, what it connects to, and how it is licensed.
ACOG can run entirely inside your own environment. A self-hosted installation runs the same product as the hosted service, built from the same code, and is installed with one Helm chart.
What you run
| Service | Role |
|---|---|
| Web | The console, and the single entry point: it serves /gateway (the data plane) and /api (the control plane) on one address |
| Data plane | The gateway your applications call |
| Control plane | Organizations, users, keys, connections, settings, licensing |
| Metering | Usage, cost and savings, off the request path |
| DLP | Free-text and protected-source detection for data loss prevention |
| Embedder | Embeddings for DLP protected sources and the semantic cache |
| NER | Named-entity detection (names, medical terms) for DLP |
And their datastores: PostgreSQL (configuration), Dragonfly or another Redis-protocol store (hot state, caches), ClickHouse (usage and analytics), and optionally Milvus (the semantic cache). The chart can run all of them for you or use ones you already operate.
All images are public at docker.io/tessarac and multi-architecture (amd64 and arm64). The data plane and control plane use their -selfhost builds (tessarac/dataplane-selfhost, tessarac/controlplane-selfhost).
Requirements
| Kubernetes | Any conformant distribution, with Helm 3 (OCI support) and a ReadWriteOnce StorageClass. See Install on Kubernetes. |
| Size | About 8 vCPU, 16 GiB memory and 60 GiB disk for a single node running the bundled datastores. With the semantic cache, plan for 16 vCPU, 32 GiB and 200 GiB or more. |
| Ingress | One HTTPS address for the web service, with a 660-second idle timeout and a 64 MiB body limit. You provide the TLS certificate; ACOG itself needs no certificates, certificate authority or cert-manager. |
| An SMTP relay (or Amazon SES) for verification, password reset and invitation mail. Required in production. | |
| Licence | A licence file and its password, from your Tessarac agreement. See Licensing. |
What it connects to
| Destination | Why | Required |
|---|---|---|
| Your AI providers | To serve requests | Yes |
| Your SMTP relay | Yes, in production | |
| Your identity provider | Single sign-on | If you use it |
| Your Git host | DLP protected sources | If you use them |
| Your OpenTelemetry collector or Langfuse | Traces | If you use them |
| Tessarac | Never. No component contacts Tessarac at runtime, licensing included. |
Users’ browsers load nothing from outside your installation’s address.
How it differs from the hosted service
| Self-hosted | |
|---|---|
| Sign-in | Passwords, two-factor authentication, passkeys and your own SSO. Members are added by an admin with a one-time password, not by email invitation. |
| Billing | No invoices. The licence switches savings on; without one the gateway runs in pass-through. |
| Keyless connections | Also install identity: use the identity your installation already runs as. See Install identity. |
| Provider addresses | Any address you configure, including private networks and plain HTTP |
| Semantic cache | Off until you enable Milvus and the embedder |
| Batch hold window | 10 minutes by default (ACOG_BATCH_HOLD_SECS); your load balancer’s idle timeout must cover it (660 s) |