Architecture

How a request travels from the public internet to a model and back — and the four independent gates it must pass through on the way in, the line it will never cross, and the curated set of providers it can reach on the way out.

Zero Trust ingress · Local data residency · Curated provider mesh · April 2026

01 · Ingress

Two Clients, Four Gates

Aetherkeep serves two very different clients: people in a browser headed for Open WebUI, and Hephaestus coding agents calling the API. Both traverse the same Cloudflare Zero Trust fortress — they just present different credentials at each gate.

INTERNET CLOUDFLARE ZERO TRUST APOLLO · HOME LAN GATE 1 WAF US geo-fence GATE 2 Access identity check GATE 3 Tunnel cloudflared GATE 4 Scoped per-client auth PERSON apollo.aetherkeep.net OAuth Session Apollo chat & workspace HEPHAESTUS hermes.aetherkeep.net SvcToken API key Hermes model gateway
Gate 1
WAF Geo-Fence
Cloudflare edge · zone-wide
Every request is inspected at Cloudflare's global edge. If it originates outside the United States, it is dropped with an HTTP 403 before any Aetherkeep service sees it.
Person Requires a US-origin IP.
Hephaestus Same fence — the agent must dial out from a US network.
Blocks scanning bots, opportunistic attackers, and most of the internet before the next gate runs.
Gate 2
Cloudflare Access
Identity check · per-host policy
Zero Trust means every request proves who (or what) is making it before Cloudflare forwards it to Apollo. There is no anonymous entry and no login page reachable to unauthenticated clients.
Person Google OAuth → email must be on the allowlist. Identity carried as Cf-Authenticated-User-Email.
Hephaestus Service token → CF-Access-Client-Id + -Secret headers. One token per agent, revocable independently.
Blocks unauthenticated traffic from ever reaching the home LAN — so bugs in Apollo or Hermes cannot be exploited by random internet requests.
Gate 3
Tunnel Transport
cloudflared · outbound-only
Apollo has no open ports to the public internet. The cloudflared daemon dials out to Cloudflare and carries encrypted traffic in over that outbound connection. The home router never forwards a public port.
Person Browser ↔ Cloudflare ↔ Apollo, encrypted end-to-end.
Hephaestus Same tunnel — agent ↔ Cloudflare ↔ Apollo.
Blocks port scans, direct IP probes, and anything that depends on reaching a listening service. Aetherkeep is simply not addressable except through the Cloudflare fabric.
Gate 4
Scoped Authorization
Inside Apollo · per-client limits
Passing Cloudflare proves identity. Gate 4 answers the follow-on question: what is this specific client allowed to do? It runs inside Apollo, against whichever service the client reaches.
Person Apollo account — group / role governs which models are visible and applies per-user rate limits.
Hephaestus Scoped Hermes API key — hard monthly budget, rate limit, and explicit model allowlist.
Contains a compromise: a leaked agent key spends only up to its budget; a compromised account sees only the models its group allows. Instant revocation in either case.
02 · Residency

Your Data Lives Here

A single mini PC, on your LAN, holds everything you create. Nothing in this panel is stored in anyone else's cloud — if you unplug it, the data goes with it.

Apollo
APOLLO · Aetherkeep mini PC · 192.168.1.134
The only place your personal data is stored
PostgreSQL with pgvector · Docker bridge network · not exposed outside the LAN
💬
Chat history
Every conversation is stored in the local openwebui database. Not in ChatGPT's servers, not in Anthropic's. You can docker exec in and read the rows yourself.
📄
Uploaded documents
Files attached for RAG are parsed to text and stored locally. The original binary never leaves Apollo; only the passages relevant to a given question are sent to a model.
🧮
Vector embeddings
Semantic search runs against pgvector on Apollo. Your document index lives on your hardware; retrieval happens locally before anything crosses the public internet.
🧠
Skills, memories, prompts
Custom personas, pinned prompts, long-term memories — all persisted in the same local Postgres. Portable as a single pg_dump file.
📝
Memory pipe & Mnemosyne
An OWUI filter pipe captures durable user-specific facts turn-by-turn via a cheap task model, writes them add-only to the local memory store, and injects date-tagged recall into future conversations via semantic retrieval. The Mnemosyne skill is the curation counterweight — invoked manually when Mike wants to audit, consolidate, or rewrite memories, always with preview + approval before any destructive change.
Bottom line No chat history, document, embedding, or memory ever leaves this Pi — except the specific passages you explicitly ask a model to see, which travel through Panel 3.
03 · Egress

Curated Provider Mesh

Hermes fans model calls out to a hand-picked set of providers. Every one holds a documented privacy posture — and every one that doesn't is banned by policy, not by oversight.

Hermes model gateway hermes.aetherkeep.net Anthropic direct · no training on API data OpenAI direct · no training on API data Google AI Studio direct · paid tier, no training Fireworks AI direct · Zero Data Retention OpenRouter curated router · data_collection: deny DeepInfra · Parasail Together · Fireworks Novita · Google Vertex
Anthropic
Direct API · US-based
Claude Opus, Sonnet, and Haiku reach Anthropic's Commercial API directly. Anthropic does not train on Commercial API inputs or outputs. A 30-day retention window exists for trust-and-safety review only.
OpenAI
Direct API · US-based
GPT, GPT-Image, Whisper, TTS, and text-embedding-3-small (the RAG embedding model) reach OpenAI's API directly. OpenAI does not train on API data. 30-day abuse-monitoring retention.
Google AI Studio
Direct API · paid tier
Gemini Pro and Flash Lite reach Google's paid AI Studio tier directly. On the paid tier, Google does not train on prompts or completions. US-based company, US-hosted infrastructure.
Fireworks AI
Direct API · ZDR by default
Open-weight workhorses — MiniMax, GLM, Qwen Plus — reach Fireworks directly. Zero Data Retention by default: prompts and completions are not retained beyond the request. SOC 2, ISO 27001/27701/42001, HIPAA.
OpenRouter
Curated router · explicit allowlist
Models with no direct API go through OpenRouter. Every Hermes request carries data_collection: "deny", and the provider order is pinned to an explicit allowlist of US-hosted operators with ZDR or equivalent terms: DeepInfra, Parasail, Together, Fireworks, Novita, Google Vertex. allow_fallbacks: false means if no allowlisted provider has capacity, the request fails rather than silently rerouting through a non-vetted provider.
Never routed
Non-US / EU jurisdictions Providers hosting inference outside US or EU data-protection regimes — where retention practices are hard to verify and enforcement is uncertain.
No-ZDR providers Any provider without a documented Zero Data Retention or no-training-on-API-data commitment, even if technically reachable through OpenRouter.
Non-vetted providers OpenRouter's provider order is an explicit allowlist, not an allow-by-default. Any operator not on that list is unreachable, regardless of what model they host.
Sources of truth