Air-Gap Deployment Guide — DKTrace in Classified Networks

Why Air-Gap Deployments Are Different

Every dependency that normally resolves via internet must be handled internally:

Pre-Deployment Checklist

Threat Intelligence Without Internet

DKTrace supports three offline TI update methods:

Method 1: USB/Media Import

threat-intel-manager accepts STIX 2.1 bundles via REST API.

# On transfer workstation (internet-connected):
./ti-export.sh --format stix2 --output /media/usb/ti-bundle-$(date +%Y%m%d).json

# On air-gap system:
curl -X POST https://dktrace-internal:8091/api/ti/import   -H "Authorization: Bearer $TOKEN"   -F "bundle=@/media/usb/ti-bundle-20260310.json"

Method 2: Data Diode (One-Way Hardware)

Owl Cyber Defense, Fox-IT, and similar hardware data diodes feed TI updates in with no return path possible. DKTrace supports UDP-only receive mode for data diode ingestion.

Method 3: Scheduled Transfer

Removable media with signed STIX packages, imported by the security team on a defined schedule (typically weekly for IOCs, daily for CVE updates).

Network Architecture

[COLLECTION ZONE]           [DATA DIODE]      [DKTRACE CORE]
  Syslog/CEF sources    →  (one-way HW)   →  ingestion-gateway :8082
  Agent endpoints       →  (one-way HW)   →  agent-receiver    :8098
  TI feeds (USB)        →  (manual xfer)  →  threat-intel-mgr  :8091

[ANALYST ZONE] — separate VLAN, no route to collection zone
  ← HTTPS from api-gateway :8080
  ← WebSocket from ws-gateway :8087

Critical: Never expose ports 5433 (PostgreSQL), 9002 (ClickHouse HTTP), 6380 (Redis), or 4222 (NATS) to the analyst VLAN. These are internal service bus ports only.

Certificate Management

# Generate all service certs against your internal CA
./scripts/generate-certs.sh   --ca /etc/dktrace/pki/internal-ca.pem   --ca-key /etc/dktrace/pki/internal-ca-key.pem   --services all   --validity-days 365   --output /etc/dktrace/certs/

All inter-service communication uses mutual TLS (mTLS) with client certificates. Rotate certs annually — DKTrace's cert-manager service handles rolling rotation with zero downtime.