Air-Gapped Operation

Athena is designed to run indefinitely on a fully isolated network — no internet, no telemetry, no license check-ins, no phone-home.

No phone-home#

Every part of a default Athena deployment resolves locally. Nothing reaches outside the isolated network during normal operation:

The database is local SQLite by default (Data Source=athena.db) — no external database service to reach.
Agents connect outbound-only to the server; there is no external message broker or cloud relay in the path.
The Root CA and all agent certificates are generated locally on first run.
Packages, session recordings, agent binaries, and audit logs are all stored on local disk.

None of these require any external service.

Designed for isolation

A default install has no outbound dependency — no telemetry, no license check-ins, and no update servers to reach. Athena is built to run indefinitely on a network that never touches the internet.

Offline Windows Update scanning#

For patch visibility without internet, the server hosts Microsoft's offline scan catalog, wsusscn2.cab. Agents use it to evaluate which updates are missing entirely offline. See Windows Update Management for the complete workflow — catalog upload and signing, on-demand and scheduled scans, and reviewing results.

Upload and manage the catalog via the api/updates endpoints:

Method & path	Purpose
`POST api/updates/wsusscn2.cab`	Upload the offline scan catalog
`GET api/updates/wsusscn2.cab`	Download the current catalog
`GET api/updates/wsusscn2.cab/info`	Inspect catalog metadata (size, date)
`DELETE api/updates/wsusscn2.cab`	Remove the catalog

You can also manage it in the console under Settings → Agent → WSUS. Agent-side scanning is opt-in via Agent:UpdateScanner:Enabled (false by default).

The CAB is large (hundreds of MB). Transfer it onto the network like any other artifact — see Transferring artifacts onto the network.

Transferring artifacts onto the network#

Move the server image across the air-gap boundary as a tarball. On a connected machine, export the image; carry the tar across the boundary; then load it on the isolated host:

# On a connected machine: export the image to a tarball
docker save ghcr.io/<owner>/athena-server:latest -o athena-server.tar

# Move athena-server.tar across the air-gap boundary (USB, data diode, etc.)

# On the isolated host: load the image from the tarball
docker load -i athena-server.tar

Bring the rest of the artifacts across the same way:

The agent installer bundle (from Agent Enrollment).
The wsusscn2.cab offline scan catalog, if you use offline update scanning.

TLS without public CAs#

Public certificate authorities are unreachable on an isolated network, so issue the server certificate yourself. Use an internal PKI or a self-signed PFX for the server certificate.

On agents, choose one of:

Install your CA into the host trust store, so the self-issued server certificate validates normally; or
Set ValidateServerCertificate=false for self-signed setups.

Athena's own PKI is independent

Athena's agent PKI (the local Root CA and the certificates it issues to agents) is independent of any public CA. The server TLS certificate above is a separate concern from the agent identity certificates.

To stand up Athena behind an air gap, use the docker load + docker run install described in Installation. That path has no outbound dependency and is the canonical way to deploy Athena on an isolated network.