Self-host anywhere

Vocion is one Next.js app and one Postgres database. Schedules, workflows and background jobs run inside the app on that database. Anywhere you can run a container next to Postgres works.

Requirements


Runtime	Node 20+, or Docker
Database	PostgreSQL 16 with the `vector` extension (managed is fine: RDS, Cloud SQL, Neon, Supabase…)
Required env	`DATABASE_URL`, `AUTH_SECRET`, `NEXT_PUBLIC_APP_URL`
A chat model	Anthropic, OpenAI, or Bedrock (see Models)
Embeddings	OpenAI (default) or Bedrock Titan — knowledge search needs one even when chat runs on Anthropic
One schedule owner	`VOCION_SCHEDULE_OWNER=1` on exactly one app process
A credential vault	`VOCION_CREDENTIAL_VAULT=kms` + `VOCION_KMS_KEY_ARN`, or `local` + `VOCION_CREDENTIAL_VAULT_KEY`

Optional: Langfuse (traces), Sentry, Resend for email, Slack, Twilio, the engineering runner.

Build the image

No prebuilt app image is published, because NEXT_PUBLIC_* values are baked in at build:

git checkout v5.0.0
docker build -f packages/core/Dockerfile \
  --build-arg NEXT_PUBLIC_APP_URL=https://agents.northwind.example \
  -t northwind/vocion:v5.0.0 .

The build needs about 8 GB of memory; build in CI if the host is small. White-label with the NEXT_PUBLIC_BRAND_NAME, NEXT_PUBLIC_BRAND_TAGLINE, NEXT_PUBLIC_BRAND_MARK and NEXT_PUBLIC_BRAND_LOCKUP build args.

Prepare the database

CREATE EXTENSION IF NOT EXISTS vector;

Apply migrations before starting a new release: npm run db:migrate from a checkout at the same tag, or infra/aws/apply-migrations.sh (plain psql, no Drizzle in the runtime image). Migrations only move forward.

Run

docker run -d -p 3000:3000 --env-file .env.production northwind/vocion:v5.0.0

Put TLS in front (Caddy, a load balancer). Then create the first admin with npm run user:create (see Quickstart) and apply your workspace with workspace:apply, with WORKSPACE_PATH set wherever the app runs.

Production checklist

AUTH_SECRET and a separate VOCION_TOOL_SIGNING_SECRET
Exactly one process with VOCION_SCHEDULE_OWNER=1
VOCION_CREDENTIAL_VAULT=kms (or local with a key you keep)
VOCION_ARTIFACTS_DIR on a private, persistent volume
VOCION_ENFORCE_WORKSPACE_ACCESS=1
Langfuse configured, or LANGFUSE_ENABLED=false
Database backups (see Backups)
A pinned release tag, never a branch (see Release lines)

All variables: Environment variables.