Self-hosted and air-gapped deployments

View as Markdown Open in ChatGPT Open in Claude

Outpost is a hosted service, and the rest of this documentation describes the hosted service. Some organizations need Outpost on infrastructure they run themselves, or on a network that never reaches the internet. Both are available by arrangement with Outpost, and this page explains what each one is.

Self-hosted

A self-hosted deployment runs the Outpost server software on your own infrastructure. You operate the servers and databases, and your endpoints report to an address you control. It is licensed to your organization, and the license decides which product it runs as. How a self-hosted deployment checks its plan is part of the arrangement. Contact Outpost for details.

Behind a TCP proxy

Agents connect to Depot over mutual TLS, so a proxy in front of the agent port has to pass the connection through rather than end it. A TCP or TLS passthrough proxy such as HAProxy or nginx stream does that, but Depot then sees the proxy’s address for every agent, and each endpoint’s Connected from history shows the proxy instead of the endpoint’s public address.

To keep the real addresses, have the proxy send a PROXY protocol header, and set these two variables in the Depot environment:

OUTPOST_DEPOT_GRPC_PROXY_PROTOCOL=true
OUTPOST_DEPOT_TRUSTED_PROXIES=<proxy-address>/32

The setting is off by default.
Depot accepts the header only from an address in OUTPOST_DEPOT_TRUSTED_PROXIES, and refuses to start with the setting on and that list empty.
From a trusted proxy the header is optional, so turn the setting on before the proxy starts sending it.
A connection from any other address that sends the header is refused. Agents that connect to Depot directly keep working, and their own address is recorded.
Version 1 and version 2 headers are both accepted.

A proxy sends the header to everything behind it, not per host name. Every service behind the same proxy listener has to accept the header before you turn it on.

Remote Outpost (air-gapped)

Remote Outpost is for a network with no route to the internet, such as a secure facility or an isolated production network. It manages one organization.

It never contacts Outpost. A connected deployment checks in with Outpost to keep its license current. Remote Outpost does not, and nothing reports outbound.
Its license is delivered by hand. You receive the license file from Outpost and install it yourself. The license, not a check with Outpost, decides what it includes.
Mail works on your network. IMAP, POP3, and SMTP against a mail server on your network work as usual.

These features need the internet, so Remote Outpost does not offer them:

Feature	Why
Outpost Cloud Storage	The storage is on the internet. Use storage on your own network instead.
Microsoft 365 and Google Workspace mail	Both are cloud services.
Outgoing mail services other than SMTP	Each is a service on the internet. Send through an SMTP server on your network instead.
Domain monitoring	It checks public DNS, registration data, and certificates on the internet.
The breached-password check	It queries a public service on the internet.
Outpost Cloud AI	It calls a model provider on the internet. A model server on your own network still works.

Arrange a deployment

To discuss a self-hosted deployment or Remote Outpost, contact Outpost. See Contact.

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.