On-premises is the main path, not an option — installable offline, operable locally.
From bare metal to production in one pass: fill in a site manifest and it executes in order, bundling k3s HA, GPU support, Harbor and CNPG, with a full pre-install health-check acceptance gate. Replayable, with no manual SSH.
All services converge into one declarative catalog (manifest); adding a product line means one JSON entry plus a PR, zero code. It eliminates registry drift at the root.
One domain model drives three runtimes: native local processes, single-machine Docker, and a customer's existing Kubernetes. A single platform manages local development plus customer single machines and existing clusters.
CI pushes to the build registry, and the platform promotes tags to the internal run registry via Harbor pull-through replication before deploying. A product repo includes one template and gains a complete production pipeline, with zero manual work.
Ordinary configuration is rendered declaratively, secrets are stored encrypted with AES-256-GCM, and version snapshots are rollback-able — secrets never enter git, and plaintext keys never leave the customer's network.
Full-database backup and restore, air-gapped remote-support diagnostic bundles, and backup-first upgrade migrations. When something genuinely goes wrong on site, there is a backup to restore and a diagnostic bundle for remote rescue, and every upgrade is backed up and rollback-able in advance.
One interface operates all services and middleware: no kubectl, no memorizing subdomains. Postgres and Redis never expose public endpoints, and heavy operations run through on-demand temporary secure tunnels.
.tueoupdate signed update bundles: Ed25519 official signature verification plus a pre-check compatibility gate. The catalog segment goes to the capability platform and the image segment installs into Harbor. Anything that fails verification or lacks a signature is refused.
The platform deploys itself with its own Kubernetes driver; an upgrade swaps image tags and never breaks the genesis manifest. Two layers of immutable offline CI images plus a signed SBOM minimize the supply-chain attack surface.
Single domain + path routing + same-origin sessions — no more debt forced by cross-domain.
Package the whole platform into an offline bundle plus license.
Bundled k3s; all services start after signature verification.
One external domain + path routing; all products are same-origin.
Config / logs / status / deployment managed from one entry point.
Book a demo to discuss your on-premises or air-gapped deployment needs.