Pragatix Private AI — System Requirements
Parameter | Value |
|---|---|
Users supported | 3,000 licensed / ~100 concurrent |
Topology | Hybrid — on-prem + AWS Israel VPC + AWS Bedrock (EU) |
Connectivity | AWS Direct Connect (on-prem ⇄ il-central-1 VPC) |
Bedrock region | eu-west-1 (Ireland) |
Architecture overview — Pragatix Private AI Hybrid Deployment
1. Component Summary
# | Component | Location | OS | Role |
|---|---|---|---|---|
1 | Gateway | On-prem | Ubuntu 22.04 LTS | API, orchestration, Docker host |
2 | Dashboard / Ingestor | On-prem | Windows Server 2019+ | Admin UI, ingestion, IIS |
3 | Database Server | On-prem | Windows Server 2019+ | MS SQL Standard + PostgreSQL (pgvector) |
4 | Bridge / Reverse Proxy | AWS il-central-1 | Ubuntu 22.04 LTS | NGINX reverse proxy to Bedrock (EU) |
5 | Embedding Server | AWS il-central-1 | Ubuntu 22.04 LTS | GPU document embedding |
6 | LLM | AWS Bedrock eu-west-1 | Managed service | Foundation model inference |
2. On-Premises Server Specifications
2.1 Gateway (Linux)
CPU | 16 cores — Intel Xeon / AMD EPYC |
|---|---|
Memory | 32 GB DDR4+ |
Storage | 256 GB NVMe SSD (R/W ≥ 100 MB/s) |
OS | Ubuntu Server 22.04 LTS |
Container runtime | Docker CE 27.3.1+ |
Network | 1 Gbps NIC; routed to on-prem edge for Direct Connect |
GPU | Not required |
2.2 Dashboard / Ingestor (Windows)
CPU | 16 cores — Intel Xeon / AMD EPYC |
|---|---|
Memory | 32 GB DDR4+ |
Storage | 256 GB NVMe SSD |
OS | Windows Server 2019 or newer |
Roles / features | IIS (installed by Pragatix installer), .NET prerequisites |
Domain | Active Directory domain-joined |
Network | 1 Gbps NIC |
2.3 Database Server
CPU | 16 cores — Intel Xeon / AMD EPYC |
|---|---|
Memory | 32–64 GB DDR4+ |
Storage | 4 TB NVMe SSD |
OS | Windows Server 2019+ (MS SQL); Postgres in Docker container |
Database engines | MS SQL Server Standard 2019+ · PostgreSQL 15+ with pgvector |
Backup | Daily snapshots + transaction log backup |
3. AWS Cloud Components
3.1 Bridge / Reverse Proxy EC2
Instance type | t3a.small (2 vCPU, 2 GB RAM) |
|---|---|
OS | Ubuntu Server 22.04 LTS |
Disk | 30 GB gp3 SSD |
Software | NGINX |
Region | il-central-1 (Tel Aviv) |
3.2 Embedding Server
Instance type | g5.xlarge (NVIDIA A10G 24 GB, 4 vCPU, 16 GB RAM) |
|---|---|
OS | Ubuntu Server 22.04 LTS |
Disk | 100 GB gp3 SSD |
GPU driver | NVIDIA driver + CUDA 12.x (CC ≥ 7.0) |
Region | il-central-1 (Tel Aviv) |
3.3 AWS Bedrock
Region | eu-west-1 (Ireland) |
|---|---|
Models to enable | Anthropic Claude · Meta Llama (optional) · Cohere Embed v4 (optional) |
4. Network & Ports
4.1 On-Premises
Source | Destination | Ports | Purpose |
|---|---|---|---|
End users | Dashboard | TCP 443 | User access to UI |
Dashboard | Gateway | TCP 8080, 443 | Gateway API |
Dashboard | DB Server | TCP 1433 | MS SQL |
Gateway | DB Server | TCP 1433, 5432 | MS SQL + PostgreSQL |
File Uploading Agent (optional) | Dashboard | TCP 8080, 443 | Bulk file ingestion |
Admin workstations | All servers | RDP 3389 / SSH 22 | Administration |
4.2 On-Prem → AWS Israel VPC (via Direct Connect)
Source | Destination | Ports | Purpose |
|---|---|---|---|
Gateway (on-prem) | Bridge EC2 (VPC) | TCP 443 | Bedrock proxy traffic |
Gateway (on-prem) | Embedding EC2 (VPC) | TCP 443 | Embedding requests |
4.3 AWS Israel VPC → AWS EU
Source | Destination | Ports | Purpose |
|---|---|---|---|
Bridge EC2 | TCP 443 | LLM inference |
5. Internet / Egress Allowlist
Source | Destination hosts | Purpose |
|---|---|---|
Gateway + Bridge EC2 + Embedding EC2 | *.docker.io, *.docker.com, production.cloudflare.docker.com, docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com, *.auth0.com | Docker image pulls |
6. Software Prerequisites
Server | Required software |
|---|---|
Gateway (Linux) | Docker CE 27.3.1+, systemd, openssh-server, curl |
Dashboard (Windows) | Windows Server 2019+, IIS, .NET prerequisites |
DB Server | MS SQL Server Standard 2019+; PostgreSQL 15+ with pgvector |
Embedding EC2 | Ubuntu 22.04, Docker CE, NVIDIA GPU driver, CUDA 12.x |
Bridge EC2 | Ubuntu 22.04, NGINX |
7. Permissions & Service Accounts
Item | Requirement |
|---|---|
MS SQL (source DB for ingestion) | Read-only service account |
Dashboard / Ingestor VM | Active Directory domain-joined |
SharePoint ingestion | Service user: Site Collection Admin + read-only to sites |
Confluence ingestion | Service user with read access to target spaces/pages |
Jira ingestion | Service user with read access to target projects |
File Uploading Agent (optional) | Runs as Local System; access to source file shares |
8. SSL & Authentication
SSL certificate (optional but recommended): customer-provided, installed on Dashboard VM for IIS.
Authentication: username/password or Active Directory integration via the domain-joined Dashboard VM.
9. AGAT / Pragatix Remote Access (Optional)
Remote access is optional. When enabled: RDP + SSH from Pragatix static IP during deployment; temporary, time-boxed access from the same IP for post-deployment support. Customer self-service deployment is also supported.
10. Deployment Prerequisite Checklist
Three on-prem VMs provisioned (Gateway, Dashboard, DB)
AWS Direct Connect established between on-prem and il-central-1 VPC
Bridge EC2 (t3a.small) launched in il-central-1
Embedding EC2 (g5.xlarge) launched in il-central-1
AWS Bedrock model access approved in eu-west-1
Network ports per §4 opened across all tiers
Outbound allowlist per §5 applied on proxy / firewall
SSL certificate obtained (if HTTPS required)
Service accounts created (AD, SharePoint, Confluence, Jira as applicable)
Backup strategy defined for DB server
Data residency review completed (Bedrock egress IL → EU)
AGAT remote access decision made (optional)