Installation and Deployment

Installation and Deployment

Nexus Gateway is the same platform in every deployment — the AI Gateway, Compliance Proxy, Desktop Agent, Control Plane and its console, and the Nexus Hub, backed by a database, a cache, and a message queue. It runs in one of three ways depending on how much you want to operate yourself and how isolated your environment must be. The components and the way they govern AI traffic are identical across all three; only who runs the infrastructure and how it connects to the outside world changes.

SaaS (hosted)

The management plane is operated for you: you do not stand up the database, services, or console yourself. You connect your applications, proxies, and agents to the hosted endpoint and administer everything through the same console. This is the lowest-operational-burden option — there is no infrastructure for your team to run or upgrade.

Self-hosted

You run the whole stack on your own infrastructure. The backing stores — PostgreSQL, the cache, and the message queue — come up via the project's Docker Compose definition, and the five services and the console run on top of them. A single node is enough for a trial or a small deployment, and the same components scale out for larger fleets. You own the data, the network boundary, and the upgrade cadence.

The operator documentation is the authoritative procedure for a self-hosted bring-up:

• Deployment — bring-up and topologies.
• Single-node on EC2 — a complete single-node deployment.
• Backup and disaster recovery.
• PKI and certificates.

Air-gapped

For isolated or offline networks with no outbound internet, the same self-hosted stack runs with no external dependencies. Updates, provider credentials, and rule packs are brought in out of band rather than fetched over the network. The air-gapped deployment runbook is the authoritative procedure for this model.

Choosing a model

The three differ only in operations and isolation, not in what the product does:

• SaaS — least to operate; suitable when running infrastructure yourself is not a requirement.
• Self-hosted — full control over data residency, network boundary, and upgrade timing; suitable for most enterprise on-premises and private-cloud deployments.
• Air-gapped — strict isolation for regulated or disconnected environments, at the cost of out-of-band update handling.

See also

• Getting Started — bring the stack up locally first.
• Architecture Overview — the components referenced here.
• Operations and Runbooks — day-two operational procedures.