Turn on advanced search, Plane AI, and sensitive data scanning on self-hosted Plane

Self-hosted Plane ships with three add-ons that start switched off: advanced search, Plane AI, and sensitive data scanning.

Advanced search runs on an OpenSearch cluster you provide. Plane AI and the scanner are containers in Plane's own stack, set to zero replicas. You turn each one on with a few keys in plane.env, then check it from the terminal or in the app.

Advanced search needs OpenSearch 2.19 or later, on your own servers or as a managed service.

One command connects Plane to it: sudo prime-cli configure, with --opensearch-url, a username, a password, and an index prefix.

sudo prime-cli configure \
  --opensearch-enabled \
  --opensearch-url https://<your-opensearch-host>:9200 \
  --opensearch-username <username> \
  --opensearch-password "<password>" \
  --opensearch-index-prefix <prefix>

1. It lists the keys it will change in plane.env, with the password masked, and restarts Plane when you confirm.
2. Next, in the API container, manage_search_index builds the indexes with index rebuild, then fills them in the background with document index.

From then on, each change waits in a Redis queue, and a worker sends the batch every five seconds. The queue needs Redis 6.2 or later.

On Kubernetes, the Helm chart can run OpenSearch for you, or point Plane at yours.

In the app, the search box in the top bar now searches the whole workspace through OpenSearch. Press / to jump to it. Results update as you type, and a title matches on the first letters of any word in it. Each person sees results only from projects they can open.

Plane AI needs an API key from your LLM provider, the OpenSearch that advanced search uses, its own database, and read access to Plane's database.

It comes as four services: an API, a worker, a scheduler, and a migrator that runs once. All four start at zero replicas.

1. On the bundled Postgres, Plane creates Plane AI's database for you. On a managed server, create it yourself first.
2. Then prime-cli configure, with -e for each key, sets the two database URLs, the API key, and one replica per service, then restarts Plane. You don't set Plane AI's address or its OAuth callback: Plane builds both from your domain.
3. To check, curl /pi/ready/ on your Plane domain. It answers ready, true, when Plane AI can reach its database.

Embeddings are optional. Without an embedding model, Plane AI searches by keyword. Set one, then run manage_search_index once with --vectorize. To add your own model, use the custom LLM keys.

On Kubernetes, set services.pi.enabled to true in the chart's values.

In the app, an AI assistant button appears in the top bar. MCP connectors for Plane AI are in Workspace settings, then Integrations, then Connectors.

Each workspace has its own switch, in Workspace settings, then Plane AI. It starts on, so turn it off in any workspace that shouldn't use AI.

Open Workspace settings, then Sensitive data scanning. Until the scanner runs, the page says it isn't set up. If it says isn't enabled instead, the workspace's plan doesn't include it.

The scanner is Argus, one service plus a migrator that runs once and exits. Argus keeps its own schema in Plane's database and only reads Plane's tables. Nothing leaves your deployment. It never stores a value it matches, only a fingerprint made with a secret you generate.

1. Make the secret with openssl rand -hex 32, and keep it. A new secret invalidates every fingerprint Argus has stored.
2. One configure run sets the secret, one Argus replica, and one migrator, then restarts Plane. Keep Argus at one replica: a second would fail the scans the first is running.
3. To check, sudo prime-cli healthcheck lists Argus as healthy and its migrator as gracefully stopped, and a curl to /argus/healthz on your Plane domain returns status, ok.
4. Back on the settings page, press Retry. It opens on the scan history, with tabs for Scan, Detectors, and Allow list.

On Kubernetes, set services.argus.enabled to true, with the fingerprint secret in the chart's values.

Search now runs through OpenSearch, Plane AI on its own database, and scanning on Argus, and you've checked all three.