> For the complete documentation index, see [llms.txt](https://help.resouris.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.resouris.com/part-2-running-resouris/deployment-modes.md). # Deployment modes ReSouris installs in one of three deployment modes. Each mode has its own delivery path, licence-issuance flow, revocation-list transport, and update cadence. The mode is baked into the licence itself (via the `deployment_mode` field) and the installer refuses a mismatched licence. ## SaaS The shared multi-tenant service, hosted at `*.rostaire.example` by ReSouris. **Characteristics:** * No installer to run — you sign in at your tenant's URL. * Licences are auto-fetched from the ReSouris Licence service daily at 03:00 UTC (v1.7 D1). * Revocations pull from the public feed at `https://portal.licence.rostaire.com/revocations.json` daily at 03:15 UTC. * Corpus updates roll out with the SaaS release cycle — you cannot pin an older corpus version. * Cross-tenant isolation is enforced via Postgres row-level security. The audit chain is per-tenant. **When to pick:** default choice. You get the latest features without operations overhead. ## Self-hosted You run ReSouris on your own infrastructure — physical, virtual, or containerised. **Characteristics:** * Installer: Docker Compose or Kubernetes Helm chart from the release feed. * Licence: ReSouris staff issue a signed `.json` file; you install with `bin/rostaire-licence install --path licence.json`. * Revocations: pulled from the public feed on the same daily 03:15 UTC cadence, provided the host has outbound HTTPS to `portal.licence.rostaire.com`. * Corpus: you pick which version to run; upgrades are opt-in. * Full control over Postgres, audit-witness backend, backup destination, notification adapters. **When to pick:** compliance or contractual requirements to keep data on your infrastructure; existing Postgres estate you want to co-locate on; strict change-window discipline. ## Air-gapped No internet reachability from the ReSouris host. Used by regulated deployments (defence, some NHS trusts, some financial-services HR systems). **Characteristics:** * Same installer as self-hosted. * Licence: ReSouris staff issue a signed file offline; you transfer it via USB / secure file share. * Renewal: MAK-style (Multiple Activation Key) request/response flow — ReSouris generates a signed request document; you carry it out-of-band to the ReSouris Licence portal (via a workstation with internet); ReSouris Licence issues the signed licence response; you carry it back. * Revocations: manual import via `bin/rostaire-licence import-revocations --path revocations.json`. The 30-day air-gapped-stale banner (see [Audit and compliance](/part-2-running-resouris/audit-and-compliance.md)) surfaces if you fall behind on imports. * Corpus updates: manual — you download a signed corpus bundle and apply it with `bin/rostaire-migrate` (there is no separate corpus installer; the migration corpus IS the bundle). * Backup destination is typically a local encrypted volume; no cloud KMS available so the backup-encryption adapter uses a local PEM key or an on-premise HSM. **When to pick:** hard air-gap requirement. Every other operational preference (control, compliance) is served by self-hosted with less friction. ## Comparison | Concern | SaaS | Self-hosted | Air-gapped | | -------------------- | ------------------ | ---------------------------- | ----------------------------- | | Licence delivery | Auto-fetch | Signed file, online delivery | Signed file, offline transfer | | Revocation transport | Auto-pull | Auto-pull | Manual import | | Corpus updates | Automatic | Opt-in | Manual, signed bundle | | KMS for signing keys | Cloud KMS | Cloud KMS or local PEM | Local PEM or on-prem HSM | | Backup destination | Cloud object store | Your choice | Local encrypted volume | | Support bundle | Auto-uploaded | Manual submission | Manual submission (redacted) | ## Switching modes Not supported in place. Switching means: 1. Export all data from the source deployment via the standard export tools. 2. Provision the target deployment. 3. ReSouris staff issue a new licence for the target `deployment_mode`. 4. Import. Most customers stay in one mode for the life of the deployment. A common evolution is SaaS pilot → self-hosted production once the compliance case is made. ## Verifying your mode `/ui/admin/about` shows the `deployment_mode` reported by the currently-active licence, alongside the tenant identity and corpus version. If it doesn't match what you expect, open a support ticket — a mode mismatch means the licence was issued for a different install profile and features may silently misbehave. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.resouris.com/part-2-running-resouris/deployment-modes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.