S5/S7 AI for Windows:Company Server

A Company Server allows an organization to provide a centrally managed AI connection for S5/S7 AI Copilot. End users do not need personal OpenAI or Anthropic API keys.

The customer package is self-contained. The customer does not need the internal IBHsoftec server project.

Functions

The reference server:

• accepts Copilot chat requests;
• forwards requests to the configured upstream AI service;
• publishes the available model;
• authorizes individual PCs by fingerprint;
• keeps provider credentials on the server;
• can run as a Linux systemd service or Docker container.

Supported upstream services include OpenAI-compatible APIs such as Ollama, Open WebUI, vLLM and LiteLLM.

Download

Download the S57AI Company Server customer package

The package contains the FastAPI reference server, configuration examples, systemd service, Dockerfile and detailed README.

Requirements

• Linux server or virtual machine;
• Python 3.10 or newer, or Docker;
• network access from Copilot PCs to the server;
• access from the server to the selected upstream AI service;
• HTTPS and reverse proxy recommended for production use.

Quick start with Python

python3 -m venv /opt/s57ai-company-server/venv
/opt/s57ai-company-server/venv/bin/pip install -r requirements.txt

Copy company-server.env.example to a protected environment file and configure at least:

UPSTREAM_BASE_URL=http://127.0.0.1:11434/v1
UPSTREAM_MODEL=deepseek-coder-v2:16b
UPSTREAM_API_KEY=your-upstream-key
ALLOWED_FINGERPRINTS=FINGERPRINT-OF-APPROVED-PC

Start the server:

/opt/s57ai-company-server/venv/bin/uvicorn server:app --host 0.0.0.0 --port 8080

Quick start with Docker

Build and run the image from the customer package:

docker build -t s57ai-company-server .
docker run --env-file company-server.env -p 8080:8080 s57ai-company-server

The container runs with a non-privileged user and includes a health check.

Configure Copilot

1. Open S5/S7 AI Copilot.
2. Select Company Server.
3. Enter the externally reachable server URL.
4. Copy the displayed fingerprint.
5. Add the fingerprint to ALLOWED_FINGERPRINTS on the server.
6. Restart the server and test a Copilot request.

Example:

https://ai.company.example

API used by Copilot

The Company Server provides:

• GET /v1/models for the model list;
• POST /v1/copilot/chat for Copilot text requests;
• a health endpoint for monitoring.

The model list reported by the server replaces local model defaults in Copilot.

Production recommendations

• publish the service only through HTTPS;
• use nginx or another reverse proxy;
• restrict incoming network access;
• store environment files with limited permissions;
• rotate upstream API keys regularly;
• back up the configuration and fingerprint allowlist;
• monitor health, logs, storage and response times;
• never expose an unsecured Ollama or Open WebUI endpoint to the Internet.

Troubleshooting

If Copilot cannot connect:

1. verify the URL and port from the Copilot PC;
2. check firewall and reverse-proxy rules;
3. verify the approved fingerprint;
4. check the Company Server log;
5. test access from the Company Server to the upstream AI service;
6. verify the exact upstream model name.

If the model list is empty, check UPSTREAM_MODEL and the upstream model API. If a request exceeds the model context window, reduce the project context or configure a model with a larger context size.

Security responsibility

The customer operates and secures the Company Server. The organization is responsible for upstream provider terms, network security, access control, logging, retention and protection of PLC project data.

Further information: Copilot access to AI