SELF-HOSTdocker compose · air-gap · BYO Postgres + Redis · SAML / LDAP / OIDCdocker compose · air-gap · BYO auth

Self-hosted plagiarism checker.

Run the Apache 2.0 engine on your own infrastructure. Docker compose for the typical install, Helm chart for Kubernetes, bare-metal supported for air-gapped environments. Your servers, your Postgres, your auth, your data. No traffic leaves your VPC. The right deployment when cloud isn't an option.

docker compose in 10 minutesAir-gap supportedBYO Postgres · SAML / LDAP / OIDC

WHO SELF-HOSTS

Four contexts where cloud isn't an option.

LAW FIRMS

Privilege-preserving deployment

Briefs, memos, and discovery materials under protective order can't go to a third-party cloud.

Air-gapped network supported
SAML / LDAP / Active Directory auth
Runs inside your already-compliant environment

UNIVERSITIES

IRB-reviewable, on-campus

Student submissions, clinical research, IRB-approved studies — strict data-residency requirements.

Runs alongside Canvas / Moodle on your network
Apache 2.0 — your IT clones the repo before signing
EU-residency mode if cloud is the right tier

GOVERNMENT

Air-gapped + FedRAMP-adjacent

Federal, state, defence — content can't leave the agency network.

Bare-metal install option (no Docker required)
OIDC / CAC / PIV smart-card auth supported
STIG-hardenable base image (RHEL UBI)

ENTERPRISE

Internal IP + trade-secret protection

R&D documents, M&A drafts, internal whitepapers — content that must stay inside the firewall.

Kubernetes Helm chart for horizontal scale
BYO Postgres + Redis + object store
Audit log → SIEM (Splunk / Datadog / Elastic)

INSTALL OPTIONS

Three deployment modes. One engine.

Pick the path that matches your infrastructure. The detection engine is identical across all three; only the operational packaging differs.

01 · docker compose (10 min)

git clone github.com/NoplagLabs/noplag-engine && cd engine && docker compose up -d. The compose file ships with Postgres + Redis + the engine container + a minimal admin UI. Defaults to a single-node deployment suitable for small-team workloads (~1,000 checks/day). Production-ready as-is; the harder work is bringing your own auth and corpus.

02 · Kubernetes Helm chart

helm install noplag noplag/engine --values your-values.yaml. The chart externalises Postgres + Redis (point at your existing cluster services), supports horizontal scaling for the engine pods, and exposes Prometheus metrics for autoscaling. Documented Helm values for resource limits, replica counts, and persistent-volume claims.

03 · Bare-metal / air-gapped

For environments that can't run Docker (some defence + government). Ship the engine as a tar archive with all dependencies pinned; install via ansible playbook on RHEL UBI or Ubuntu LTS. Air-gap-friendly: no external network calls required after install. STIG-hardenable base image; OIDC / CAC / PIV auth modules included.

SYSTEM REQUIREMENTS

What it needs to run.

Modest hardware footprint for small-team deployments. Scales horizontally for production volume. Bring your own everything from auth to corpus on Enterprise.

01 · ENGINE NODE

8 vCPU + 16 GB RAM minimum for the engine container. Handles ~50 concurrent checks at median 47 sec per 1,500-word document. Scale horizontally by adding engine pods behind a load balancer — Kubernetes Helm chart automates this with HPA on CPU + queue depth.

02 · DATABASE

PostgreSQL 15+ with pgvector extension. Sized for your fingerprint volume: ~50 GB for 100,000 indexed documents, scales linearly. RDS / Cloud SQL / managed instances supported via standard connection string. Self-managed Postgres needs the pgvector + GIN extensions enabled.

03 · CACHE / QUEUE

Redis 7+ for the work queue + caching layer. Modest footprint (~2 GB RAM typical). Elasticache / Memorystore / Redis Cloud all work; in-cluster Redis pod fine for smaller deployments. The chart defaults to Redis Sentinel for HA.

04 · CORPUS STORAGE

Enterprise: ships the public corpus as an indexable bundle (~280 GB compressed). Restored to Postgres + object store (S3 / GCS / MinIO / Ceph) on first install. Optional: BYO web-search adapters (Google / Brave API keys) for live verification, or skip if you only check against indexed corpus.

05 · IDENTITY

SAML 2.0, LDAP, OIDC (Okta, Azure AD, Auth0, Keycloak), or built-in email-password. Smart-card auth (CAC / PIV) supported via OIDC bridge for government deployments. Multi-tenant supported within a single install — useful for shared-service deployments across departments.

06 · OBSERVABILITY

Prometheus metrics endpoint + OpenTelemetry traces. Audit log emitted as JSON; pipe to your SIEM (Splunk, Datadog, Elastic, Grafana Loki). Dashboards shipped as Grafana JSON in the repo. Compatible with the standard CNCF observability stack.

DEPLOY IT IN 10 MINUTES

Standard docker compose deployment.

Production-ready compose stack with the engine, Postgres, Redis, and admin UI. Add your auth provider; configure your corpus; cluster horizontally when you outgrow a single node.

$ install · bashCopy

$ git clone https://github.com/NoplagLabs/noplag-engine
$ cd engine
$ cp .env.example .env
$ vim .env  # configure auth + corpus + secrets
 
$ docker compose up -d
 
  Creating noplag-postgres ... done
  Creating noplag-redis    ... done
  Creating noplag-engine   ... done
  Creating noplag-admin    ... done
 
  Engine ready at http://localhost:8080
  Admin UI at  http://localhost:8081

.env · configurationCopy

# Auth
AUTH_PROVIDER=saml  # or oidc, ldap, builtin
SAML_METADATA_URL=https://idp.acme.com/...
 
# Database
POSTGRES_URL=postgres://user:pw@db:5432/noplag
REDIS_URL=redis://redis:6379/0
 
# Corpus
CORPUS_BUNDLE_PATH=/srv/corpus/2026-05
WEB_SEARCH_ENABLED=false  # air-gap
 
# Observability
OTEL_ENDPOINT=https://otel.acme.com:4317
AUDIT_LOG_SINK=splunk-hec

10 mindocker compose to ready
8 / 16vCPU / GB RAM minimum
Apache2.0 · free forever
0external network required (air-gap)
SAMLLDAP · OIDC · CAC / PIV smart-card

AUTH + IDENTITY

Plug into your existing identity infrastructure.

01 · SAML 2.0

Standard enterprise SSO

Configure SAML_METADATA_URL pointing to your IdP. Tested with Okta, Auth0, OneLogin, Microsoft Entra (Azure AD), Ping Identity, Keycloak, and Shibboleth. Group-attribute mapping for role-based access. SCIM 2.0 user provisioning supported via the admin API.

Just-in-time provisioning + SCIM sync · most common enterprise pattern.

02 · LDAP / AD

Direct Active Directory integration

For environments running on-prem AD or OpenLDAP. Bind credentials configured in .env; group queries determine access. Useful for universities + law firms + government deployments where SAML is overkill or AD already covers the org.

Supports nested-group queries · 5-second auth latency typical.

03 · OIDC + SMART-CARD

OIDC for cloud-native + CAC/PIV for defence

Standard OIDC for Okta / Auth0 / Cognito / Google Workspace. For defence + federal: CAC/PIV smart-card auth via the OIDC bridge. Maps the smart-card identifier to a Noplag user; group mapping respects the organisation's DoD smart-card directory.

FedRAMP-adjacent posture · smart-card auth path tested with DoD CAC + GSA PIV.

PATCH MANAGEMENT

Update on your schedule, not ours.

Self-hosted means you control the update cadence. We tag stable releases monthly (the same commit running the cloud tier) and patch releases as security issues warrant. Pull the new tag, run docker compose pull && up -d, done. The migrations run on container startup. Air-gapped operators: we publish signed release bundles (RPM / DEB / tar) with detached signatures; verify the signature, transfer via your existing inbound-software-approval process, and install at the next maintenance window. Long-term-support tags get critical security patches for 18 months; production-ready tags get monthly updates with the cloud-tier release cycle. Either way: the upgrade path is yours, the data is yours, and the only thing we control is what we publish to the registry.

Read the upgrade guide

FAQ

What IT / DevOps actually asks before deploying.

What's actually free vs paid in the self-hosted version?

The Apache 2.0 engine itself is free forever — clone the repo, run it. What you get for free covers the detection cascade + admin UI + REST API. Enterprise adds: the indexable public corpus bundle (~280GB pre-built index), dedicated support SLA, signed-release air-gap delivery, and migration assistance.

Can we run it without internet access (air-gapped)?

Yes. The engine doesn't need external network access for indexed-corpus checks. Set WEB_SEARCH_ENABLED=false to skip the live-web layer. Enterprise ships signed-release bundles with detached GPG signatures — transfer via your existing software-approval process. Tested in DoD + intelligence-community deployments.

What's the minimum hardware footprint?

Engine container: 8 vCPU + 16 GB RAM. Postgres: 4 vCPU + 8 GB + ~50 GB for 100k indexed docs. Redis: ~2 GB RAM. For 5,000 checks/month a single mid-range server runs everything. For 100k+ checks/month, Kubernetes + horizontal engine scaling + managed Postgres.

Does it work with our existing identity infrastructure?

SAML 2.0 (Okta, Auth0, Entra, OneLogin, Keycloak, Shibboleth), LDAP / Active Directory, OIDC, CAC/PIV smart-card via OIDC bridge for federal deployments, or built-in email-password. SCIM 2.0 provisioning supported. Group-attribute → role mapping configurable.

What about pgvector — is that a hard dependency?

It will be, for the L3 vector-embeddings layer (v1.2); v1.0 does not require it. Postgres 15+ with pgvector. RDS / Cloud SQL / Cloud Postgres all support it. Self-managed Postgres needs CREATE EXTENSION pgvector at deploy time. Without it the engine still runs the shipped layers but will lose the semantic-paraphrase layer once that ships.

How do we get the public corpus on a private network?

Enterprise: shipped as a signed ~280 GB bundle. Transfer via your existing data-import process, restore to Postgres + object store on first install. Re-shipped monthly with the cloud-tier corpus refresh. Community tier: build your own from OpenAlex / CORE / Common Crawl public dumps using the ingest scripts.

What's the upgrade story for production deployments?

Stable releases tagged monthly (the same commit running cloud). LTS tags get 18 months of security patches. Standard upgrade: docker compose pull && up -d (Helm: helm upgrade). Migrations run automatically on startup; semver honoured; breaking changes documented in migration notes.

Does this work with SOC 2 / HIPAA / FedRAMP?

Self-host makes the compliance posture your responsibility — we provide the engine, you run it inside an environment that already meets your requirements. We're a relaunching open-core company and don't hold SOC 2, HIPAA, or FedRAMP authorisations ourselves; we don't claim to. What self-host gives teams with those requirements is a way to run Noplag entirely within controls they already operate — air-gap + bare-metal + CAC/PIV supported, PHI controls on your side, nothing leaving your network.

Can we customise the detection pipeline?

Apache 2.0 — fork and modify. Self-host operators have added: custom corpus sources, modified citation classifiers (regional styles not in the default six), and integration plug-ins. Upstream PRs welcome; we review and merge what fits the broader user base.

What about support?

Community: GitHub issues, public Discord, community-maintained docs. We respond to bug reports and security disclosures but don't promise SLAs. Enterprise: dedicated solutions engineer, named support contact, response-time SLA tied to contract, custom integration help, migration assistance.

Clone the repo. docker compose up. Run it inside your network.

Apache 2.0 — free forever. Enterprise contracts add the indexable public corpus bundle, dedicated support SLA, and signed-release air-gap delivery. Otherwise: github.com/NoplagLabs/noplag-engine and a docker host you control.

Clone on GitHub Talk to Enterprise