Air-gapped sites

An air-gapped install works like any other, except the download happens on a different machine. The release you carry in has everything inside it, and the installer never reaches the network.

1. Download the releaseCopy Anchor Link

On any machine with internet access, download without installing. Use your code, so the release includes your organisation's sealed packs (the checks 3AM runs):

curl -fsSL https://get.3am.si | sh -s -- --code 3AM-DL-XXXXX-XXXXX-XXXXX

A trial code (3AM-TRIAL-…) works too. Download codes come from Keychain → Install on another machine in the console of an install you already have, or from us.

This leaves a 3am-<version> folder. Pack it up to carry across:

tar -cf 3am-0.4.41.tar 3am-0.4.41
sha256sum 3am-0.4.41.tar      # note this, to compare on the other side

2. Check it on the other sideCopy Anchor Link

Compare the checksum after the transfer, then unpack:

sha256sum 3am-0.4.41.tar
tar -xf 3am-0.4.41.tar && cd 3am-0.4.41

The installer checks every file against SHA256SUMS, and checks that file's signature against 3AM's release key. To do it yourself first:

sha256sum -c SHA256SUMS
openssl pkeyutl -verify -pubin -inkey 3am-release.pub -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig
openssl pkey -pubin -in 3am-release.pub -outform DER | openssl dgst -sha256

The last line must print 3AM's release key:

f50802ccfd18ca2a18f8f6f6de28ed28ba18d616c38b7aa7a9a2899d2cb0323a

If it doesn't, stop: the release wasn't signed by us.

3. InstallCopy Anchor Link

The models need an endpoint inside your network, or a GPU in the server:

./install.sh --model-url https://llm.example.internal/v1 --model meta-llama/Llama-3.3-70B-Instruct \
  --model-key-file ~/llm.key --s1-url https://llm.example.internal/v1/systemone

For a GPU in the server, download with --profile gpu. That release carries the model runtime and its weights, about 11 GB instead of 400 MB. Then plain ./install.sh is enough.

4. Add the licenceCopy Anchor Link

The console's licence step shows this install's fingerprint. From any machine with internet access, open warden.3am.si/redeem, enter your trial code and the fingerprint, and download the licence file. Upload it in the console.

With no route to 3am.si, 3AM checks the licence offline, from its signature. There's nothing to turn off.

KubernetesCopy Anchor Link

Push the images from the release into your registry, then install the chart that comes with it:

podman load -i images/3am-core.tar
podman tag localhost/3am-core:0.4.41 registry.example.internal/3am/3am-core:0.4.41
podman push registry.example.internal/3am/3am-core:0.4.41

kubectl create namespace 3am
kubectl -n 3am create secret generic 3am-packs --from-file=config/packs/
helm install 3am helm/3am-0.4.41.tgz -n 3am \
  --set image.repository=registry.example.internal/3am/3am-core --set image.tag=0.4.41 \
  --set packs.existingSecret=3am-packs <your model settings>

The model settings are the same as on a connected cluster (Kubernetes → Models).

Common questionsCopy Anchor Link