# Supported environment

What draften needs on your own server, what it has been tried on and where it
connects. The installation procedure itself is in
[Installing, step by step](/en/admin/installing).

## Server

| | Requirement |
|---|---|
| Processor | **x86-64**. We do not build images for ARM (arm64) today; we will build them once a customer needs them. |
| Memory | **4 GB**. The web runs in two copies so that updates cause no outage. |
| Disk | **20 GB** — images, two bundles side by side during an update, the database and backups. Large mailboxes need more. |
| Machine | virtual or physical, it does not matter. |

## Operating system and Docker

- **Linux**, any distribution with **Docker Engine 24** or newer
  and the **compose v2** plugin (the `docker compose` command). The old
  standalone `docker-compose` (v1) is not enough.
- Tried on **Ubuntu Server**, with Docker 28 and compose 2.40 and 5.
- **Docker Desktop** (Windows, macOS) works, but only for trying draften out.
  For real use we recommend a Linux server.
- **Podman** is not supported — the updater needs a Docker-compatible socket
  and `docker compose`.
- **Synology and other NAS devices with Docker**: the installation script is
  written to work there, but it has not yet run on a real NAS.
- The tools `tar`, `base64` and `sha256sum` (or `shasum`), which nearly every
  system has.
- Commands are run by **root** or a user in the `docker` group. With HTTPS
  right in draften, the installation directory is closed to other users, so
  use `sudo`.

## Network: what must be reachable from outside

It depends on where HTTPS ends:

- **HTTPS ends in draften** — draften listens on ports **443** and **80**
  (80 only redirects to HTTPS).
- **HTTPS ends in front of draften** (a reverse proxy, a tunnel) — draften
  listens only on `127.0.0.1:8085` and cannot be seen from outside at all.
  When the proxy runs on another machine, open port 8085 for the proxy only.

The database has no port.

## Network: where draften connects

The installation itself needs no internet — the bundle carries all the images
and nothing is downloaded from Docker Hub or anywhere else. While running,
draften connects only where you send it:

| What for | Addresses (port 443; IMAP and SMTP as your server has them) |
|---|---|
| Microsoft 365 | `login.microsoftonline.com`, `graph.microsoft.com` |
| Google Workspace | `accounts.google.com`, `oauth2.googleapis.com`, `openidconnect.googleapis.com`, `www.googleapis.com`, `gmail.googleapis.com` |
| other mailboxes | your IMAP server |
| language models | `api.anthropic.com`, `api.openai.com`, or the address of your OpenAI-compatible server — depending on the keys you enter |
| outgoing mail (invitations, password links) | your SMTP server, or `api.brevo.com` |
| CRM connections | `api.hubapi.com` (HubSpot), `app.raynet.cz` (Raynet), `api.flowii.com` (FLOWii) |
| updater: new releases | `download.draften.ai` — the list of releases once a day, the bundle download during an update (about 500 MB); only with an uploaded licence |

No telemetry and no error reports reach us from your own installation.

Whoever publishes draften through a **Cloudflare Tunnel** also needs a
connection to Cloudflare as its documentation describes, and the
`cloudflared` image, which Docker downloads from Docker Hub — it is not in
the bundle.

## Mail and models

- **Mail systems**: Microsoft 365 (Exchange Online), Google Workspace
  and other mailboxes over IMAP. See [Microsoft 365](/en/admin/microsoft-365),
  [Google Workspace](/en/admin/google-workspace) and
  [Mail access](/en/admin/organisation-mail-access).
- **Language models**: Anthropic, OpenAI and an OpenAI-compatible server,
  such as a local model. See [Model API keys](/en/admin/api-keys).

## HTTPS

The interface must be reachable over HTTPS. The three options — a certificate
right in draften, your reverse proxy, or a Cloudflare Tunnel — are described
in the HTTPS step of [Installing, step by step](/en/admin/installing). You
obtain the certificate yourself (from a certificate authority or with an ACME
client).