AI Search Installation Guide

AIS containers ──► Aras Innovator   (Server + OAuth + Vault)
               ──► Temporal         (workflow orchestration, port 7233)
               ──► SQL Server       (inside the existing Innovator database, port 1433)
               ──► RabbitMQ / Azure Service Bus  (CDC events via Edge API, AMQP 1.0)
               ──► Embeddings provider  (OpenAI-compatible API, port 443)

ai-search/
├── docker-compose.yaml   # Copy from the "docker-compose.yaml" section below
├── .env                  # Copy from the ".env" section below, then fill in your values (See "Configure the environment file" below)
└── certs/                # Directory for the OAuth certificate (See "Place the certificate" below)

mkdir -p ai-search/certs
cd ai-search

# Production AI Search stack — standalone, image-based.
# All services use published Docker Hub images; no source builds.
#
# Prerequisites:
# - Create .env.example to .env next to this file (See the .env section below) and fill in all required values.
# - Place the OAuth certificate file in the certificate directory (default: ./certs/).
#   The file must be named <INNOVATOR_OAUTH_CLIENT_ID>.pfx (e.g. IndexerWorker.pfx).
#   Override the directory with CERTS_HOST_DIR in .env if certs live elsewhere.
# - Innovator Server and its SQL Server are reachable from the host via the URLs in .env.
# - External RabbitMQ (from the Edge API/CDC stack) is reachable and AMQP_CONNECTION_STRING is set in .env.
#   The broker must have the rabbitmq_amqp1_0 plugin enabled (AI Search uses AMQP 1.0).
# - A Temporal frontend endpoint must be reachable at TEMPORAL_HOST (see .env section).
#   This file contains only AIS services — Temporal itself is an external dependency.
# - Vault Server must be reachable from the indexer worker containers (see .env section).
#   Ensure the vault hostname is resolvable from Docker containers via extra_hosts, DNS, or
#   host.docker.internal as appropriate for your deployment.
#
# IMAGE_TAG in .env controls which version of all AI Search images is deployed.
#
# Minimum recommended hardware:
#   CPU:  4 vCPUs  (ais-parser-worker uses all available cores for ML inference)
#   RAM:  8 GB     (parser-worker loads ~4 GB of ML models; remainder for API, indexer, and Temporal)
#   Disk: 20 GB    for the parser-staging volume (transient workspace during file indexing;
#                  actual size depends on the number and size of files indexed concurrently)

x-logging: &default-logging
  driver: json-file
  options:
    max-size: "50m"
    max-file: "5"

name: aras-ai-search

services:

  # ---------------------------------------------------------------------------
  # One-shot init containers
  # ---------------------------------------------------------------------------
  ais-db-migrations:
    image: ${IMAGE_REGISTRY:?IMAGE_REGISTRY is required}/db-migrations:${IMAGE_TAG:?IMAGE_TAG is required}
    restart: "no"
    environment:
      ASPNETCORE_ENVIRONMENT: Production
      AisDb__SchemaInstallConnectionString: "${AIS_DB_SCHEMA_CONNECTION_STRING:?AIS_DB_SCHEMA_CONNECTION_STRING is required}"
      AisDb__MigrationCommandTimeoutSeconds: "${AIS_DB_MIGRATION_COMMAND_TIMEOUT_SECONDS:-}"
    extra_hosts:
      - "${DOCKER_HOST_GATEWAY:-host.docker.internal}:host-gateway"
    networks:
      - ais-network

  parser-staging-init:
    image: busybox:1.36.1
    # setgid 2770 + GID 5000 owner: new files inherit group ownership; workers get GID 5000 via group_add.
    command: ["sh", "-c", "mkdir -p /var/lib/aras/parser-staging && chown root:5000 /var/lib/aras/parser-staging && chmod 2770 /var/lib/aras/parser-staging"]
    volumes:
      - parser_staging:/var/lib/aras/parser-staging
    restart: "no"
    networks:
      - ais-network

  # ---------------------------------------------------------------------------
  # AI Search API (SPA host + JSON API)
  # ---------------------------------------------------------------------------
  ais-api:
    image: ${IMAGE_REGISTRY:?IMAGE_REGISTRY is required}/api:${IMAGE_TAG:?IMAGE_TAG is required}
    depends_on:
      ais-db-migrations:
        condition: service_completed_successfully
    environment:
      ASPNETCORE_ENVIRONMENT: Production
      ASPNETCORE_URLS: http://+:8080
      Innovator__InstanceId: "${INNOVATOR_INSTANCE_ID:?INNOVATOR_INSTANCE_ID is required}"
      Innovator__InnovatorServerUrl: "${INNOVATOR_SERVER_URL:?INNOVATOR_SERVER_URL is required}"
      AisDb__DataConnectionString: "${AIS_DB_DATA_CONNECTION_STRING:?AIS_DB_DATA_CONNECTION_STRING is required}"
      AisDb__SearchConnectionString: "${AIS_DB_SEARCH_CONNECTION_STRING:?AIS_DB_SEARCH_CONNECTION_STRING is required}"
      Temporal__TargetHost: "${TEMPORAL_HOST:?TEMPORAL_HOST is required}"
      Temporal__Namespace: "${TEMPORAL_NAMESPACE:-default}"
      Temporal__Credentials__ApiKey: "${TEMPORAL_API_KEY:-}"
      Amqp__ConnectionString: "${AMQP_CONNECTION_STRING:?AMQP_CONNECTION_STRING is required}"
      Cdc__ConfiguratorUrl: "${CDC_CONFIGURATOR_URL:?CDC_CONFIGURATOR_URL is required}"
      Cdc__Origin: "${CDC_ORIGIN:-aisearch}"
      Cdc__InstanceName: "${CDC_INSTANCE_NAME:-default}"
      Cdc__ConfiguratorUserName: "${CDC_CONFIGURATOR_USER:-admin}"
      Cdc__ConfiguratorAttemptTimeout: "${CDC_CONFIGURATOR_ATTEMPT_TIMEOUT:-00:02:00}"
      Cdc__ConfiguratorTotalTimeout: "${CDC_CONFIGURATOR_TOTAL_TIMEOUT:-00:05:00}"
      Embeddings__Endpoint: "${EMBEDDINGS_ENDPOINT:?EMBEDDINGS_ENDPOINT is required}"
      Embeddings__ApiKey: "${EMBEDDINGS_API_KEY:?EMBEDDINGS_API_KEY is required}"
      Embeddings__ModelId: "${EMBEDDINGS_MODEL_ID:-text-embedding-3-small}"
      VectorSearchSettings__VectorDimension: "${VECTOR_DIMENSION:-1536}"
    ports:
      # Bound to localhost — place a TLS-terminating reverse proxy (nginx, Traefik, etc.) in front for external access.
      # Health endpoints (no auth required):
      #   GET /health/live  — liveness (instant, no external checks); suitable for K8s liveness probe
      #   GET /health/ready — readiness (checks SQL, Temporal, CDC, Embeddings); suitable for load-balancer / Traefik
      #	  GET /health/deep  — deep checks excluded from /health/ready (e.g. temporal-worker task-queue polling);
      #                       for diagnostics, not load-balancer/k8s probes — a transient failure here should not pull the pod out of rotation
      - "127.0.0.1:5080:8080"
    restart: unless-stopped
    extra_hosts:
      - "${DOCKER_HOST_GATEWAY:-host.docker.internal}:host-gateway"
    logging: *default-logging
    networks:
      - ais-network

  # ---------------------------------------------------------------------------
  # AI Search Temporal Worker (.NET — indexing workflows + incremental consumer)
  # ---------------------------------------------------------------------------
  ais-indexer-worker:
    image: ${IMAGE_REGISTRY:?IMAGE_REGISTRY is required}/indexer-worker:${IMAGE_TAG:?IMAGE_TAG is required}
    depends_on:
      ais-db-migrations:
        condition: service_completed_successfully
      parser-staging-init:
        condition: service_completed_successfully
    environment:
      ASPNETCORE_ENVIRONMENT: Production
      Innovator__InstanceId: "${INNOVATOR_INSTANCE_ID:?INNOVATOR_INSTANCE_ID is required}"
      Innovator__InnovatorServerUrl: "${INNOVATOR_SERVER_URL:?INNOVATOR_SERVER_URL is required}"
      Innovator__OAuthServerUrl: "${INNOVATOR_OAUTH_URL:?INNOVATOR_OAUTH_URL is required}"
      Innovator__ClientId: "${INNOVATOR_OAUTH_CLIENT_ID:-IndexerWorker}"
      Innovator__CertificatePath: "/Container/Certificates/${INNOVATOR_OAUTH_CLIENT_ID:-IndexerWorker}.pfx"
      Innovator__CertificatePassword: "${ARAS_OAUTH_CERTIFICATE_PASSWORD}"
      Innovator__ServiceUserName: "${INNOVATOR_SERVICE_USER:-vadmin}"
      AisDb__DataConnectionString: "${AIS_DB_DATA_CONNECTION_STRING:?AIS_DB_DATA_CONNECTION_STRING is required}"
      Temporal__TargetHost: "${TEMPORAL_HOST:?TEMPORAL_HOST is required}"
      Temporal__Namespace: "${TEMPORAL_NAMESPACE:-default}"
      Temporal__Credentials__ApiKey: "${TEMPORAL_API_KEY:-}"
      Amqp__ConnectionString: "${AMQP_CONNECTION_STRING:?AMQP_CONNECTION_STRING is required}"
      IncrementalConsumer__StartupDelaySeconds: "5"
      IncrementalConsumer__HeartbeatSeconds: "60"
      IncrementalConsumer__MaxProcessingAttempts: "5"
      IncrementalConsumer__RetryBackoffSeconds: "2"
      ParserStaging__Root: "/var/lib/aras/parser-staging"
      ParserStaging__MaxFileBytes: "536870912"
      ParserStaging__TransferBufferBytes: "16777216"
      Embeddings__Endpoint: "${EMBEDDINGS_ENDPOINT:?EMBEDDINGS_ENDPOINT is required}"
      Embeddings__ApiKey: "${EMBEDDINGS_API_KEY:?EMBEDDINGS_API_KEY is required}"
      Embeddings__ModelId: "${EMBEDDINGS_MODEL_ID:-text-embedding-3-small}"
      VectorSearchSettings__VectorDimension: "${VECTOR_DIMENSION:-1536}"
      FileParsing__MaxTokens: "${FILE_PARSING_MAX_TOKENS:-1500}"
      FileParsing__MergePeers: "${FILE_PARSING_MERGE_PEERS:-true}"
      FileParsing__DoOcr: "${FILE_PARSING_DO_OCR:-false}"
      FileParsing__TableMode: "${FILE_PARSING_TABLE_MODE:-accurate}"
      FileParsing__DoTableStructure: "${FILE_PARSING_DO_TABLE_STRUCTURE:-true}"
      Temporal__ActivityPolicies__CheckFileProcessedStartToCloseSeconds: "10"
      Temporal__ActivityPolicies__DownloadFileStartToCloseSeconds: "300"
      Temporal__ActivityPolicies__DownloadFileHeartbeatSeconds: "120"
      Temporal__ActivityPolicies__ParseAndStageChunksStartToCloseSeconds: "900"
      Temporal__ActivityPolicies__ParseAndStageChunksHeartbeatSeconds: "120"
      Temporal__ActivityPolicies__PersistStagedChunksStartToCloseSeconds: "120"
      Temporal__ActivityPolicies__EmbedFileChunksStartToCloseSeconds: "300"
      Temporal__ActivityPolicies__EmbedFileChunksHeartbeatSeconds: "120"
      Temporal__ActivityPolicies__CleanupStagedFileStartToCloseSeconds: "30"
      Cdc__ConfiguratorUrl: "${CDC_CONFIGURATOR_URL:?CDC_CONFIGURATOR_URL is required}"
      Cdc__InstanceName: "${CDC_INSTANCE_NAME:-default}"
    volumes:
      - "${CERTS_HOST_DIR:-./certs}:/Container/Certificates:ro"
      - parser_staging:/var/lib/aras/parser-staging:rw
    # ais-staging (GID 5000): write access to the parser-staging shared volume.
    group_add:
      - "5000"
    restart: unless-stopped
    stop_grace_period: 60s
    extra_hosts:
      - "${DOCKER_HOST_GATEWAY:-host.docker.internal}:host-gateway"
    logging: *default-logging
    networks:
      - ais-network

  # ---------------------------------------------------------------------------
  # File Parser Worker (Python — docling-based file parsing)
  # ---------------------------------------------------------------------------
  ais-parser-worker:
    image: ${IMAGE_REGISTRY:?IMAGE_REGISTRY is required}/parser-worker:${IMAGE_TAG:?IMAGE_TAG is required}
    depends_on:
      ais-db-migrations:
        condition: service_completed_successfully
      parser-staging-init:
        condition: service_completed_successfully
    environment:
      PARSER_WORKER__TEMPORAL__TARGET_HOST: "${TEMPORAL_HOST:?TEMPORAL_HOST is required}"
      PARSER_WORKER__TEMPORAL__NAMESPACE: "${TEMPORAL_NAMESPACE:-default}"
      PARSER_WORKER__TEMPORAL__INNOVATOR_INSTANCE_ID: "${INNOVATOR_INSTANCE_ID:?INNOVATOR_INSTANCE_ID is required}"
      PARSER_WORKER__TEMPORAL__API_KEY: "${TEMPORAL_API_KEY:-}"
      PARSER_WORKER__STAGING_ROOT: "/var/lib/aras/parser-staging"
      PARSER_WORKER__MAX_CONCURRENT_ACTIVITIES: "${PARSER_WORKER__MAX_CONCURRENT_ACTIVITIES:-1}"
    volumes:
      - parser_staging:/var/lib/aras/parser-staging:rw
    # ais-staging (GID 5000): write access to the parser-staging shared volume.
    group_add:
      - "5000"
    restart: unless-stopped
    stop_grace_period: 60s
    extra_hosts:
      - "${DOCKER_HOST_GATEWAY:-host.docker.internal}:host-gateway"
    logging: *default-logging
    networks:
      - ais-network

volumes:
  parser_staging:

networks:
  ais-network:
    name: ais-network
    driver: bridge

# AI Search — Production stack environment variables
# Used by: docker-compose.yaml
# Copy this file to .env in the same directory and fill in all required values.
# Run: docker compose up -d
#
# Required values are marked with (required).
# Optional values with defaults show the default in the comment.

# ── Image version ─────────────────────────────────────────────────────────────

# Tag of the AI Search Docker images to deploy. (required)
# Use the CI build tag from the Actions run that was validated (e.g. 0.1.0-build.1047).
IMAGE_TAG=

# Registry + repository prefix for the AI Search images. (required)
# Resolved as: <IMAGE_REGISTRY>/<component>:<IMAGE_TAG>
#
# AI Search images are published publicly to Docker Hub under the arascorporation organisation.
# No login is required to pull them.
#
# Example:
#   IMAGE_REGISTRY=arascorporation
IMAGE_REGISTRY=

# ── Temporal ──────────────────────────────────────────────────────────────────

# Temporal frontend gRPC address. (required)
# Examples:
#   temporal:7233                        ← local self-hosted Temporal on the same Docker host
#   <namespace>.tmprl.cloud:7233         ← Temporal Cloud
#   temporal.company.com:7233            ← self-hosted managed by another team
TEMPORAL_HOST=

# Temporal namespace. Default: default
# For Temporal Cloud this is typically your account-scoped namespace (e.g. myorg.acme).
# TEMPORAL_NAMESPACE=default

# Temporal API key for authentication. Optional.
# Required for Temporal Cloud; leave empty for a self-hosted Temporal cluster
# that does not require authentication.
# TEMPORAL_API_KEY=

# ── Innovator ─────────────────────────────────────────────────────────────────

# Unique identifier for this Innovator instance.
# Used as the Temporal task-queue suffix (ai-search-index-<INNOVATOR_INSTANCE_ID>).
# Must match ^[A-Za-z0-9_-]{1,64}$. (required)
INNOVATOR_INSTANCE_ID=

# Base URL of the Innovator Server — must be reachable from Docker.
# For Innovator running on the same Docker host, use host.docker.internal (Mac/Win)
# or set DOCKER_HOST_GATEWAY below (Linux). (required)
# Example (external server): https://your-innovator.example.com/
# Example (same Docker host): http://host.docker.internal:18081/
INNOVATOR_SERVER_URL=

# Base URL of the Innovator OAuth server. (required)
# Example: https://your-innovator.example.com/OAuthServer/
# Example (same Docker host): http://host.docker.internal:18082/
INNOVATOR_OAUTH_URL=

# On Linux Docker, host.docker.internal is not set automatically.
# Uncomment and set to enable containers to reach services on the Docker host.
# Default: host.docker.internal
# DOCKER_HOST_GATEWAY=host.docker.internal

# OAuth client ID registered in Innovator for the indexer worker.
# Default: IndexerWorker
INNOVATOR_OAUTH_CLIENT_ID=IndexerWorker

# Host path to the directory containing OAuth client certificate(s).
# The directory must contain a file named <INNOVATOR_OAUTH_CLIENT_ID>.pfx.
#   Example: CERTS_HOST_DIR=/etc/aras/certs → expects /etc/aras/certs/IndexerWorker.pfx
# Default: ./certs  (a certs/ sub-directory next to this file)
# CERTS_HOST_DIR=./certs

# Password for the OAuth PFX certificate file.
# Leave empty if the PFX is not password-protected.
ARAS_OAUTH_CERTIFICATE_PASSWORD=

# Service account used by the indexer worker to perform Innovator operations.
# Default: vadmin
INNOVATOR_SERVICE_USER=vadmin

# ── Database ──────────────────────────────────────────────────────────────────

# SQL Server connection string for data read/write operations.
# Used by ais-api and ais-indexer-worker for general operations. (required)
#
# Copy one of the examples below and substitute your database name, user, and password:
#   External SQL Server:
#     Server=tcp:sql.company.com,1433;Database=innovator;User Id=aisearch;Password=yourpassword;Encrypt=True;TrustServerCertificate=True;
#   SQL Server on the Docker host (Mac / Windows Docker Desktop / Linux):
#     Server=tcp:host.docker.internal,1433;Database=innovator;User Id=aisearch;Password=yourpassword;Encrypt=True;TrustServerCertificate=True;
#     (Linux only: also set DOCKER_HOST_GATEWAY=host.docker.internal above)
AIS_DB_DATA_CONNECTION_STRING=

# SQL Server connection string for vector/full-text search queries.
# Can point to a read-only replica for scaling. (required)
AIS_DB_SEARCH_CONNECTION_STRING=

# SQL Server connection string for schema migrations.
# Needs CREATE TABLE / ALTER TABLE permissions. (required)
# In simple deployments all three strings can be set to the same value.

AIS_DB_SCHEMA_CONNECTION_STRING=
  
# Command timeout in seconds for schema migration steps. Optional.
# The DiskANN vector index migration may time out on instances with large existing datasets.
# Increase if ais-db-migrations exits with a timeout error during upgrade.
# Default: 3600
# AIS_DB_MIGRATION_COMMAND_TIMEOUT_SECONDS=3600

# ── Message bus (AMQP) ────────────────────────────────────────────────────────

# AMQP 1.0 connection string to the RabbitMQ broker provided by the Edge API/CDC stack. (required)
# This must point at the same broker that the Edge API exporter publishes CDC events to.
# Note: AI Search uses the AMQP 1.0 protocol (AmqpNetLite). The RabbitMQ broker must have
#       the rabbitmq_amqp1_0 plugin enabled.
#
# Exchange: the Edge API exporter creates and publishes to exchange "ams.exchange" automatically.
#           AI Search does not need to create or configure this exchange.
# Queues:   AI Search auto-provisions its own durable queues and bindings on the broker when
#           CDC configuration is applied (via CDC_CONFIGURATOR_URL below). No manual queue
#           setup is needed on the RabbitMQ side.
#
# Examples:
#   amqps://user:password@rabbitmq.example.com:5671/vhost    (TLS — recommended for production)
#   amqp://user:password@rabbitmq.example.com:5672/vhost     (plain — development only, credentials sent in cleartext)
AMQP_CONNECTION_STRING=

# ── CDC (Change Data Capture) ─────────────────────────────────────────────────

# URL of the EdgeAPI CDC configurator service. (required)
# The configurator provisions AI Search queues and bindings on the RabbitMQ broker above,
# and enables SQL Server CDC tracking for the configured ItemTypes.
# This service is part of the Edge API/CDC stack — it must be reachable from Docker.
# Example: http://edgeapi-configurator-service:8080/
CDC_CONFIGURATOR_URL=

# CDC origin identifier. Default: aisearch
CDC_ORIGIN=aisearch

# CDC instance name identifying this Innovator deployment. Default: default
CDC_INSTANCE_NAME=default

# Innovator user the indexer worker impersonates when calling the configurator during an apply.
# The configurator authorises by matching the token's username claim against its own
# Configurator__Innovator__Auth__Username__Value, so this must equal that value (default: admin).
# Deliberately separate from INNOVATOR_SERVICE_USER, which is the vault identity and needs the
# FileAdministrators identity instead.
CDC_CONFIGURATOR_USER=admin

# Resilience timeouts for calls the indexer worker makes to the CDC configurator during an apply.
# Format: hh:mm:ss. Optional — increase on slow networks or a heavily loaded configurator.
# Defaults: 00:02:00 (per attempt) / 00:05:00 (total, must be greater than the per-attempt value).
# CDC_CONFIGURATOR_ATTEMPT_TIMEOUT=00:02:00
# CDC_CONFIGURATOR_TOTAL_TIMEOUT=00:05:00
  
# ── Embeddings provider ───────────────────────────────────────────────────────

# Full base URL of the embeddings API endpoint. (required)
# Example: https://your-openai.openai.azure.com/openai/v1
EMBEDDINGS_ENDPOINT=

# API key for the embeddings provider. (required)
EMBEDDINGS_API_KEY=

# Model identifier used for generating embeddings.
# Default: text-embedding-3-small
EMBEDDINGS_MODEL_ID=text-embedding-3-small

# Vector dimension — must match the model above.
# Currently only 1536 is supported. Default: 1536
VECTOR_DIMENSION=1536

# ── File parsing ──────────────────────────────────────────────────────────────

# Maximum tokens per parsed chunk. Default: 1500
FILE_PARSING_MAX_TOKENS=1500

# Merge peer chunks during parsing. Default: true
FILE_PARSING_MERGE_PEERS=true

# Enable OCR during parsing (slow; enable for scanned PDFs). Default: false
FILE_PARSING_DO_OCR=false

# Table detection mode: fast or accurate. Default: accurate
FILE_PARSING_TABLE_MODE=accurate

# Enable table structure recognition. Default: true
FILE_PARSING_DO_TABLE_STRUCTURE=true

# ── Parser worker ─────────────────────────────────────────────────────────────

# Number of parallel file-parsing activities the parser worker runs simultaneously.
# Increase on hosts with more CPU cores and memory to speed up initial indexing. Default: 1
# PARSER_WORKER__MAX_CONCURRENT_ACTIVITIES=1

docker version          # Engine version
docker compose version  # Compose plugin version

docker logs <edgeapi-exporter-container> --tail 5
# Expected: CDC reader mode: Normal, synchronized tables: N, pending: 0

docker exec <rabbitmq-container> rabbitmq-plugins list | grep amqp1_0
# Expected: [E*] rabbitmq_amqp1_0

# Generate a 2048-bit RSA key and self-signed certificate valid for 5 years
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem \
  -days 1825 -noenc -subj "/CN=IndexerWorker"

# Extract public key — needed for Innovator registration (see "Configure Innovator OAuth" below)
openssl x509 -in cert.pem -out IndexerWorker.cer

# Bundle into .pfx without a password (leave ARAS_OAUTH_CERTIFICATE_PASSWORD empty in .env):
openssl pkcs12 -export -out IndexerWorker.pfx -inkey key.pem -in cert.pem -passout pass:

# Or with a password (set ARAS_OAUTH_CERTIFICATE_PASSWORD=<password> in .env):
openssl pkcs12 -export -out IndexerWorker.pfx -inkey key.pem -in cert.pem -passout pass:<password>

# Linux / macOS
rm key.pem cert.pem

# Windows (PowerShell)
Remove-Item key.pem, cert.pem

<InnovatorRoot>/OAuthServer/App_Data/Certificates/IndexerWorker.pfx

openssl pkcs12 -in IndexerWorker.pfx -nokeys -clcerts -out IndexerWorker.cer -passin pass:

<InnovatorRoot>/OAuthServer/App_Data/Certificates/IndexerWorker.cer

<clientRegistry id="IndexerWorker" enabled="true">
  <secrets>
    <secret type="JwtBearerAssertionServerSecret">
      <certificate filePath="App_Data/Certificates/IndexerWorker.cer" />
    </secret>
  </secrets>
  <allowedScopes>
    <scope name="Innovator" />
  </allowedScopes>
  <allowedGrantTypes>
    <grantType name="impersonate" />
  </allowedGrantTypes>
  <tokenLifetime accessTokenLifetime="3600" />
</clientRegistry>

-- Create a dedicated login for AI Search (substitute your own name and password)
CREATE LOGIN aisearch WITH PASSWORD = '<strong-password>';

-- Grant db_owner on the Innovator database
USE [innovator];  -- substitute your actual Innovator database name
CREATE USER aisearch FOR LOGIN aisearch;
ALTER ROLE db_owner ADD MEMBER aisearch;

USE [innovator];
ALTER ROLE ais_schema_install_role ADD MEMBER aisearch;
ALTER ROLE db_owner DROP MEMBER aisearch;

-- Confirm the owner
SELECT SUSER_SNAME(owner_sid) AS db_owner FROM sys.databases WHERE name = 'InnovatorSolutions';

-- Reassign ownership to the sa login (or another valid SQL login) so CDC enable doesn't need AD lookups
ALTER AUTHORIZATION ON DATABASE::innovator TO sa;

# TLS (recommended for production, port 5671):
amqps://<user>:<password>@<rabbitmq-host>:5671/

# Plain (development / internal network only, port 5672):
amqp://<user>:<password>@<rabbitmq-host>:5672/

# Standard Azure Service Bus connection string (from Azure Portal):
Endpoint=sb://<namespace>.servicebus.windows.net/;SharedAccessKeyName=<policy>;SharedAccessKey=<key>

# AMQP URI form (port 5671 — TLS):
amqps://<policy>:<key-url-encoded>@<namespace>.servicebus.windows.net

cd ai-search/

# Temporal Cloud:
TEMPORAL_HOST=<namespace>.tmprl.cloud:7233

# Self-hosted cluster:
TEMPORAL_HOST=temporal.company.com:7233

TEMPORAL_API_KEY=<your-temporal-cloud-api-key>

cp /path/to/IndexerWorker.pfx certs/IndexerWorker.pfx

# Pull all AI Search images
docker compose pull

# Start the stack in the background
docker compose up -d

curl -s -o /dev/null -w "%{http_code}" http://localhost:5080/health/ready

curl -s http://localhost:5080/health/ready | jq .   # or: python3 -m json.tool

curl -s http://localhost:5080/health/ready/sql-data
curl -s http://localhost:5080/health/ready/sql-search
curl -s http://localhost:5080/health/ready/innovator
curl -s http://localhost:5080/health/ready/embeddings
curl -s http://localhost:5080/health/ready/temporal
curl -s http://localhost:5080/health/ready/cdc-configurator

docker compose logs --tail 50 ais-api
docker compose logs --tail 50 ais-indexer-worker

info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.

docker compose exec ais-indexer-worker sh -c "echo /Container/Certificates/*"

docker inspect <indexer-worker-image> --format '{{.Config.User}}'

docker run --rm -v <CERTS_HOST_DIR>:/certs busybox stat /certs/<INNOVATOR_OAUTH_CLIENT_ID>.pfx

docker run --rm -v <CERTS_HOST_DIR>:/certs busybox chmod 644 /certs/<INNOVATOR_OAUTH_CLIENT_ID>.pfx
docker compose restart ais-indexer-worker

nc -zv <rabbitmq-host> 5671   # TLS (production)

docker exec <rabbitmq-container> rabbitmq-plugins list | grep amqp1_0

curl -s http://localhost:5080/health/ready/embeddings

docker compose restart ais-api ais-indexer-worker

docker compose logs ais-db-migrations

docker compose ps ais-indexer-worker

docker compose logs --tail 100 ais-indexer-worker | grep -i "temporal\|error"

curl -s http://localhost:5080/health/ready/temporal

docker run --rm --network ais-network busybox nc -zv <temporal-host> 7233

curl -s http://localhost:5080/health/ready | jq .   # or: python3 -m json.tool