--- title: "Set up an Outpost" description: "From an empty machine to the first searchable folder — with the Outpost application for Windows, macOS and Linux." canonical_url: "https://meingpt.com/en/docs/integrations/vault/deployment" language: en --- # Set up an Outpost An Outpost is a machine at your site that makes your documents searchable. You install the **Outpost application** on it — a program with a user interface, for **Windows, macOS and Linux** — and point it at folders. The program reads the documents and builds a search index; both stay on that machine. **This installs an Outpost, not Cloud Vault — and only as much leaves as you release** This page keeps its former URL so existing bookmarks continue to work. The product installed here is the self-hosted **Outpost**. Cloud Vault is a separate MeinGPT service and is not installed on this machine — see [Data sources (RAG)](/en/docs/integrations/data-pools-rag) for what it is. See the canonical [Outpost overview](/en/docs/admin-guide/outposts) for the product boundary and supported environments. "On-premise" does not mean nothing leaves your network — it means only what you release leaves it. Source files and the search index are not centrally synchronised, but every answer carries at least the matching passage out, or there would be no answer. Exactly how much is decided exclusively per folder on the Outpost by the release level below. The Outpost itself is still under active development: **Early access — free to try** The Outpost is in **early access**. It is usable day to day and we ship quickly — expect frequent updates and expect individual screens to change. You can walk the whole setup below for free: **100 documents** are included. That is a preview, not a plan — it is sized so you can see once that the setup works: pair, release a folder, let it index, search. For production use, talk to us (**enterprise@meingpt.com**). ## What you need The machine reads your documents and answers search queries. It should stay on: while it is off — or while the Outpost is stopped — its documents cannot be found. MeinGPT keeps working; only these sources are missing. ### Operating system | Platform | Requirement | | ----------- | ---------------------------------------------------------------------------------------------------------------------------- | | **Windows** | Windows 10 version 1809 or later, Windows 11, Windows Server 2016 (until 12 January 2027), Windows Server 2019 or newer, 64-bit | | **macOS** | **Apple Silicon** (M1 and newer) — no build for Intel Macs | | **Linux** | x86-64 with **glibc 2.39+** and libstdc++ providing **`GLIBCXX_3.4.31`**, verified on **Ubuntu 24.04 LTS** and **Debian 13** | Physical or a VM. **Windows Server 2016: supported until 12 January 2027** Microsoft ends support for Windows Server 2016 on that date, and the Outpost supports it until then. Plan the move to Windows Server 2019 or newer. After that date, an Outpost on Windows Server 2016 keeps running its installed version and receives no updates. **Windows: the Visual C++ Redistributable (x64) has to be there first** The installer aborts when the **Microsoft Visual C++ Redistributable (x64)** is missing or outdated and offers you the download of the current version: [aka.ms/vc14/vc_redist.x64.exe](https://aka.ms/vc14/vc_redist.x64.exe). On a freshly installed machine it is regularly absent. An unattended install aborts without a dialog and states the reason in the installation log. ### Machine and access | | | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | | **Memory** | At least **8 GB RAM and 2 cores**. We recommend **16 GB** for production and **32 GB** for large or OCR-heavy collections. No GPU required. | | **Disk** | Allow space for extracted text, search indexes, and temporary space during index upgrades. Size the storage budget using a representative sample of the collection. | | **Access to your storage** | Local path, UNC path or mount readable by the runtime identity. On Windows, the unattended service accesses domain shares as the computer account `DOMAIN\HOSTNAME$`. | | **Optional services preview** | Only when enabled for your workspace: databases and local MCP servers must be reachable from this machine. | ### Installation privileges | Platform | What's needed | | ----------- | ------------------------------------------------------------------------------------------------------------------- | | **Windows** | Local administrator rights for installation, repair, service control and configuration changes. The service status view opens without a UAC prompt. | | **macOS** | Drag the application out of the disk image into your Applications folder — depending on the account, macOS asks for administrator rights while you do. | | **Linux** | The AppImage starts without elevated rights. | No reboot needed. There is **no database, no container and no runtime** to install alongside it. Server, search index and the built-in embedding model are inside the application. **There is no Outpost for Intel Macs** The macOS build runs on **Apple Silicon only** (M1 and newer). There is no download for a Mac with an Intel processor, and Rosetta does not help here — it translates in the other direction. Check this **before** you download: Apple menu → **About This Mac**. If it lists _Chip_ and an "Apple M…", you are fine. If it lists _Processor_ and an Intel model, use a Windows or Linux machine for this Outpost — the application is the same on all three. ### What the firewall has to allow Two outbound connections, both on port 443. **No inbound port, no port forwarding.** | Host | Port | Type | Purpose | | -------------------- | ---- | --------- | ----------------------------------------------- | | `bridge.meingpt.com` | 443 | HTTPS/WSS | The tunnel MeinGPT sends search queries through | | `app.meingpt.com` | 443 | HTTPS | MeinGPT API and pairing | **This list is also in the application** The Outpost prints it on the **Connection** tab under *Network requirements* — with a **Copy** button. That is the most reliable way to hand it to IT: it states what this machine in this version actually needs, including a different MeinGPT URL if you run your own instance. ## Step 1 — Install the program Download the application **on the prepared machine**, not on your own workstation. You find the download in MeinGPT under **Settings → Outposts → Connect Outpost**: | System | What you get | What you do with it | | ----------- | --------------------------------------- | ----------------------------------------------- | | **Windows** | an installer | run it, follow the wizard | | **macOS** | a disk image (`.dmg`) for Apple Silicon | open it, drag the application into Applications | | **Linux** | a verified install command | copy it from MeinGPT and run it in a terminal | ![The "Set up an Outpost" dialog with the three tiles Windows, macOS and Linux — macOS and Linux each with their own install action.](/images/vault/deployment/download-dialog.webp) **How you can tell you installed the right thing** The **Windows installer** is signed with a publicly trusted certificate for **SelectCode GmbH**; Windows shows the publisher before installing. The **macOS application** is signed with a Developer ID certificate and notarized by Apple — so it opens on a plain double-click. There is no Gatekeeper block to work around and no right-click detour. On **Linux**, MeinGPT first checks the downloaded bootstrap script against the SHA-256 from its authenticated release response. That script verifies an Ed25519-signed installation descriptor and then the AppImage size and SHA-256 before installing it. The AppImage itself carries no operating-system code signature. The manual AppImage link is therefore a recovery path only: compare the complete SHA-256 shown beside it before starting the file. **Updates** are protected on all three systems: the Outpost verifies every update against an Ed25519-signed manifest plus the checksum of the individual artifact. After that it keeps itself current — there is no manual update step. ## Step 2 — Pair On Windows, first select **Change configuration** and approve the Windows prompt. The service status view remains accessible without administrator rights. ![The Windows service-status view with "Change configuration" marked as a protected action; the status view itself opens without administrator approval.](/images/vault/console/windows-service-status.webp) On first start the application walks three screens: **Pairing**, **Resources** and **Folder**. On the first one, **the machine** generates its own code — not MeinGPT; you approve it afterward in MeinGPT. The full flow with the code, fingerprint phrase, and what to do if pairing does not go through, is under [Create and pair an Outpost](/en/docs/integrations/vault/deployment/create-vault). ## Step 3 — Set resource limits Once pairing succeeds, the wizard advances automatically to **Resources**. Two settings are required here before you can continue — both can be changed again later, in the application's **Settings** tab. **Compute budget** — a profile: **Resource-conscious operation**, **Automatic (recommended)**, or **Faster background indexing**. Live searches take priority over background indexing under every profile; the profile only decides how much CPU, RAM and how many background jobs are reserved for it, and the application shows the current limits right below it (e.g. "Up to 50% CPU · keep 20% memory free · 2 background jobs"). **Storage budget** — a ceiling for text and search indexes combined. The default is **200 GiB** (shown as “200 GB” in the application). Change it under **Settings → Outpost storage limit**. This value does not reserve disk space: indexing pauses independently of the configured limit when less than **512 MiB or 5% free space** remains. For production, measure a representative sample and allow for temporary space during index upgrades, as described under [What you need](#what-you-need). At **80% usage**, **Status** and **Settings** warn with the used storage and limit. Indexing continues; raise the limit before it is reached, provided the disk has enough room. The update raises stored limits of exactly **50 GiB to 200 GiB**, including an earlier deliberate choice of 50 GiB. Other values stay unchanged. Folders set to **Automatic** may consequently start building their vector index if the storage budget was the missing requirement. This uses additional processing time and storage. ![The "Set resource limits" step: the compute-budget selector and the storage budget in GB.](/images/vault/deployment/resources.webp) ## Step 4 through 6 — Share, adopt, start What gets read is decided **in the program on the machine**, not in MeinGPT: the **Shares** tab → **Share** → **A folder**. You then adopt the reported folder in MeinGPT under **Settings → Outposts → Manage → Shares** and grant access to the right people or teams. Finally you press **Start** in the status bar — only then does it read, index and answer. The full flow with every intermediate step, screenshots, and what to watch for with network drives, is under [A folder on this machine](/en/docs/integrations/vault/sources/local). **Services are a separate preview** Databases and local MCP servers only appear when we have enabled the controlled services preview for your workspace. Seeing only folders here is the expected state in the general early access. ### These three steps in detail ### [A folder on this machine](/en/docs/integrations/vault/sources/local) Pick the path, set the release level, adopt it in MeinGPT — step by step. ### [An SMB share](/en/docs/integrations/vault/sources/smb) Mount it, then treat it like a local folder. ### [The console: verify and operate](/en/docs/integrations/vault/operations) What the seven areas show, how you verify that it works, and what support needs from you. ## How much may leave? Applies **per folder**, and the decision is made **in the Outpost** — not in the web console: _Shares → open the folder → "What this folder releases"_. The choice is between **text only** (default) and additionally the **original files**; the full explanation is under [The release level](/en/docs/integrations/vault/security#the-release-level--the-one-setting-that-matters). ## More topics Beyond the setup itself: ### [Your own root certificate](/en/docs/integrations/vault/deployment/custom-ca) When your network inspects TLS with an internal CA. ### [Security](/en/docs/integrations/vault/security) Authentication, encryption, attack surface. ### [Moving off the previous generation](/en/docs/integrations/vault/deployment/migration) For teams still running the Outpost as a container. In the default case you do not need an Outpost: data sources can be connected in MeinGPT directly, without running a machine yourself. An Outpost pays off when source files and the search index must stay in your network, or when systems cannot be reached from the cloud. You control per folder on the Outpost what individual requests may transmit.