On-prem and air-gapped
On-prem and air-gapped
On-prem StackGen runs in your data center and is operated by your team. An air-gapped deployment does not need a network path back to StackGen, GitHub, or a public image registry.
This model gives you full control of the environment. It also moves release installation, image management, upgrades, rollback, and first-line diagnosis to your operators.
Architecture
The deployment uses the same core application services as Private SaaS:
- A Kubernetes cluster for the StackGen UI and StackGen services.
- PostgreSQL for the StackGen application databases.
- S3-compatible object storage.
- An internal ingress endpoint, DNS record, and customer-provided TLS certificate.
- An identity provider that the cluster and users can reach on the internal network.
- A private container registry for all release images.
StackGen provides packaged release versions. Your team transfers each package through its approved process, mirrors the images, and installs the release.
Capacity sizing
Use these reference numbers for procurement, then confirm them with StackGen for your release and expected user count.
| Component | Reference sizing |
|---|---|
| Worker nodes | 4 nodes with 8 vCPU and 32 GiB each |
| Total schedulable compute | 32 vCPU and 128 GiB, plus one node of spare capacity for upgrades |
| Node disk | 60 GiB or more per node, plus image and container storage |
| PostgreSQL | 2 vCPU, 4 GiB, and 32 GiB of storage to start, on encrypted and backed-up storage |
| Object storage | Sized from your retention policy, starting in the tens of gigabytes |
| Pod addresses | About 50 pods per node, so reserve roughly 300 to 400 cluster addresses |
| Service addresses | A separate non-overlapping range for cluster services |
Keep the cluster pod and service ranges clear of your internal routed networks. You also need one address or virtual IP for the StackGen ingress endpoint and capacity in your registry for the current release plus the rollback release.
Responsibilities
You:
- Provision and operate the Kubernetes cluster, network, DNS, TLS, PostgreSQL, object storage, and image registry.
- Scan, approve, and promote every release image into your private registry.
- Plan, execute, validate, and roll back every upgrade.
- Operate backups and test recovery.
- Monitor the platform and perform first-line diagnosis.
- Export approved logs and diagnostic bundles when you request StackGen support.
- Maintain an identity-provider application that users and StackGen can reach.
StackGen:
- Provides periodic packaged releases and release documentation.
- Provides the release image inventory and application configuration needed for installation.
- Supports the application from the diagnostic material that you export.
- Helps assess release compatibility and upgrade sequencing.
There is no GitOps path from StackGen into an air-gapped environment. StackGen cannot perform remote debugging or upgrades without access that you explicitly establish.
Release and support model
StackGen SaaS releases frequently. Air-gapped environments receive periodic bundled releases, so installed versions can trail Managed SaaS and Private SaaS.
Before each upgrade:
- Review release notes and compatibility requirements.
- Import and scan the release images.
- Back up PostgreSQL, object storage, and application configuration.
- Test the release and rollback procedure outside production.
- Promote and install the approved release.
- Run the agreed validation checks.
Define how your team will collect logs and diagnostic bundles before production launch. Remove secrets and regulated data according to your policies before sharing them with StackGen.
Identity and network requirements
Users sign in through your identity provider, so it must be reachable from the StackGen cluster and from user networks. Create an application registration for StackGen and add this redirect URI, replacing the hostname with your StackGen hostname:
https://<stackgen-domain>/auth/callback
Then share the client ID, client secret, provider endpoints, and the first administrator email with StackGen. The Private SaaS SSO steps describe the same registration process.
Supported providers are Microsoft Entra ID, Google, and GitHub, which normally rely on external endpoints. A disconnected environment needs an approved identity provider that users and the cluster can reach internally, so confirm your provider with StackGen during design.
An air-gapped deployment has no required outbound route to GitHub, ghcr.io, or StackGen. Optional integrations that call public services will not work unless your security team provides an approved proxy or route. These can include:
- Public AI providers.
- SendGrid email notifications.
- Public Git providers.
- Langfuse and Unleash endpoints outside your network.
Use customer-issued TLS certificates. Public ACME certificate issuance is not suitable for a disconnected service.
Before you proceed
The distribution package, supported Kubernetes versions, capacity, image list, upgrade path, and diagnostic bundle process can change by release. Confirm them with StackGen before procuring infrastructure.
Complete the on-prem / air-gapped prerequisites checklist, then share it with StackGen for architecture review. After deployment, configure the StackGen CLI to use your internal URL.