The Problem

Organizations that need a self‑hosted, omnichannel support desk often must choose between expensive SaaS suites (Intercom, Zendesk) or fragmented open‑source alternatives that lack integrated AI, multi‑channel support, and easy deployment. This repo aggregates several projects that together aim to fill that gap, but the loose coupling means a newcomer must understand four independent code bases before running the platform.

What This Does

The repository consists of four self‑contained projects [MEASURED ANALYSIS]:

  • app – 5 680 files (950 code, 2 496 data). Contains the core Ruby on Rails API, React/ Vue front‑end, Tailwind‑styled dashboard, and ONNX‑based sentiment‑analysis model (vendor/db/sentiment-analysis.onnx). Entry points include app/javascript/dashboard/components-next/... and Rails routes under config/.
  • theme – 2 files (2 code). Provides the default UI theme and static assets.
  • .circleci – 2 files (1 code). CI pipelines for testing, building Docker images, and publishing.
  • __mocks__ – 1 file (1 code). Test mocks used by the spec suite.

The app project wires a Rails backend (Gemfile, config/) to a React dashboard (package.json, app/javascript/). Conversations are persisted via database migrations (db/migrate/) and webhook secrets are stored in config/secrets.yml. The front‑end consumes the API through app/javascript/dashboard/composables/. Sentiment scoring runs the ONNX model inside a background job (lib/).

How It Is Wired

Execution starts at the Rails router (config/routes.rb) which delegates to controllers that call service objects in app/services/. The dashboard UI bootstraps at app/javascript/dashboard/components/index.js and renders conversation lists via the base/index.js and table/index.js components. WebSocket connections for live chat are handled by ActionCable channels defined in app/channels/. The CI pipelines in .github/workflows/ run run_foss_spec.yml and run_mfa_spec.yml against the test suite (1 253 test files). The Docker base image is declared in .devcontainer/Dockerfile using a mutable tag ghcr.io/chatwoot/chatwoot_codespace:latest.

External touches – Docker Compose files (.devcontainer/docker-compose.yml, .github/workflows/publish_*_docker.yml) orchestrate the stack (PostgreSQL, Redis, Elasticsearch). The ONNX model is loaded by a background job that scores inbound messages. GitHub Actions secrets are referenced in workflow files that deploy Docker images to GHCR.

How To Use It

# Spin up the full stack with Docker Compose (as defined in .devcontainer/) docker compose -f .devcontainer/docker-compose.yml up -d


- **Configuration**  
  Copy `.env.example` to `.env` and set the required variables: `DATABASE_URL`, `REDIS_URL`, `SECRET_KEY_BASE` (generated by `rails secret`), and `ONNX_MODEL_PATH` (pointing at `vendor/db/sentiment-analysis.onnx`).  

- **Running it**  
  After containers are up, run the Rails console to verify the DB is reachable:  
  ```bash
  docker exec -it chatwoot_app_1 bundle exec rails console

The dashboard becomes available at http://localhost:3000 (mapped port in docker-compose.yml).

  • Testing (if needed) ``bash docker exec -it chatwoot_app_1 bundle exec rspec # runs the 1 253 spec files ``

Real‑World Use

A midsize SaaS company wants to replace a $2 k/month Intercom plan with a self‑hosted solution that also provides AI‑driven triage. They deploy Chatwoot behind their VPC, configure incoming email (config/mailer/), and enable the Captain AI agent (referenced in the README) to auto‑respond to common queries. Agents use the dashboard (app/javascript/dashboard/) to add private notes (@mentions), apply labels, and assign conversations. The ONNX sentiment model tags messages as positive/negative, surfacing them in the UI for prioritisation.

Code Health & Issues

  • HIGH – Pin third‑party GitHub Actions to a commit SHA: .github/workflows uses docker/setup-qemu-action@v3, docker/setup-buildx-action@v3, docker/login-action@v3, docker/build-push-action@v6. Tags can move, risking secret exposure.
  • HIGH – Make CI invoke the test suite it has: 1 253 test files but no test command in the four workflows read.
  • MEDIUM – Declare least‑privilege permissions for GITHUB_TOKEN: 4 workflows declare no permissions, 2 reference secrets.
  • MEDIUM – Enable Dependabot or Renovate: 2 manifest(s) present, no update bot configured.
  • MEDIUM – Pin the container base image by digest: .devcontainer/Dockerfile uses ghcr.io/chatwoot/chatwoot_codespace:latest (mutable tag).
  • MEDIUM – Gate pull requests on a dependency vulnerability scan: no dependency scan in CI.
  • MEDIUM – Move large binaries to Git LFS or out of the repository: vendor/db/sentiment-analysis.onnx (65.8 MB) and large_file.pdf (26.0 MB).
  • LOW – Set timeout-minutes on workflow jobs: 4 workflows declare no job timeout.

All findings are from static analysis; no additional issues are inferred.

The Bottom Line

This repo is a pragmatic collection of four projects that together deliver a self‑hosted, omnichannel support platform with an AI agent. The app code base is well‑structured for a Rails + React stack, but the lack of CI test invocation, mutable Docker tags, and unpinned GitHub Actions pose real security and maintenance risks. Teams that can invest in hardening the CI pipeline, fixing image digests, and migrating large binaries to LFS will get a solid, extensible alternative to commercial help‑desk tools.