Air-gap bundle

Fosnie runs fully offline. Core "runs offline" out of the box; the certified air-gap – a signed release with SBOM verification and hardware-key custody – is a Fosnie Enterprise capability.

Before you disconnect

The offline bundle installs the Fosnie backend, ML service, and frontend – not the model engine or its weights (bring your own Ollama or vLLM, with weights already present). The base OS must already have: ca-certificates (TLS verification uses the OS trust store – the most common air-gap footgun), PostgreSQL, Qdrant, Redis, Python 3.12, and the ML system packages (pandoc, LibreOffice, PDF/render libraries, fonts, ffmpeg).

Install

Unpack the release bundle, verify it, place the artefacts, install the Python ML environment from the bundled wheels (no index), configure, and start the services:

tar xzf fosnie-offline-<version>.tar.gz && cd fosnie-offline-<version>
deploy/scripts/verify-release.sh .          # must report PASS before continuing

sudo install -m0755 bin/fosnie-backend /usr/local/bin/
sudo cp -R frontend/dist /opt/pai/frontend
sudo cp -R migrations    /opt/pai/migrations
sudo cp deploy/systemd/*.service /etc/systemd/system/

# ML service from offline wheels
python -m venv /opt/pai/ml/.venv
/opt/pai/ml/.venv/bin/pip install --no-index --find-links wheels -r wheels/requirements.txt
# keep the offline guards in the ML env:
#   HF_HUB_OFFLINE=1  TRANSFORMERS_OFFLINE=1

sudo cp config/config.example.toml /etc/pai/config.toml   # set DB, Redis, ML base URL, public URL
sudo systemctl daemon-reload
sudo systemctl enable --now pai-ml.service fosnie-backend.service
# poll http://localhost:8080/health for 200, then create the first admin

The offline guards (HF_HUB_OFFLINE, TRANSFORMERS_OFFLINE) make any stray model download fail loudly rather than hang.

Prove zero egress

Fosnie ships a static lint and a runtime proof so your security team can verify no data path exists:

• Static: deploy/scripts/airgap-lint.sh --config /etc/pai/config.toml --ml-env /etc/pai/ml.env → PASS.
• Runtime: apply a deny-all-egress firewall rule, then confirm health, chat, and document ingest all succeed while the drop counter stays at zero.

Certification (Enterprise)

The Enterprise release adds signed-release verification for a no-trust install: verify the release signature (cosign / minisign) against a public key you obtain independently, check the SBOM and artefact hashes, and run the zero-egress proofs above. Key custody uses BYOK/HSM.