Quickstart: Deploying Air-Gapped Sovereign AI Clusters

This deployment runbook guides systems engineers through connecting enterprise banking, healthcare, or defense services to an Elesium private vLLM inference endpoint inside a secured VPC in the ap-south-1 (Mumbai) or ap-south-2 (Hyderabad) regions.

Prerequisites

• Dedicated AWS DirectConnect, Azure ExpressRoute, or private wireguard leased line terminating in your sovereign VPC.
• Mutual TLS (mTLS) client certificate issued by your enterprise Root Certificate Authority (CA).
• Python 3.10+ runtime or standard cURL client.

Step 1: Verify Direct VPC Peering

Test the unidirectional network socket to ensure zero packet egress to public internet gateways:

# Ping the internal sovereign gateway IP
traceroute -n 10.240.16.4

# Verify that external DNS resolution fails (Zero-WAN Invariant)
nslookup google.com || echo "Air-gap verified: WAN DNS inaccessible"

Step 2: Authenticate via Mutual TLS (mTLS)

All REST calls require bidirectional certificate exchange. Generate the request envelope with your client keys:

import requests
import json

SOVEREIGN_ENDPOINT = "https://10.240.16.4:8443/v1/chat/completions"
CERT_BUNDLE = ("/etc/ssl/certs/enterprise_client.crt", "/etc/ssl/private/enterprise_client.key")
CA_BUNDLE = "/etc/ssl/certs/elesium_internal_ca.crt"

headers = {
    "Content-Type": "application/json",
    "X-Elesium-Audit-Tenant": "IN-BFSI-PRODUCTION-01"
}

payload = {
    "model": "elesium-indic-sovereign-70b-fp8",
    "messages": [
        {"role": "system", "content": "You are a deterministic financial underwriting engine executing inside an air-gapped VPC."},
        {"role": "user", "content": "Analyze debt-service coverage ratio for ₹50 Cr term facility."}
    ],
    "temperature": 0.0,
    "max_tokens": 512
}

response = requests.post(
    SOVEREIGN_ENDPOINT,
    headers=headers,
    data=json.dumps(payload),
    cert=CERT_BUNDLE,
    verify=CA_BUNDLE,
    timeout=5.0
)

print("Inference Status:", response.status_code)
print("Response Payload:", response.json()["choices"][0]["message"]["content"])
print("Cryptographic Zeroization Hash:", response.headers.get("X-Zeroization-Proof"))

Step 3: Verification of Memory Erasure Receipt

Inspect the returned X-Zeroization-Proof HTTP response header. This header contains an Ed25519 digital signature proving the ephemeral KV-cache buffer was wiped upon token generation completion.