# Install without internet access

> Install the hub and edge gateways on a network with no internet access. Carry the images over as files, load them, start, and activate the license offline.

Source: https://proxus.io/docs/operate/offline-install

At the end of this guide, the Proxus hub runs on a machine that cannot reach the internet, its license is active,
and edge gateways on the same closed network can be installed. You prepare the files on a machine that has internet
access and carry them over, for example on a USB drive.

Proxus collects, stores, shows and sends data inside your network without any internet connection. Two things
normally come from the internet, and this page replaces both: the installer (from `proxus.io`) and the container
images (from Docker Hub).

## Before you start

You need:

- **A connected machine** with Docker, to download the files. Use one with the same processor type as the target
  machines (x86-64 or ARM64), or add `--platform`, for example `--platform linux/arm64`, to each `docker pull`.
- **The hub machine** on the closed network, with Docker Engine and the Docker Compose plugin already installed,
  and the [system requirements](https://proxus.io/docs/get-started/system-requirements) met. Docker itself is not part of the
  Proxus files: install it from your operating system's offline packages first.
- A way to carry about 2 to 3 GB of files to the hub machine.
- A license key, or a way to send the hub's **License ID** to Proxus or your distributor from another machine (see
  [Step 5](#step-5-activate-the-license)).

## Step 1: Download the files on the connected machine

1. Download the installer for the hub machine's operating system:

         ```bash
   curl -fsSL https://proxus.io/install.sh -o install.sh
   ```
         ```powershell
   Invoke-WebRequest https://proxus.io/install.ps1 -OutFile install.ps1
   ```
      
   If your Proxus delivery came with a prepared `docker-compose.yml`, you can use that file instead of the installer.
2. Download the images the hub uses:

   ```bash
   docker pull proxusplatform/proxus-ui:latest
   docker pull proxusplatform/proxus-server:latest
   docker pull nats:alpine
   docker pull postgres:16
   docker pull bitnamilegacy/clickhouse:latest
   ```

   These are the images named in the compose file that the installer writes. If you use a compose file from your
   delivery, `docker compose config --images` in its folder lists the images it needs.
3. Save them into one file:

   ```bash
   docker save -o proxus-hub-images.tar \
     proxusplatform/proxus-ui:latest proxusplatform/proxus-server:latest \
     nats:alpine postgres:16 bitnamilegacy/clickhouse:latest
   ```
4. If you will install edge gateways on other machines of the closed network, save their images too. A gateway runs
   the same `proxus-server` image next to a small message server of its own:

   ```bash
   docker pull nats:2-alpine
   docker save -o proxus-edge-images.tar proxusplatform/proxus-server:latest nats:2-alpine
   ```

Copy `install.sh` (or `install.ps1`, or your `docker-compose.yml`) and the `.tar` files to the drive.

## Step 2: Load the images on the hub machine

Copy the files to the hub machine, then load the images:

```bash
docker load -i proxus-hub-images.tar
docker image ls
```

`docker image ls` lists the five images with the tags above. Docker Compose uses an image that is already on the
machine and downloads nothing.

## Step 3: Start the hub

Run the installer you carried over, in the folder where Proxus should live:

```bash
bash install.sh
```
```powershell
powershell -ExecutionPolicy Bypass -File .\install.ps1
```

The installer needs no internet access. It asks for the culture and the time zone, detects the machine's address
for edge gateways, and writes `proxus-platform/docker-compose.yml`. Answer `Y` to **Start the platform now?**: the
stack starts from the loaded images.

With a compose file from your delivery instead, follow
[Install from a compose file](https://proxus.io/docs/get-started/install#install-from-a-compose-file). Its `docker compose up -d`
also uses the loaded images.

Check that every service is running and healthy:

```bash
cd proxus-platform
docker compose ps
```

## Step 4: Tell the hub it has no internet access

The edge gateway install window offers the hub's public internet address, which the hub looks up on the internet.
On a closed network the lookup finds nothing and the list shows only the local addresses. To skip the lookup, add
this line under `environment:` of the `proxus-ui` service in `docker-compose.yml`, then run `docker compose up -d`:

```yaml
      Service__DetectPublicAddress: "false"
```

## Step 5: Activate the license

The license check runs on the hub against the key's signature. Activation does not contact Proxus, so it works the
same way on a closed network.

1. Open `https://<host>:8443`, sign in as `Admin` with an empty password, as in
   [Sign in for the first time](https://proxus.io/docs/get-started/install#sign-in-for-the-first-time).
2. In the **License Activation** window, select **Copy** next to the **License ID** and write it down or save it to
   a file.
3. From any machine with e-mail or internet access, send the License ID to Proxus or your distributor. The key you
   get back works only for this ID.
4. Paste the key into **License key**, accept the agreement and select **Activate License**.

The License ID comes from the hub's host and its configuration volume. Keep both when you move or restore the hub,
or ask for a new key. See [License](https://proxus.io/docs/administer/license).

## Install edge gateways on the closed network

An edge gateway needs to reach only the hub, on port `7422` and on the hub's HTTPS port (`8443` by default).

1. On the gateway machine, load the images you saved in Step 1:

   ```bash
   docker load -i proxus-edge-images.tar
   ```
2. Create the gateway in the hub and run its install command, as in
   [Install an edge gateway](https://proxus.io/docs/connect/edge-gateways/install-a-gateway). The command comes from the hub, so it
   works without internet access. When the image cannot be downloaded, the installer uses the images already on the
   machine and continues.

To take the gateway image from a registry on your own network instead, set `EdgeDeployment__Image` on the
`proxus-ui` service to the image's full name in that registry, for example
`registry.plant.local/proxusplatform/proxus-server:latest`. The install command then uses that name.

## What needs the internet, and what to use instead

| Feature | Without internet access |
| --- | --- |
| Install, upgrade | Carry the images over as on this page. |
| License | Works. Only the License ID and the key travel, by any channel you choose. |
| Copilot | Use **Ollama (local)** on a machine of your network. Cloud AI services cannot be reached. Copilot's documentation search ships with the hub and works offline. See [Copilot settings](https://proxus.io/docs/administer/copilot-settings). |
| Outbound targets | A target on your network works. A cloud target works only if the gateway that sends to it can reach it. For AWS IoT Core, choose Amazon Root CA 1 together with the certificates: the hub cannot download it itself. See [Secure connections to targets](https://proxus.io/docs/connect/secure-target-connections). |
| Notification channels | E-mail works with a mail server on your network. Services on the internet, such as Slack, Teams or Telegram, cannot be reached. |
| Documentation | This site needs the internet. The hub's own copy of the documentation, used by Copilot, does not. |

## Upgrade without internet access

Repeat Step 1 for the new release on the connected machine, then on the hub machine:

```bash
docker load -i proxus-hub-images.tar
cd proxus-platform
docker compose up -d
```

Loading replaces the `latest` images, and Compose recreates the containers whose image changed. Read
[Upgrade](https://proxus.io/docs/operate/upgrade) first: it says what to back up and what to do after each release.

On each gateway machine, load the new edge images and recreate the gateway in its folder, skipping the `pull` step
of [Upgrade the edge gateways](https://proxus.io/docs/operate/upgrade#upgrade-the-edge-gateways):

```bash
docker load -i proxus-edge-images.tar
cd /opt/proxus/proxus-edge-3
sudo docker compose -p proxus-edge-3 -f compose.yaml up -d
```

## What's next

- [Harden the installation](https://proxus.io/docs/operate/security) before you connect the plant network.
- [Back up the installation](https://proxus.io/docs/operate/backup-and-restore), including the `config` volume.
- [Run Proxus with Docker](https://proxus.io/docs/operate/docker) for the day-to-day commands.