Deployment profiles¶

CVDLink is installed in one of two profiles. The profile determines how each component is configured and must be decided before installation begins, because changing it later requires reconfiguring every component.

Central deployment¶

Components connect to shared infrastructure operated by the project. The database and message broker run on a dedicated data host, and authentication is handled by Keycloak.

This profile is used for the project's development, integration, and production environments. It requires network access to the shared hosts.

Characteristics:

• PostgreSQL runs on the data host and is shared between components and sites
• The database image includes the pgvector extension, enabling the assistant features
• Authentication uses Keycloak; user roles are enforced
• A shared MQTT broker carries node status events
• Several sites may connect to the same infrastructure

Standalone deployment¶

Every component runs on a single machine with no external dependencies. The database is installed alongside the applications and restored from a supplied dump, and authentication is handled locally.

This profile is used by partner institutions, for offline demonstrations, and for evaluation installations. It requires no network access once the images are available locally.

Characteristics:

• PostgreSQL is installed as part of the deployment and holds all data locally
• Authentication uses local accounts with self-registration; role restrictions are not applied
• No Keycloak and no shared broker
• The installation is self-contained and functions without network connectivity

Configuration differences¶

The following values differ between profiles. Each installation page states the correct value for both.

Setting	Central	Standalone
OFFLINE_MODE	false	true
DB_HOST	Address of the data host	host.docker.internal
DB_PORT	5432	5444
MESH_MQTT_ENABLED	true	false
MESH_MQTT_BROKER_URL	Address of the data host	Not used
Keycloak settings	Required	Not used
Sign-in route	Redirect to Keycloak	/auth/login/
Registration	Managed in Keycloak	/auth/register/

The two database ports are not interchangeable. They correspond to two different PostgreSQL instances serving different purposes, described in Hosts and ports.

Access control¶

This difference has operational consequences and should be understood before choosing the standalone profile.

In a central deployment, access to data management and administrative functions is restricted to users holding the appropriate role, as issued by Keycloak. In a standalone deployment, role checks are bypassed and every authenticated user has access to all functions, including administrative pages.

Where a standalone installation holds sensitive data, access must therefore be controlled by other means: restricting network access to the machine, controlling who may create accounts, or placing the application behind an authenticating reverse proxy.

Assistant features¶

The assistant features require the vector PostgreSQL extension and a local model runtime.

The extension is provided by the pgvector/pgvector:pg17 image, which both profiles use, so the database side of the requirement is met in either case. The model runtime is a separate requirement and is not part of a standalone installation by default; where the assistant features are needed, it must be installed and reachable at the address given in OLLAMA_BASE_URL.