Add documentation for air-gapped / fully offline FlowFuse deployments

[dgatti0213]

Description

Summary

We currently do not have documentation covering how to deploy FlowFuse in a fully air-gapped (offline) environment and what requirements, dependencies, and supported patterns so we can properly support this deployment model.

This is becoming a blocker for enterprise deals process.

What we need from engineering

Please define the minimum viable requirements to run FlowFuse in an air-gapped environment:
• Private container registry requirements (how images are delivered/updated)
• Node-RED / npm dependency strategy (offline node installs)
• DNS requirements (internal resolution expectations)
• TLS / certificate authority requirements
• Authentication options (SSO vs local, offline constraints)
• Networking assumptions (how components communicate internally)

Goal

Produce a clear requirements sheet that can be shared directly with a customer’s IT team, outlining:
• All required infrastructure
• All supporting systems/services they must provide
• What FlowFuse provides vs what the customer must own

Link to example: https://fathom.video/share/tR9McHcTBG9_YETCAuQVU8ks9QmkQrYf

[hardillb]

There is no one size fits all solution here, it totally depends on the customers security posture and what exactly they mean by "air-gapped" (each organisation I have talked to has had different definitions).

But the short version:

Things owned by the customer and they are fully responsible for

• Container registry, containers are published to Docker Hub, it is up to the customer to populate their internal registry
• NPM registry, customer must ensure all required packages are available for any node-red nodes they wish to install, this would normally via a pull through cache that bridges internal network and internet. (constraint that any npm module that pulls in pre-built native binaries will not work if they do not have build from source setup as these binaries are not pulled from npm registry, could be anywhere on the internet). Customer must supply this registry, can not reuse the one shipped with FlowFuse (used for team nodes)
• DNS, no change, they must provide DNS resolution for normal Docker/K8s install
• TLS certificates, same as Docker/K8s install (private ca chain certs need to be available at install time).
• SSO, As long forge application can reach the SAML/LDAP provider should just work
• Network, same as normal Docker/K8s install, forge app must be reachable via HTTPS/Websockets by Device Agent installs

Complications

• if no internet access then Hosted Instances must be configured with correct .npmrc values in template
• Remote Instances will need NodeJS installing and device-agent installing manually from internal npm mirror. Device Agent installer will not work

Totally air-gapped solutions are a lot of work to setup and maintain, and should be discussed with the Engineering team early on in the process as EVERY environment is different

[hardillb]

Some mitigations for npm pull through cache for Remote Instances only is the module cache option described here:

https://flowfuse.com/docs/device-agent/running/#creating-a-module-cache

This can be combined with custom device-agent docker containers as a pre-build single deployable

[dgatti0213]

I have taken the above and made this:
Deployments by constraint

Would you mind reviewing?