Skip to main content

Air-Gapped Licensing

Air-gapped sites cannot (or must not) keep a continuous Host→cloud HTTPS session. Operators move signed packages between cloud and site — export, carry, import — instead of relying on always-on sync.

Air-gap complements Local Relay continuous sync; it does not replace Relay for sites that can sync outbound. It is also distinct from single-device offline request/response issuance.

Directions

DirectionIdea
Cloud → siteExport signed entitlements / revocation (± offline material); import and apply on the site (often via Relay.Host)
Site → cloudExport usage / status / receipts (no private keys); import on the cloud for reconciliation

Packages are fail-closed: bad signature, digest mismatch, or wrong tenant/audience → reject the whole apply. Re-import of the same package id is idempotent (no duplicate seat or usage side effects).

When to use

  1. True air-gap or scheduled sneakernet transfers.
  2. Policy forbids continuous outbound from the site.
  3. You still need occasional capacity / revocation updates without opening a permanent tunnel.

Next steps