Air-gapped installation

Toucan AI runs without internet access. At runtime it calls none of our services and loads no CDN script or web font: it only calls the services you configure.

What you provideCopy Anchor Link

• A container registry the cluster can pull from.
• An OpenAI-compatible LLM endpoint (vLLM, Ollama, LiteLLM…), with a model that supports tool calling.
• An OpenAI-compatible embeddings endpoint, with a model that returns 1024-dimension vectors, such as bge-m3.
• An SMTP server.
• PostgreSQL with the pgvector and pgcrypto extensions, Redis, and an S3-compatible bucket. The chart can run all three, for evaluation only.

Mirror the imagesCopy Anchor Link

From a machine with internet access, log in to registry.distr.sh with the credentials we provide (skopeo login registry.distr.sh), then copy the images your values use into your registry. Ours go at its root: registry.distr.sh/toucantoco/backend:<tag> becomes registry.example.com/backend:<tag>. Third-party images keep their path minus the registry host: docker.io/library/redis:8.8.1 becomes registry.example.com/library/redis:8.8.1.

global.imageRegistry is emptied so that helm template shows where each image comes from. For instance with skopeo:

helm template toucan-ai toucan-ai-<version>.tgz -f values.yaml --set global.imageRegistry= \
  | sed -nE "s/^[ -]*image: *['\"]?([^'\" ]+).*/\1/p" | sort -u \
  | while read -r src; do
      dst=${src#registry.distr.sh/toucantoco/}
      skopeo copy --all "docker://$src" "docker://registry.example.com/${dst#*/}"
    done

If your registry is not reachable from that machine, copy each image the same way to an archive (oci-archive:redis.tar), carry the archives over, then copy them to your registry.

Configure the chartCopy Anchor Link

global.imageRegistry points every image at your registry, the bundled PostgreSQL, Redis and Garage included:

global:
  imageRegistry: registry.example.com
  imagePullSecrets:
    - name: registry-credentials

backend:
  config:
    AI_DEFAULT_PROVIDER: openai-compatible
    OPENAI_COMPATIBLE_API_URL: https://llm.example.com/v1
    OPENAI_COMPATIBLE_MODEL: qwen3-32b
    EMBEDDING_API_URL: https://embeddings.example.com/v1
    EMBEDDING_DEFAULT_MODEL: bge-m3
    DOC_URL: https://docs.toucan.example.com
  envFrom:
    - secretRef:
        name: toucan-ai-secrets # OPENAI_COMPATIBLE_API_SECRET, EMBEDDING_API_SECRET…

frontend:
  config:
    DOC_URL: https://docs.toucan.example.com
    DOCS_PRODUCT_URL: https://toucan.example.com
    STATUS_PAGE_URL: ""

DOC_URL is the host the chart serves these docs on (ingress.docs). The assistant also reads them from the backend pods, so your cluster's DNS must resolve that host.

An agent building a custom front imports the chart libraries it needs from a CDN, which your users' browsers cannot reach. When you build a front with an agent, ask it to ship them as files of the front, and check the front from a browser inside your network.