Licensed to be used in conjunction with basebox, only.
// installation
Customer-managed operations
Applies to
Product: Server · Operation: by the customer · Audience: Platform Operator · IT management
What the customer is responsible for after handover of the software: operating system, drivers, Kubernetes, basebox, service models, inference, network and backups. basebox provides software, updates, documentation and support – you operate the server. This page is your task list.
What you are responsible for
| Area | Your task | Runbook |
|---|---|---|
| Physical hardware, data center | Power, cooling, network connectivity, access; with hosting at basebox, basebox takes this row | Hosting options |
| Operating system | Security updates, hardening, access (SSH keys, no root login, fail2ban, ufw) | Server Preparation Guide → Security |
| NVIDIA driver, CUDA, GPU Operator | Version state, compatibility with vLLM, MIG layout after reboots | NVIDIA / GPU |
| Kubernetes | Cluster health, certificates, ingress, storage, CloudNativePG, upgrades | Kubernetes |
| basebox | Helm releases, values, updates, migrations | Updates |
| Service models | ragsrv/ragsrv-support healthy, model caches, GPU/MIG allocation | Deploy service models |
| Inference | Endpoint reachable, model loaded, latency, capacity | Connect inference · Models & inference |
| Network | DNS, TLS renewal, firewall, egress for integrations | Networking · VPN / networking |
| Backups | Databases, media, secrets; restore rehearsed | Backup & restore |
| Monitoring and logging | Alerts, log collection, retention per your policies | Monitoring · Logging |
| Connector workloads | Deploy MCP services via Helm, egress to target systems | MCP connectors with Helm |
| Identity | Keycloak: LDAP federation, SSO, admin access | LDAP / OIDC |
Not your task as Platform Operator: application administration. Users, apps, model selection, connector enablement and policies lie with the administrators – even if the same person does both, they are separate roles.
What basebox provides
- Software: Helm charts and container images from the basebox registry; versions in the Version matrix.
- Updates: security and feature updates, announced by e-mail and release notes; no automatic updates – installation is up to you.
- Documentation: these pages, the compliance package, release notes and changelog.
- Support: support@basebox.ai per the contractually agreed response times; for cases this guide does not cover, for air-gapped installations and custom configurations.
- Notification: in case of known systemic risks or security-relevant incidents, basebox informs affected customers without delay.
What basebox does not do
Without a separate engagement, basebox has no access to your server – no remote maintenance, no monitoring, no updates by basebox. If a support case needs access, that happens only after your approval via an agreed path (PAM/VPN, time-limited) – see Remote maintenance.
What your team should bring
- Linux administration (Ubuntu), package management, systemd, firewall.
- Kubernetes day to day:
kubectl,helm, pods, PVCs, ingress, secrets, reading events. - NVIDIA stack: driver updates,
nvidia-smi, GPU Operator, MIG if needed. - PostgreSQL basics for backup and restore (CloudNativePG).
- Willingness to read release notes before updating.
If that is not available in-house, Operation by basebox is the path – or a service provider of your choice.
Handover from basebox to you
If basebox installs and you operate afterwards, the handover should include:
- Manifest: chart/app version, image digests, driver, CUDA, Kubernetes, GPU Operator, GPU UUIDs with role, MIG layout
- Values files (without secrets) and the list of Kubernetes secrets
- Credentials: Keycloak admin, first basebox administrator (already handed to the administrators)
- Acceptance record per Validate installation
- A first backup and evidence of a rehearsed restore
- basebox's access is terminated (PAM/VPN disabled) unless an operations engagement follows
If you get stuck
- Troubleshooting and FAQ.
- Have logs of
aisrvand the affected component, events and the manifest ready. - support@basebox.ai with symptom, time, recent changes – without credentials. For security incidents additionally datenschutz@basebox.ai.
Next step: Monitoring