Self-Hosting & Sovereignty

Deploy Konversio and run it under your control

By Wile E. Coyote

• 3 articles

Environment variables reference

Environment variables referenceKonversio is configured through environment variables, typically defined in a .env file at the project root. The repository ships a .env.example with the full list and inline comments — treat that file as the authoritative reference. This article covers the variables you must set or are most likely to need to change.Required variablesThese must be set before the app will start correctly.SECRET_KEY_BASE A long random string used to sign session cookies and encrypted tokens. Generate one with openssl rand -hex 64. Never reuse across environments, never commit to version control.FRONTEND_URL The public URL of your Konversio instance, e.g. https://support.example.com. Used in email templates, widget embed snippets, and webhook callbacks. Must match your actual domain — mismatches break email links and live chat.RAILS_ENV Set to production for any real deployment. The default in development is development, which disables caching and enables verbose logging.Email (SMTP)All four of these are required for outbound email to work.VariableExampleSMTP_ADDRESSsmtp.eu.mailprovider.comSMTP_PORT587SMTP_USERNAMEyour@email.comSMTP_PASSWORDyourpasswordOptional email variables:SMTP_DOMAIN — your sending domain, used in HELOSMTP_AUTHENTICATION — defaults to plain; use login or cram_md5 if requiredSMTP_ENABLE_STARTTLS_AUTO — defaults to trueMAILER_SENDER_EMAIL — the From address on system emailsStorageACTIVE_STORAGE_SERVICE Controls where file attachments are stored. Two options:local (default) — files stored on disk at storage/ inside the container volumeamazon — use any S3-compatible endpoint (works with Scaleway Object Storage, Hetzner, Backblaze B2, etc.)When using S3-compatible storage, also set:S3_BUCKET_NAME= AWS_ACCESS_KEY_ID= AWS_SECRET_ACCESS_KEY= AWS_REGION= S3_ENDPOINT_URL= # required for non-AWS providers InternationalisationDEFAULT_LOCALE Sets the default UI language. Defaults to en. Supported locales are listed in config/locales/.Pilot AI variablesPilot replaces Chatwoot's proprietary Captain AI. Instead of being locked to a single vendor, Pilot is configured by pointing it at any OpenAI-compatible API endpoint.VariablePurposePILOT_ENABLEDSet to true to activate PilotPILOT_AI_PROVIDER_URLAPI base URL (e.g. Mistral, Ollama, Scaleway AI)PILOT_AI_API_KEYAPI key for the provider (leave blank for local Ollama)PILOT_AI_MODELModel name, e.g. mistral-small-latest, gemma3:4bThese are optional in the sense that Konversio runs without them — Pilot simply stays inactive.Optional but commonly neededLOG_LEVEL — info in production; debug when troubleshootingFORCE_SSL — set to true behind a TLS-terminating reverse proxyDISABLE_TELEMETRY — set to true to prevent any outbound telemetry pingsWEB_CONCURRENCY — number of Puma workers; defaults to 2, raise for more throughputFor the complete list with descriptions, see .env.example in the repository root.

Last updated on Jun 05, 2026

Deploying Konversio for EU sovereignty

Deploying Konversio for EU sovereigntySelf-hosting is not the same as sovereignty. You can run Konversio on your own server and still have legal exposure if that server, its DNS provider, its email relay, or its AI backend is subject to US jurisdiction. This article explains what genuine sovereignty looks like in practice and gives you a concrete checklist.What sovereignty actually meansThe question is not only "where is the data stored?" but "who can compel access to it?"The US CLOUD Act (2018) allows US authorities to compel US-headquartered companies to hand over data stored anywhere in the world, including data held by their European subsidiaries and European-region cloud instances. This creates a conflict with GDPR's prohibition on transferring personal data outside the EU without adequate safeguards.Running on AWS eu-west-1 or Azure West Europe does not resolve this. The parent companies are US entities. For a full explanation of this conflict and its legal status, see the CLOUD Act / GDPR conflict page on konversio.org.Konversio was built to make it possible to close this gap entirely.Architecture checklistWork through this list to assess your deployment.1. Run on EU-owned infrastructureChoose a cloud or bare-metal provider headquartered in the EU with no US parent.Tested and recommended:Scaleway (France) — tested by the Konversio team; good Docker support, EU object storage, GPU instances for model inferenceNebius (EU-incorporated, operates GPU clusters in Europe) — tested for Pilot with Llama/Qwen inferenceHetzner (Germany) — cost-effective VPS and dedicated servers, no GPU but solid for app + databaseOVHcloud (France) — large provider, good network, bare metal optionsAvoid: AWS, Azure, GCP, DigitalOcean (US-owned), Linode/Akamai.2. Use an EU-controlled AI provider for PilotThe default Pilot configuration is provider-agnostic. Sovereign options:Mistral API (French company, EU-hosted inference) — PILOT_AI_PROVIDER_URL=https://api.mistral.ai/v1Scaleway AI — hosts Mistral and other models on Scaleway infrastructureSelf-hosted Ollama — run Gemma 4, Qwen 2.5, or Mistral locally on your own server; no external API call at all; set PILOT_AI_PROVIDER_URL=http://localhost:11434/v1 and leave PILOT_AI_API_KEY blank3. Keep email within the EUSMTP is a common oversight. Use an EU-headquartered transactional email provider:Brevo (France, formerly Sendinblue)Mailpace (UK/EU, carbon-neutral)Your own Postfix/Exim — maximum control, more operational overheadAvoid Mailgun, SendGrid, Postmark — all US-owned.4. Disable third-party telemetrySet DISABLE_TELEMETRY=true in your .env. This prevents any analytics pings from leaving your instance. Verify with a network monitor on first boot that no outbound calls go to unexpected hosts.5. Control your own encryption keysFor database encryption at rest, use your provider's disk encryption or LUKS on bare metal — with keys you hold. If using object storage for attachments, use server-side encryption with customer-managed keys (CMK/BYOK) where your provider supports it.Scaleway Object Storage and OVH both support SSE with managed keys.What this buys youA deployment following this checklist runs with no dependency on any US-jurisdiction service. Customer conversation data — messages, contact details, attachments, AI inference inputs — stays within EU legal borders at every step. This is what "European strategic autonomy" means in operational terms, not just a marketing claim.

Last updated on Jun 05, 2026

Self-hosting Konversio: overview and requirements

Self-hosting Konversio: overview and requirementsKonversio is designed to run entirely on infrastructure you control. This article covers what you need before you start, what the stack looks like, and how to think about storage and backups.What you needServer requirementsA Linux server running a recent Ubuntu LTS or Debian stable release is the recommended base. You will also need:Docker (20.10 or later) and Docker Compose (v2 plugin or standalone v1.29+)A domain name with DNS you control — Konversio needs a publicly reachable URL for webhooks, email routing, and the live chat widgetAn SMTP service for outbound email (conversation replies, agent notifications, password resets)Minimum hardware specsUse caseCPURAMStorageEvaluation / small team2 cores4 GB20 GBProduction without Pilot2 cores4 GB40 GB+Production with Pilot4 cores8 GB60 GB+If you run Pilot with a locally hosted model (via Ollama), add at least 8–16 GB RAM and a GPU or fast CPU — the model inference load is separate from the Konversio app itself.What Docker Compose runsThe default docker-compose.yml brings up the following services:Rails app — the main web server, handles the UI and APISidekiq — background job worker (email delivery, webhook dispatch, automation triggers, report generation)cable — Action Cable server for real-time updates in the agent UIPostgreSQL — primary databaseRedis — job queue, pub/sub for real-time features, cachingAll services communicate on an internal Docker network. Only the Rails app and cable server are exposed externally (via a reverse proxy such as Nginx or Caddy).What data is stored and wherePostgreSQL holds everything structured: accounts, contacts, conversations, messages, users, teams, labels, automation rules, reports, and help center content.File attachments (images, documents sent in conversations) are stored either locally on disk or in an S3-compatible object store, depending on your ACTIVE_STORAGE_SERVICE setting. By default, local storage is used.Backup recommendationsAt minimum, back up two things:PostgreSQL database — use pg_dump on a schedule. A daily dump with a week of retention is a reasonable baseline. Store dumps off the server (object storage, a second machine).Attachments — if using local storage, back up the storage/ directory. If using S3-compatible storage, your bucket versioning and lifecycle policies cover this.Redis does not need persistent backups — it holds transient job queue state that will recover on restart.Test your restores. A backup you have never tested is not a backup.

Last updated on Jun 05, 2026