Skip to main content

Set up Tickessa Local AI

Tickessa Local AI runs approved tasks on an internal AI computer. A saved profile activates neither projects nor automatic email sending.

What Local only means​

Local only accepts only models from the validated internal service. Cloud primary models and fallbacks are blocked before execution. If the machine or connection fails, tickets, knowledge and manual replies remain usable with no silent cloud transfer.

No ticket content sent to external AI providers is valid only after a successful local-only route check. It does not imply every system is in the same building: a Tickessa server may connect from outside the company through VPN.

Prepare the AI computer​

Use an Apple Silicon Mac and Node.js 22.13+, an internal TLS certificate and a local OpenAI-compatible model server. Models are not included; verify source, licence, SHA-256 checksum, memory requirements and permitted use.

Register installed text and embedding models separately in TICKESSA_LOCAL_AI_TEXT_MODELS and TICKESSA_LOCAL_AI_EMBEDDING_MODELS. Capabilities are not inferred from names, preventing accidental model-role confusion.

Bind both model server and Tickessa service only to loopback or private addresses. Do not forward ports from the public internet.

Install the service​

Local AI 0.2.0 is a separately purchased plugin for the download edition. Hosting plans are not eligible. It includes one year of updates and unlimited use of entitled versions; plugin and application update periods are independent. After verifying the package, open Installieren.command on the Mac to start setup. macOS 27 compatibility requires an actual test before it is promised.

Verify the manifest with node bin/verify-package.mjs .. On macOS, packaging/macos/install.sh installs versioned files and a LaunchDaemon. Configuration, certificates and vector indexes stay outside release files and survive normal updates. Uninstallation preserves them unless --purge-data explicitly removes them.

The service package's README.md contains commands and Linux/container limitations.

Pair in Tickessa​

Under Settings → AI providers → Tickessa Local AI, enter:

  • Private HTTPS service origin without subpath, e.g. https://10.0.0.20:7443.
  • Private LAN or customer-controlled VPN topology.
  • Direct or explicitly forwarded route matching the service report.
  • At least 32 random characters as the encrypted, non-returned access secret.
  • Server CA certificate for internal TLS verification.
  • Timeout and call limits.

Check connection and privacy sends no ticket or article contents. It checks private routing, certificate, secret, protocol, service identity, topology, route and reported privacy boundaries. A fixed synthetic 128 KiB pattern estimates route throughput, not model performance. It also retrieves model IDs, queue and resource metrics.

Changing address, route, topology, secret or CA invalidates the check. Retest and reconfirm local-only project modes; calls remain blocked until then.

Approve a project​

Under Operating mode and local knowledge search, select:

  • Cloud/BYOK: cloud only; Local AI blocked.
  • Tickessa AI with quota: approved gateway models; Local AI blocked.
  • Local only: validated local service; never cloud fallback.
  • Hybrid: cloud only for explicitly listed and confirmed data categories.

Assign available local models to tasks such as classification, summary and reply drafts. Models appear after a successful test, and normal input/source/output guards still apply.

Choose a local embedding model and Rebuild index. Only current approved public article versions for the project go to the internal service. It stores source IDs, checksums and vectors, not article text. MariaDB originals can always rebuild the index.

Stale vectors are not used after knowledge changes. Existing local full-text search remains available until rebuilding.

Attachments, OCR and transcription​

Service 0.1.1 supports text, embeddings and vector search with explicit model separation. Attachments, OCR and transcription remain unapproved; local-only mode leaves them for human handling instead of outsourcing them.

Diagnosis​

Status includes protocol/service version, LAN/VPN, direct/forwarded route, runtime, latency, queue, free memory and node count, without prompts or answers. Per-call memory covers only the Tickessa service process; measure model-server/GPU memory, system pressure and swap separately for hardware approval.

Since 0.1.1, node bin/benchmark.mjs checks TLS, authentication, protocol, routing, structured text, queue, embeddings and vector search using only synthetic data. Supply service address, CA, secret and one text/embedding model ID. Run after installation, model changes and updates; retain its JSON with hardware, system and runtime details.

For failures, check service and bind address, certificate/CA, matching secret/protocol/topology/route, model-server availability/model loading, then queue and timeout. Do not open public ports or enable cloud fallback to troubleshoot; work manually until the private test passes.

No hardware guarantee yet​

Mac mini and Mac Studio are intended test classes, not guaranteed sizing. Recommendations require reproducible measurements with exact models, quantisation, context, concurrency, memory and routes. Two-machine load balancing is different from distributed inference of one large model.

An initial M4 Mac mini/16 GB development baseline passed the single-node path with qwen3:4b and qwen3-embedding:0.6b. Warm short structured tasks took about 2.2 seconds; two concurrent submissions ran sequentially through one text slot. This demonstrates functionality, not customer sizing or approval of planned M6/M5/cluster tiers.

Last updated on