---
title: "Self-hosted and air-gapped deployments"
description: "Outpost is a hosted service. Running it on your own infrastructure, or on a network with no internet access, is available by arrangement."
url: "https://support.outpostplatform.com/get-started/self-hosted-and-air-gapped/"
product: "platform"
type: "concept"
status: "draft"
ai_summary: "Outpost is a hosted service. Self-hosted deployments on the customer's own infrastructure, and Remote Outpost for air-gapped networks (license delivered by hand, no outbound reporting), are available by arrangement through Outpost. Remote Outpost lacks Outpost Cloud Storage, the Microsoft 365 and Google Workspace mail drivers, domain monitoring, the breached password check, and Outpost Cloud AI."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/get-started/self-hosted-and-air-gapped.md"
license: "CC BY 4.0"
---

# Self-hosted and air-gapped deployments

Outpost is a hosted service, and the rest of this documentation describes the
hosted service. Some organizations need Outpost on infrastructure they run
themselves, or on a network that never reaches the internet. Both are available
by arrangement with Outpost, and this page explains what each one is.

## Self-hosted

A self-hosted deployment runs the Outpost server software on your own
infrastructure. You operate the servers and databases, and your endpoints
report to an address you control. It is licensed to your organization, and the
license decides which product it runs as. How a self-hosted deployment checks
its plan is part of the arrangement. Contact Outpost for details.

### Behind a TCP proxy {#tcp-proxy}

Agents connect to Depot over mutual TLS, so a proxy in front of the agent port
has to pass the connection through rather than end it. A TCP or TLS
passthrough proxy such as HAProxy or nginx `stream` does that, but Depot then
sees the proxy's address for every agent, and each endpoint's **Connected
from** history shows the proxy instead of the endpoint's public address.

To keep the real addresses, have the proxy send a PROXY protocol header, and
set these two variables in the Depot environment:

```sh
OUTPOST_DEPOT_GRPC_PROXY_PROTOCOL=true
OUTPOST_DEPOT_TRUSTED_PROXIES=<proxy-address>/32
```

- The setting is off by default.
- Depot accepts the header only from an address in
  `OUTPOST_DEPOT_TRUSTED_PROXIES`, and refuses to start with the setting on
  and that list empty.
- From a trusted proxy the header is optional, so turn the setting on before
  the proxy starts sending it.
- A connection from any other address that sends the header is refused.
  Agents that connect to Depot directly keep working, and their own address is
  recorded.
- Version 1 and version 2 headers are both accepted.

A proxy sends the header to everything behind it, not per host name. Every
service behind the same proxy listener has to accept the header before you
turn it on.

## Remote Outpost (air-gapped)

[Remote Outpost](/remote-outpost/) is for a network with no route to the
internet, such as a secure facility or an isolated production network. It
manages one organization.

- **It never contacts Outpost.** A connected deployment checks in with Outpost
  to keep its license current. Remote Outpost does not, and nothing reports
  outbound.
- **Its license is delivered by hand.** You receive the license file from
  Outpost and install it yourself. The license, not a check with Outpost,
  decides what it includes.
- **Mail works on your network.** IMAP, POP3, and SMTP against a mail server on
  your network work as usual.

These features need the internet, so Remote Outpost does not offer them:

| Feature | Why |
| --- | --- |
| Outpost Cloud Storage | The storage is on the internet. Use storage on your own network instead. |
| Microsoft 365 and Google Workspace mail | Both are cloud services. |
| Outgoing mail services other than SMTP | Each is a service on the internet. Send through an SMTP server on your network instead. |
| Domain monitoring | It checks public DNS, registration data, and certificates on the internet. |
| The breached-password check | It queries a public service on the internet. |
| Outpost Cloud AI | It calls a model provider on the internet. A model server on your own network still works. |

## Arrange a deployment

To discuss a self-hosted deployment or Remote Outpost, contact Outpost. See
[Contact](/support/contact/).

## Related

- [How Outpost is hosted](/get-started/how-outpost-is-hosted/)
- [Remote Outpost](/remote-outpost/)
- [Choose a plan](/get-started/choose-a-plan/)