Requirements and network
Host size, Docker version, Elasticsearch version, LLM endpoint, hostname, and the inbound and outbound ports to open.
Delivery form
RST AI Copilot for Elastic ships as Docker containers only: the gateway, a Caddy reverse proxy that terminates TLS, and a Postgres that holds user accounts. Elasticsearch is not included. The gateway connects to your existing Elasticsearch 8.x and Kibana, reads logs and alerts, and writes only its own indices such as .rst_copilot_*. For a PoC or a host without ELK, you can choose bundled Elasticsearch and Kibana at install time; see Installing from the archive.
Host
| Item | Requirement |
|---|---|
| Operating system | Ubuntu 20.04, 22.04, 24.04, or equivalent Linux (Debian, RHEL family) |
| Size | At least 2 vCPU, 4 GB RAM, 20 GB disk. The gateway container is capped at 2 CPU and 2 GB by default (RST_GATEWAY_CPUS, RST_GATEWAY_MEM) |
| Runtime | Docker Engine 24 or later, Docker Compose v2 |
| Access | Run deploy.sh with sudo or as a member of the docker group |
A local embedding model for an air-gapped knowledge base adds about 3 GB RAM for Ollama and bge-m3. No GPU is required.
With bundled Elasticsearch and Kibana, both containers run on the gateway host, and Elasticsearch uses a 1 GB heap (ES_JAVA_OPTS=-Xms1g -Xmx1g).
Elasticsearch
| Item | Requirement |
|---|---|
| Version | 8.x and 9.x, verified on 8.12 and 9.5. 7.x is not supported |
| Network | The gateway host reaches Elasticsearch on 9200 or 9243. For HTTPS with a private CA, place the CA certificate under ./certs/ |
| Account | A dedicated user; see Elasticsearch permissions |
| Kibana | Optional. Used for Open in Kibana links and webhook alert push |
LLM
Any OpenAI-compatible endpoint works, such as Volcengine Ark, DeepSeek, Qwen, Azure OpenAI, self-hosted vLLM, or Ollama. You need the URL, an API key, and a model name. Air-gapped sites use a local model with the air-gapped masking mode. You can add failover providers after installation in AI settings.
Hostname
CADDY_SITE_ADDRESS must be a hostname such as copilot.corp.local. An IP literal is not a valid TLS SNI and some browsers refuse the handshake. Without internal DNS, add a hosts entry on analyst workstations.
Ports
Inbound to the gateway host:
| Port | From | Purpose |
|---|---|---|
| 443/TCP | Analyst network | https://<hostname>/v2/, the only entry point |
| 80/TCP | Analyst network | HTTP to HTTPS redirect, optional |
The gateway's port 8000 stays on the compose-internal network. On cloud hosts, also open 443 in the security group.
Outbound from the gateway host:
| Target | Port | Purpose | Required |
|---|---|---|---|
| LLM endpoint | 443 | Inference and embeddings | Yes; an internal address for local models |
| Elasticsearch | 9200 or 9243 | Queries, audit, knowledge base | Yes |
| Kibana | 5601 | Deep links | Optional |
license.reallysec.com | 443 | Activation, heartbeat, online update | Only for an online-activated commercial license. Unactivated installs and offline licenses never connect |
| Feishu, DingTalk, WeCom, Teams, Slack, SMTP | 443, 465, 587 | Outbound channels | Optional |
Editions
Compare the Community, Professional, and Enterprise editions and see which one fits.
Installing from the archive
The install script and air-gapped installation, the archive and its contents, the deploy.sh steps and prompts, bundled Elasticsearch and Kibana, the user account table, manual installation, and post-install checks.