# Air-gapped installation and updates

URL: /deploy/air-gapped

Run Foxborne on a network with no path out. Releases arrive as signed bundles your administrator carries in, the license is checked offline and maps come from elevation data you load.



An air-gapped deployment has no network path out at all, and Foxborne needs none. It sends no telemetry, checks its license offline, draws maps without a tile service and installs releases only from signed bundles. Your administrator carries each bundle in, and Foxborne verifies it before anything installs.

## What changes inside an enclave [#what-changes-inside-an-enclave]

| Concern           | How Foxborne handles it                                                                                                                                                                                                                                      |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Releases          | Each release is one signed `.fxb` file with its software bill of materials, carried in on media your process approves.                                                                                                                                       |
| Signature         | Foxborne checks the bundle against the Foxborne release key before anything installs. Nothing installs on a mismatch.                                                                                                                                        |
| Bill of materials | An SPDX document stored with the release, listing every component and version for your own review. The example reads SPDX 2.3, 412 components.                                                                                                               |
| License           | An offline license file with no call home. **Hosting** shows the seats in use and the renewal date.                                                                                                                                                          |
| Maps              | Drawn from elevation data and imagery you load. Nothing calls a tile service, so the enclave shows the same map as a connected network.                                                                                                                      |
| AI models         | Shipped in the release bundle and run on an inference node inside the enclave. Nothing calls a model provider, so the [AI models](/concepts/ai-models) work the same offline. Without an inference node, their features are hidden and nothing else changes. |
| Collectors        | Installed from your internal package mirror and enrolled against the deployment inside the enclave.                                                                                                                                                          |
| Receivers         | Listen for telemetry inside the enclave, on the address you set.                                                                                                                                                                                             |
| Time              | chrony on companion computers and NTP on receivers need a time source inside the enclave.                                                                                                                                                                    |
| Audit             | Streams over syslog with TLS to a SIEM inside the enclave.                                                                                                                                                                                                   |

## Before you start [#before-you-start]

* You need the **Admin** role in Foxborne to install releases and manage collectors.
* The enclave holds what a data center deployment needs: hosts, PostgreSQL 16, S3-compatible storage with write-once originals, key management, your identity provider and your SIEM.
* Your process approves a way to carry files into the enclave.
* An internal package mirror serves the collector package to companion computers.
* A time source inside the enclave serves chrony and NTP.

## Install inside the enclave [#install-inside-the-enclave]

<Steps>
  <Step title="Prepare the environment">
    Build the environment as in [Deploy in your data center](/deploy/on-premises): hosts, PostgreSQL 16, write-once object storage, your key, your identity provider and your SIEM. Every part stays inside the enclave.
  </Step>

  <Step title="Carry the release in">
    Bring the release in on media your process approves: one signed `.fxb` file, with its software bill of materials. Nothing is downloaded at any point.
  </Step>

  <Step title="Install and let Foxborne verify it">
    Foxborne checks the bundle's signature against the Foxborne release key before anything installs. A bundle that does not match installs nothing, and the bill of materials is stored with the release.
  </Step>

  <Step title="Plan the maps">
    Maps are drawn from the basemaps and elevation store in your object storage, and nothing on the page reaches for a tile service. <Availability status="planned" /> Loading an offline PMTiles basemap and an elevation file is planned; [Basemaps and elevation](/deploy/basemaps) covers what the map draws today.
  </Step>

  <Step title="Enroll the collectors">
    On each companion computer, install the collector package from your internal mirror. The package is signed with the Foxborne release key.

    Then run the command from the vehicle's **Enroll** drawer, under **Sources**, **Vehicle collectors**. The collector connects outbound to the deployment inside the enclave over mutual TLS, with a certificate of its own.
  </Step>

  <Step title="Set up the receiver and the time sources">
    Run the MAVLink receiver inside the enclave, on the listen address you set. The console's example is `udp://0.0.0.0:14560`.

    Point chrony on each companion computer, and NTP on the receiver, at a time source inside the enclave. Without one, the journal stays on the companion's own clock and makes no before or after claim against the flight log.
  </Step>
</Steps>

<Callout type="note" title="Markings in a classified enclave">
  Settings offers a CUI or an UNCLASSIFIED banner. A classified deployment sets its banner from its own accreditation, not from Foxborne's settings. See [CUI marking](/security/cui-marking).
</Callout>

## Install updates [#install-updates]

Updates follow the same path as the first release. Carry the new `.fxb` bundle in, open **Hosting** and select **Install an update**.

Foxborne reads the bundle and checks its signature, bill of materials and database migration. Once you confirm, it schedules the install for the maintenance window.

Collectors update from the deployment itself. Select **Update** on a vehicle's row, then **Schedule update**. The vehicle downloads the new collector from your deployment the next time it is on the ground and online.

[Install an update](/deploy/upgrades) walks through each check.

## Check the result [#check-the-result]

Open **Hosting** and confirm the enclave's posture:

* **Network** reads No outbound internet, and the status bar repeats **No outbound internet** on every screen.
* **Outbound connections** lists Foxborne, Inc. and map and tile services as **None**. The identity provider reads **Inbound** and your SIEM **Internal**.
* **Updates** shows **Signed by** with the Foxborne release key, and **Bill of materials** ends in **stored with the release**.
* **License** shows the seats in use and the renewal date, with no call home behind them.
* The **Basemaps and elevation** row notes that maps never call a tile service.

Then open **Incidents**. The site map at the top draws its contours from the site's elevation model, with no request to a tile service. Under **Sources**, **Vehicle collectors** should show each enrolled vehicle **Online**, with a synchronized **Clock**.

## Troubleshoot [#troubleshoot]

**The signature does not match.** Nothing installs. Foxborne trusts only bundles signed with the Foxborne release key, so a damaged or altered file stops at this check. Carry in a fresh copy.

**A vehicle's clock reads Not synchronised.** chrony on that companion computer cannot reach a time source inside the enclave. Point it at one, and [align the clock by hand](/investigate/align-a-clock) for runs already recorded.

**Collectors show Buffering.** A vehicle out of reach of the enclave network spools locally. Uploads resume on their own when it reconnects, and nothing is lost unless the spool budget fills.

## Next [#next]

* [Install an update](/deploy/upgrades) covers the four checks and the maintenance window.
* [Release signing and SBOM](/security/release-signing) explains the release key and the bill of materials.
* [Install and enroll the collector](/collect/collector/install) has the enroll drawer step by step.
* [Read the map](/investigate/map) shows what the map draws from your elevation data.