M↓ View as Markdown ↗

Connected and Air-gapped deployments

Availability

• Deployment: Self-managed deployments only. Actian SaaS always runs Connected.

A self-managed deployment declares one network posture. The posture applies to the whole deployment and every organization on it. You can't set it per organization.

Posture	What it means
Connected	The deployment may reach Actian and third-party services on the internet.
Air-gapped	The server refuses vendor-hosted keys and settings at boot, and you run every dependency (identity provider, LLM, embeddings, object storage, mail and tracing) on your network. Your network controls keep egress closed (see How Air-gapped is enforced). Vendor integrations that can't be self-hosted are unavailable rather than degraded.

Set the posture

The server reads the posture from NETWORK_POSTURE, which must be connected or air-gapped. If the value is missing or unknown, the server refuses to start.

Compose bundleHelm chart

The Compose bundle always runs Air-gapped. NETWORK_POSTURE is fixed to air-gapped, and that stays true even when you use the compose.customer-network.yml override to reach services on your network.

Set server.networkPosture to connected or air-gapped. The chart default is connected, so an Air-gapped install must set it explicitly:

server:
  networkPosture: air-gapped

The values-airgap.example.yaml file in the Release bundle already sets it.

Connected self-managed deployments use the Helm chart. The Compose bundle has no Connected option.

How Air-gapped is enforced

Air-gapped is enforced in two layers.

At boot, the server checks its configuration. On an Air-gapped deployment the server refuses to start in these cases:

• A vendor-hosted key is set. This covers keys for Slack, Microsoft Teams, Intercom, web search (TAVILY_API_KEY), Amazon SES mail, Google Cloud Storage, a cloud KMS key for warehouse credentials (WAREHOUSE_KMS_KEY), the Actian Inference provider keys (ANTHROPIC_API_KEY, OPENAI_API_KEY), the Auth0 Management API, and other services used only by Actian SaaS. The error names each key it found:

  NETWORK_POSTURE=air-gapped forbids vendor-hosted env vars: <keys>. Unset them; these integrations are unavailable on an Air-gapped deploy.
  

• A setting would reach a vendor-hosted service. The error starts with NETWORK_POSTURE=air-gapped: and lists each problem:

  Setting	Why it's refused	Fix
  IDENTITY_BACKEND is auth0 or unset	Unset defaults to Auth0.	Set IDENTITY_BACKEND=keycloak.
  LLM_PROVIDER is anthropic or openai	These values select Actian Inference.	Use openai-compatible with your own API, or leave it unset.
  Agent tracing keys are set without a tracing base URL	Without a base URL, traces would go to a hosted tracing service.	Point the tracing base URL at your own tracing server, or remove the keys.
  STORAGE_DRIVER=s3 without S3_ENDPOINT	Without an endpoint, objects would go to AWS S3.	Set S3_ENDPOINT to your S3-compatible server.
  EMBEDDING_MODEL without EMBEDDING_BASE_URL (or EMBEDDING_NEXT_MODEL without EMBEDDING_NEXT_BASE_URL)	The default embedding endpoint is vendor-hosted.	Set the base URL to your own embedding API.

• The support channel is set to managed. The managed channel reaches Intercom and Slack, so SUPPORT_CHANNEL=managed stops the server with its own error. Use local, or leave it unset (Air-gapped deployments default to local).

At the network layer, your environment blocks egress.

• Compose bundle: every container sits on a Docker internal network with no route off the host. The reverse proxy also joins an edge network so its ports can be published. If you add the compose.customer-network.yml override so the server, Keycloak and JDBC bridge can reach your own services, the host firewall becomes what keeps the install Air-gapped. Allow traffic out of that network only to your own address ranges. See Warehouse connectivity.
• Helm chart: the server's boot checks apply, and your cluster's egress policy does the rest. The chart doesn't ship a NetworkPolicy for the server, so define one that matches your environment.

See the Configuration reference for every setting.

What members can't use on an Air-gapped deployment

Feature	What happens when Air-gapped
Slack and Microsoft Teams integrations	Not available. The Slack and Teams tiles still appear under Connections, but the integrations aren't configured on an Air-gapped deployment. In the Connect Microsoft Teams dialog, Download app package shows Teams is not configured for this deployment to administrators who manage integrations.
In-app support chat	The Support item under Resources in the Studio sidebar is hidden.
Docs	The Docs tab in the right-hand panel is removed (a link to it opens Steward instead), and the Docs link under Resources is hidden.
Help links on error screens	The Help and Contact support buttons on the error screen are hidden.
Contact buttons	The Contact us button in plan-limit dialogs, the contact button on a blocked organization's screen (such as Contact sales or Contact Actian), and the Contact us button on the pending-deletion screen are hidden.
Steward web search	Steward has no web search tool, because the search provider is vendor-hosted.
Actian Inference	Not available. Chat uses an OpenAI-compatible API that you run. See Configure inference.

Changelog under Resources stays available.

What works differently on an Air-gapped deployment

• Bug reports stay on your installation. Report a Bug remains under Resources unless you set SUPPORT_ENABLED=false. The dialog reads: Tell us what went wrong. Your report stays on this installation; an administrator includes it in the diagnostic export for Actian. After a member submits, they see Thanks! Your bug report has been saved. Reports reach Actian only when an administrator hands over a Diagnostic export.
• Email domain checks skip DNS. When an administrator invites a member or sets the organization's contact email, AI Analyst doesn't look up the domain's mail (MX) records. The built-in block lists for disposable and hosting mailboxes still apply.

Product documentation on Air-gapped deployments

The in-app Docs tab loads articles from the online documentation at docs.actian.com/ai-analyst, which an Air-gapped deployment can't reach, so AI Analyst hides it. The Release bundle doesn't include a copy of this documentation.

Services you host on an Air-gapped deployment

Service	Required?	Notes
Identity provider	Required	Keycloak 26.5 or later with Organizations turned on. Bundled with Compose; optional in the Helm chart. See Identity and first sign-in.
OpenAI-compatible chat API	Required for chat	Must support tool calling. Until you configure one, every question is refused. See Configure inference.
OpenAI-compatible embedding API	Optional	Without it, search matches keywords only.
SMTP relay	Needed for email features	Needed for emailed invitations, self-registration through sign-up domains, Scheduled Insights and notification email. Without one, you can't invite members by email, so the first Administrator is the only member until you set one up. See Identity and first sign-in.
Postgres and object storage	Required	Bundled with Compose. With Helm, Postgres 16 with vector and pg_trgm, and S3-compatible storage with S3_ENDPOINT.

Connected self-managed deployments

A Connected self-managed deployment runs the Helm chart with server.networkPosture: connected. Connected allows outbound calls, so:

• Docs works. The server fetches articles from docs.actian.com, so it needs outbound access to that host.
• Identity: you can use Keycloak, or an Auth0 tenant that Actian provisions for your deployment. Contact Actian about the Auth0 option. A deployment never mixes the two.
• Images: instead of loading tarballs from the Release bundle, you can pull the product images by digest from Actian's registry. See Release bundle.
• Inference: use your own OpenAI-compatible API. Set LLM_PROVIDER=openai-compatible, or leave it unset. Don't set LLM_PROVIDER to anthropic or openai on a self-managed deployment.
• Bug reports and support chat: by default the support channel is managed. Report a Bug appears only when SLACK_FEEDBACK_WEBHOOK_URL is set, and the report is posted to the Slack webhook you configure. The Support chat appears only when INTERCOM_WEB_SDK_SECRET is set. To keep bug reports on your installation, set SUPPORT_CHANNEL=local. To remove support features, set SUPPORT_ENABLED=false.

Note

Contact Actian to confirm which Connected options are available for your deployment.

Troubleshooting

The server won't start and the log mentions NETWORK_POSTURE. Read the error: it names each offending key or setting. Remove vendor-hosted keys, or fix the settings listed in How Air-gapped is enforced, then restart and check the log again. The server can report the setting errors before the vendor-hosted key error, so fixing one can reveal the other. With Compose, run docker compose logs server to see the error.

Members see the Slack or Teams tile but can't connect. This is expected on an Air-gapped deployment. These integrations need vendor-hosted services and aren't configured.

Members can't find the Docs tab or the Support item. Both are hidden on Air-gapped deployments. Members can still use Report a Bug (unless you turned support off), and you can send reports to Actian in a Diagnostic export.