Nexary

Hybrid RAG and auditable AI collaboration for customer-controlled networks.

Quickstart · Architecture · Screenshots · Documentation

platform.mp4

An on-premise AI platform export for multi-provider chat, document retrieval and auditable operations. Provider egress is optional configuration; the deployment keeps application data in customer-controlled infrastructure.

Why this exists

Regulated teams need to inspect where data goes, retrieve exact identifiers as well as concepts, and export activity to existing operations tooling.

Control	Retrieve	Operate
Customer-network deployment and SSO	Dense retrieval + BM25 + reranking	Audit events and SYSLOG export
Docker Compose, PostgreSQL and MinIO	Qdrant and PostgreSQL full text	Health endpoints and runbooks

Status: public portfolio export. The production Linux deployment was previously verified; this export has not been re-verified as a fresh end-to-end private-cloud install. The OCR service is separate, and no customer data or credentials are included.

Quickstart

The private-cloud stack requires Docker and the services in the installation guide.

cp .env.example .env
docker compose -f docker-compose.private-cloud.yml up -d --build

On PowerShell, use Copy-Item .env.example .env. Configure values in .env; do not commit them.

Variable group	Purpose
Provider, PostgreSQL, Qdrant, MinIO and Redis settings	Private-cloud service connections
Auth settings	Application identity configuration

This is a deployment wiring guide, not a verified one-command laptop stack. UI-only work uses bun install && bun run dev with reachable PostgreSQL.

Architecture

flowchart LR
    USER[Browser] --> EDGE[nginx TLS edge]
    EDGE --> APP[Next.js application]
    APP --> AUTH[Stack Auth and SSO]
    APP --> RAG[Ingestion and hybrid RAG]
    RAG --> PG[(PostgreSQL BM25)]
    RAG --> QD[(Qdrant vectors)]
    RAG --> OBJ[MinIO originals]
    APP --> AUDIT[Audit and SYSLOG]
    APP -.->|optional egress| LLM[Configured AI provider]

Loading

Retrieval fuses lexical and vector candidates before reranking; originals, metadata and vectors stay in separate stores. Architecture and boundaries ->

Screenshots

Landing surface	Registration flow

These captures show the exported UI, not a fresh deployment verification.

Engineering decisions

Decision	Benefit	Tradeoff
Qdrant + PostgreSQL BM25	Exact identifiers and semantic matches both contribute	Two retrieval paths must be operated and evaluated
Provider abstraction	Deployments can choose allowed providers	Egress and provider behavior need per-deployment controls
Private-cloud topology	Customer controls data stores and network boundaries	More services than a hosted SaaS
SYSLOG audit export	Fits existing SIEM operations	Not an independent compliance audit

What I'd do differently

• Build an evaluation set before retrieval features. Exact-identifier failures established that dense-only retrieval was insufficient.
• Enforce secret handling from the first build. Configuration must remain environment-only and reviewable.
• Separate demonstration material sooner. Session summaries obscured operator documentation until this public export was reorganized.

Marketing site

The trilingual marketing frontend (German, English, Spanish — Next.js 15, next-intl, light/dark themes, WCAG-conscious) lives in marketing/. It is a separate Next.js application:

cd marketing
npm ci
npm run dev        # localhost:3000/de · /en · /es

See marketing/README.md and marketing/docs/ for its architecture and decisions.

Documentation index · Demo script · Compliance guides · Runbooks

---

Built by Youssef Ouhaghi Ahmian · Mokka · GitHub Released under the MIT license.