On-Prem Enterprise

For customer-managed deployments inside your own VM, datacenter, or air-gapped environment, Caura ships a separate on-prem distribution that wraps the platform in a one-VM Docker Compose stack and a Caura-issued license file.

Repository: github.com/caura-ai/caura-onprem-installer — that repo's README.md and docs/ are the canonical install / day-2 / upgrade reference. The summary below is a pointer.

What it gives youCopy Anchor Link

• A single-VM Docker Compose stack (docker-compose.yml in the repo).
• A signed license.key — required; the platform refuses to start without one.
• Connected (pulls from ghcr.io/caura-ai/*) or fully air-gapped (load images from a tarball — airgap-load.sh).
• Backup / restore scripts (scripts/backup.sh, scripts/restore.sh) covering Postgres, Redis, .env, and the license file.
• Tag-driven, reversible upgrades (upgrade.sh) on Docker named volumes.
• A redacted support-bundle workflow for talking to Caura support.

With the admin audit transport fix, admin audit events write directly to platform-storage when the event bus is in-process. RabbitMQ is retired. Writes remain best-effort, so monitor storage failures; previously missing events cannot be recovered automatically. See the transport rollout runbook for paired installer and image requirements.

Set CAURA_RELEASE_VERSION to a published compatible service release. A version must be supplied explicitly; the historical default is refused before pulling images or writing install files.

Quickstart — connected VMCopy Anchor Link

curl -sL https://onprem.caura.ai/install.sh | bash -s -- --version "$CAURA_RELEASE_VERSION"

The installer runs preflight checks, generates secrets, writes /opt/memclaw/.env, pulls pinned images, brings the stack up, and prints the URL of a first-run wizard where an admin uploads the license and creates the first account.

Quickstart — air-gapped VMCopy Anchor Link

# Transfer caura-onprem-<version>.tar.gz to the VM (USB, SCP, etc.) --
# releases also publish the bundle under its previous filename at the same
# path, kept working for existing scripts.
./airgap-load.sh /path/to/caura-onprem-<version>.tar.gz
./install.sh --offline --version "$CAURA_RELEASE_VERSION" --license /path/to/license.key

The tarball bundles Caura services plus upstream bases (Postgres/pgvector, Redis, and gateway build bases), so docker compose never needs to pull.

Set IDENTITY_TOKEN_MODE=off for Enterprise services without GCP workload identity; this skips Google SDK imports and metadata probes for internal storage requests. The default, metadata, warms tokens at service startup and makes cold callers share one probe bounded to five seconds. Missing SDK/default credentials disable further probes for that audience until restart, with one warning per process. Valid tokens refresh in the background after 45 minutes and are cached for at most 50 minutes; transient refresh failures keep a still-valid token during a 30-second cooldown. Expired tokens are never sent: callers await a retry, and transient failures propagate instead of silently dropping authentication.

Silent / unattended installCopy Anchor Link

Every value can be supplied via CLI flag, CAURA_* env var, or a single config file:

./install.sh --config /etc/memclaw/install.conf --non-interactive

See install.conf.example for the full template.

PrerequisitesCopy Anchor Link

• Ubuntu 24.04 or equivalent.
• Docker ≥ 24 and Docker Compose v2.
• 16 GB RAM minimum, 200 GB disk for Postgres + Redis + room for memory growth.
• A DNS record pointing to the VM and a TLS cert (cert.pem + key.pem) for that hostname.
• A Caura-issued license.key.

When on-prem is the right pickCopy Anchor Link

• You need a contract, signed builds, and SLAs.
• You require a fully air-gapped install with no calls home.
• You have data-residency or compliance requirements that rule out the managed deployment.
• You want the platform's organisation management and multi-tenant gateway inside your own perimeter.

The OSS Self-host is the right pick if you only need the engine and are happy operating it yourself under Apache 2.0.

Day-2, upgrades, troubleshootingCopy Anchor Link

Live in the installer repo:

• docs/install.md — connected install
• docs/install-airgap.md — air-gapped install
• docs/day2-ops.md — backups, restore, log rotation
• docs/upgrade.md — sequential-minor upgrade path, rollback
• docs/troubleshooting.md
• docs/security.md, docs/TLS.md, docs/logging.md

Pricing and evaluationCopy Anchor Link

For pricing, sizing, and an evaluation copy of the on-prem distribution and license: contact the Caura team.

Give the PostgreSQL container at least 512 MB of shared memory (shm_size: 512m in Compose, or the equivalent pod setting). The container default of 64 MB is too small for PostgreSQL's parallel hash and sort work under collaboration load and surfaces as could not resize shared memory segment ... No space left on device.