Secure a CE deployment

Before making WhoDB available to other people, decide which databases they should reach and which credentials they should be able to use. In CE, the network boundary, database privileges, and server-configured profiles are central to that decision.

Restrict reachability#

Run WhoDB on a network intended for its users. Use HTTPS for remote browser access. When an HTTPS proxy fronts WhoDB, set WHODB_SECURE=true so the browser uses a Secure session cookie.

Do not set that option for an ordinary HTTP development URL; a Secure cookie will not work over that connection. Configure the proxy and allowed origins for the deployment you actually use. See Installation for the available settings.

Treat configured profiles as shared access#

Server-configured profiles let people select an alias and use its database credentials. Anyone who reaches that CE instance can select those profiles. An alias does not establish a separate WhoDB user account or permission boundary.

Use restricted database accounts and separate access paths when audiences need different privileges. Test those accounts before sharing the instance URL.

Protect session storage#

Persist the data directory when login sessions need to survive container replacement. Keep WHODB_ENCRYPTION_KEY stable and protected so the stored sessions remain usable.

Treat the data volume, encryption key, profile definitions, and client certificate files as sensitive deployment material. Do not put real values in an example file that will be committed or shared.

Review data leaving the source#

An export can contain the same sensitive data as the original database. Share the smallest result needed and control access to the downloaded file.

Chat requests can send prompts, schema context, and included data to the configured provider. Choose that endpoint deliberately. A self-hosted WhoDB interface does not mean a remote model request stays on your network.

Keep an appropriate record#

Configure audit logging when you need a retained record of the supported database actions. Check that the log destination persists and that its readers are appropriate for the data it can contain.

Use Database access and MCP permissions to configure the database and assistant access separately from the UI.