Self-hosted diagram renderer
Text diagrams are normally drawn by our rendering service. If your policy says diagram source must not leave your network, point the app at your own Kroki-compatible server instead.
Everything else stays the same: the same languages, the same editors, the same storage in your Confluence site.
#When you would change this
Regulated environments where source may not leave the network.
Organisations with an existing Kroki deployment.
Air-gapped or heavily restricted networks.
#What you can set
Setting | What it does |
|---|---|
Requirement | A Kroki-compatible server reachable from your users' browsers. |
Configuration | The renderer URL, set in site settings. |
Egress | The renderer's domain must be approved as an egress domain. |
Scope | Text languages only. draw.io and Excalidraw already render in the browser. |
This is the answer to the hardest security question. Combined with source stored in your own Confluence site, a self-hosted renderer means diagram content never reaches us at all.
#A few things that catch people out
The server must be reachable from the reader's browser, not only from your data centre.
Version differences between your Kroki and ours can render the same source slightly differently.
If the renderer is unreachable, diagrams fail to draw rather than silently falling back to ours.
#Related
Set it once, in the right place.
