System Requirements
Bemba is hosted on Linux VPS with native Docker. This page describes what a production or pre-production server needs.
Server
| Resource | Minimum | Recommended | Current |
|---|---|---|---|
| OS | Ubuntu 22.04 LTS | Ubuntu 24.04 LTS | Ubuntu (OVH VPS) |
| CPU | 4 vCPU | 8 vCPU | 8 vCPU |
| Memory | 8 GB | 16 GB | 23 GB (pre-production, which also hosts Kobo, Survey Solutions and GitLab) |
| Disk | 100 GB SSD | 200 GB SSD | 193 GB |
| Network | fixed public IPv4 | — | 51.75.79.112 (prod), 51.75.77.220 (pre-prod) |
Pre-production needs more memory than production: KoboToolbox (≈ 5 GB) and GitLab (≈ 3 GB) run there alongside the application.
Server software
| Software | Version | Note |
|---|---|---|
| Docker Engine | 24 or later | native install (apt), no Docker Desktop or virtual machine |
| Docker Compose | v2 (docker compose, plugin) | v1 (docker-compose) is incompatible with Docker Engine 28 (KeyError: 'ContainerConfig') |
| Git | 2.x | optional on the server (code is shipped as an archive) |
cron | — | backups, grievance digest, assistant indexing |
Nothing else is installed on the host: PHP, Node, PostgreSQL, Redis and Nginx run in containers.
Ports
| Port | Exposed to | Service |
|---|---|---|
| 22 | Internet (SSH key only) | administration |
| 80, 443 | Internet | Traefik (HTTP redirected to HTTPS) |
| 2525 | the 220 server only (production) | SMTP relay for KoboToolbox |
| 2222 | Internet (pre-production) | GitLab SSH |
| 3100, 8080, 9100, 9121, 9187 | 127.0.0.1 only | Loki and metrics exporters |
| 5432, 6379 | internal Docker network | PostgreSQL, Redis |
DNS
A records to create at the registrar (OVH):
| Name | Target |
|---|---|
bemba.ucp-pch.org, mariacare.ucp-pch.org, ucp-pch.org, sig.ucp-pch.org, docubemba.ucp-pch.org | 51.75.79.112 |
sig-preprod.ucp-pch.org, kf.kobo.ucp-pch.org, kc.kobo.ucp-pch.org, ee.kobo.ucp-pch.org, gitlab.ucp-pch.org | 51.75.77.220 |
Traefik obtains Let's Encrypt certificates automatically as soon as the name points to the right server.
External services
| Service | Use | Required |
|---|---|---|
OVH SMTP (ssl0.ovh.net:587, account noreply@ucp-pch.org) | application e-mails | yes |
| Anthropic (Claude) | Bemba assistant | for the assistant |
| Cohere | assistant semantic search, grievance clustering | no (full-text fallback) |
| KoboToolbox (cloud and self-hosted) | data collection, grievances, code of conduct | depending on projects |
| Sentry | error reporting | recommended |
220 server and SMTP
The pre-production server cannot reach any OVH SMTP port. Application e-mails fail there on purpose; KoboToolbox e-mails go through the production relay (see self-hosted KoboToolbox).
Admin workstation
- SSH client with the key authorised on the servers.
- Node.js 20+ and npm to build the frontend and the documentation; PHP 8.3 for local checks.
- A recent browser (Chrome, Edge, Firefox).