Skip to main content
This section is for operators running self-hosted Noxus (VM docker-compose or Kubernetes) who need to define firewall, ingress, and egress rules. On the managed cloud (app.noxus.ai) all of this is handled for you — you only need your users to reach the app over HTTPS. Noxus has two independent connectivity surfaces. Treat them separately when you plan firewall rules:

Inbound

Traffic arriving at your deployment — your users’ browsers and API clients, plus webhooks pushed by external SaaS (Slack, WhatsApp, Teams…).

Outbound

Traffic Noxus initiates — model providers, integration APIs, object storage, and the optional Noxus Control Service.

​
The mental model

​
Two kinds of inbound — don’t conflate them

OAuth sign-in callbacks are browser redirects, not server-to-server calls. They only need to be reachable by your users’ browsers — not by the OAuth provider’s servers. See Inbound connectivity.

​
What restricted networking costs you

A fully air-gapped deployment is supported but constrained: you must point models at an in-network OpenAI-compatible endpoint, use direct (non-NCS) OAuth apps or static credentials, and disable telemetry. The Outbound page walks through the minimal-egress setup.