Skip to content
Copyright © 2022-2026 basebox GmbH, all rights reserved.
Licensed to be used in conjunction with basebox, only.

// security

Air-gapped environments

Applies to

Product: Server · Audience: Security / Compliance reviewer · Platform Operator

Operating a server without internet access: what works (core platform, RAG, OCR, speech-to-text, local inference), what does not (web search, online model download, external services), and how software, models and updates are delivered. The Infrastructure policy lists the air-gapped option as supported by default; telemetry is disabled anyway.

What works

Feature Air-gapped Note
Chat with a local model Yes Inference on the server or a GPU host in the same isolated network
Upload documents, PDFs, images, OCR Yes ragsrv/ragsrv-support with pre-loaded models
Knowledge bases (RAG) Yes Embeddings local
Speech-to-text Yes Whisper endpoint local
Apps, roles, groups, audit log, exports Yes Core platform
REST and OpenAI-compatible API Yes Inside the network
Connectors to internal systems Yes Wiki, ticket system, IMAP in the same network
Sign-in via LDAP / internal OIDC Yes Directory in the same network
Mail Only with an internal mail server Invitations and notifications need SMTP
Web search No Needs the search provider – disable for the installation
Online model download No Pre-load models
External OIDC providers, SaaS connectors No Only what is reachable in the network
Automatic pull of images/charts No Via internal mirror
Certificates via cert-manager with a public CA No Own certificates (existing-secret) from an internal CA

How software gets in

  1. Container images and Helm charts from the basebox registry (gitea.basebox.health) pulled on a connected system, mirrored into an internal registry, values pointed at the internal registry.
  2. Model weights pre-loaded onto the volumes (download job on a connected system, then copy) and inference run with HF_HUB_OFFLINE: "1" – Inference server → Offline configuration. The same for the models of the service models (ragsrv-support-models).
  3. Backups to an internal S3-compatible target (e.g. MinIO) – the only way for CloudNativePG backups without internet (Backup & restore).
  4. Integrity check during transport: verify image digests from the manifest against the mirrored images. Signed images are in preparation according to the infrastructure policy; until then digests are your evidence.

How updates arrive

basebox announces releases and security updates by e-mail and release notes – to a mailbox your operations team reads outside the isolated network. The update path is then: check release notes → mirror images/charts → mirror models if needed → backup → upgrade per Updates. Plan the transport path (media, data lock) as part of the operations process; under operation by basebox the maintenance access itself is a point to clarify – a fully isolated server can only be looked after on site or via a controlled maintenance path (Remote maintenance).

Configuration in brief

# Values excerpt – air-gapped operation
global:
  imageRegistry: registry.intern.example/basebox     # internal mirror
inference:
  env:
    HF_HUB_OFFLINE: "1"
ragsrv:
  mode: gpu
ragsrv-support:
  mode: gpu
tls:
  mode: existing-secret                               # certificate from internal CA

Disable web search for the installation in the administration; enable connectors only for internal systems (Policies).

What air-gapped operation achieves security-wise – and does not

Achieves: no path to the outside – neither for data nor for attackers; web search risks disappear entirely; the data processing boundary is the network.

Does not achieve: protection against insiders, missing storage encryption or weak access rights; security updates arrive only as fast as your transport path brings them – an air-gapped server without an update process is an outdated server.

For the review

  • Egress rule: none. Document that as a deliberate configuration.
  • Describe the transport path for images, models and updates with integrity checking (digests).
  • Assign responsibility for reading the security announcements and for the update cycle.
  • Name internal mail server, internal directory and internal CA as prerequisites.

Next step: External services → Model providers