Deployment
Run the entire control plane air-gapped.
Signed mega-tarball delivery, JWS licence tokens, Caddy internal CA - zero external dependencies. Nothing phones home. No telemetry leaves your network.
Public internet
- Download signed tarball
- Receive licence JWS
- (One-way · then disconnected)
Your air-gapped network
- Verify tarball signature
- Validate licence JWS offline
- Caddy internal CA · self TLS
- Postgres · brain · daemons
- SIEM push to internal sinks
How it works
1
Download signed tarball
On a connected host - single ~140 MB file, Ed25519-signed.
2
Transfer across the gap
USB, one-way diode, internal mirror - your choice.
3
Verify signature + licence
Install script checks tarball signature against bundled pubkey. Licence JWS validated locally - no callback.
4
Install · internal CA
Caddy issues internal TLS certs from a self-rooted CA. No Let's Encrypt, no ACME.
Deep dives
Signed delivery
Every tarball is Ed25519-signed by our release key. The pubkey ships with the installer - a compromised mirror can't slip a malicious build past you.
Licence as JWS
Self-contained JSON Web Signature - seat limits, expiry, features. Verified locally against our public licence-issuer key. No phone-home required.
Internal CA
Caddy bootstraps its own root CA on first install. Service-to-service TLS uses internal certs only - no public ACME, no internet trust roots.
Installation
shell · air-gap install
# On connected host — download signed tarball
$ curl -fsSLO https://releases.example.com/v0.9.2.tar.xz
# Transfer the bundle across the gap, then on the target host:
$ synaptyx-install \
--tarball v0.9.2.tar.xz \
--license-file acme-airgap.jws
✓ Bundle MANIFEST signature verified (ed25519:b3:9f8c…3a4e)
✓ License valid · 247 days remaining
✓ Caddy internal CA bootstrapped
✓ Services running — open https://synaptyx.acme.internal
Nothing phones home.
No telemetry, no analytics ping, no auto-update check. The control plane runs identically whether the wire is connected or not. For gov / finance / defense - this is non-negotiable, and we built for it from day one.
Compare
| Synaptyx | SaaS-only competitors | Self-host w/ external deps | |
|---|---|---|---|
| Zero internet required | 100% | cloud-only | needs ACME / DNS / docker hub |
| Signed delivery | Ed25519 tarball | N/A | docker image · maybe signed |
| Offline licence | JWS · local verify | subscription check | license server callback |
| Internal CA | Caddy bootstrap | vendor cert | bring your own PKI |
| No telemetry | verifiable | always | depends on stack |
FAQ
Same as install - download the new signed tarball on a connected host, transfer it across, then run synaptyx-install --upgrade-from <new-tarball>. Migrations are bundled and idempotent, with a pre-upgrade snapshot for rollback.
We issue a new JWS; you bring it across the gap and run synaptyx-license install --license acme-airgap-2027.jws. A grace period covers transfer delay.
x86_64 or arm64 Linux. 4 cores · 16 GB RAM · 100 GB SSD for the brain. Optional GPU for self-hosted embeddings. Postgres 15+. Tested on RHEL 8/9, Ubuntu 22.04+, Debian 12, SUSE 15.
Yes - that's the design centre. Built for defence, finance, and government from day one. SOC 2 (in progress), DPA on request, FedRAMP roadmap on Enterprise.
Ready to govern your AI infrastructure?
Request access in minutes - or talk to us about your air-gap deployment.