Deployment mode · Appliance

Darkmoon Appliance

Your hardware. Your infrastructure. Darkmoon. Transform compatible infrastructure into a dedicated Darkmoon security appliance — without proprietary hardware.

It is not a box

A software-defined appliance, not proprietary hardware

“Do you have a box?” Yes — Darkmoon can run as a dedicated appliance. But you do not buy proprietary hardware from us. The appliance is software that turns a machine you already trust into an autonomous security node.

You
Your server
Bare metal, VM, mini-PC or edge node you already own
You
Linux
A standard host OS you patch and harden
You
Docker
Docker Engine + Compose v2, the only runtime dependency
Darkmoon
Darkmoon
Packaged images, install tooling and lifecycle
Darkmoon
Darkmoon Appliance
A dedicated, autonomous security node
No proprietary hardware

Nothing to buy from us but the software. Bring your own machine.

No mandatory box

No OVA, no ISO, no sealed unit shipped to your dock.

No hardware lock-in

Move, resize or replace the machine on your own terms.

Sizing

Find your Darkmoon configuration

Five reference profiles for the machine you provide. Each one starts with what it is recommended for — match the workload first, then read the specs. These are recommended values carrying an engineering margin, not hard floors.

Minimum
Typical workload

Single low-parallelism campaign, a few assets.

CPU
2 vCPU
RAM
8 GB
Storage
40 GB SSD
Network
Outbound HTTPS to LLM + target reachability
Architecture
amd64
AI mode
Connected / Private
GPU
None
Standard
Popular
Typical workload

One campaign, normal agent parallelism.

CPU
4 vCPU
RAM
16 GB
Storage
80 GB SSD
Network
Sustained scan traffic during campaigns
Architecture
amd64
AI mode
Connected / Private
GPU
None
Performance
Typical workload

High concurrency / larger multi-asset campaigns.

CPU
8 vCPU
RAM
32 GB
Storage
160 GB NVMe
Network
Higher concurrent scan + LLM
Architecture
amd64
AI mode
Connected / Private
GPU
None
Industrial
Typical workload

Sustained on-site / edge node, long retention.

CPU
8–16 vCPU
RAM
32–64 GB
Storage
250 GB+ NVMe
Network
On-site targets, egress per AI mode
Architecture
amd64 (arm64 experimental)
AI mode
Any
GPU
None
Local AI
Typical workload

Sovereign, on-node inference.

CPU
8+ vCPU
RAM
16–32 GB + model floor (7B +8 GB, 13B +16 GB, 33B +32 GB)
Storage
160 GB+ NVMe (+ model weights)
Network
LLM stays on node
Architecture
amd64
AI mode
Local
GPU
Optional (local inference only, never for the engine or VR)
Not sure which to pick?

The documentation walks through parallelism, retention and AI mode so you can size the machine precisely.

Full sizing methodology →

Operations

Operate it through its lifecycle, not by hand

You run Darkmoon through its lifecycle tooling — not by hand-administering every container. One command brings the node up, one keeps it healthy, one moves it forward.

01
Install
install.sh

Pulls the packaged images and brings the node up.

02
Darkmoon
darkmoon run

Launch a campaign against a target you own.

03
Doctor
darkmoon doctor

Diagnose the host, runtime and containers.

04
Repair
darkmoon repair

Apply the safe automatic fix Doctor identified.

05
Update
darkmoon update

Move to the next version, the same way every time.

The control of self-hosting. The simplicity of SaaS.

Diagnostics

Darkmoon Doctor keeps the node honest

One command inspects the whole node and tells you plainly what is wrong. Every check below is a real check the tool runs.

darkmoon@node
$ darkmoon doctor
Running diagnostics…
✓Runtime— Docker Engine present and healthy
✓Compose— Compose v2 available
✓Containers— All services up and responsive
✓Images— Pinned versions match the release
✓License— Valid and in date
✓AI provider— Reasoning endpoint reachable
✓Privacy Gateway— Tokenization active
✓Ports— Required ports bound, no conflicts
✓Disk— Free space above threshold
✓Memory— Headroom for the sized profile
✓GPU— Detected for local inference (GPU profile only)
✓ Node healthy · 0 issues

When something drifts, the loop is short and legible:

Problem

A container stops, a config drifts, a prerequisite is missing.

Doctor

darkmoon doctor inspects host, runtime and containers.

Diagnosis

It names the fault in plain language — no runbook required.

Action

A safe automatic fix, or a documented action you confirm.

Reasoning

Choose your AI

The reasoning layer is yours to place. The engine is the same — only the model's location changes.

Connected
Remote LLM + Privacy Gateway

Reason with a remote model while the Privacy Gateway tokenizes sensitive values on the node before anything leaves. Data-minimization by design — not an offline mode.

Private
Your own endpoint

Point the node at a model endpoint you already operate — your VPC, your gateway, your contract. Darkmoon reasons through it, nothing routes elsewhere.

Local
On-node inference

Run the model on the node itself for a self-contained, sovereign deployment. A GPU is optional and used only for local inference.

Note. The Privacy Gateway is data-minimization, not an offline mode: it tokenizes sensitive values before they reach a remote model. A GPU is relevant only for Local inference — never for the engine, and never for the immersive view, which renders client-side.

Responsibility

Your infrastructure. Our software.

A clean line between what you run and what we ship. There is no proprietary box to replace — if a machine breaks, you swap the machine and bring the node back up.

You control
  • Physical hardware
  • VM / hypervisor (if applicable)
  • Host operating system
  • Host security & hardening
  • Network & firewall
  • Power & physical maintenance
  • Hardware replacement
  • Hardware warranty
Darkmoon provides
  • Darkmoon software
  • Packaged deployment
  • Docker images
  • Installation tooling
  • Darkmoon Doctor
  • Application lifecycle & updates
  • Compatibility documentation
  • Reference sizing
  • Software support
Deployment

Deploy where you need it

The same node fits a rack, a hypervisor, a plant floor or your own cloud tenancy. Any of these substrates works, and no hardware brand is mandatory — you choose the machine, the appliance is the software on top.

Dedicated server

A bare-metal machine you own, racked or on a bench.

Linux VM

A guest on your existing hypervisor, sized to a profile.

Industrial PC

A fanless or ruggedized unit on the plant floor.

Edge server

A node close to the assets it tests, on-site.

Private cloud

Your own tenancy, under your governance and controls.

Ecosystem

One engine, a horizontal ecosystem

The appliance is the execution point. The same engine integrates across the tools you already use — the ecosystem stays horizontal, wherever the node runs.

Darkmoon Pro

Web console, reporting and remediation on top of the engine.

MCP

The Model Context Protocol server, exposing Darkmoon to agents.

CI/CD

Security campaigns wired into your pipelines.

IDE

Reach the same engine from where you write code.

Automation

Trigger and orchestrate campaigns programmatically.

Monitoring & security

Feed findings into the tooling you already run.

Infrastructure Graph

The tested estate rendered as a live topology.

Attack Paths

Chains of findings surfaced as reachable routes.

Spatial / WebXR

Walk the graph in a desktop or immersive view.

Spatial

From node to attack graph

The appliance produces the graph data. Darkmoon Pro turns it into attack paths you can walk — on the desktop or in an immersive view. The immersive rendering happens client-side, so it never needs a GPU on the node.

ApplianceGraph dataAttack pathDarkmoon ProDesktop / Spatial / WebXR

Read the Appliance documentation

Packaged Docker images, install tooling and Darkmoon Doctor. See how to install, size, operate and diagnose a dedicated node on your own hardware.