--- title: "Set up an Outpost" description: "From an empty machine to the first searchable folder — with the Outpost application for Windows, macOS and Linux." canonical_url: "https://meingpt.com/en/docs/integrations/vault/deployment" language: en --- # Set up an Outpost An Outpost is a machine at your site that makes your documents searchable. You install the **Outpost application** on it — a program with a user interface, for **Windows, macOS and Linux** — and point it at folders. The program reads the documents and builds a search index; both stay on that machine. **This installs an Outpost, not Cloud Vault** This page keeps its former URL so existing bookmarks continue to work. The product installed here is the self-hosted **Outpost**. Cloud Vault is a separate meinGPT service and is not installed on this machine — see [Data sources (RAG)](/en/docs/integrations/data-pools-rag) for what it is. See the canonical [Outpost overview](/en/docs/admin-guide/outposts) for the product boundary and supported environments. **Only as much leaves as you release** "On-premise" does not mean nothing leaves your network — it means only what you release leaves it. Source files and the search index are not centrally synchronised, but every answer carries at least the matching passage out, or there would be no answer. Exactly how much is decided exclusively per folder on the Outpost by the release level below. **Early access — free to try** The Outpost is in **early access**. It is usable day to day and we ship quickly — expect frequent updates and expect individual screens to change. You can walk the whole setup below for free: **100 documents** are included. That is a preview, not a plan — it is sized so you can see once that the setup works: pair, release a folder, let it index, search. For production use, talk to us (**enterprise@meingpt.com**). ## What you need The machine reads your documents and answers search queries. It should stay on: while it is off — or while the Outpost is stopped — its documents cannot be found. meinGPT keeps working; only these sources are missing. | | | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Operating system** | Windows 10/11 or Windows Server 2019+ (64-bit), macOS on **Apple Silicon**, or Linux x86-64 with **glibc 2.39+** and libstdc++ providing **`GLIBCXX_3.4.31`**. Linux is verified on **Ubuntu 24.04 LTS** and **Debian 13**. Physical or a VM. | | **Memory** | At least **8 GB RAM and 2 cores**. We recommend **16 GB** for production and **32 GB** for large or OCR-heavy collections. No GPU required. | | **Disk** | About a third of the total size of your documents, at least 10 GB. The search index lives in the application's data folder. | | **Access to your storage** | Local path, UNC path or mount readable by the runtime identity. On Windows, the unattended service accesses domain shares as the computer account `DOMAIN\HOSTNAME$`. | | **Optional services preview** | Only when enabled for your workspace: databases and local MCP servers must be reachable from this machine. | | **Privileges** | On Windows, local administrator rights once for the installation. On macOS you drag the application out of the disk image into your Applications folder — depending on the account, macOS asks for administrator rights while you do. On Linux the AppImage starts without elevated rights. No reboot needed. | There is **no database, no container and no runtime** to install alongside it. Server, search index and the built-in embedding model are inside the application. **There is no Outpost for Intel Macs** The macOS build runs on **Apple Silicon only** (M1 and newer). There is no download for a Mac with an Intel processor, and Rosetta does not help here — it translates in the other direction. Check this **before** you download: Apple menu → **About This Mac**. If it lists _Chip_ and an "Apple M…", you are fine. If it lists _Processor_ and an Intel model, use a Windows or Linux machine for this Outpost — the application is the same on all three. ### What the firewall has to allow Two outbound connections, both on port 443. **No inbound port, no port forwarding.** | Host | Port | Type | Purpose | | -------------------- | ---- | --------- | ----------------------------------------------- | | `bridge.meingpt.com` | 443 | HTTPS/WSS | The tunnel meinGPT sends search queries through | | `app.meingpt.com` | 443 | HTTPS | meinGPT API and pairing | **This list is also in the application** The Outpost prints it on the **Connection** tab under *Network requirements* — with a **Copy** button. That is the most reliable way to hand it to IT: it states what this machine in this version actually needs, including a different meinGPT URL if you run your own instance. ## Step 1 — Install the program Download the application **on the prepared machine**, not on your own workstation. You find the download in meinGPT under **Settings → On-premise → Add Outpost**: | System | What you get | What you do with it | | ----------- | --------------------------------------- | ----------------------------------------------- | | **Windows** | an installer | run it, follow the wizard | | **macOS** | a disk image (`.dmg`) for Apple Silicon | open it, drag the application into Applications | | **Linux** | a verified install command | copy it from meinGPT and run it in a terminal | **How you can tell you installed the right thing** The **Windows installer** is signed with a publicly trusted certificate for **SelectCode GmbH**; Windows shows the publisher before installing. The **macOS application** is signed with a Developer ID certificate and notarized by Apple — so it opens on a plain double-click. There is no Gatekeeper block to work around and no right-click detour. On **Linux**, meinGPT first checks the downloaded bootstrap script against the SHA-256 from its authenticated release response. That script verifies an Ed25519-signed installation descriptor and then the AppImage size and SHA-256 before installing it. The AppImage itself carries no operating-system code signature. The manual AppImage link is therefore a recovery path only: compare the complete SHA-256 shown beside it before starting the file. **Updates** are protected on all three systems: the Outpost verifies every update against an Ed25519-signed manifest plus the checksum of the individual artifact. After that it keeps itself current — there is no manual update step. ## Step 2 — Pair On first start the application walks three pages: an overview, an explanation of the connection (the page you can show to IT security) and the pairing. In meinGPT, under **Settings → On-premise → Add Outpost**, you give it a name and get an eight-character **pairing code**. Read it out to whoever is at the machine — they type it in and press **Pair**. No meinGPT login is needed on the machine, and the code expires. ![The pairing step of the setup wizard: one field for the eight-character code from meinGPT](/images/vault/console/pairing.webp) **The wizard is only done once pairing succeeds** **Finish** in the bottom right triggers the pairing when none exists yet — it does not skip it. Without a valid code you cannot get past this page, and that is deliberate: pairing is the one step that can fail on a proxy, a firewall or a certificate. When it does, the page offers a button that runs the network check — see [Console & operations](/en/docs/integrations/vault/operations). ### [Create and pair an Outpost](/en/docs/integrations/vault/deployment/create-vault) The flow in meinGPT, step by step. ## Step 3 — Share folders (on the machine) What gets read is decided **in the program on the machine**, not in meinGPT. The **Shares** tab holds one list and, above it, one button: **Share**. - **A folder** — documents on this machine, or on a share it can reach. The Outpost reads them and makes them searchable. **Services are a separate preview** Databases and local MCP servers only appear when we have enabled the controlled services preview for your workspace. Seeing only folders here is the expected state in the general early access. You decide about your content, not about our structure — which machinery runs behind it is a question you do not have to answer. **There is no ID to copy any more** Earlier builds required creating a data source in meinGPT first and typing its **data source ID** into the Outpost by hand. That is gone. The machine reports its folders itself; meinGPT adopts one of them in the next step. ## Step 4 — Adopt it in meinGPT In meinGPT, open **Settings → On-premise**, click **Manage** on your Outpost and switch to **Shares**. What this machine has reported is listed there — with the path, exactly as it is named on the machine. A folder that has not been adopted yet offers **Use as source**. You give it a name, and from then on it is a document collection like any other: it is where you control **who** may find the documents. This is the split that runs through the whole product: | On the Outpost machine | In meinGPT | | -------------------------------------------- | --------------------------------------------------- | | which folders and systems are shared | which collections exist and who may see them | | which path is behind them | how much an Outpost may release | | when reading happens, what was skipped | which Outposts exist and whether they are connected | | troubleshooting, rebuilding the search index | who a collection is shared with | **The machine decides what exists — meinGPT decides who sees it** The platform cannot create a folder. A folder is bound where someone can see the disk and knows whether they may read it. Conversely, the machine does not decide who finds the documents — that is a permissions question and belongs in the platform. ### [A folder on this machine](/en/docs/integrations/vault/sources/local) Pick the path, done. ### [An SMB share](/en/docs/integrations/vault/sources/smb) Host, service account, password. ## Step 5 — Start it and watch it index After setup the Outpost is **paired but stopped**. The status bar along the bottom of the window shows `Stopped` on the left with a **Start** button; only after that does it read, index and answer. Press **Start** and open your folder under **Shares**. The row shows when it becomes usable; **Processing** tracks file discovery, text extraction or OCR, the keyword index and the vector index separately. **Source documents** names skipped or failed files and their reason. ### [The console: verify and operate](/en/docs/integrations/vault/operations) What the seven areas show, how you verify that it works, and what support needs from you. ## How much may leave? Applies **per folder**, and the decision is made **in the Outpost**: _Shares → open the folder → "What this folder releases"_. Not in the web console — the person who binds the folder is the one who knows whether its files may leave the building. The higher level includes everything from the lower one. | Level | Leaves your network | What for | | ------------------------- | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | **Text only** _(default)_ | the matching paragraphs, the file name and the complete text of the documents found | The file itself stays with you. | | **Original files** | everything from “Text only” plus the file itself | People can open the file from a citation and reuse it. For a quote template, the file _is_ the answer. | A third, lower level used to release only individual passages. It is gone: whoever may read one passage can ask a second question for the next one and assemble the document that way — the level cost answer quality and protected nothing. Existing sources still set to it keep working unchanged. The difference between "Text only" and "Original files" is _text versus artifact_, not machine versus human — anyone who releases the text can have the assistant read the content back. What "Text only" protects is the form: the layout, the signed PDF, the letterhead. **File system permissions do not travel** Releasing a folder for a data source releases it to everyone allowed to see that data source in meinGPT — including people who could not open it in Explorer or on the share. NTFS, Active Directory and POSIX permissions are **not** carried over. Check which folder is assigned to which team before you release it. ## More topics ### [Your own root certificate](/en/docs/integrations/vault/deployment/custom-ca) When your network inspects TLS with an internal CA. ### [Security](/en/docs/integrations/vault/security) Authentication, encryption, attack surface. ### [Console & operations](/en/docs/integrations/vault/operations) Status, index, logs, diagnostics for support. ### [Moving off the previous generation](/en/docs/integrations/vault/deployment/migration) For teams still running the Outpost as a container. In the default case you do not need an Outpost: data sources can be connected in meinGPT directly, without running a machine yourself. An Outpost pays off when source files and the search index must stay in your network, or when systems cannot be reached from the cloud. You control per folder on the Outpost what individual requests may transmit.