1. Pilae
2. Apps
3. Apache Answer

Running Apache Answer in production: what it takes

1. Build the image with its plugins

   Answer has no plugin installer: plugins are compiled into the binary with answer build. We build your image from a pinned release with every plugin pinned too, record what answer plugin reports, and keep the list in your repository. A plugin added later is a new build and a restart, not a setting.

2. Install onto PostgreSQL, not SQLite

   The installation guide recommends SQLite for a first look, and Answer cannot move its data to another database afterwards, so we install straight onto PostgreSQL. config.yaml is rendered from a template at every start, which keeps the database password out of the image, and the Swagger UI, on by default, is turned off.

3. Sign on through Keycloak, then close password login

   The OAuth2 connector points at Keycloak, checks the email_verified claim and limits new accounts to your email domains. Once administrators have linked their accounts to it and signed in through it, password login and email registration are switched off. If Keycloak is ever unreachable, answer config --with allow_password_login, run with Answer stopped, turns password login back on from the server.

4. Keep uploads behind the sign-in

   With sign-in required, Answer checks the session before it serves an image or attachment from its data volume. The S3 storage plugin hands out links straight into a bucket, which that check does not cover, so uploads stay on the volume. A second instance changes that: it needs the uploads in a Garage bucket on the private network, and the Redis cache plugin, because sessions are held in each instance's memory.

5. Back up the database and the volume together

   PostgreSQL goes offsite daily, encrypted, to your chosen country, with the uploads and config.yaml beside it. The connector settings and their client secret are in the database, so they are covered too. Once a month we restore both into a scratch environment, sign in through Keycloak and open a question with an image.

6. Rebuild for every upgrade

   Each release is a rebuild with the same plugin list, and the container runs answer upgrade before Answer starts. Upstream asks for a backup of the database and configuration first, so a snapshot is taken just before. The Pilae Agent tests the upgrade on a copy, waits for your approval, applies it in your window and records it in the console.

What Apache Answer is, and who runs it

Apache Answer system requirements

Before anything is deployed, this is what has to exist. We size it with you in the first session, and we say so when your own hardware is already enough.

CPU and memory

2 vCPU · 4 GBOur starting point for Answer and PostgreSQL on one machine. Upstream publishes no sizing; Answer itself is a single Go process.

Database

PostgreSQLHolds the questions, answers, users, site settings and plugin settings. Upstream also supports MySQL and SQLite but cannot move data from one to another, so the choice is made once.

Data volume

/dataHolds config.yaml, uploaded images and attachments, translations and the cache file. The uploads are the part that has to be backed up with the database.

Sign-on

OIDC provider · connector-basicThrough the generic OAuth2 connector the stock image already includes. The provider's user info must carry email_verified, or Answer asks each person for an email address at first sign-in.

Build toolchain

Go · Node.js · pnpm · gitanswer build compiles the Go binary and rebuilds the web interface around the plugins. It runs in our build pipeline, never on your server.

Mail

SMTP relayFor notification emails. Answer sends none until SMTP is configured in its admin settings.

Migrating from Stack Internal to Apache Answer

Stack Internal, the product formerly called Stack Overflow for Teams, lets a team administrator download the team's data as JSON files: posts, comments, tags, users, votes, badges and images. Answer has no importer for it, and its plugin interface for imports only creates questions, so we write the import for your data. Questions, answers, comments and tags come across with their authors, dates and accepted answers, and images are uploaded again. Vote counts, reputation and badges stay behind: Answer earns reputation under its own rules, so it starts again for everyone. Each post arrives as its latest version, without its edit history. Articles have no equivalent in Answer, so they move to a wiki such as BookStack or Outline.

1. Download the team's data

   A team administrator downloads it from the Stack Internal settings as a ZIP of JSON files, or we read the questions, answers, comments, tags and users through its API with the exporter Stack publishes as open source. Everything after this works on that copy, never on the live team.

2. Create the accounts first

   Every author becomes an Answer account, matched by email address and linked to their Keycloak user. Answer refuses a single sign-on login whose address belongs to an account it has not linked yet, so the import writes those links instead of leaving them to the first sign-in.

3. Import into staging and check

   Questions, answers, comments and tags go into a staging copy of Answer, where the owners of the busiest tags check their own questions. Because everyone starts again at a reputation of 1, the privilege level is set to the one upstream intends for private teams.

4. Open it, then stop posting to the old team

   Answer opens to everyone through single sign-on and nothing new is posted to Stack Internal. A second, smaller import carries across what was asked in between, and the old team stays available for reference until its subscription ends.

The plugin list is the image

# Dockerfile. Plugins are compiled into the binary, so plugins.txt is the plugin list:
# connector-basic, reviewer-basic, captcha-basic, quick-links and search-meilisearch,
# one module@tag per line. Every tag comes from versions.env and moves after a test build.
ARG ANSWER_TAG
ARG GO_TAG
FROM apache/answer:${ANSWER_TAG} AS stock

FROM golang:${GO_TAG}-alpine AS build
ARG PNPM_TAG
RUN apk --no-cache add build-base git bash nodejs npm && npm install -g pnpm@${PNPM_TAG}
COPY --from=stock /usr/bin/answer /usr/bin/answer
COPY plugins.txt .
RUN answer build $(sed 's/^/--with /' plugins.txt) --output /usr/bin/answer-acme \
 && /usr/bin/answer-acme plugin

FROM stock
COPY --from=build /usr/bin/answer-acme /usr/bin/answer
COPY config.yaml.tmpl /etc/answer/config.yaml.tmpl
ENTRYPOINT ["/bin/sh", "-c", "mkdir -p /data/conf && envsubst < /etc/answer/config.yaml.tmpl > /data/conf/config.yaml && exec /entrypoint.sh"]

# config.yaml.tmpl
server:
  http:
    addr: 0.0.0.0:80
data:
  database:
    driver: postgres
    connection: host=pg.acme.internal port=5432 user=answer password=${ANSWER_DB_PASSWORD} dbname=answer sslmode=require
  cache:
    file_path: /data/cache/cache.db   # held in memory, written here every minute
i18n:
  bundle_dir: /data/i18n
swaggerui:
  show: false                         # true by default
service_config:
  upload_path: /data/uploads          # served by Answer itself, behind the sign-in

# OAuth2 Basic connector, set in the admin pages and stored in the database
#   Authorize URL   https://sso.acme.internal/realms/acme/protocol/openid-connect/auth
#   Token URL       https://sso.acme.internal/realms/acme/protocol/openid-connect/token
#   User JSON URL   https://sso.acme.internal/realms/acme/protocol/openid-connect/userinfo
#   User ID, email and email verified JSON paths: sub, email, email_verified
#   Scope           openid,email,profile
#   Redirect URI registered in Keycloak:
#     https://answers.acme.internal/answer/api/v1/connector/redirect/basic

What Pilae is responsible for

Where it runs

zur1, fra1, fal1, gra1, ams1, hel1, lon1, ash1, hil1, sin1, tok1, syd1, on-premZurich, Frankfurt, Falkenstein, Gravelines, Amsterdam, Helsinki, London, Ashburn, Hillsboro, Singapore, Tokyo, Sydney, Your own hardware

Who holds the credentials

You do. Ours are separate, named, logged and revocable with one command. We ask before anything changes outside an agreed window.

If you leave

The machine, the data, the compose files and the runbook are already yours. Nothing stops when our access does.

What running Apache Answer costs

On Starter, Apache Answer runs in Pilae Cloud for CHF 449EUR 479USD 559 a month, hosting and onboarding included. On Business, it is one of up to three apps for CHF 1,590EUR 1,690USD 1,990 a month, on your own servers or in Pilae Cloud. Enterprise is quoted. The plans set what each includes; these are the inputs that move the price around them.

Instance size

The CPU, memory and, where a model runs, the GPUs the app needs for your users and your data.

High availability

One machine with tested restores, or a replicated setup that keeps serving when a node fails.

Storage and backups

How much data it holds, how long backups are kept, and point-in-time recovery for its database.

Plan and support

Starter, Business or Enterprise: support hours, response times in the contract and how often we review the service with you.

Region

Your own hardware, where the infrastructure is already yours, or a Pilae Cloud region, where machines are priced per month. On Starter, Pilae chooses the site.

Sign-on and integrations

Single sign-on, directory sync, mail relays and the other systems the app has to reach.

Apache Answer: common questions

Also in collaboration and identity