> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/setup/deployment/outpost.md).

# Outpost

An Outpost is a worker-only Teleskope deployment that runs inside your network and scans data sources your Teleskope environment cannot reach directly, such as on-premise SQL databases and SMB file shares. This page covers what runs where, host and network requirements, and how to install and update the Outpost bundle.

## How It Works

The Outpost runs Teleskope's crawler and scanner workers on a single VM you provide, on k3s (a lightweight Kubernetes distribution) installed by the bundle. It connects outbound to your Teleskope environment to receive work and report results.

* File contents never leave your network. Workers read and classify data locally; only classification results and metadata are sent to your Teleskope environment.
* All connections are outbound from the Outpost. Teleskope requires no inbound access to your network.
* Container images ship inside the install bundle. The VM needs no access to a container registry.

## Prerequisites

* A dedicated VM running Ubuntu 22.04 LTS with root access
* 4 vCPU and 16 GB RAM minimum (32 GB recommended), 100 GB disk
* Outbound network access per the table below
* An install bundle URL from your Teleskope team (a time-limited download link)

## Network Requirements

All connections are outbound. No inbound rules are required.

| Destination                             | Port          | Purpose                                             |
| --------------------------------------- | ------------- | --------------------------------------------------- |
| `api.metadata.<your-env>.teleskope.ai`  | 443           | Work coordination and result reporting              |
| `sqs.<region>.amazonaws.com`            | 443           | Job queueing                                        |
| `secretsmanager.<region>.amazonaws.com` | 443           | Connector credential retrieval                      |
| Bundle download URL host                | 443           | One-time bundle download                            |
| `processing.<your-env>.teleskope.ai`    | 6380          | ML classification, when enabled for your deployment |
| Your file servers                       | 445           | SMB file share scanning                             |
| Your database servers                   | Database port | On-premise SQL scanning                             |

Your Teleskope team confirms the exact hostnames, region, and ports for your deployment before install.

{% hint style="warning" %}
**Warning:** The installer downloads public packages over HTTPS while it runs, so general outbound access on port 443 must be open during installation. After install completes, egress can be restricted to the destinations above.
{% endhint %}

## Install

1. Download the bundle. Single-quote the URL — it contains `&` characters that break the shell otherwise:

   ```bash
   curl -o teleskope-k3s.tar '<bundle-url>'
   ```
2. Extract the bundle:

   ```bash
   tar xf teleskope-k3s.tar && cd teleskope-k3s
   ```
3. Run the installer with the flags your Teleskope team provides:

   ```bash
   sudo ./install-k3s.sh --no-gpu
   ```

   The installer sets up k3s, imports the bundled container images, and starts the Teleskope workers.
4. Verify the node and workers are up:

   ```bash
   systemctl status k3s
   sudo k3s kubectl get pods -n teleskope
   ```

   All pods reach `Running` within a few minutes.

## Update

Teleskope provides a new bundle URL for each update. On the Outpost VM:

```bash
sudo ./update.sh '<new-bundle-url>'
```

Updates replace container images and configuration. Scan state and connector credentials live in your Teleskope environment and are unaffected.

## Troubleshooting

| Symptom                                         | Cause and fix                                                                                    |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| k3s node not `Ready`                            | Check `systemctl status k3s` and `journalctl -u k3s -f`.                                         |
| `x509: certificate signed by unknown authority` | Install CA certificates: `sudo apt-get install -y ca-certificates`.                              |
| `dial tcp ...:445: i/o timeout` in worker logs  | The VM cannot reach the file server. Check firewall rules between the Outpost VM and the target. |
| Pods stuck in `CrashLoopBackOff`                | Usually a bundle configuration issue. Contact your Teleskope team.                               |

For anything else, reach out to your Teleskope rep or email <contact@teleskope.ai>.