Installation and operation
This document contains the information needed to install and operate Parsewise in the customer's infrastructure: the delivery set, environment requirements, configuration, the installation procedure and operation.
1. Delivery set
| Item | Content |
|---|---|
| Server image | API server, queue worker and task scheduler: one image run as three separate deployments with different start commands |
| Dashboard image | web interface for project employees and administrators |
| Embedding service image | inference server with the deepvk/USER-bge-m3 embedding model (vector size 1024) built into the image; two pools are run from this image — for indexing and for search queries |
| Widget | static bundle widget.iife.js and widget.css for placing on a website or in a personal account |
| Kubernetes manifests | files of the k8s repository: manifests/00-namespace.yaml, 02-backend.yaml, 02a-embedder-index.yaml, 02b-embedder-query.yaml, 03-celery.yaml, 03a-backend-domains-rbac.yaml, 04-admin-frontend.yaml, 06-ingress.yaml, 06a-ingress-shops.yaml, the secrets template docs/delivery-secrets-template.yaml and a sample bucket access policy storage/media-bucket-policy.json, as well as the server repository file k8s/custom-domains.yaml — routing of projects' own domains: deployments, services, routing, autoscaling; the queue worker's account and rights for connecting projects' own domains |
| Documentation | this document, Functional characteristics, User and administrator guide |
The delivery manifests are the manifests of the rightsholder's cloud installation, and its addresses and services are written in them. Before applying them the customer adapts them to their own installation:
- image addresses — to the versions from the delivery registry;
- values written directly in the server and queue worker manifests:
FRONTEND_URL,SHOPS_DOMAIN,R2_ENDPOINT,R2_PUBLIC_URL,SMTP_HOST,SMTP_PORT,SMTP_USE_TLS,SMTP_START_TLS— to their own (a value in the manifest takes precedence over a value in a secret);LLM_MODEL_QUERY— to the name of their model, or remove it; - references to the secret keys
yandex-gpt-api-key,yandex-gpt-folder-id,yandex-maps-api-keyand to themetrika-credentialssecret — remove them: only the cloud installation needs them, and without them pods do not start in the cluster; - in the dashboard manifest — remove
NEXT_PUBLIC_API_URLandNEXT_PUBLIC_YM_COUNTER_IDand set thePARSEWISE_*parameters from section 3; - the secrets template — fill in with their own values and apply; it holds every secret the delivery manifests read, including
app-config-fullwith the parametersSECRET_KEY,DOCS_USERNAME,DOCS_PASSWORD,EMAIL_FROM,INGRESS_LB_IP,LLM_BASE_URL; - parameters of services the customer does not use — remove them: payments through Robokassa, Yandex Metrica;
- the sample bucket access policy — put in the name of their bucket and the server's account; it is written for Yandex Object Storage, in other storage the same access rules (section 2) are set with its own tools;
- for project addresses of the form
project.domain— issue a certificate for*.domainthrough cert-manager with a DNS01 check at their DNS provider and reference it in06a-ingress-shops.yaml.
Manifests of the marketing website, documentation and monitoring are not part of the delivery.
Images are handed over as an OCI archive for loading into the customer's registry or through the rightsholder's image registry.
Images are built from the rightsholder's mirrors: base images, Python packages and npm packages are not downloaded from public repositories during the build. For audio and video processing the server image includes ffmpeg from the Debian distribution. The embedding model is not downloaded during installation or start-up. Processes in the server and dashboard containers run as an unprivileged user.
2. Environment requirements
| Component | Requirement |
|---|---|
| Orchestrator | Kubernetes; the software is run in production on version 1.32. The manifests use the APIs apps/v1, autoscaling/v2, networking.k8s.io/v1, rbac.authorization.k8s.io/v1 |
| Nodes | x86-64 architecture (linux/amd64); the components are delivered as containers and need no privileges on the node: no privileged mode, no access to the node's file system or network. The node operating system is Linux with a container runtime supported by Kubernetes, including Astra Linux Special Edition 1.8, RED OS 8 and ALT Linux |
| Metrics server | the Kubernetes metrics server — autoscaling works on the CPU and memory load of pods |
| Image registry | OCI-compatible, reachable from the cluster |
| Ingress controller | ingress-nginx or equivalent: TLS, routing by domain name, a request body limit of at least 100 MB, connection, send and read timeouts of at least 300 s — the assistant's answer is streamed |
| TLS certificates | issued by cert-manager for the ingress controller through a ClusterIssuer chosen by the customer, including the customer's internal certificate authority; in the cloud installation the rightsholder uses a public certificate authority |
| PostgreSQL | two databases: main and vector; the software is run in production on PostgreSQL 15 |
| pgvector | an extension in the vector database: the vector type must be available; the software creates IVFFlat indexes |
| Redis | queue broker and cache; the software is run in production on Valkey 7.2, which is compatible with Redis |
| Object storage | S3-compatible, one bucket. The dashboard uploads files to storage straight from the browser through a signed link; through signed links the dashboard and the widget also receive knowledge base files and dialogue attachments. The storage must therefore be reachable from users' browsers over HTTPS, and the bucket's CORS rules must allow GET and PUT requests from the dashboard's address. Reading without authorisation is allowed only for public objects — avatars, covers, product and profile media, review photos, skill resources: the prefixes system/, users/, skills/, tmp/, shops/*/avatar/, shops/*/cover/, shops/*/bot_avatar/, shops/*/products/, shops/*/temp/, shops/*/reviews/. Knowledge base files (shops/*/files/) and dialogue attachments (shops/*/chats/) are not served without authorisation, and neither is the bucket's object list. The account whose keys are given to the server needs to read, write, delete and list objects |
| Language model | hosted by the customer, OpenAI-compatible API — for example, vLLM |
| Internet access | not needed when the language model is hosted inside the customer's perimeter, except for speech recognition in audio and video (Yandex SpeechKit) and sign-in through Yandex ID and VK ID, if these functions are on. Without access to Yandex SpeechKit files are kept, but speech is not extracted from them |
Each server and queue worker pod opens up to 40 connections to PostgreSQL. With many replicas a connection pooler is recommended, for example PgBouncer or Odyssey.
Compute resources
| Component | Replicas | CPU / RAM request | CPU / RAM limit | Autoscaling |
|---|---|---|---|---|
| API server | 1–10 | 500m / 512Mi | 2000m / 2Gi | CPU 70%, memory 80% |
| Queue worker | 4–10 | 500m / 1Gi | 2000m / 4Gi | CPU 70%, memory 80% |
| Task scheduler | exactly 1 | 50m / 128Mi | 200m / 256Mi | no |
| Embedding, indexing | 2–6 | 1000m / 2.5Gi | 4000m / 4Gi | CPU 70% |
| Embedding, queries | 2–6 | 500m / 2.5Gi | 2000m / 4Gi | CPU 70% |
| Dashboard | 1–10 | 200m / 256Mi | 1000m / 1Gi | CPU 70% |
Total resource requests without Kubernetes system components: about 5.8 vCPU and 14.9 GiB of memory at the minimum number of replicas, about 21.1 vCPU and 47.6 GiB at the maximum. A node must fit an embedding pod with a memory request of 2.5 GiB.
The configuration on which the rightsholder runs the software: 4–10 nodes of 4 vCPU and 8 GiB each with automatic node addition; the main and vector databases are separate PostgreSQL 15 clusters of 2 vCPU and 8 GiB with a 20 GiB disk growing automatically up to 64 GiB; Valkey 7.2 — 2 vCPU and 4 GiB.
3. Configuration
The parameters of the server, queue worker and scheduler are set with environment variables — from Kubernetes secrets or as values in the manifests (section 1). All three deployments receive the same parameters for connecting to the databases, Redis and object storage.
Required
| Parameter | Purpose |
|---|---|
DATABASE_URL | main PostgreSQL database |
VECTOR_DATABASE_URL | vector database with pgvector. Without this parameter the vector store does not start: falling back to the main database is deliberately forbidden |
REDIS_URL | queue broker and cache |
SECRET_KEY | key for signing session tokens |
R2_ENDPOINT, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET, R2_PUBLIC_URL | object storage: address, access keys, bucket and the address at which browsers receive the bucket's public objects. The software builds signed links to knowledge base files and dialogue attachments on the R2_ENDPOINT address. The parameter names are historical; any S3-compatible storage will do |
DOCS_USERNAME, DOCS_PASSWORD | login and password for the API documentation at /v1/docs |
FRONTEND_URL | address of the customer's dashboard; used in links in emails |
EMAIL_FROM | sender address of emails |
SHOPS_DOMAIN | domain of project addresses of the form project.domain; used in project addresses and when checking the host of the corporate sign-in (SSO) |
INGRESS_LB_IP | external address of the ingress controller; shown in DNS setup hints when a project's own domain is connected |
SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD, SMTP_USE_TLS, SMTP_START_TLS | mail server. Required: password sign-in needs the address confirmed with a code from an email, and password recovery and project invitations also arrive by email |
The parameters FRONTEND_URL, EMAIL_FROM, SHOPS_DOMAIN and INGRESS_LB_IP have default values pointing to the rightsholder's cloud installation, so in the customer's installation they must be set.
Language model
| Parameter | Value |
|---|---|
LLM_SERVICE | openai — any model with an OpenAI-compatible interface. Set it explicitly: the default value yandex sends requests to Yandex Cloud |
LLM_BASE_URL | address of the customer's model, for example http://llm.internal:8000/v1 |
LLM_MODEL | model name. Without LLM_BASE_URL and LLM_MODEL the connection to the model is not initialised |
OPENAI_API_KEY | access key to the model, if the model server requires one; optional |
LLM_MODEL_QUERY | a separate model for rephrasing the search query; optional, if not set LLM_MODEL is used. In the cloud installation manifests it is set directly (section 1) |
The software does not use services of the company OpenAI: "OpenAI-compatible" is only the API format supported by vLLM and other model servers. The names openai and OPENAI_API_KEY follow that format.
Embedding
| Parameter | Purpose |
|---|---|
LOCAL_EMBEDDING_URL | address of the embedding service for indexing |
QUERY_EMBEDDING_URL | address of the embedding pool for search queries; if not set, LOCAL_EMBEDDING_URL is used |
Optional
| Parameter | Purpose |
|---|---|
MAX_UPLOAD_SIZE | maximum size of a file downloaded from a source by link, in bytes; 100 MiB by default |
FILE_URL_TTL_SECONDS | lifetime of a signed link to a knowledge base file or a dialogue attachment, in seconds; 3600 by default. An issued link is valid for no less than half of this time and no more than all of it |
YANDEX_SPEECHKIT_API_KEY, YANDEX_SPEECHKIT_FOLDER_ID, SPEECH_LANGUAGES | speech recognition in audio and video through Yandex SpeechKit and the recognition languages |
Dashboard and widget
The dashboard reads the installation parameters from the container's environment variables at start-up. A variable that is not set keeps the value the image was built with; a variable with an empty value switches the corresponding function off. The image is built with the values of the rightsholder's cloud installation — the Yandex Metrica counter, the Yandex ID and VK ID applications, the widget address on releases.parsewise.ru — so in the customer's installation PARSEWISE_YM_COUNTER_ID, PARSEWISE_YANDEX_CLIENT_ID and PARSEWISE_VK_CLIENT_ID are set explicitly, with their own values or empty, and PARSEWISE_WIDGET_SCRIPT_URL with the widget's address in the customer's infrastructure.
| Parameter | Purpose |
|---|---|
PARSEWISE_API_URL | API server address; also added to the content security policy of the dashboard pages |
PARSEWISE_APP_URL | dashboard address; its host serves the dashboard, other hosts serve the project's guest page |
PARSEWISE_ADMIN_HOSTS | additional dashboard hosts, comma-separated |
PARSEWISE_SHOPS_DOMAIN | domain of project addresses of the form project.domain |
PARSEWISE_PRIVACY_URL, PARSEWISE_TERMS_URL, PARSEWISE_OFFER_URL | links to the personal data processing policy, the terms of use and the offer |
PARSEWISE_SALES_EMAIL | address for pricing enquiries |
PARSEWISE_YM_COUNTER_ID | Yandex Metrica counter; an empty value switches Metrica off |
PARSEWISE_YANDEX_CLIENT_ID, PARSEWISE_VK_CLIENT_ID | application identifiers for sign-in through Yandex ID and VK ID; an empty value switches that sign-in off |
PARSEWISE_WIDGET_SCRIPT_URL | address of the widget file the dashboard puts into the embedding code |
PARSEWISE_STORAGE_URL | object storage address, the same as the server's R2_ENDPOINT; added to the content security policy of the dashboard pages and to the list of storages from which the dashboard shows files |
The widget receives the API server address with the apiUrl parameter in window.ParsewiseConfig on the page, together with the project identifier shopId; the link to the personal data processing policy — with the privacyPolicyUrl parameter or from the project settings.
The same build of the dashboard and the widget works in any installation: there is no need to rebuild them for the customer's address and parameters.
4. Installation
- Prepare PostgreSQL: the main and the vector databases. The
vectortype must be available in the vector database. If it is not, the software runsCREATE EXTENSION IF NOT EXISTS vector; if the application role has no such right, the database administrator runsCREATE EXTENSION vectorin advance. - Prepare Redis and an S3-compatible object storage bucket; configure the CORS rules and access to the bucket's objects according to section 2.
- Load the images into a registry reachable by the cluster and put their addresses in the manifests.
- Create the namespace and the secrets with the parameters from section 3.
- Put the domain names of the API and the dashboard into the routing manifest and configure TLS.
- Apply the manifests. At start-up the server creates the missing tables of the main database and applies the migrations included in the image; the vector store creates its own tables and indexes.
- Place the widget files on a static server or in the customer's object storage.
- Check the installation:
- all pods are ready; embedding pods take up to three minutes to load the model;
- a
GET /v1/public/healthrequest to the API server returns{"status": "ok"}; - the server log contains the line
Alembic migrations applied (head reached)and has noAlembic upgrade failedmessages and nopgvectorerrors.
5. Getting started
- Sign in to the dashboard and create a project.
- Set up the assistant's persona: name, avatar and answer rules.
- Fill the knowledge base: upload files, import products or profiles from a file, or connect a source by link.
- Invite team members and assign roles.
- Connect the widget to the pages of the website or personal account:
<script>
window.ParsewiseConfig = {
shopId: "PROJECT_ID",
apiUrl: "https://API_SERVER_ADDRESS",
};
</script>
<script async src="https://STATIC_ADDRESS/widget.iife.js"></script>
The detailed procedure for working in the dashboard is in the User and administrator guide.
6. Operation
| Task | Procedure |
|---|---|
| Backup | done by the customer: the main and vector PostgreSQL databases, object storage |
| Monitoring | pod state and logs with the cluster's tools. Health checks: server — GET / on port 8000, dashboard — GET / on port 3000, embedding — GET /health on port 8080, queue worker — the celery inspect ping command |
| Scaling | automatic, within the limits given in the resource table. The task scheduler runs strictly as a single instance |
| Update | the customer deploys a new version of the images at their discretion; the main database schema is updated with migrations when the server starts |
| Support | the "Technical support" document |
Test it on your own data
Upload your own documents and catalogue — then ask the assistant the questions people ask you. That is the only test that means anything.
