> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Air-Gapped Deployment

> Enclave with no external network connectivity — for classified and highly regulated environments.

## Overview

Air-gapped deployment is for environments with no internet connectivity. Enclave operates entirely within your isolated network. No call-home, no telemetry, no external dependencies.

## Differences from on-premise

| Feature            | On-Premise            | Air-Gapped                      |
| ------------------ | --------------------- | ------------------------------- |
| Licence validation | Online (periodic)     | Offline (certificate-based)     |
| Container images   | Pull from registry    | Transferred via removable media |
| Updates            | `docker compose pull` | Manual transfer + load          |
| Telemetry          | Optional              | Disabled                        |
| External SMTP      | Supported             | Internal SMTP relay required    |

## Offline licence

Air-gapped deployments use an offline licence certificate tied to your hardware fingerprint:

1. Generate a hardware fingerprint on your target server:
   ```bash theme={null}
   curl -s https://releases.kvelden.com/enclave/fingerprint.sh | bash
   # Outputs: enclave-fingerprint-abc123.json
   ```
   Transfer the fingerprint file to an internet-connected machine.

2. Submit the fingerprint to Kvelden — you receive a signed licence certificate (`enclave-licence.crt`).

3. Transfer the certificate to your air-gapped environment and set:
   ```bash theme={null}
   ENCLAVE_LICENCE_CERT=/path/to/enclave-licence.crt
   ENCLAVE_LICENCE_MODE=offline
   ```

Licence certificates are valid for 12 months. Renewal requires repeating the fingerprint process.

## Transferring images

Container images are distributed as `.tar` archives via secure file transfer:

```bash theme={null}
# On internet-connected machine — download and export
docker pull registry.kvelden.com/enclave:1.4.0
docker save registry.kvelden.com/enclave:1.4.0 | gzip > enclave-1.4.0.tar.gz

# Transfer to air-gapped environment via approved media

# On air-gapped server — load
gunzip -c enclave-1.4.0.tar.gz | docker load
```

## Internal SMTP

Email notifications (invitations, alerts) require an internal SMTP relay:

```bash theme={null}
SMTP_HOST=smtp.internal.yourorg
SMTP_PORT=587
```

If no SMTP is available, set `EMAIL_DISABLED=true` — all invitation links are generated and displayed in the admin console instead.

## HSM requirement

Air-gapped deployments must use an on-premise HSM (HYOK). Cloud KMS is not available without internet access. Supported HSMs:

* Thales Luna Network HSM
* Entrust nShield Connect
* Utimaco SecurityServer

See [Key Management → On-premise HSM](/enclave/key-management#on-premise-hsm-via-kmip-hyok) for KMIP configuration.

## Support

Air-gapped environment support is handled via encrypted email or an approved secure channel. Contact [security@kvelden.com](mailto:security@kvelden.com) to establish a support arrangement before deployment.