Wannlabs Enterprise self-host kit: install guide

1. Overview

Wannlabs Enterprise is a fully sovereign, on-premise AI application development and publishing platform. It packages the Ember/Prime app builder, an enterprise Git portal (Gitea), sovereign authentication/database (Supabase), and an automated Caddy edge ingress with zero external telemetry.

Early access. This kit provisions the full infrastructure (edge, Git portal, Supabase auth and database, AI provider wiring). The Ember Studio and builder API images are private and are issued to your registry account during onboarding. License terms: LICENSE-EVALUATION.md. Open-source components: THIRD_PARTY_NOTICES.md.

2. Infrastructure Requirements

• Operating System: Ubuntu Server 22.04 LTS or 24.04 LTS (x86_64).
• Compute: 4–8 vCPUs minimum (8–16 vCPUs recommended).
• Memory: 16 GB RAM minimum (32 GB recommended for high concurrent builders).
• Storage: 100 GB+ NVMe SSD.
• Runtimes: Docker Engine 24.0+ and Docker Compose v2.
• GPU (Optional): NVIDIA GPU with 16GB+ VRAM (RTX 4090, A10G, L4, A100) if utilizing embedded local AI inference.

3. Quick Start (3 Steps)

Step 1: Extract or Clone the Appliance

# .zip or .tar.gz, whichever you downloaded
unzip wannlabs-enterprise-v1.1.1.zip   # or: tar -xzf wannlabs-enterprise-v1.1.1.tar.gz
cd wannlabs-enterprise-v1.1.1
sha256sum -c ../wannlabs-enterprise-v1.1.1.sha256 2>/dev/null || true   # optional integrity check

Step 2: Run the Interactive Setup Wizard

./setup.sh

The wizard will: 1. Verify system prerequisites (Docker, CPU, RAM). 2. Prompt for your corporate domain (e.g., dev.acme.corp) and administrator email. 3. Decouple and configure your AI inference provider (see Section 4). 4. Generate zero-knowledge 256-bit encryption keys for database and JWT secrets. 5. Create the production .env configuration file with restricted permissions (600).

Step 3: Apply Host Security Hardening (Recommended)

sudo ./security/setup-security.sh

This applies CIS-baseline security: - UFW Firewall: Restricts inbound access strictly to ports 22 (SSH rate-limited), 80 (HTTP ACME/Redirect), and 443 (HTTPS Ingress). - Kernel Sysctl: Enforces SYN flood mitigation and disables source routing. - Fail2ban: Automatically bans brute-force intrusion attempts. - Security Updates: Enables automated unattended daily security patches.

4. AI Inference Configuration

Wannlabs supports four decoupled AI inference topologies to accommodate enterprise compliance:

Topology A: Corporate BYOK (Bring Your Own Key / Gateway)

Connect to your company's existing enterprise LLM agreement (Azure OpenAI, AWS Bedrock, Anthropic, or internal OpenAI-compatible vLLM gateway):

AI_PROVIDER=corporate-byok
AI_API_ENDPOINT=https://your-resource.openai.azure.com/openai/deployments/qwen-coder/chat/completions?api-version=2024-02-15-preview
AI_API_KEY=your_corporate_key_here
AI_MODEL_NAME=Qwen/Qwen2.5-Coder-7B-Instruct

Topology B: Enterprise Modal Deployment

If your organization utilizes Modal.com for serverless GPU scaling, deploy the provided modal-coder script to your own Modal workspace:

AI_PROVIDER=modal-enterprise
MODAL_CODER_URL=https://your-org--ember-coder-web.modal.run
MODAL_CODER_API_KEY=your_modal_secret
MODAL_VISION_URL=https://your-org--ember-vision-web.modal.run

Topology C: 100% Air-Gapped Local GPU

For environments with zero internet access (defense, banking, healthcare), deploy on a server with an NVIDIA GPU. The stack boots an internal Ollama container directly:

AI_PROVIDER=local-gpu
docker compose -f docker-compose.enterprise.yml --profile local-gpu up -d

Topology D: Wannlabs Managed License

If you do not wish to operate GPU infrastructure, connect via a Wannlabs Enterprise license key:

AI_PROVIDER=managed-license
WANNLABS_LICENSE_KEY=wl_ent_live_your_key_here

5. Security & Data Sovereignty Guarantees

1. Zero Phone-Home Telemetry: Prompts, code files, and assets remain within the enterprise host boundaries.
2. Zero In-App Billing: The billing engine is disabled (BILLING_ENABLED=false), unlocking unlimited seats and projects under your enterprise license.
3. Automated TLS & Reverse Proxy: Caddy automatically provisions and renews TLS certificates or accepts enterprise-managed wildcard certificates.
4. Isolated Git Repositories: All projects are git-backed within the internal Wannlabs Gitea instance (git.yourdomain.corp).

6. Backup & Disaster Recovery

All persistent state is stored in Docker volumes: - db_data: Platform database and auth users. - repo_data / repo_db_data: Git repositories and commits. - builder_data: Project files and local template caches. - sites_data: Production published web applications.

To create an immediate snapshot:

docker compose -f docker-compose.enterprise.yml down
tar -czf wannlabs-backup-$(date +%F).tar.gz /var/lib/docker/volumes/wannlabs_*
docker compose -f docker-compose.enterprise.yml up -d