Navin Enterprise (navin-enterprise)

The Navin Enterprise AI platform: Control Plane API, background worker, GPU media worker and portal, on top of LiteLLM (gateway in front of the model providers), OPA, OpenFGA and Keycloak. FinOps and reasoning effort rules are code of the platform, not settings.

Generated from catalog/services/navin-enterprise.yaml: do not edit by hand.

Summary

Version	1.0.0
Use	install and configure
Layer	infrastructure (shown apart)
Category	Navin Enterprise
Installation methods	podman, python
External connection	no
Sandbox only	no

Licence

SPDX identifier	LicenseRef-Navin-Enterprise
Licence policy	licence of the publisher
Licence exception	-
Licence exceptions of its dependencies	LEX-013 (pending, awaiting the client), LEX-014 (pending, awaiting the client), LEX-017 (pending, awaiting the client), LEX-021 (pending, awaiting the client)
Platform component	control-plane-api

Packages and artifacts

A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.

Kind	Package	Version	Licence	Details
container image	harbor.example.internal/eai/control-plane	1.0.0	LicenseRef-Navin-Enterprise	image key control-plane, used by migrate, control-plane, worker
container image	harbor.example.internal/eai/worker	1.0.0	LicenseRef-Navin-Enterprise	image key worker, used by media-worker
container image	harbor.example.internal/eai/portal	1.0.0	LicenseRef-Navin-Enterprise	image key portal, used by portal
Python package	eai	1.0.0	LicenseRef-Navin-Enterprise	interpreters, in order of preference python3.11, python3.12
Python package	ragas	0.3.2	Apache-2.0	interpreters, in order of preference python3.11, python3.12
Python package	langchain-openai	0.3.28	MIT	interpreters, in order of preference python3.11, python3.12
Python package	datasets	4.0.0	Apache-2.0	interpreters, in order of preference python3.11, python3.12

Images are pinned by tag in the descriptor, and by digest when the descriptor declares one (the offline bundle then refuses a pulled image that does not carry it); the digest is recorded in the mirror of the Manager when the offline bundle is imported, and every pull or load is checked against it.

Supported systems and architectures

Method	Operating systems	Architectures
podman	RHEL family (dnf), Debian family (apt), Arch Linux (pacman)	x86_64, aarch64 (not restricted by the descriptor)
python	RHEL family (dnf), Debian family (apt), Arch Linux (pacman)	x86_64, aarch64 (not restricted by the descriptor)

Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.

GPU: NVIDIA GPU given to the component as CDI devices (nvidia.com/gpu): media-worker.

Prerequisites

Host

• at least 4096 MB of memory (blocking, memory).
• at least 1 NVIDIA GPU with 0 MB of memory (blocking, gpu).
• a synchronized clock (warning, time_sync).

Programs the commands and checks of the service start on the host, outside the managed roots: add them to allowed_commands of the agent (see Security of the Navin agent), else the agent refuses them with command_not_allowed: /usr/bin/systemctl.

Network and ports

Component	Port name	Port	Opened in the host firewall
control-plane	api	8080/tcp	yes
worker	metrics	9464/tcp	yes
media-worker	metrics	9465/tcp	yes
portal	http	3000/tcp	yes

Services and connections needed

• database: postgresql.
• redis: redis.
• litellm: litellm.
• opa: opa.
• openfga: openfga.
• oidc: keycloak.
• qdrant: qdrant.
• clickhouse: clickhouse.
• storage: seaweedfs.
• temporal: temporal (optional).
• livekit: livekit (optional).
• asterisk_ami: asterisk (optional).
• asterisk_ari: asterisk (optional).
• kamailio: kamailio (optional).
• livekit_sip: livekit-sip (optional).
• mem0: mem0 (optional).
• cognee: cognee (optional).
• opik: opik (optional).
• otel: otel-collector (optional).
• openbao: openbao (optional).
• nats: nats (optional).
• presidio: presidio (optional).
• docling: docling (optional).
• clamav: clamav.
• yarax: yara-x.

Details and resolution: see Dependencies.

Installation methods and modes

Method	Default	What the method uses
podman	yes	the container images of the descriptor, run by Podman under systemd
python	-	a Python virtual environment holding the Python packages of the descriptor

Components

Component	Kind	Installation methods	Ports
Database migration (migrate)	one shot	podman, python	-
Control Plane API (control-plane)	master	podman, python	8080/tcp
Background worker (worker)	master	podman, python	9464/tcp
GPU media worker (media-worker)	worker	podman	9465/tcp
Portal (portal)	master	podman	3000/tcp

Standard (standard) (default)

One API, one worker, one portal; media workers optional.

What the mode deploys:

Component	Placement
migrate	min 1, max 1
control-plane	min 1, max 1
worker	min 1, max 1
media-worker	min 0
portal	min 1, max 1

High availability (ha)

Three API and portal replicas behind HAProxy; the worker keeps one active leader (PostgreSQL advisory lock).

What the mode deploys:

Component	Placement
migrate	min 1, max 1
control-plane	min 2, recommended 3
worker	min 1, max 2, recommended 2
media-worker	min 0
portal	min 2, recommended 3

Install this service

The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.

1. Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.

2. Choose the service. On the Service step, select Navin Enterprise. The card shows the licence LicenseRef-Navin-Enterprise and the dependencies the installation needs. Pick the Method among podman, python (default podman).

3. Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode: standard (default), ha. Each mode deploys the components listed in Installation methods and modes. With several components, place each one on its hosts in Component placement (Suggest placement proposes a placement that respects the cardinalities).

4. Bind the dependencies. On the Bindings step, choose for each dependency (database, redis, litellm, opa, openfga, oidc, qdrant, clickhouse, storage, temporal, livekit, asterisk_ami, asterisk_ari, kamailio, livekit_sip, mem0, cognee, opik, otel, openbao, nats, presidio, docling, clamav, yarax) Install with the platform or Use an existing connection; an optional dependency can stay on No binding.

5. Configure. On the Configure step, review the parameters (see Configuration parameters); the required ones are rag_embedding_model, memory_embedding_model. Passwords left empty with a generated default are generated and sealed by the Manager.

6. Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.

7. Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services.

High availability

Cluster	replicas (replication)
High availability	external (external)
Failover	load balancer (load-balancer)
Replication	shared store (shared-store)
Quorum	none (none)
Discovery	database (database)
Entry point	load balancer (load-balancer)
Official documentation	https://docs.haproxy.org/3.2/configuration.html
References	https://www.postgresql.org/docs/16/high-availability.html

Prerequisites

Prerequisite	Must be highly available	Modes	Description
database	yes	ha	The replicas share their state in PostgreSQL, which must itself be highly available (Patroni cluster).
redis	yes	ha	The rate limit counters of the replicas live in Redis, which must itself be highly available (Sentinel).
clamav	yes	ha	Every upload is scanned before ingestion (enforce mode); at least two ClamAV gateways keep uploads flowing when one fails.
yarax	yes	ha	Every upload is matched against the YARA-X rules before ingestion; at least two workers keep uploads flowing when one fails.
haproxy	yes	ha	The API and portal replicas are reached through HAProxy behind a Keepalived virtual IP.

Topology per mode

Modes	Highest catalog level	Distribution	Quorum component	Fault domains	Description
standard	standalone (standalone)	single (single)	-	1	One API, one worker and one portal, no fault tolerance.
ha	ha (ha)	active-active (active-active)	-	3	Stateless API and portal replicas behind HAProxy; the worker runs active-passive through a PostgreSQL advisory lock.

Notes

• The replicas hold no local state; the high availability of the platform is bounded by the one of PostgreSQL, Redis and the scanners.

Configuration parameters

General

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
Environment (environment)	enum	prod	dev, test, staging, prod	no	no	no	dev, test, staging or prod; prod refuses unsafe settings at startup. (EAI_ENVIRONMENT)
Default language (default_locale)	enum	fr	en, fr	no	no	no	Language of the messages when the request does not choose one. (EAI_DEFAULT_LOCALE)
Log level (log_level)	enum	INFO	DEBUG, INFO, WARNING, ERROR	no	no	no	Verbosity of the Navin logs. (EAI_LOG_LEVEL)

Network

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
API port (api_port)	port	8080	-	no	no	yes	Listening port of the Control Plane API. (EAI_PORT)
Portal port (portal_port)	port	3000	-	no	no	yes	Listening port of the portal.
Public API URL (public_api_url)	url	https://{{ host.fqdn }}:{{ config.api_port }}	-	no	no	no	Address of the API as the browsers see it (NEXT_PUBLIC_EAI_API_URL, usually the APISIX gateway).
Public portal URL (public_portal_url)	url	https://{{ host.fqdn }}:{{ config.portal_port }}	-	no	no	no	Address of the portal (NEXT_PUBLIC_BASE_URL and default CORS origin).
CORS origins (cors_origins)	list	[]	-	no	no	no	Browser origins allowed to call the API (empty: the public portal URL). (EAI_CORS_ORIGINS)
Allowed hosts (allowed_hosts)	list	["*"]	-	no	no	no	Host header allowlist of the API. (EAI_ALLOWED_HOSTS)
Trusted proxies (trusted_proxies)	list	["127.0.0.1/32", "::1/128"]	-	no	no	no	Peers allowed to set X-Forwarded-For and X-SPIFFE-ID (APISIX and HAProxy hosts). (EAI_TRUSTED_PROXIES)

Database

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
Pool minimum (db_pool_min)	int	1	min 0	no	no	no	Minimum PostgreSQL connections per process. (EAI_DB_POOL_MIN)
Pool maximum (db_pool_max)	int	10	min 1, max 500	no	no	no	Maximum PostgreSQL connections per process. (EAI_DB_POOL_MAX)

Security

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
TLS (tls_enabled)	bool	false	-	no	no	yes	Serve the Control Plane API (uvicorn), the portal (HTTPS front in the portal container, Next.js standalone has no TLS listener) and the Prometheus listeners of the workers in HTTPS with the host certificate issued by the Manager CA. Chain: browser to the bank HTTPS gateway (public_portal_url and public_api_url name the gateway, which presents the certificate of the bank and trusts the Manager CA towards the hosts), gateway or HAProxy to the API and the portal in HTTPS (Manager CA), API and workers to their providers in HTTPS, rediss, tls or verify-full with the public roots plus the Manager CA. Off: plain HTTP on the hosts, behind a gateway that terminates TLS.
SPIFFE authentication (auth_spiffe)	bool	false	-	no	no	no	Accept workload identities from SPIRE (X-SPIFFE-ID from trusted proxies). (EAI_AUTH_SPIFFE)
OIDC audience (oidc_audience)	string	control-plane	-	no	no	no	Audience required in the access tokens. (EAI_OIDC_AUDIENCE)
Group synchronisation (oidc_group_sync)	bool	true	-	no	no	no	Apply the directory group mappings at each OIDC authentication. (EAI_OIDC_GROUP_SYNC)
Portal client (portal_client_id)	string	portal	-	no	no	no	OIDC public client of the portal.
Master key (master_key)	password	generated	-	no	yes	no	Encryption key of the platform secrets stored in the database. (EAI_MASTER_KEY)
Default policy decision (policy_default)	enum	deny	allow, deny	no	no	no	Decision when OPA gives no answer. (EAI_POLICY_DEFAULT)
API documentation (docs_enabled)	bool	false	-	no	no	no	Serve /docs, /redoc and /openapi.json. (EAI_DOCS_ENABLED)
Security headers (security_headers_enabled)	bool	true	-	no	no	no	Add the security headers to every answer. (EAI_SECURITY_HEADERS_ENABLED)
HSTS (hsts_enabled)	bool	true	-	no	no	no	Send Strict-Transport-Security. (EAI_HSTS_ENABLED)
HSTS lifetime (hsts_max_age_seconds)	int	31536000	min 0	no	no	no	max-age of HSTS in seconds. (EAI_HSTS_MAX_AGE_SECONDS)
Maximum body (max_body_bytes)	int	10485760	min 1024	no	no	no	Largest request body in bytes. (EAI_MAX_BODY_BYTES)
Maximum upload (max_upload_bytes)	int	104857600	min 1024	no	no	no	Largest media, document or import upload in bytes. (EAI_MAX_UPLOAD_BYTES)
JSON depth (max_json_depth)	int	64	min 4, max 1024	no	no	no	Deepest JSON nesting accepted. (EAI_MAX_JSON_DEPTH)
Rate limits (rate_limit_enabled)	bool	true	-	no	no	no	Enforce the request rate limits. (EAI_RATE_LIMIT_ENABLED)
Requests per minute (rate_limit_per_minute)	int	1200	min 1	no	no	no	Per principal, or per client IP when anonymous. (EAI_RATE_LIMIT_PER_MINUTE)
Gateway requests per minute (rate_limit_gateway_per_minute)	int	600	min 1	no	no	no	Per principal on /v1/gateway/*. (EAI_RATE_LIMIT_GATEWAY_PER_MINUTE)
Authentication failures per minute (rate_limit_auth_failures_per_minute)	int	20	min 1	no	no	no	Per client IP, then 429. (EAI_RATE_LIMIT_AUTH_FAILURES_PER_MINUTE)
JWT algorithms (jwt_algorithms)	list	["RS256", "PS256", "ES256"]	-	no	no	no	Signature algorithms accepted in the tokens. (EAI_JWT_ALGORITHMS)
JWT leeway (jwt_leeway_seconds)	int	30	min 0, max 300	no	no	no	Clock skew tolerated on token times, in seconds. (EAI_JWT_LEEWAY_SECONDS)
Private egress allowlist (egress_private_allowlist)	list	[]	-	no	no	no	Extra private destinations (host, host:port, *.suffix or CIDR); the bound LiteLLM is always added. (EAI_EGRESS_PRIVATE_ALLOWLIST)
Public egress ports (egress_allowed_ports)	list	[443]	-	no	no	no	Ports allowed for public destinations. (EAI_EGRESS_ALLOWED_PORTS)
Plain HTTP egress (egress_allow_http)	bool	false	-	no	no	no	Allow plain HTTP to public destinations (never in prod). (EAI_EGRESS_ALLOW_HTTP)
Egress DNS timeout (egress_dns_timeout_seconds)	float	3.0	min 0.1, max 60	no	no	no	Seconds allowed for the DNS check of an outbound call. (EAI_EGRESS_DNS_TIMEOUT_SECONDS)
Prompt injection mode (prompt_injection_default_mode)	enum	block	off, detect, block	no	no	no	Default of the tenants: off, detect or block. (EAI_PROMPT_INJECTION_DEFAULT_MODE)
Streaming DLP holdback (stream_dlp_holdback_chars)	int	128	min 0, max 8192	no	no	no	Characters held back at the end of a stream for the DLP. (EAI_STREAM_DLP_HOLDBACK_CHARS)
Portal idle timeout (idle_timeout_minutes)	int	30	min 1, max 1440	no	no	no	Minutes of inactivity before the portal signs out (NEXT_PUBLIC_EAI_IDLE_TIMEOUT_MINUTES).
File scan timeout (file_scan_timeout_seconds)	int	60	min 5, max 900, s	no	no	no	Timeout of one scan per engine and per instance before the next instance is tried (EAI_FILE_SCAN_TIMEOUT_SECONDS).
Largest scanned file (file_scan_max_bytes)	int	52428800	min 1024, max 4194304000	no	no	no	Platform limit of an uploaded file in bytes (EAI_FILE_SCAN_MAX_BYTES); a tenant policy can only lower it. The rendered value is the lower of this one and the StreamMaxLength of ClamAV; the archive limits of the platform (EAI_FILE_SCAN_ARCHIVE_MAX_MEMBER_BYTES, EAI_FILE_SCAN_ARCHIVE_MAX_TOTAL_BYTES) come from the MaxFileSize and MaxScanSize of ClamAV. Keep the YARA-X limit at least as high.

Models and media

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
RAG embedding model (rag_embedding_model)	string	-	-	yes	no	no	Registry model of a new knowledge base, an embedding model served through the LiteLLM gateway (local-hash-256 is refused in production). (EAI_RAG_EMBEDDING_MODEL)
Memory embedding model (memory_embedding_model)	string	-	-	yes	no	no	Embedding model of the agent memory, a registry model served through the LiteLLM gateway. (EAI_MEMORY_EMBEDDING_MODEL)
Rerank model (rag_rerank_model)	string	(empty)	-	no	no	no	Registry model with the rerank capability (empty: none). (EAI_RAG_RERANK_MODEL)
Embedding batch (embeddings_batch_size)	int	64	min 1, max 2048	no	no	no	Texts per gateway call. (EAI_EMBEDDINGS_BATCH_SIZE)
Media job kinds (media_kinds)	list	["stt", "diarization", "tts"]	-	no	no	no	One to three of stt, diarization, tts handled by the media worker (--kind).
Media stream (media_stream)	string	EAI_MULTIMODAL	-	no	no	no	NATS JetStream stream of the media jobs (--stream).

Integrations

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
OpenBao token (openbao_token)	password	-	-	no	yes	no	Token of the Control Plane in OpenBao (AppRole or periodic token, never the root token). (EAI_OPENBAO_TOKEN)
Voice worker token (voice_worker_token)	password	-	-	no	yes	no	API key of a tenant with the scope telephony:voice-worker, created in Navin Enterprise. The Manager seals it and gives it only to the livekit-agents workers (worker_token of the api endpoint); empty: the workers refuse to start.
OpenBao KV mount (openbao_kv_mount)	string	secret	-	no	no	no	Mount of the KV secrets engine. (EAI_OPENBAO_KV_MOUNT)
OpenBao Transit mount (openbao_transit_mount)	string	transit	-	no	no	no	Mount of the Transit engine. (EAI_OPENBAO_TRANSIT_MOUNT)
Audit signing key (openbao_audit_signing_key)	string	eai-audit-export	-	no	no	no	Transit key signing the WORM audit exports. (EAI_OPENBAO_AUDIT_SIGNING_KEY)
Audit signing (audit_signing)	enum	auto	auto, transit, hmac	no	no	no	auto (Transit when OpenBao is bound, else HMAC), transit or hmac. (EAI_AUDIT_SIGNING)
OpenFGA store (openfga_store_id)	string	(empty)	-	no	no	no	Store id (empty: created at the first start). (EAI_OPENFGA_STORE_ID)
OpenFGA model (openfga_model_id)	string	(empty)	-	no	no	no	Authorisation model id (empty: the latest). (EAI_OPENFGA_MODEL_ID)
Temporal namespace (temporal_namespace)	string	default	-	no	no	no	Namespace of the schedules (when Temporal is bound). (EAI_TEMPORAL_NAMESPACE)
Temporal task queue (temporal_task_queue)	string	eai	-	no	no	no	Task queue of the workflows. (EAI_TEMPORAL_TASK_QUEUE)
Opik project (opik_project)	string	navin-evaluations	-	no	no	no	Project of the evaluation traces (when Opik is bound). (OPIK_PROJECT_NAME)
Audit bucket (s3_bucket)	string	eai-audit-worm	-	no	no	no	Bucket of the WORM audit archive and of the media (object lock enabled). (EAI_S3_BUCKET)
S3 KMS key (s3_kms_key_id)	string	(empty)	-	no	no	no	Server side encryption key id (empty: bucket default). (EAI_S3_KMS_KEY_ID)
ClickHouse table (clickhouse_table)	string	eai_events	-	no	no	no	Table of the analytics export. (EAI_CLICKHOUSE_TABLE)

Observability and SIEM

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
Metrics token (metrics_token)	password	generated	-	no	yes	no	Bearer token of GET /metrics (required outside dev and test). (EAI_METRICS_TOKEN)
Traces (otel_enabled)	bool	true	-	no	no	no	Export OpenTelemetry spans (when the collector is bound). (EAI_OTEL_ENABLED)
SIEM actions (siem_forward_actions)	string	security.*,policy.*,incident.*,approval.*,secret.*,api_key.*,audit.*,dlp.*,authz.write,authz.delete,member.*,provider.disable,model.disable,agent.kill,agent.suspend,multimodal.dlp	-	no	no	no	Audit actions forwarded to the SIEM (denials and failures always are). (EAI_SIEM_FORWARD_ACTIONS)
SIEM syslog host (siem_syslog_host)	string	(empty)	-	no	no	no	Syslog receiver of the SIEM (empty: off). (EAI_SIEM_SYSLOG_HOST)
SIEM syslog port (siem_syslog_port)	port	6514	-	no	no	no	Port of the syslog receiver. (EAI_SIEM_SYSLOG_PORT)
SIEM syslog protocol (siem_syslog_proto)	enum	tls	udp, tcp, tls	no	no	no	udp, tcp or tls. (EAI_SIEM_SYSLOG_PROTO)
Worker metrics port (worker_metrics_port)	port	9464	-	no	no	no	Prometheus port of python -m eai.worker (EAI_WORKER_METRICS_PORT).
Media worker metrics port (media_worker_metrics_port)	port	9465	-	no	no	no	Prometheus port of python -m eai.media_worker (EAI_MEDIA_WORKER_METRICS_PORT).

FinOps and audit

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
Budget alert thresholds (finops_alert_thresholds)	string	50,80,100	-	no	no	no	Percent of a budget or quota raising an alert (the FinOps rules themselves are code). (EAI_FINOPS_ALERT_THRESHOLDS)
WORM retention (audit_worm_retention_days)	int	365	min 1	no	no	no	Days the WORM audit exports are kept. (EAI_AUDIT_WORM_RETENTION_DAYS)

Background tuning

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
Worker tick (worker_tick_seconds)	float	5.0	min 0.0	no	no	no	Seconds between two scheduler passes. (EAI_WORKER_TICK_SECONDS) (advanced)
Scheduler interval (worker_scheduler_interval_seconds)	int	30	min 0	no	no	no	Seconds between scheduler runs. (EAI_WORKER_SCHEDULER_INTERVAL_SECONDS) (advanced)
Outbox interval (worker_outbox_interval_seconds)	int	10	min 0	no	no	no	Seconds between outbox drains. (EAI_WORKER_OUTBOX_INTERVAL_SECONDS) (advanced)
Quota expiry interval (worker_quota_expiry_interval_seconds)	int	60	min 0	no	no	no	Seconds between quota expiry runs. (EAI_WORKER_QUOTA_EXPIRY_INTERVAL_SECONDS) (advanced)
Heartbeat interval (worker_heartbeat_interval_seconds)	int	60	min 0	no	no	no	Seconds between heartbeat checks. (EAI_WORKER_HEARTBEAT_INTERVAL_SECONDS) (advanced)
Heartbeat timeout (worker_heartbeat_timeout_seconds)	int	1800	min 0	no	no	no	Seconds without heartbeat before an agent is stale. (EAI_WORKER_HEARTBEAT_TIMEOUT_SECONDS) (advanced)
Approval expiry interval (worker_approval_expiry_interval_seconds)	int	60	min 0	no	no	no	Seconds between approval expiry runs. (EAI_WORKER_APPROVAL_EXPIRY_INTERVAL_SECONDS) (advanced)
Retention interval (worker_retention_interval_seconds)	int	86400	min 0	no	no	no	Seconds between retention runs. (EAI_WORKER_RETENTION_INTERVAL_SECONDS) (advanced)
Worker batch (worker_batch_size)	int	100	min 0	no	no	no	Rows per worker batch. (EAI_WORKER_BATCH_SIZE) (advanced)
Audit chain check (worker_verify_chain_interval_seconds)	int	3600	min 0	no	no	no	Seconds between audit chain verifications. (EAI_WORKER_VERIFY_CHAIN_INTERVAL_SECONDS) (advanced)
Gauges interval (worker_gauges_interval_seconds)	int	30	min 0	no	no	no	Seconds between gauge refreshes. (EAI_WORKER_GAUGES_INTERVAL_SECONDS) (advanced)
Reindex interval (worker_embeddings_reindex_interval_seconds)	int	60	min 0	no	no	no	Seconds between reindex runs. (EAI_WORKER_EMBEDDINGS_REINDEX_INTERVAL_SECONDS) (advanced)
Media requeue (worker_media_requeue_seconds)	int	60	min 0	no	no	no	Seconds between media requeue runs. (EAI_WORKER_MEDIA_REQUEUE_SECONDS) (advanced)
Analytics export interval (worker_analytics_export_seconds)	int	60	min 0	no	no	no	Seconds between analytics exports. (EAI_WORKER_ANALYTICS_EXPORT_SECONDS) (advanced)
Analytics batch (analytics_export_batch)	int	5000	min 0	no	no	no	Rows per ClickHouse insert. (EAI_ANALYTICS_EXPORT_BATCH) (advanced)
Analytics batches per run (analytics_export_max_batches)	int	20	min 0	no	no	no	Inserts per source and per run. (EAI_ANALYTICS_EXPORT_MAX_BATCHES) (advanced)
Analytics lag (analytics_export_lag_seconds)	float	5.0	min 0.0	no	no	no	Rows younger than this wait for the next run. (EAI_ANALYTICS_EXPORT_LAG_SECONDS) (advanced)
SIEM forward interval (worker_siem_forward_seconds)	int	30	min 0	no	no	no	Seconds between SIEM forwards. (EAI_WORKER_SIEM_FORWARD_SECONDS) (advanced)
SIEM batch (siem_forward_batch)	int	500	min 0	no	no	no	Audit events per tenant and per run. (EAI_SIEM_FORWARD_BATCH) (advanced)
WORM export interval (worker_audit_worm_seconds)	int	3600	min 0	no	no	no	Seconds between WORM exports. (EAI_WORKER_AUDIT_WORM_SECONDS) (advanced)
Media job lease (media_job_lease_seconds)	int	900	min 0	no	no	no	A running job older than this is requeued. (EAI_MEDIA_JOB_LEASE_SECONDS) (advanced)
Media job attempts (media_job_max_attempts)	int	3	min 0	no	no	no	Claims before a job fails. (EAI_MEDIA_JOB_MAX_ATTEMPTS) (advanced)
Media poll (media_worker_poll_seconds)	float	2.0	min 0.0	no	no	no	Database polling interval without NATS. (EAI_MEDIA_WORKER_POLL_SECONDS) (advanced)
Media heartbeat (media_worker_heartbeat_seconds)	float	60.0	min 0.0	no	no	no	updated_at refresh while a job runs. (EAI_MEDIA_WORKER_HEARTBEAT_SECONDS) (advanced)
Realtime token lifetime (realtime_ws_token_ttl_seconds)	int	300	min 0	no	no	no	Lifetime of a single use ws_token. (EAI_REALTIME_WS_TOKEN_TTL_SECONDS) (advanced)
Realtime message size (realtime_ws_max_message_bytes)	int	1048576	min 0	no	no	no	Largest WebSocket message. (EAI_REALTIME_WS_MAX_MESSAGE_BYTES) (advanced)
Realtime event rate (realtime_ws_max_events_per_second)	float	50.0	min 0.0	no	no	no	Sustained client event rate. (EAI_REALTIME_WS_MAX_EVENTS_PER_SECOND) (advanced)
Realtime burst (realtime_ws_burst)	int	100	min 0	no	no	no	Client events allowed in a burst. (EAI_REALTIME_WS_BURST) (advanced)
Realtime session length (realtime_ws_max_session_seconds)	int	3600	min 0	no	no	no	Connection duration limit. (EAI_REALTIME_WS_MAX_SESSION_SECONDS) (advanced)
Realtime idle timeout (realtime_ws_idle_timeout_seconds)	int	120	min 0	no	no	no	Idle time before closing. (EAI_REALTIME_WS_IDLE_TIMEOUT_SECONDS) (advanced)

Dependencies

For each active dependency the Manager takes the first of: the binding chosen in the wizard; a service of the same installation that provides it; a service already installed in the cluster; the only connection of the expected type. Otherwise an optional dependency stays unbound, and a required one is added to the installation in its default mode (the column below names the catalog service added).

Binding	Provided by	Connection type	Endpoint	Optional	When nothing is bound	Description
database	postgresql	postgresql	sql	no	postgresql is added to the installation	Database of the platform (schema eai).
redis	redis	redis	redis	no	redis is added to the installation	Rate limit counters shared by the replicas (rediss with an ACL user in production).
litellm	litellm	-	admin	no	litellm is added to the installation	Model gateway: every model call goes through LiteLLM.
opa	opa	-	api	no	opa is added to the installation	Policy decision point of the gateways.
openfga	openfga	-	http	no	openfga is added to the installation	Relationship based authorisation.
oidc	keycloak	oidc	http	no	keycloak is added to the installation	OpenID Connect provider of the users (Keycloak, or LemonLDAP::NG when it is installed instead, or any OIDC provider declared as a connection).
qdrant	qdrant	qdrant	http	no	qdrant is added to the installation	Vector store of the knowledge bases and of the memory.
clickhouse	clickhouse	clickhouse	http	no	clickhouse is added to the installation	Analytics store (export of usage and costs) and real-time telemetry of the machines and services (database navin_manager).
storage	seaweedfs	s3	s3	no	seaweedfs is added to the installation	Object storage of the platform (SeaweedFS by default): media, files and the WORM audit archive.
temporal	temporal	-	http	yes	stays unbound (optional)	Durable schedules and workflows.
livekit	livekit	-	signal	yes	stays unbound (optional)	Realtime voice and video.
asterisk_ami	asterisk	-	ami	yes	stays unbound (optional)	Asterisk Manager Interface of the PBX pool: user name and secret used to deliver the managed files and read the events.
asterisk_ari	asterisk	-	ari	yes	stays unbound (optional)	Asterisk REST Interface of the PBX pool: user name and password of the call control and of the recordings.
kamailio	kamailio	-	sip	yes	stays unbound (optional)	SIP edge: addresses of the Kamailio instances and, once Kamailio declares it on this endpoint, the auth_ephemeral shared secret of the softphone credentials.
livekit_sip	livekit-sip	-	sip	yes	stays unbound (optional)	LiveKit SIP gateway reached by the AI branch of the PBX pools.
mem0	mem0	-	api	yes	stays unbound (optional)	Mem0 server: persistent facts and memories of the agents, reached with the admin API key of the instance.
cognee	cognee	-	api	yes	stays unbound (optional)	Cognee API: knowledge graph and relations of the agents, reached with the service API key.
opik	opik	-	api	yes	stays unbound (optional)	Evaluation tracking (ragas results).
otel	otel-collector	-	otlp_http	yes	stays unbound (optional)	OpenTelemetry traces over OTLP HTTP.
openbao	openbao	-	api	yes	stays unbound (optional)	Secrets (KV) and audit signing (Transit).
nats	nats	nats	client	yes	stays unbound (optional)	Agent events and media job notices (JetStream).
presidio	presidio	-	analyzer	yes	stays unbound (optional)	PII detection of the DLP.
docling	docling	-	api	yes	stays unbound (optional)	Document conversion of the ingestion.
clamav	clamav	-	api	no	clamav is added to the installation	ClamAV gateways that scan every uploaded file before ingestion (enforce mode, all instances).
yarax	yara-x	-	api	no	yara-x is added to the installation	YARA-X workers that match every uploaded file against the rules before ingestion (enforce mode, all instances).

Endpoints

Endpoint	Scheme	Component	Port	Path	TLS parameter	Binding parameters	Binding secrets	Provisioning command
api	http	control-plane	8080 (api_port)	-	tls_enabled	-	worker_token	-
portal	http	portal	3000 (portal_port)	-	tls_enabled	-	-	-

Commands

Command	Component	Target	Description
Apply the migrations (migrate)	migrate	first host	Runs python -m eai.migrate (also run before every start by the migrate component).
API logs (logs)	control-plane	chosen host	Last lines of the API journal.
Worker logs (worker_logs)	worker	chosen host	Last lines of the worker journal.

Health checks

Liveness (per instance)

Component	Check	Details
control-plane	HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn if config.tls_enabled else (host.ip or '127.0.0.1') }}:{{ config.api_port }}/healthz	Expected 200; 60 retries; interval 2 s; timeout 5 s
worker	HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn if config.tls_enabled else (host.ip or '127.0.0.1') }}:{{ config.worker_metrics_port }}/metrics	Expected 200; 60 retries; interval 2 s; timeout 5 s
media-worker	HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn if config.tls_enabled else (host.ip or '127.0.0.1') }}:{{ config.media_worker_metrics_port }}/metrics	Expected 200; 60 retries; interval 2 s; timeout 5 s
portal	HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn if config.tls_enabled else (host.ip or '127.0.0.1') }}:{{ config.portal_port }}/	Expected 200; 60 retries; interval 2 s; timeout 5 s

Readiness (service check)

Check	Details
HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn if config.tls_enabled else (host.ip or '127.0.0.1') }}:{{ config.api_port }}/readyz	Expected 200; 10 retries; interval 3 s; timeout 5 s

Preflight checks

Check	Type	Meaning	Severity	Components
memory	memory_mb {"min": 4096}	at least 4096 MB of memory	blocking	every component
api_port_free	port_free {"param": "api_port"}	port 8080 free on the host	blocking	control-plane
portal_port_free	port_free {"param": "portal_port"}	port 3000 free on the host	blocking	portal
gpu	gpu {"min_count": 1}	at least 1 NVIDIA GPU with 0 MB of memory	blocking	media-worker
time_sync	time_sync {}	a synchronized clock	warning	every component

Uninstall

Paths removed when the data is purged: {{ paths.data }}, {{ paths.log }}.

Quick links

• Portal: {{ config.public_portal_url }}
• API health: {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn }}:{{ config.api_port }}/healthz

Upstream documentation

• Homepage: https://navin.ai
• Source: https://github.com/navin-ai/navin-enterprise-ai
• High availability: https://docs.haproxy.org/3.2/configuration.html
• High availability: https://www.postgresql.org/docs/16/high-availability.html