Skip to content

On-Premises Deployment

Lynx AI Agent supports on-premises deployments for organizations that require data to remain within their own infrastructure - whether in a private cloud or a fully air-gapped network.

Both deployment types share the same backend setup. The only difference is the AI engine:

  • Private Cloud - AI inference runs via a managed cloud provider, fully within your cloud tenant.
  • Air-gapped - AI inference runs on a self-hosted open-weight model with no internet connectivity whatsoever.

AI Engine

The Lynx AI backend requires an OpenAI-compatible completions endpoint. How you source it depends on your deployment type.

Private Cloud

For private cloud deployments, use your cloud provider's managed AI service as the inference endpoint. Popular choices include:

  • Amazon Bedrock
  • Google Vertex AI
  • Microsoft Foundry

All of these expose an OpenAI-compatible API and support Bearer key authentication.

Air Gapped

Warning

A local inference engine is a pre-requisite for an air-gapped environment.

In an air-gapped deployment, Lynx AI Agent relies on the power of local LLMs for Splunk reasoning, tool execution, and guardrail protections (including malicious payload and prompt-injection checks).

We continuously evaluate new checkpoints, publish benchmarks, and update the supported model list as the industry evolves. Learn more about our supported models here.

The inference endpoint must expose an OpenAI-compatible Completions API, be reachable from the backend over either HTTP or HTTPS, and may accept an optional Bearer key.

You can test the connection to the inference endpoint like this: 

curl -H "Authorization: Bearer <API_KEY>" \
     -H "Content-Type: application/json" \
     -d '{"model":"glm-5.1","messages":[{"role":"user","content":"What is the meaning of life?"}]}' \
     https://example.com/api/v1/chat/completions # (1)!

  1. Set the base URL to the inference endpoint in your organization.

Lynx AI Backend

The backend ships as a hardened container image, deployable with Docker, Docker Compose, Kubernetes, or OpenShift.

Minimum allocation: 1 CPU core, 1 GB RAM, and a stable network path to the model endpoint.

  1. Create the following .env file: 

    # .env

# App
ONPREM_MODE=true # (1)!
TRUSTED_HOSTS=<host1>[,<host2>] # (2)!
LATEST_VERSION=<version> # (3)!
PORT=<port> # (4)!
SSL_ENABLED=<boolean> # (5)!
IPV6=<boolean> # (6)!

# Inference
INFERENCE_URL=<url> # (7)!
INFERENCE_API_KEY=<api_key>
INFERENCE_URL2=<url> # (8)!
INFERENCE_API_KEY2=<api_key>
GUARDRAIL=<boolean> # (9)!
COMPACT_MAX_TOKENS=<number> # (10)!
AUXILIARY_MODEL=<model> # (11)!
REPLAY_REASONING=<boolean> # (12)!
VERIFY_SSL=<boolean> # (13)!

    1. This is required to be set to true when deployed in an air-gapped environment.
    2. Hostnames that the backend can accept requests on.
    3. Informs the backend what's the expected version of the Splunk app. The app checks its version against this value on load - if they don't match, it'll show a notification.
    4. Port the server listens on. Default: 3000
    5. Whether to listen for HTTPS requests. false means HTTP. true requires SSL certificates to be mounted into the container. Default: false
    6. Bind to :: (IPv6) instead of 0.0.0.0 (IPv4). Default: false
    7. Base URL to the primary inference endpoint. You can also use INFERENCE_URL1.
    8. Optional secondary inference endpoint. You can configure multiple endpoints by incrementing the number (e.g., INFERENCE_URL3, INFERENCE_URL4).
    9. Enable request filtering via a lightweight LLM guardrail. Default: true
    10. Maximum number of tokens to be generated by the compaction process. Default: 2000
    11. AI model used for guardrail protections and auxiliary tasks like chat title generation. Must be set to the name value of one of the on-prem AI models in ai.conf. Default: google/gemini-2.5-flash-lite
    12. Convert replayed reasoning_content to reasoning_details instead of stripping it. Usually not required for on-premises deployments. Default: false
    13. Whether to verify the SSL certificate of the inference endpoint. Default: true

  2. Run the container image with the .env file: 

    docker run -d -p 3000:3000 --env-file .env \
  ghcr.io/trylynx-ai/ai-agent-for-splunk-backend:latest

    If SSL_ENABLED=true, mount a certificate chain and private key into the container at /ssl/cert.pem and /ssl/privkey.pem: 

    docker run -d -p 3000:3000 --env-file .env \
  -v /path/to/fullchain.pem:/ssl/cert.pem:ro \
  -v /path/to/privkey.pem:/ssl/privkey.pem:ro \
  ghcr.io/trylynx-ai/ai-agent-for-splunk-backend:latest

Tip

Ensure the certificate files are readable by the container process (e.g., chmod 644).

Splunk App

When deploying the Splunk app, in addition to setting up the details of your backend server, you must also set onprem_mode = true and specify your available on-prem AI models in local/ai.conf.
See ai.conf for more details.

From this point on, setting up the Splunk app is the same as for an internet-connected deployment.

Follow the instructions in Installation and Configuration to complete the setup.