Self-hosting on AWS

Deploy Vocion in your AWS account. Or on your own host.

One OpenTofu apply provisions the network, host, secrets and DNS. A bootstrap script then starts Vocion with Postgres, Langfuse and TLS on that host. The first boot takes a few minutes once the settings below are in place. Connecting Slack, email, GitHub and your workspace comes after.

Get a demo View on GitHub

Architecture

Vocion on top. Your controls underneath.

Vocion runs the apps, agents, review and record. AWS services do the plumbing. All of it sits inside the IAM, network, keys and audit trail your security team already runs.

Your AWS account

VOCIONApps, agents, review, the recordMPL-2.0 · yours

Today

Amazon Bedrock AgentCore

Optional runtime and eval grading for agents

On the roadmap

Bedrock Guardrails

Screen model inputs and outputs

Today

CloudWatch · OpenTelemetry

Traces in your own stack

Your IAM · VPC · KMS · CloudTrail

The controls your security team already audits

Read first

Before you apply.

The module and the env example ship with defaults for our own account, and a few settings the first boot depends on. Set these first.

Set your account, region, hosted zone and instance size. The module's defaults are our own.
Pin a release tag for git_ref instead of main.
Limit SSH (ssh_cidr) to your own network. The default is open.
Set AUTH_SECRET.
Set VOCION_SCHEDULE_OWNER=1 on the app, or schedules and workflows never run.
Create an S3 bucket for Langfuse and grant the host role access, or set LANGFUSE_ENABLED=false.
To wrap credentials with your own KMS key, grant the host role use of it and set VOCION_CREDENTIAL_VAULT=kms.
Pick an instance that can build the image (about 8 GB of memory), or build it in CI.
Set VOCION_HOSTNAME and NEXT_PUBLIC_APP_URL to your own domain. The example points at ours, and Caddy requests a certificate for that name.
Set OPENAI_API_KEY even if no agent uses OpenAI: knowledge search embeds with OpenAI by default. Or configure Bedrock embeddings.
Fill the LANGFUSE_* values marked "set me", or set LANGFUSE_ENABLED=false.
After the first boot, apply your workspace. The box starts with a migrated database and no workspace content. From a checkout with dev dependencies, set WORKSPACE_PATH to your workspace repo and run npm run workspace:apply.

How to apply a workspace: docs/workspace.md in vocion-core.

Known issue: update.sh still asks for a Clerk key on rebuild.

The reference deployment

Your records stay in your account.

The reference path runs the platform on one host to start: the app, Postgres with pgvector, Langfuse for traces and an OpenTelemetry collector, behind Caddy for TLS. Schedules and workflows run inside the app on its own Postgres. Model calls go to the providers you choose. Scale the host, or point Vocion at RDS, when you need to.

Your AWS account or your own host

VOCIONMPL-2.0

app · agents · schedules and workflows · the record

Postgres 16

pgvector · records, documents, durable jobs

Langfuseoptional

traces

OTel collectoroptional

metrics and logs

Caddy

TLS

On AWS: VPC · IAM · Secrets Manager

prompts, documents an agent reads, synced documents for search
prompts, documents an agent reads, synced documents for search
Model providers you choose
Op
- Chat: Anthropic, OpenAI or Amazon Bedrock, per agent
- Search: OpenAI or Bedrock embeddings
- Rerank: Claude Haiku when an Anthropic key is set
the repo being built
the repo being built
Software Factory builds
- Claude Code · Anthropic
what you sync and send
what you sync and send
Tools and channels you connect
SlTw
- HubSpot, Gmail, GitHub, Slack, Resend, Twilio
traces
traces
Langfuse Cloud, if you choose it
- Instead of the Langfuse on your host

Inside the line: what the reference deployment runs. Outside: the services you choose that process data.

Provision

One apply for the account-level pieces.

The OpenTofu module in the repo creates the network, the host, the secret store and your DNS records. Its defaults are our own, so set your account, region, hosted zone and instance size before you apply.

Network: VPC, subnet, security group and an Elastic IP.
Host and backups: One EC2 host with a data volume and daily snapshots kept for 7 days.
Secrets and DNS: A Secrets Manager secret for runtime config, and Route 53 records in your existing hosted zone.

infra/terraform

$ cd infra/terraform
$ cp terraform.tfvars.example terraform.tfvars
$ tofu init
$ tofu apply

Set the variables in Before you apply first.

Run

From a blank account to a live URL.

The deployment guide walks the whole path in order. Once DNS resolves, the certificate follows in under a minute.

Apply
OpenTofu provisions the network, host, secret and DNS.
Secrets
Model keys, AUTH_SECRET, the credential vault, your hostname and VOCION_SCHEDULE_OWNER=1 into Secrets Manager.
Boot
The bootstrap script installs Docker, builds or pulls your image, starts the stack and runs migrations.
TLS
Caddy serves your domain with security headers.
Apply your workspace
From a checkout, with WORKSPACE_PATH set: agents, teams and apps from your git repo.

infra/terraform · infra/aws

Anywhere else

What Vocion needs.

Postgres 16 with pgvector, Node 20.9 or later, a model key and an embeddings provider. Build the Docker image from the repo for each environment, and run it on a VM, a cluster or a laptop. The full list is in the requirements.

Open source

MPL-2.0. No commercial agreement needed to self-host.

Your models

Bring Anthropic, OpenAI or Amazon Bedrock keys.

Your records

Stored in your Postgres. Model calls go to the providers you choose.

Requirements Deployment guide View on GitHub Security

Get started

See Vocion run your team's real work.

Bring one job your team does every week. In the demo we walk through it on sample data shaped like yours, with the record it keeps.

Get a demo

For your team: a demo built around your job, on sample data.

For your engineers

Run it yourself

The requirements, the AWS path and the repo.