Running Convaa with no outbound network at all

The data plane never calls out. Point model inference at your own endpoint, ship the images in as a tarball, and the whole stack runs with no egress.

There is now a documented path to running Convaa on a host with no internet connection.

Self-hosted often turns out to mean self-hosted apart from the parts that still phone home, and you only find out which parts those are after the firewall logs tell you. We would rather be specific about it up front.

The data plane makes no outbound calls. Postgres, auth, storage and realtime all run on your host behind an internal gateway that is not published, and the browser only ever talks to Convaa, which relays to those services server-side. Model inference is the one thing that reaches out by default, and you close it by pointing the OpenAI-compatible base URL at your own endpoint. LiteLLM, vLLM, llama.cpp and Ollama all speak that protocol, so whatever you already run will do.

Images are the other half of it. Every dependency is pinned to a version rather than latest, so a rebuild six months from now gets you the same stack. The three images we build ourselves have build stages that need a registry, and none of them has to run on the air-gapped machine. Build them once somewhere connected, save them to a tarball, carry that in by whatever your transfer policy allows, load it, and start the stack without a build step. An internal registry mirror works the same way.

The transcription model travels the same route, as a file you place rather than a download the container attempts.

The result is a deployment where the answer to what leaves this network is nothing, and you can show that rather than assert it.