Flow 02 · On-prem enclave

On-prem enclave.

RelayGate deployed on customer hardware. No outbound callbacks, local secret store, signed offline upgrades. Run the same binary inside the perimeter.

Request path

customer perimeter · no outbound callbacks Agent internal RelayGate self-host CGO=0 · ~18 MB local vault · local CA receipts stay internal Local model vLLM / Ollama / TGI Offline upgrade signed artifact

Deploy

## airgapped install
scp relaygate-v1.4.0-linux-amd64.tar.gz customer:/opt/
scp relaygate-v1.4.0-linux-amd64.sig customer:/opt/

# on the customer host
tar xzf relaygate-v1.4.0-linux-amd64.tar.gz
relaygate verify --sig relaygate-v1.4.0-linux-amd64.sig
relaygate config apply --file /etc/relaygate/config.yaml
systemctl enable --now relaygate

Policy that makes it work

# airgap.yaml
mode: airgap
telemetry:
  outbound: false          # no calls to managed observability
receipts:
  destination: local_fs
  path: /var/log/relaygate/receipts/
secrets:
  backend: local_vault
  path: /etc/relaygate/vault
upstreams:
  - id: primary
    driver: openai-compatible
    base_url: http://vllm.internal:8000

Observability output

Every receipt lands in a local append-only store. Prometheus scrapes the local metrics endpoint; traces export to the customer's internal OTLP collector. No data leaves the perimeter.

← back to flows · enterprise on-prem pricing →