Self-Hosting & Air-Gapped

git clone https://github.com/hanzoai/cloud
cd cloud
make dev

CGO_ENABLED=0 go build -o cloud ./cmd/cloud
mkdir -p .dev && (umask 077 && openssl rand -base64 32 > .dev/master.key)
CLOUD_LISTEN=127.0.0.1:8080 \
  CLOUD_DATA_DIR=.dev/data \
  CLOUD_ENABLE_STAGED=functions \
  CLOUD_KMS_MASTER_KEY_REF="$(cat .dev/master.key)" \
  ./cloud

# 1. Liveness check (answers on port 9090)
curl -sS http://127.0.0.1:9090/healthz

# 2. Write a JSON document to the embedded SQLCipher store (/v1/base)
curl -sS -X POST http://127.0.0.1:8080/v1/base/collections/notes \
  -H "Content-Type: application/json" \
  -d '{"doc":{"title":"airgap-smoke-test"}}'

# 3. Read the collection back
curl -sS http://127.0.0.1:8080/v1/base/collections/notes

# 4. Verify the MCP JSON-RPC server exposes the registered tools
curl -sS -X POST http://127.0.0.1:8080/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

# 1. Pull model weights locally (resolves short aliases or any <org>/<model> ID)
hanzo pull zen-nano

# 2. List locally cached models
hanzo engine list

# 3. Serve on http://127.0.0.1:1234/v1 (with built-in browser chat UI at /ui)
hanzo engine serve zen-nano -- --host 127.0.0.1 -p 1234 --no-advertise

# 1. Confirm the model is loaded
curl -sS http://127.0.0.1:1234/v1/models

# 2. Run a local completion (standard OpenAI wire format)
curl -sS http://127.0.0.1:1234/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "zenlm/zen-nano-0.6b",
    "messages": [{"role": "user", "content": "Reply with the single word pong."}],
    "max_tokens": 256
  }'

# 1. Point a minimal config at your local engine (:1234)
mkdir -p ~/.hanzo-local-bot/workspace
cat > ~/.hanzo-local-bot/bot.json <<'EOF'
{
  "agents": {
    "defaults": {
      "workspace": "~/.hanzo-local-bot/workspace",
      "model": { "primary": "local-engine/zenlm/zen-nano-0.6b" }
    }
  },
  "models": {
    "mode": "replace",
    "providers": {
      "local-engine": {
        "baseUrl": "http://127.0.0.1:1234/v1",
        "apiKey": "local",
        "api": "openai-completions",
        "models": [
          {
            "id": "zenlm/zen-nano-0.6b",
            "name": "Zen Nano 0.6B (Local)",
            "reasoning": false,
            "input": ["text"],
            "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
            "contextWindow": 32768,
            "maxTokens": 4096
          }
        ]
      }
    }
  }
}
EOF

# 2. Start the local gateway (Terminal A)
BOT_SKIP_CHANNELS=1 BOT_STATE_DIR=~/.hanzo-local-bot \
  BOT_CONFIG_PATH=~/.hanzo-local-bot/bot.json \
  hanzo-bot gateway run --port 18789 --auth none

# 3. Run an end-to-end agent turn against local Cloud Core (:8080) (Terminal B)
BOT_STATE_DIR=~/.hanzo-local-bot BOT_CONFIG_PATH=~/.hanzo-local-bot/bot.json \
  hanzo-bot agent --session-id smoke \
  --message "Query http://127.0.0.1:8080/v1/base/collections/notes and summarize the records."

mkdir -p hanzo-airgap/{bin,weights}

# 1. Build the static cloud binary (pure Go, zero dynamic libc links)
git clone https://github.com/hanzoai/cloud
(cd cloud && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ../hanzo-airgap/bin/cloud ./cmd/cloud)

# 2. Fetch the Linux engine binary (or compile from source with CUDA for NVIDIA GPUs)
curl -fL https://github.com/hanzoai/engine/releases/latest/download/hanzoai-linux-amd64.tar.gz \
  | tar xz -C hanzo-airgap/bin

# 3. Pull model weights locally (either via `hanzo pull` into ~/.cache/huggingface/hub
#    or directly into a portable weights folder)
hanzo pull zen-nano
cp -RL ~/.cache/huggingface/hub/models--zenlm--zen-nano-0.6b/snapshots/* \
  hanzo-airgap/weights/zen-nano-0.6b

# 4. Archive for transfer
tar czf hanzo-airgap.tar.gz hanzo-airgap/

tar xzf hanzo-airgap.tar.gz
cd hanzo-airgap

# 1. Start Cloud Core
mkdir -p data && (umask 077 && openssl rand -base64 32 > master.key)
CLOUD_LISTEN=127.0.0.1:8080 \
  CLOUD_DATA_DIR=./data \
  CLOUD_ENABLE_STAGED=functions \
  CLOUD_KMS_MASTER_KEY_REF="$(cat master.key)" \
  ./bin/cloud &

# 2. Start Model Engine directly from the staged weights directory
./bin/hanzoai --serve-ip 127.0.0.1 --port 1234 \
  run -m ./weights/zen-nano-0.6b &

git clone https://github.com/hanzoai/iam
cd iam

# Generate a local dev signing key + seed file once
mkdir -p .dev/keys
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out .dev/keys/cert-dev
printf '{"organizations":[{"owner":"admin","name":"hanzo"}],"certs":[{"owner":"admin","name":"cert-dev","cryptoAlgorithm":"RS256"}],"applications":[{"owner":"admin","name":"hanzo-dev","clientId":"hanzo-dev","organization":"hanzo","enablePassword":true}]}\n' > .dev/init_data.json

# Boot local OIDC + JWKS on 127.0.0.1:8000 (ZAP on :19653 so it can run beside cloud's :9653)
IAM_DEV_HOST_RELATIVE=1 IAM_SIGNING_KEYS=.dev/keys \
  go run . serve --http http://127.0.0.1:8000 --zap 127.0.0.1:19653 --init-data .dev/init_data.json

curl -sS http://127.0.0.1:8000/.well-known/openid-configuration
curl -sS http://127.0.0.1:8000/v1/iam/.well-known/jwks

curl -sS -X POST http://127.0.0.1:8080/v1/kms/orgs/<org>/secrets \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"UPSTREAM_KEY","env":"dev","value":"example-secret"}'

curl -sS "http://127.0.0.1:8080/v1/kms/orgs/<org>/secrets/UPSTREAM_KEY?env=dev" \
  -H "Authorization: Bearer $TOKEN"

git clone https://github.com/hanzoai/chat
cd chat
pnpm install --no-frozen-lockfile
VITE_HANZO_API=http://127.0.0.1:8080 VITE_HANZO_IAM=http://127.0.0.1:8000 pnpm dev