> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> The services, ports and data stores that make up a self-hosted Cymph deployment.

A self-hosted Cymph deployment is a single Docker Compose project named `cymph`. Everything it needs runs on one host — there are no external dependencies apart from the integrations you configure and, optionally, an AI provider.

## Services

| Service         | Image                       | Role                                                                                                                                                           |
| --------------- | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `nginx`         | `nginx:1.27-alpine`         | Terminates TLS and reverse-proxies to the application. The only service that needs to be reachable from outside the host.                                      |
| `ui`            | `cymph/ui:latest`           | The web application, served on port 3000 inside the network as `cymph-ui`.                                                                                     |
| `api`           | `cymph/api:latest`          | The application API on port 5050, as `cymph-api`. Holds the license, integration configuration and playbook data.                                              |
| `embedding-api` | `text-embeddings-inference` | Generates the vector embeddings behind semantic search, on port 8090. Runs the `all-MiniLM-L6-v2` model locally — no content leaves the deployment for search. |
| `db`            | `pgvector/pgvector:pg16`    | PostgreSQL 16 with the `pgvector` extension, as `cymph-db`. The single data store for the deployment.                                                          |

`ui`, `api` and `db` each declare a healthcheck, and Compose starts them in dependency order — `db` before `api`, `api` before `ui`, `ui` before `nginx`.

Users reach the deployment through nginx, on the address and port you choose during [installation](/deployment/self-hosted/installation). Uploads are capped at 20MB.

<Note>
  `ui`, `api`, `embedding-api` and `db` are reachable only on the internal Docker network — none of them is published on the host. The single published port is nginx's, which means every request reaching the application has passed through TLS termination. See [Networking](/deployment/networking).
</Note>

## Data and volumes

Four Docker volumes hold everything that survives a container restart:

| Volume                 | Contents                                                                                                                           |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| `cymph_db-data`        | The PostgreSQL data directory — playbooks, executions, users, organisations, workspaces, integration configuration and audit logs. |
| `cymph_api-data`       | Mounted at `/var/opt/cymph` in the API container: application logs, static files and data files.                                   |
| `cymph_log-data`       | nginx access and error logs.                                                                                                       |
| `cymph_embedding-data` | The cached embedding model.                                                                                                        |

These are what you snapshot — see [Backup & restore](/deployment/self-hosted/backup-restore).

## Secrets generated at setup

`env.sh` generates the deployment's secrets on first run and writes them to `.env` and `db/secrets.txt`:

* `NEXTAUTH_SECRET` / `CYMPH_AUTH_SECRET` — session token signing
* `CYMPH_SESSION_SECRET` — session state
* `CYMPH_ENCRYPTION_KEY` and `CYMPH_ENCRYPTION_IV` — encryption of sensitive integration data at rest
* A Fernet key in `db/secrets.txt`, passed to the database container as a Compose secret

<Warning>
  These values are generated once and are not recoverable. If you lose `.env` or `db/secrets.txt`, encrypted data in the database cannot be decrypted — back them up alongside the volumes.
</Warning>

## Outbound connections

The `api` service makes outbound connections to the endpoints your integrations point at, and to your AI provider if you enable one. Search embeddings are computed locally by `embedding-api`, so no content leaves the deployment for search, and product analytics is disabled in the on-prem configuration (`NEXT_PUBLIC_AMPLITUDE_ENABLED=false`).

See [Networking](/deployment/networking) for allowlisting, and [AI & data usage](/security/ai-data-usage) for what an enabled AI provider receives.