Airgap deployment

Ironmark installs on an airgap network from a signed offline bundle. In normal operation there are no outbound network calls — no telemetry, no license phone-home, no auto-update. Updates are opt-in and travel the same way the original install did: a signed bundle, hand-carried in.

The install bundle

Ships as a single IM_setup.tar.gz with a detached .sig signed by the vendor. The bundle contains everything needed to install on a clean Debian/Ubuntu box:

Application	Backend + frontend + SDM packages
Python wheels	~60 wheels prebuilt for manylinux2014_x86_64. No pip network fetch required.
System deps	MySQL 8, nginx, Node, Java (for Apache FOP) — as .deb files or system-installed via the install script
Setup script	`install.sh` handles user creation, MySQL init, systemd unit install, nginx config, and cert setup
Bundle size	~128 MB

Install path

Same script for airgap and connected installs. The connected path optionally uses Let's Encrypt; airgap uses a self-signed or customer-supplied cert.

Verify the bundle signature against the vendor pubkey
Extract to /opt/ironmark/setup
Run ./install.sh — installs deb deps from the bundle, sets up MySQL, deploys the app, configures nginx, seeds a fresh DB
Admin panel becomes reachable at the configured hostname

Typical time on a clean nanode-equivalent VM: ~10 minutes end-to-end.

Updates

Same bundle format. Two update paths:

Admin-panel offline update — upload the signed bundle through the browser. The admin panel verifies the signature, previews the version delta and DB migrations, requires backup affirmation, then applies. Rollback via the versioned release directory.
Shell install — same install.sh --upgrade path used for the initial install. Preserves data + DB.

Both paths verify the bundle's detached signature against the customer's installed pubkey. Unsigned or tampered bundles are rejected at the load stage.

License enforcement

Licenses are signed .irm files issued by the vendor. Customer installs verify against the license pubkey, offline, at boot and periodically. On expiry, reads and exports keep working; publish is gated until renewal. No phone-home for enforcement.

On the outbound-call posture: the app makes no outbound HTTP in the default configuration. The only outbound call Ironmark can make is a dependency-CVE check, and even that is opt-in. If your program wires up an SMTP relay for notifications, that's configured explicitly. Everything else stays on the network you put it on.

Backup + restore

MySQL dump — standard mysqldump against the ironmark schema. Restore with mysql.
File storage — /opt/ironmark/app/data/ holds project graphics, imported IADS DTDs, reference docs, and outputs. Rsync-friendly.
Both together cover a full instance. The admin panel's offline-update flow requires backup affirmation before applying migrations.

What isn't included

Redis and Celery are optional. In the default install the publish pipeline runs in-process; Celery + Redis let you scale to concurrent long-running publishes. Airgap installs typically stay on the in-process path.
No cloud storage bucket. All project data lives on the server's filesystem.
No hosted mode from within airgap — the app doesn't reach out for anything.

← Back to Architecture