Air-Gap Mode Guide

Audience: operators deploying Stella Ops into a sealed (air-gapped) environment with no outbound network access.

This guide defines the supported deployment scope for air-gap mode and the activation order. The posture model behind it is described in ../architecture.md.

Supported scope

Air-gap mode uses the Offline Kit, Docker Compose or host/service-manager deployment, signed release manifests, local registries, local storage and OfflineKit carriers for content.

Kubernetes and Helm air-gap deployment instructions are retired.

Activation order

  1. Verify the release bundle and Offline Kit checksums and signatures (see ../../../OFFLINE_KIT.md).
  2. Load images and configuration into approved local stores; configure services through Compose environment files or host secret stores.
  3. Provide the import trust public key and the timestamp-authority trust chain to offlinekit-web. Release bundle: ${STELLA_OFFLINE_DIR:-./offline}/offlinekit/import-trust.pem and OFFLINEKIT_TIME_ANCHOR_TRUST_ROOTS_PATH (relative to config/). Repository compose overlay: OFFLINEKIT_IMPORT_TRUST_PUBLIC_KEY_PATH and OFFLINEKIT_TIME_ANCHOR_TRUST_ROOTS_PATH.
  4. Start the stack and wait for health.
  5. Declare trusted time: stella airgap time-anchor declare --token <rfc3161-token> --trust-roots <pem>.
  6. Declare the posture: stella airgap seal --reason "<change ticket>"; confirm with stella airgap status.
  7. Verify egress is closed (Sealing and Egress) and store the output as evidence.
  8. Bring content in only as verified carriers: stella airgap import (../../../runbooks/airgap/offlinekit-import.md).

Unsupported legacy paths

Do not run Helm installs, apply Kubernetes manifests, or use kubectl in Stella Ops air-gap deployment procedures. The predecessor airgap-controller host and its /api/v1/time/anchor endpoint are retired; posture and time are declared through Platform as above.