---
description: How Connected and Air-gapped self-managed deployments differ, how Air-gapped is enforced, and which features members can't use on an Air-gapped deployment.
---

# Connected and Air-gapped deployments

!!! info "Availability"
    - **Deployment:** Self-managed deployments only. Actian SaaS always runs Connected.

A self-managed deployment declares one *network posture*. The posture applies to the whole deployment and every organization on it. You can't set it per organization.

| Posture | What it means |
|---|---|
| **Connected** | The deployment may reach Actian and third-party services on the internet. |
| **Air-gapped** | The server refuses vendor-hosted keys and settings at boot, and you run every dependency (identity provider, LLM, embeddings, object storage, mail and tracing) on your network. Your network controls keep egress closed (see [How Air-gapped is enforced](#how-air-gapped-is-enforced)). Vendor integrations that can't be self-hosted are unavailable rather than degraded. |

## Set the posture

The server reads the posture from `NETWORK_POSTURE`, which must be `connected` or `air-gapped`. If the value is missing or unknown, the server refuses to start.

=== "Compose bundle"

    The Compose bundle always runs Air-gapped. `NETWORK_POSTURE` is fixed to `air-gapped`, and that stays true even when you use the `compose.customer-network.yml` override to reach services on your network.

=== "Helm chart"

    Set `server.networkPosture` to `connected` or `air-gapped`. The chart default is `connected`, so an Air-gapped install must set it explicitly:

    ```yaml
    server:
      networkPosture: air-gapped
    ```

    The `values-airgap.example.yaml` file in the [Release bundle](release-bundle.md) already sets it.

Connected self-managed deployments use the Helm chart. The Compose bundle has no Connected option.

## How Air-gapped is enforced

Air-gapped is enforced in two layers.

**At boot, the server checks its configuration.** On an Air-gapped deployment the server refuses to start in these cases:

- **A vendor-hosted key is set.** This covers keys for Slack, Microsoft Teams, Intercom, web search (`TAVILY_API_KEY`), Amazon SES mail, Google Cloud Storage, a cloud KMS key for warehouse credentials (`WAREHOUSE_KMS_KEY`), the Actian Inference provider keys (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`), the Auth0 Management API, and other services used only by Actian SaaS. The error names each key it found:

    ```text
    NETWORK_POSTURE=air-gapped forbids vendor-hosted env vars: <keys>. Unset them; these integrations are unavailable on an Air-gapped deploy.
    ```

- **A setting would reach a vendor-hosted service.** The error starts with `NETWORK_POSTURE=air-gapped:` and lists each problem:

    | Setting | Why it's refused | Fix |
    |---|---|---|
    | `IDENTITY_BACKEND` is `auth0` or unset | Unset defaults to Auth0. | Set `IDENTITY_BACKEND=keycloak`. |
    | `LLM_PROVIDER` is `anthropic` or `openai` | These values select Actian Inference. | Use `openai-compatible` with your own API, or leave it unset. |
    | Agent tracing keys are set without a tracing base URL | Without a base URL, traces would go to a hosted tracing service. | Point the tracing base URL at your own tracing server, or remove the keys. |
    | `STORAGE_DRIVER=s3` without `S3_ENDPOINT` | Without an endpoint, objects would go to AWS S3. | Set `S3_ENDPOINT` to your S3-compatible server. |
    | `EMBEDDING_MODEL` without `EMBEDDING_BASE_URL` (or `EMBEDDING_NEXT_MODEL` without `EMBEDDING_NEXT_BASE_URL`) | The default embedding endpoint is vendor-hosted. | Set the base URL to your own embedding API. |

- **The support channel is set to `managed`.** The managed channel reaches Intercom and Slack, so `SUPPORT_CHANNEL=managed` stops the server with its own error. Use `local`, or leave it unset (Air-gapped deployments default to `local`).

**At the network layer, your environment blocks egress.**

- **Compose bundle**: every container sits on a Docker internal network with no route off the host. The reverse proxy also joins an edge network so its ports can be published. If you add the `compose.customer-network.yml` override so the server, Keycloak and JDBC bridge can reach your own services, the host firewall becomes what keeps the install Air-gapped. Allow traffic out of that network only to your own address ranges. See [Warehouse connectivity](warehouse-connectivity.md).
- **Helm chart**: the server's boot checks apply, and your cluster's egress policy does the rest. The chart doesn't ship a NetworkPolicy for the server, so define one that matches your environment.

See the [Configuration reference](configuration-reference.md) for every setting.

## What members can't use on an Air-gapped deployment

| Feature | What happens when Air-gapped |
|---|---|
| Slack and Microsoft Teams integrations | Not available. The Slack and Teams tiles still appear under **Connections**, but the integrations aren't configured on an Air-gapped deployment. In the Connect Microsoft Teams dialog, **Download app package** shows **Teams is not configured for this deployment** to administrators who manage integrations. |
| In-app support chat | The **Support** item under **Resources** in the Studio sidebar is hidden. |
| Docs | The **Docs** tab in the right-hand panel is removed (a link to it opens **Steward** instead), and the **Docs** link under **Resources** is hidden. |
| Help links on error screens | The **Help** and **Contact support** buttons on the error screen are hidden. |
| Contact buttons | The **Contact us** button in plan-limit dialogs, the contact button on a blocked organization's screen (such as **Contact sales** or **Contact Actian**), and the **Contact us** button on the pending-deletion screen are hidden. |
| Steward web search | Steward has no web search tool, because the search provider is vendor-hosted. |
| Actian Inference | Not available. Chat uses an OpenAI-compatible API that you run. See [Configure inference](configure-inference.md). |

**Changelog** under **Resources** stays available.

## What works differently on an Air-gapped deployment

- **Bug reports stay on your installation.** **Report a Bug** remains under **Resources** unless you set `SUPPORT_ENABLED=false`. The dialog reads: *Tell us what went wrong. Your report stays on this installation; an administrator includes it in the diagnostic export for Actian.* After a member submits, they see **Thanks! Your bug report has been saved.** Reports reach Actian only when an administrator hands over a [Diagnostic export](diagnostic-export.md).
- **Email domain checks skip DNS.** When an administrator invites a member or sets the organization's contact email, AI Analyst doesn't look up the domain's mail (MX) records. The built-in block lists for disposable and hosting mailboxes still apply.

## Product documentation on Air-gapped deployments

The in-app **Docs** tab loads articles from the online documentation at `docs.actian.com/ai-analyst`, which an Air-gapped deployment can't reach, so AI Analyst hides it. The Release bundle doesn't include a copy of this documentation.

## Services you host on an Air-gapped deployment

| Service | Required? | Notes |
|---|---|---|
| Identity provider | Required | Keycloak 26.5 or later with Organizations turned on. Bundled with Compose; optional in the Helm chart. See [Identity and first sign-in](identity-and-first-sign-in.md). |
| OpenAI-compatible chat API | Required for chat | Must support tool calling. Until you configure one, every question is refused. See [Configure inference](configure-inference.md). |
| OpenAI-compatible embedding API | Optional | Without it, search matches keywords only. |
| SMTP relay | Needed for email features | Needed for emailed invitations, self-registration through sign-up domains, Scheduled Insights and notification email. Without one, you can't invite members by email, so the first Administrator is the only member until you set one up. See [Identity and first sign-in](identity-and-first-sign-in.md). |
| Postgres and object storage | Required | Bundled with Compose. With Helm, Postgres 16 with `vector` and `pg_trgm`, and S3-compatible storage with `S3_ENDPOINT`. |

## Connected self-managed deployments

A Connected self-managed deployment runs the Helm chart with `server.networkPosture: connected`. Connected allows outbound calls, so:

- **Docs** works. The server fetches articles from `docs.actian.com`, so it needs outbound access to that host.
- **Identity**: you can use Keycloak, or an Auth0 tenant that Actian provisions for your deployment. Contact Actian about the Auth0 option. A deployment never mixes the two.
- **Images**: instead of loading tarballs from the Release bundle, you can pull the product images by digest from Actian's registry. See [Release bundle](release-bundle.md#connected-installs-pull-images-from-a-registry).
- **Inference**: use your own OpenAI-compatible API. Set `LLM_PROVIDER=openai-compatible`, or leave it unset. Don't set `LLM_PROVIDER` to `anthropic` or `openai` on a self-managed deployment.
- **Bug reports and support chat**: by default the support channel is `managed`. **Report a Bug** appears only when `SLACK_FEEDBACK_WEBHOOK_URL` is set, and the report is posted to the Slack webhook you configure. The **Support** chat appears only when `INTERCOM_WEB_SDK_SECRET` is set. To keep bug reports on your installation, set `SUPPORT_CHANNEL=local`. To remove support features, set `SUPPORT_ENABLED=false`.

!!! note
    Contact Actian to confirm which Connected options are available for your deployment.

## Troubleshooting

**The server won't start and the log mentions `NETWORK_POSTURE`.**
Read the error: it names each offending key or setting. Remove vendor-hosted keys, or fix the settings listed in [How Air-gapped is enforced](#how-air-gapped-is-enforced), then restart and check the log again. The server can report the setting errors before the vendor-hosted key error, so fixing one can reveal the other. With Compose, run `docker compose logs server` to see the error.

**Members see the Slack or Teams tile but can't connect.**
This is expected on an Air-gapped deployment. These integrations need vendor-hosted services and aren't configured.

**Members can't find the Docs tab or the Support item.**
Both are hidden on Air-gapped deployments. Members can still use **Report a Bug** (unless you turned support off), and you can send reports to Actian in a [Diagnostic export](diagnostic-export.md).