Helpdock 1.0: My Open-Source, Self-Hosted Help Desk Is Stable

Executive Summary

• Helpdock 1.0.0 is out: the first stable release of my open-source, self-hosted customer support platform, under AGPL-3.0.
• One deploy: ticketing, live chat, a help center and an AI assistant for all your brands, in English and Arabic, on one server with 2 vCPU and 4 GB of memory.
• Every channel, one inbox: email, Telegram, WhatsApp, Messenger, Instagram, a website chat widget, web forms and a REST API.
• AI that stays inside your docs: it answers only from your knowledge base, cites its sources, and hands the conversation to your team when the docs don't answer.
• Measured: in English, 97.5% of answerable questions were answered correctly; in Arabic, 94.6%. Every question outside the knowledge base went to a human, and no prompt-injection attack worked. That's one model pair, so measure the one you choose.
• Tested before release: an external pentest, a load run, a screen-reader pass, an onboarding test with three outside testers, a restore drill, and an OWASP ASVS Level 2 walk-through with no gap open.

I made a short video of this on X. Everything in it is the real app running locally with demo data; the widget's AI runs on a local test model.

Helpdock 1.0 is stable: your whole help desk, one deploy

What's in 1.0

One inbox for every channel

Email (IMAP or an inbound webhook, replies over the brand's SMTP), the brand's Telegram bot, WhatsApp, Messenger and Instagram through Meta's Graph API, a chat widget on your website, a hosted web form and POST /api/v1/tickets all file into the same tickets, with the same statuses, SLAs, rules and assignment.

Every channel lands in one inbox

A full ticket desk

• SLA policies with business hours, holidays and time zones; clocks pause in the statuses you choose.
• Workflow rules and time-based rules with a test run and an execution log, macros with placeholders, tags, custom fields, merge, unmerge and split.
• New in 1.0: previous tickets on the contact card. The ticket shows up to three of the customer's other tickets, newest first, with their status, so a returning customer is easy to spot.

The real ticket view with the contact's previous tickets

AI that answers only from your knowledge base

The assistant reads help-center articles, uploaded PDF and DOCX files, crawled websites, Notion and Google Drive. Customer-facing answers read only public knowledge. It cites its sources and drops any citation that doesn't resolve to a retrieved document. When the knowledge base doesn't answer the exact question, or confidence is below the channel's threshold, the conversation goes to your team instead of a guess.

For agents it drafts replies, summarizes and translates. It works with any provider the pi-ai layer supports, or any OpenAI-compatible server such as Ollama or vLLM. PII is redacted before each call, there's a prompt-injection filter and per-brand budgets, and the model has no tools: it reads knowledge and writes text.

The real chat widget: an answer that cites the help-center article

Measured in English and Arabic

The release ran the bilingual evaluation in GitHub Actions, with glm-4.6 answering, glm-5.1 judging and bge-m3 embeddings:

• Answerable questions answered correctly: 97.5% in English (39 of 40) and 94.6% in Arabic (35 of 37). The goal is at least 85%.
• Questions outside the knowledge base handed to a human: 100% in both (12 of 12, 11 of 11). The goal is at least 95%.
• Prompt-injection attacks that worked: 0 of 6 in each language.
• Every citation resolved, and every answer came back in the question's language.

That's one provider pair. If you plug in another model, run the evaluation on it; the AI guide explains how.

Illustration: the AI evaluation results in English and Arabic

A help center in two languages

Each brand gets its own knowledge base on its own domain, with a certificate issued on demand. Articles are written in English and Arabic, with right-to-left pages, search in each language and "was this helpful?" feedback. Internal articles serve your staff from the same place.

The real help center in Arabic, right to left

Many brands, one install

Every tenant table carries a brand_id under a forced Postgres row-level security policy, and the API refuses to start if its database role could bypass it. Each brand has its own inboxes, channels, help center, widget theme and AI knowledge.

Also in 1.0

• For developers: a REST API with scoped keys and an OpenAPI document, HMAC-signed webhooks with retries and replay, and reports with CSV export.
• Staff SSO: SAML 2.0 and OpenID Connect, with guides for Okta, Microsoft Entra ID, Google Workspace and Keycloak.
• Migration: importers for Zendesk, Freshdesk and Zoho Desk, plus a CSV mapper for any other tool. I covered both in the 0.6.0 post.

How 1.0 was tested

Before tagging 1.0.0, every release gate had to pass:

1. An external penetration test of the widget and the API.
2. A load run on the reference host.
3. A screen-reader accessibility pass.
4. An onboarding test on a clean server with three outside testers.
5. A restore drill from backup.
6. An OWASP ASVS 4.0.3 Level 2 walk-through: every requirement with its evidence, no gap open.
7. The AI evaluation above.

To be clear, the pentest, load and onboarding results are held by me, not published in the repository. The release image is built for amd64 and arm64, signed keylessly with Cosign and shipped with a CycloneDX SBOM (release run).

Illustration: every release gate passed before 1.0.0

Install it

You need a Linux server with Docker Engine and Compose v2, 2 vCPU and 4 GB of memory, two DNS names (admin, and API plus widget), ports 80 and 443 open, and an S3-compatible bucket.

git clone --depth 1 --branch v1.0.0 https://github.com/Docker-Hunterpedia/Helpdock.git
cd Helpdock/docker
cp ../.env.example .env
openssl rand -base64 32   # the master key, for APP_MASTER_KEY

Set at least HELPDOCK_VERSION=1.0.0, APP_URL, APP_MASTER_KEY, the two database passwords and URLs, ADMIN_HOST, API_HOST, ACME_EMAIL and the S3 settings in .env, then:

docker compose up -d
docker compose ps

Open https://<ADMIN_HOST> and finish the first-run wizard before anyone else can reach the host. Back up .env with the database: without APP_MASTER_KEY, nothing encrypted can be read back. The install guide covers every step.

Already on 0.7? Set the version to 1.0.0 and restart. Database migrations run on their own when the API starts.

Known limits

• SSO and the importers were tested against stand-in services built from each vendor's documented API, not against a live Okta or Entra ID tenant or real vendor accounts.
• Help Scout, Intercom, Gorgias, Zammad and Front importers come after 1.0. Until then, use the CSV mapper.

Helpdock is open source under AGPL-3.0. If it's useful to you, a star on GitHub helps, and issues are welcome.

Sources

• Helpdock 1.0.0 release and changelog
• Helpdock README
• AI evaluation run and AI guide
• OWASP ASVS Level 2 walk-through
• Release run with Cosign signing and the SBOM