Enterprise-grade RAG platform: Workspace-scoped knowledge, hybrid Dense + Sparse + Graph retrieval, 2-stage Flowable BPMN document approval, and embedded Lakehouse DuckDB analytics — 100% on your own infrastructure.
Select a business scenario to inspect:
No citation selected
Click on [S1] or [S2] inside the answer to view source excerpt and confidence.
cp .env.production.example .env.productionchmod 600 .env.production# Configure TOKEN_KEY secret & database credentials...docker compose -f docker-compose.prod.yml --env-file .env.production up -d --build# APISIX edge gateway ready at :8088 → Open /setupCore Solutions
No vague claims: Concrete technical mechanisms running in the repo, fully verifiable in architectural docs.
OpenVie synthesizes answers strictly grounded in your workspace knowledge base, marking exact citations [S1] down to document snippets. When no supporting evidence is found, it triggers intelligent abstention rather than speculating.
All models run locally via Ollama (chat Vylinh ~3B; embedding BGE-M3). The platform self-hosts completely on your private servers or VPC, with zero bytes of confidential data leaking to external clouds.
Integrated embedded Flowable BPMN engine enforces a 2-stage approval workflow: stage 1 WORKSPACE_ADMIN, stage 2 ORG_OWNER. Features automated SLAs, anti-self-approval rules, and an immutable audit trail.
Architecture & Data Plane
Microservice-ready architecture cleanly separating control plane, data plane, and AI inference plane.
RESTful HTTP JSON, SSE StreamingCore business state manager, 3-role multi-tenant RBAC, secure chat sessions, M2M ovk_ API keys, and HMAC-signed Webhook emitter.
Authoritative owner of PostgreSQL OLTP
✓ Strictly follows Single Source of Truth principles, preventing state contention.
Manages business state, multi-tenant RBAC, secure chat sessions, and Flowable BPMN workflow execution on PostgreSQL.
Powers multi-stage retrieval (Qdrant Vector + Kùzu Graph) and local LLM inference, strictly decoupled from core business state.
Stores raw original files and partitions Snappy Parquet Lakehouse files by tenant/year/month.
Executes analytical OLAP queries directly against Parquet data at blazing speeds without impacting PostgreSQL OLTP.
Architecture specifications grounded in docs/ARCHITECTURE.md §1 §3
Platform Capabilities
Optimized specifically for Vietnamese and engineered to satisfy strict private infrastructure requirements.
Interactive Q&A over workspace knowledge bases via low-latency SSE streaming. Every answer links verifiable citations and automatically abstains when facts are missing.
Fuses the power of BGE-M3 vector embeddings, BM25 keyword matching, and Kùzu Knowledge Graph. Rewrites conversational follow-ups and merges rankings via RRF.
Asynchronous ingestion of PDF, DOCX, TXT, MD, HTML, XLSX, CSV with SHA-256 deduplication. Activate optional OCR for scanned docs and ASR for audio/video on demand.
Embedded Flowable BPMN engine in the primary API runtime. Document lifecycle management with automated SLAs (24h reminder / 48h escalation) and anti-self-approval enforcement.
Keycloak OIDC SSO (PKCE S256) or password/JWT. IdP roles map directly to 3 RBAC tiers: ORG_OWNER, WORKSPACE_ADMIN, MEMBER. Issues machine-to-machine (M2M) ovk_ API keys.
Real-time CDC via RabbitMQ writes Snappy-compressed Parquet on SeaweedFS S3. Embedded DuckDB runs complex analytical SQL queries without slowing down primary databases.
100% of capabilities exposed over standard RESTful endpoints at /api/v1/**. HMAC-SHA256-signed webhooks notify external systems with an outbox-backed retry mechanism.
Apache APISIX edge gateway enforces route-based rate limits and security headers. ClamAV scans byte streams INSTREAM, quarantining malware at the perimeter before storage.
Security & Sovereignty
Engineered to satisfy the stringent requirements of enterprise IT, regulated industries, and sovereign institutions:
Document scanned by ClamAV malware quarantine and assigned PENDING_STAGE1 status.
Workspace Admin vets document content. Anti-self-approval rule prevents author from self-approving.
Organization Owner issues the final verdict. Decision is signed into an immutable audit log.
Status changes to APPROVED, RabbitMQ triggers CDC to Lakehouse, activating vector & graph indexing.
All data, search indexes, and language models operate entirely within your private perimeter, preventing confidential data leaks.
Enforced tenant_id filtering across every tier: PostgreSQL records, Qdrant vector spaces, and Kùzu graph partitions.
Immutable logs for all approvals, queries, and uploads anchored by SHA-256 hashes and uploader provenance.
ClamAV inspects uploaded byte streams INSTREAM, isolating malware before document parsing and ingestion queues.
Automated backup.sh and restore.sh scripts verified against SHA-256 manifests for rapid disaster recovery drills.
Strict role enforcement across Organization Owners, Workspace Admins, and regular Members.
OpenVie puts complete technological control into your engineering team's hands: full authority over data retention policies, network zoning, TLS certificates, and identity integration.
API & Integration
OpenVie's core is headless: All capabilities are accessible via HTTP JSON at /api/v1/**, ready for seamless integration into existing DMS, ERP, or portal architectures.
curl -X POST "$BASE/api/v1/admin/api-keys" \ -H "Authorization: Bearer $ACCESS_TOKEN" -H 'Content-Type: application/json' \ -d '{"name":"DMS-Bridge","workspaceId":"<workspace-uuid>","role":"MEMBER"}'# → Returns 201 Created with secret key ovk_... (revealed once)curl -X POST "$BASE/api/v1/chat/sessions/$SESSION_ID/messages" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H 'Content-Type: application/json' -H 'Accept: application/json' \ -d '{"content":"Summarize this security policy document","documentIds":["<doc-uuid>"]}'curl -X POST "$BASE/api/v1/admin/webhook-endpoints" \ -H "Authorization: Bearer $ACCESS_TOKEN" -H 'Content-Type: application/json' \ -d '{"name":"DMS-Webhook","url":"https://dms.example.com/hooks","events":["document.status.changed","workflow.approved"]}'# → 201 Created with signing secret whsec_... for payload verificationdocument.status.changedworkflow.startedworkflow.approvedworkflow.rejectedworkflow.escalatedwebhook.testStandard JSON envelope: { id, type, occurred_at, workspace_id, data } with an Outbox pattern for guaranteed delivery and Idempotency-Key deduplication.
Standards & Guarantees
Open, transparent architecture delivering complete technological sovereignty to your engineering team.
“Engineered for organizations where data sovereignty is paramount: Transparent, independent, fully auditable, and completely free from cloud vendor lock-in.”
Extended capabilities such as OCR scanning, ASR speech-to-text, TEI reranker, and monitoring are designed as optional modules — consuming server resources only when explicitly enabled.
Quick Deployment
Ready for on-premise hardware, private VPS, or VPC clusters with a single Docker Compose command.
Create .env.production from the template, lock permissions to chmod 600, and generate high-entropy 32-byte secret tokens:
cp .env.production.example .env.productionchmod 600 .env.production# Generate cryptographically secure tokens:openssl rand -hex 32Validate the configuration and launch all containers with a single command:
docker compose -f docker-compose.prod.yml --env-file .env.production config --quietdocker compose -f docker-compose.prod.yml --env-file .env.production up -d --buildAccess the APISIX gateway at /setup to create your initial Organization Owner (ORG_OWNER) account:
# Open your browser: http://your-domain:8088/setup# CLI tool available for offline owner recovery if ever needed:make -C api recover-owner ENV_FILE=../.env.productionollama pull bge-m3ollama pull hf.co/QuantFactory/Arcee-VyLinh-GGUF:Q4_K_Mollama cp hf.co/QuantFactory/Arcee-VyLinh-GGUF:Q4_K_M vylinhWe assist enterprises and public institutions with sovereign on-premise & private cloud RAG deployment. Contact our engineering team directly on Facebook.
Release Milestones
Four major milestones delivered with strict acceptance criteria verified in the repo:
Self-hosted RAG Foundation: Spring Boot + FastAPI + Next.js, APISIX gateway, PostgreSQL/SeaweedFS/Qdrant/Kùzu, cited chat, and intelligent abstention.
Enterprise Identity: Keycloak OIDC SSO, Spring Resource Server, 3-tier RBAC mapping (Owner/Admin/Member), and multi-factor authentication support.
BPMN Approval & Multimodal Citations: Embedded Flowable OSS engine for 2-level e-Office workflow, approval inbox, multimodal image citations, and SHA-256 backup.
Lakehouse & DuckDB OLAP: RabbitMQ CDC streaming to Snappy Parquet on SeaweedFS S3, embedded DuckDB executing instant SQL analytics without OLTP locking.
Open Source & License
OpenVie is a pure open-source project delivering complete technological sovereignty to enterprise engineering teams.
Your organization has full access to inspect every line of code, adapt internal workflows, customize the interface, and deploy on air-gapped infrastructure with zero licensing hurdles.
Review the architecture — Launch in one command — Retain 100% control over internal knowledge.
Need technical guidance & deployment consultation? Contact on Facebook →