DocumentationLicense
Self-hosting
Self-hosting

Air-gapped install

Run MCPG with no outbound internet — an in-cluster OCI mirror for plugins, an offline Sigstore trust root so signature verification still works, and IaC that distributes modules from your own registry.

MCPG runs fully disconnected. Nothing about the gateway needs the public internet at runtime — the challenge of an air-gapped install is getting signed artifacts (images, plugins, charts) into the enclave and keeping signature verification working once they are there. This page covers the supported path.

The shape of the problem

A default install pulls three kinds of artifact from public registries: the gateway/operator container images, the plugin cdylib OCI artifacts, and the Helm charts. In an air-gapped site you mirror all three into an internal registry once, then teach MCPG to pull from the mirror without weakening the cryptographic checks that gate what loads.

Mirror plugins with MCPGPluginMirror

The operator ships an MCPGPluginMirror custom resource that runs an in-cluster OCI mirror. It rehomes upstream plugin references under an internal prefix and rewrites pull requests fail-closed — a plugin ref that has not been mirrored is refused rather than silently reaching out:

yaml
apiVersion: mcpg.dev/v1alpha1
kind: MCPGPluginMirror
metadata:
  name: house-mirror
spec:
  # Rehome this upstream prefix onto the in-cluster registry.
  sourcePrefix: "ghcr.io/mcpg-dev/source-code/plugins"
  mirrorPrefix: "registry.internal.svc/mcpg/plugins"
  failClosed: true

Gateways then resolve platform-agnostic oci: plugin refs against the mirror, picking the artifact for their OS/arch/libc across x86_64 and aarch64 Linux (glibc and musl), Apple Silicon, and x86_64 Windows.

Keep signatures verifying offline

Mirroring an artifact does not change its identity — cosign and SLSA provenance still verify against the original upstream reference, so a rehomed plugin proves it is the exact bytes that were signed. In a disconnected enclave the one thing that needs help is fetching Sigstore's trust material, which normally comes from the public good instance. Point the operator and gateway at an offline bundle instead:

bash
--sigstore-trust-root /etc/mcpg/sigstore-trust-root.json

With the offline trust root in place, plugin signature verification runs exactly as it does online: Ed25519 signature, SHA-256 content pin, revocation check, and typed capability grants all still gate what loads. Keep plugin trust set to Enforce in production — air-gapped is not a reason to relax it.

Scaffold from the air-gapped template

Start from the config template built for this shape, which wires plugin sources to internal references and turns off anything that assumes egress:

bash
mcpg config init --template air-gapped --output airgap.yaml
mcpg config check airgap.yaml

Distribute IaC from your own registry

The OpenTofu module suite is designed for disconnected sites: modules and the provider distribute over an OCI registry (no public module registry), and OpenTofu adds client-side state and plan encryption so nothing sensitive leaves the enclave. The Terraform and Pulumi paths install the same operator; mirror their providers into your internal registry the same way you mirror images.

Where to go next