Air-gapped and restricted networks

CodeLotse needs no connection to Quavon or any other vendor service at runtime. It talks only to the code hosts, trackers and model endpoints you configure. Building the images needs internet access (or mirrors).

Outbound connections

Connection	When	How to avoid or redirect
Code host (GitHub, GHES, GitLab, Azure DevOps)	Always, for the hosts you connect	Use a host inside your network, for example GHES
Model endpoints	Reviews, triage, replies, fixes, embeddings of the code index (hybrid mode)	Configure a private endpoint per tenant (below); a local embeddings server works through the OpenAI-compatible provider
Trackers (Jira, Linear, Azure Boards)	Only when a tracker connection exists	Do not configure them, or use Jira Data Center (trackers.md)
Notifications (Slack, Microsoft Teams, webhooks, SMTP)	Only when a tenant admin adds a channel	Use e-mail through an internal relay or a webhook to an internal endpoint (notifications.md)
ACME (Let's Encrypt)	Compose with --tls acme	Use --tls provided with your own certificate, or --tls internal
Product telemetry	Only after an instance admin opts in and QUAVON_PRODUCT_TELEMETRY_URL is set	Set QUAVON_PRODUCT_TELEMETRY=disabled to turn it off for good (telemetry.md)
OpenTelemetry export	Only when OTEL_EXPORTER_OTLP_ENDPOINT is set	Point it to your own collector (observability.md)
MCP servers (review context)	Only when QUAVON_MCP_CONTEXT=allowed, a tenant admin registers a server and a private repository turns it on	Keep QUAVON_MCP_CONTEXT=disabled (the default), or allow internal hosts with QUAVON_MCP_PRIVATE_HOSTS (mcp-context.md)
Package registries from sandbox jobs	Only for registries listed in QUAVON_SANDBOX_REGISTRIES (empty by default)	Leave it empty (sandbox.md)

There is no update check and no licence check. The browser loads GitHub avatars from avatars.githubusercontent.com for github.com users only.

Docker Compose

The Compose installer always builds the images on the host (docker compose up -d --build). The build downloads base images from Docker Hub and gcr.io, packages from the npm registry, Go modules, Debian packages and the PostgreSQL extensions from GitHub. An offline Compose installation is therefore not supported. For a host without internet access:

• allow these downloads during install and upgrades through your proxy or registry mirrors (configure the Docker daemon and BuildKit accordingly), and block outbound traffic at runtime; or
• use Kubernetes with the air-gap profile below.

After the installation, set in deploy/compose/.env:

QUAVON_PRODUCT_TELEMETRY=disabled
QUAVON_MCP_CONTEXT=disabled

and restart with ./deploy/compose/quavon install --yes. Use --tls provided or --tls internal instead of ACME. The sandbox images are built by deploy/images/sandbox/build.sh during the installation and need the same downloads.

Kubernetes

The chart has an air-gap profile, values-airgap.yaml: images only by digest from your registry, product telemetry and MCP context hard off, no internet egress, no ACME annotations and no sandbox registry egress. See kubernetes.md for the full list.

1. On a machine with internet access, build the images and push them to a registry that the cluster can reach (commands in kubernetes.md). Build the sandbox images with deploy/images/sandbox/build.sh --registry <MIRROR>.

2. List every image the chart will pull with your values:

   deploy/helm/images.sh -f values.yaml -f deploy/helm/codelotse/values-airgap.yaml

   Mirror these and the sandbox images in deploy/images/sandbox/images.lock.json.

3. Set the digests in images.<name>.digest, narrow networkPolicy.egressCidrs to your code host and model servers, and install with both values files.

Private model endpoints

Model credentials are set per tenant in the web interface under Language model credentials (models.md describes the form, the endpoint presets and the model list):

Provider	Base URL
OpenAI-compatible (vLLM, Ollama and similar servers)	Required, for example https://llm.example.internal/v1. http:// is allowed only for this provider and only for private hosts (localhost, *.internal, *.local, single-label names, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, loopback, fc00::/7).
Azure OpenAI	Required: the resource name, which becomes https://<resource>.openai.azure.com, or the full resource URL
OpenAI, Anthropic, Mistral	None in the form; the official API is used. The API still accepts an optional base URL.
Amazon Bedrock	None; choose the AWS region

• An API key is always required. If your server does not check keys, enter any placeholder value.
• The base URL must not contain credentials, a query or a fragment.
• With QUAVON_EDITION=enterprise only public https endpoints are accepted.
• https endpoints must have a certificate from a public CA. A private CA cannot be added yet.