Operations & Deployment · docs.mindaeon.ai
Sovereign Air-Gapped Single-Host Appliance
Measured 7-Service Resource Footprint (1,091 MiB Total Idle RAM)
Unlike enterprise AI platforms that require multi-cluster Kubernetes and external cloud databases, Mindaeon's single-host appliance runs all 7 stateful and stateless platform services in 1,091 MiB of RAM (48.5% of its 2,248 MiB sizing budget) with zero outbound internet dependencies.
| Service | Measured Idle RSS | Hard Memory Cap | Role in Sovereign Stack |
|---|---|---|---|
keycloak (Keycloak 26) |
683 MiB | 896 MiB | Enterprise OIDC/SAML identity broker, WebAuthn passkeys, SCIM 2.0 |
postgres (PostgreSQL 18 + pgvector) |
158 MiB | 512 MiB | Row-Level Security (RLS) state store, hybrid SCIP/vector index, audit ledger |
gitea (Gitea Git Server) |
93 MiB | 256 MiB | Internal mirror, worktree shadow branches, air-gapped PR review |
seaweedfs (S3 Object Store) |
78 MiB | 256 MiB | Immutable SLSA provenance bundles, CycloneDX SBOMs, session replay blobs |
control-plane (Mindaeon Core) |
29 MiB | 128 MiB | Session orchestrator, AST mutation gate, Foundry compiler, model broker |
openbao (OpenBao KMS) |
26 MiB | 100 MiB | Per-tenant transit encryption (mindaeon-tenant-<id>), key rotation |
edge + opa (TLS Proxy & OPA) |
25 MiB | 100 MiB | mTLS termination and pre-execution Rego policy evaluation |
| Total Appliance Stack | 1,091 MiB | 2,248 MiB | 48.5% budget utilization — fits on a single 4 GB+ Linux VM or bare-metal node |
Hardware & Operating System Requirements
- Minimum Host Sizing (Control Plane + Governance): 4 vCPU, 4 GB RAM, 50 GB NVMe SSD, Linux kernel 6.1+ with cgroup v2 and OCI runtime (Docker Engine 26+ or Podman 5+).
- Recommended Host Sizing (With Local vLLM / Ollama Inference): 16+ vCPU, 64 GB RAM, 500 GB NVMe SSD, and 1× NVIDIA L40S / A100 / H100 GPU (or external air-gapped inference endpoint).
- KMS Auto-Unseal Options: PKCS#11 HSM (Thales Luna / YubiHSM 2), TPM 2.0 local seal, AWS KMS / GCP Cloud KMS / Azure Key Vault (hybrid connected mode), or Shamir 3-of-5 offline quorum.
Offline Bundle Verification & Installation
# 1. Verify the Ed25519 signature and air-gap image tarballs before transfer
mindaeon-appliance-ctl verify-bundle --bundle mindaeon-appliance-0.1.0-airgap.tar.zst \
--signature mindaeon-appliance-0.1.0-airgap.sig \
--key-id release-prod-2026-01
# 2. Load signed container images into local OCI store (zero network egress)
mindaeon-appliance-ctl load-images --bundle mindaeon-appliance-0.1.0-airgap.tar.zst
# 3. Initialize OpenBao transit keys, PostgreSQL RLS, and launch stack
mindaeon-appliance-ctl up --config /etc/mindaeon/appliance.toml --verify-airgap