Air-gapped install — bRRAIn Docs

Installing and upgrading a customer-run bRRAIn brain from a release mirror inside your own network.

Air-gapped install

The installer and brrain upgrade read releases from one origin, which you can replace with a mirror inside your network by setting BRRAIN_MANIFEST_BASE. The SHA-256 check still applies, so a corrupted mirror is caught rather than installed.

What to mirror

For each release you want available:

  • the manifest: latest.json for the current stable release and <version>.json for each version you may install or pin;
  • the tarball the manifest's artifact.url points at (brrain-handler-<version>.tar.gz).

Both the installer and brrain upgrade download the tarball from the URL written in the manifest, so in your mirrored manifests set artifact.url to the tarball's address on your mirror. Do not change the sha256 value: it must still match the tarball bRRAIn published.

Install from the mirror

sudo BRRAIN_MANIFEST_BASE=https://mirror.internal.example/brain-images sh brrain-install.sh --check
sudo BRRAIN_MANIFEST_BASE=https://mirror.internal.example/brain-images sh brrain-install.sh

Bring the installer script itself in with the release. Before running it:

  • Install Ollama yourself. If ollama is not on the path, the installer runs Ollama's own installer from ollama.com, which an air-gapped host cannot reach.
  • Install curl, tar, gzip and zstd from your internal package mirror if they are missing.

The Handler is registered from the Modelfile inside the release tarball, so no model download from the internet is needed.

Upgrade from the mirror

Set BRRAIN_MANIFEST_BASE for brrain upgrade as well, for example in a systemd drop-in or in the environment of the shell that runs it:

sudo BRRAIN_MANIFEST_BASE=https://mirror.internal.example/brain-images brrain upgrade -check
sudo BRRAIN_MANIFEST_BASE=https://mirror.internal.example/brain-images brrain upgrade -pin <version>

Have a written process for bringing each new release (manifest, tarball, release notes) across the air gap.

License verification

Installation verification is a call from bRRAIn to your host's https:// address (see TLS & license verification). A host that is not reachable from the internet cannot complete it as described. Agree the approach with bRRAIn before install day.

Backups

Snapshot copies still need to leave the host; in an air-gapped site, "offsite" means another location inside your isolated environment. See Backup & restore.