[{"data":1,"prerenderedAt":279},["ShallowReactive",2],{"-docs-deploy-airgap":3,"-docs-deploy-airgap-surround":266},{"id":4,"title":5,"body":6,"description":256,"extension":257,"links":258,"meta":259,"navigation":260,"path":262,"seo":263,"stem":264,"__hash__":265},"docs\u002Fdocs\u002F3.deploy\u002F3.airgap.md","Air-gap deploy",{"type":7,"value":8,"toc":248},"minimark",[9,13,18,26,47,59,63,90,108,112,119,172,176,198,202,214,217,221,244],[10,11,12],"p",{},"TheSpider is built to run fully air-gapped. Validation is air-gap-safe by default (public keys embedded in the image); telemetry has a documented off switch; methodology ships as a bundled snapshot.",[14,15,17],"h2",{"id":16},"validate-the-license-offline","Validate the license offline",[10,19,20,21,25],{},"License validation uses ",[22,23,24],"strong",{},"embedded public keys",", so it works with zero outbound network:",[27,28,29,41],"ul",{},[30,31,32,36,37,40],"li",{},[33,34,35],"code",{},"LICENSE_JWKS_URL"," defaults to ",[33,38,39],{},"off",". Leave it unset\u002Fempty for a fully air-gapped install — no JWKS refresh is attempted.",[30,42,43,46],{},[33,44,45],{},"LICENSE_PUBLIC_KEY"," lets you override the embedded key with a base64url raw Ed25519 key for rotation, still with no network.",[10,48,49,50,54,55,58],{},"A boot with a ",[51,52,53],"em",{},"malformed\u002Fbad-signature"," license ",[22,56,57],{},"fails loudly"," instead of degrading — you'll know at startup, not silently weeks later.",[14,60,62],{"id":61},"turn-telemetry-off","Turn telemetry off",[64,65,71],"pre",{"className":66,"code":67,"filename":68,"language":69,"meta":70,"style":70},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","TELEMETRY=off\n","deploy\u002F.env","bash","",[33,72,73],{"__ignoreMap":70},[74,75,78,82,86],"span",{"class":76,"line":77},"line",1,[74,79,81],{"class":80},"sTEyZ","TELEMETRY",[74,83,85],{"class":84},"sMK4o","=",[74,87,89],{"class":88},"sfazB","off\n",[10,91,92,95,96,99,100,103,104,107],{},[33,93,94],{},"TELEMETRY=off"," means zero outbound traffic. When on, telemetry sends ",[22,97,98],{},"only"," ",[33,101,102],{},"{ version, deployment_mode, instance\u002Flicense id, usage rollups (counts), error counts }"," — never findings content (asserted in the test suite and in ",[33,105,106],{},"deploy\u002Fverify-onprem.sh",").",[14,109,111],{"id":110},"ship-a-methodology-snapshot","Ship a methodology snapshot",[10,113,114,115,118],{},"Every image release bundles a methodology snapshot at build time, so an air-gapped install gets a current methodology with the image — no ",[33,116,117],{},"GET \u002Fv1\u002Fmethod-updates"," pull required. Apply a newer snapshot offline:",[64,120,122],{"className":66,"code":121,"language":69,"meta":70,"style":70},"docker compose -f deploy\u002Fdocker-compose.yml exec server \\\n  bun run src\u002Fapply-methodology.ts --project default --file \u002Fpath\u002Fto\u002Fsnapshot.json\n",[33,123,124,148],{"__ignoreMap":70},[74,125,126,130,133,136,139,142,145],{"class":76,"line":77},[74,127,129],{"class":128},"sBMFI","docker",[74,131,132],{"class":88}," compose",[74,134,135],{"class":88}," -f",[74,137,138],{"class":88}," deploy\u002Fdocker-compose.yml",[74,140,141],{"class":88}," exec",[74,143,144],{"class":88}," server",[74,146,147],{"class":80}," \\\n",[74,149,151,154,157,160,163,166,169],{"class":76,"line":150},2,[74,152,153],{"class":88},"  bun",[74,155,156],{"class":88}," run",[74,158,159],{"class":88}," src\u002Fapply-methodology.ts",[74,161,162],{"class":88}," --project",[74,164,165],{"class":88}," default",[74,167,168],{"class":88}," --file",[74,170,171],{"class":88}," \u002Fpath\u002Fto\u002Fsnapshot.json\n",[14,173,175],{"id":174},"keep-model-keys-local","Keep model keys local",[10,177,178,179,182,183,186,187,190,191,193,194,197],{},"On-prem AI dedupe uses ",[22,180,181],{},"your"," key and endpoint (",[33,184,185],{},"AI_DEDUPE_API_KEY",", ",[33,188,189],{},"AI_DEDUPE_BASE_URL",") — a platform key never ships in the image. If your air-gap includes no outbound model access at all, leave ",[33,192,185],{}," unset; dedupe falls back to ",[22,195,196],{},"heuristics-only"," (the free-tier behavior).",[14,199,201],{"id":200},"verify-the-posture","Verify the posture",[64,203,205],{"className":66,"code":204,"language":69,"meta":70,"style":70},"bash deploy\u002Fverify-onprem.sh\n",[33,206,207],{"__ignoreMap":70},[74,208,209,211],{"class":76,"line":77},[74,210,69],{"class":128},[74,212,213],{"class":88}," deploy\u002Fverify-onprem.sh\n",[10,215,216],{},"The verifier asserts the telemetry-off posture and the license-validation path, among other checks.",[14,218,220],{"id":219},"next-steps","Next steps",[27,222,223,231],{},[30,224,225,230],{},[226,227,229],"a",{"href":228},"\u002Fdocs\u002Fguide\u002Fdata-handling","Data handling"," — retention and isolation in your environment.",[30,232,233,237,238,186,240,243],{},[226,234,236],{"href":235},"\u002Fdocs\u002Freference\u002Fenv-vars","Environment reference"," — ",[33,239,81],{},[33,241,242],{},"LICENSE_*",", AI dedupe knobs.",[245,246,247],"style",{},"html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":70,"searchDepth":150,"depth":150,"links":249},[250,251,252,253,254,255],{"id":16,"depth":150,"text":17},{"id":61,"depth":150,"text":62},{"id":110,"depth":150,"text":111},{"id":174,"depth":150,"text":175},{"id":200,"depth":150,"text":201},{"id":219,"depth":150,"text":220},"Run TheSpider fully offline with no phone-home","md",null,{},{"icon":261},"i-lucide-wifi-off","\u002Fdocs\u002Fdeploy\u002Fairgap",{"title":5,"description":256},"docs\u002F3.deploy\u002F3.airgap","lj4YchzFz9l49Px3b1jS5m0PJnm2BnyXn4Xw8M7t9A4",[267,273],{"title":268,"path":269,"stem":270,"description":271,"icon":272,"children":-1},"On-prem deploy","\u002Fdocs\u002Fdeploy\u002Fonprem","docs\u002F3.deploy\u002F2.onprem","Install TheSpider on-prem with Docker Compose or Helm","i-lucide-hard-drive-download",{"title":274,"path":275,"stem":276,"description":277,"icon":278,"children":-1},"API reference","\u002Fdocs\u002Freference\u002Fapi","docs\u002F4.reference\u002F1.api","The client ↔ server API surface","i-lucide-code-xml",1783955419688]