Bring your own hardware
Step 4 asks: "Which models should power this namespace?" Choose "Your own LLM hardware" to serve models from your own machines. Scirix connects to your hardware through a Tailscale tailnet, a private, encrypted network between your machines.
Agent pools🔗
If your organization already owns one or more agent pools, the form first shows an Agent pool picker with two options:
- Attach to your existing pool. Reuse a pool you already have. If you have more than one, a dropdown lets you choose.
- Create a new pool instead. Provision a fresh private pool.
If this is your first time, no picker appears and a new pool is created for you automatically.
How the connection works, and the security model🔗
You do not install any Scirix software on your hardware. The connection works the other way around.
- Scirix joins your tailnet as an ephemeral node, using an auth key that you provide.
- The connection is outbound-only from Scirix's side. Your network can never reach into Scirix.
- Because you tag the auth key in your Tailscale ACLs, you control exactly which machines and ports Scirix may reach. Nothing else on your tailnet is visible to it.
- Your auth key is stored encrypted and is never shown again after you submit it.
Prerequisites🔗
Before starting this step, you need:
- A tailnet. Create one for free at tailscale.com if you do not have one.
- A machine on that tailnet running your model server. Any OpenAI-compatible server works. Ollama is the most common choice and the forms default to it.
- A Tailscale auth key. In the Tailscale admin console, generate a key that is:
- Reusable. Scirix may need to rejoin.
- Expiring. Do not create a non-expiring key.
- Tagged with a dedicated tag, for example
tag:scirix-proxy, so your ACLs control what Scirix may reach.
Auth keys start with tskey-auth-.
Sharing one tailnet across a team: several people and machines can join the same tailnet: a teammate's laptop, a second GPU box, your phone. Each model server is registered in Scirix as its own endpoint (Part B), so one tailnet can serve models from multiple machines.
Part A: Register the tailnet and provision your pool🔗
- In Step 4, select "Your own LLM hardware".
- Fill in the form.
| Field | What to enter | Example |
|---|---|---|
| Tailnet name | A name for this tailnet inside Scirix. | acme-tailnet |
| Tailscale auth key | The reusable, expiring, tagged auth key from the Tailscale admin console. | tskey-auth-… |
- Click "Register tailnet & provision pool".
Both fields are required. If the auth key is missing, the request is rejected.
What happens next: Scirix stores the auth key encrypted, provisions or reuses your organization's private agent pool, and moves this namespace onto it. A confirmation banner shows the pool name and confirms the namespace now runs on your pool instead of the shared one.
Part B: Add a tailnet endpoint🔗
Next, tell Scirix where your model server listens inside the tailnet.
- Fill in the endpoint form.
| Field | What to enter | Default / example |
|---|---|---|
| Endpoint name | A label for this machine. | llm-server |
| Tailnet address | The machine's Tailscale IP. Prefer the stable 100.x address, which does not change. Find it in the Tailscale admin console or by running tailscale ip on the machine. | 100.64.0.7 |
| Port | The port your model server listens on. | 11434 (the Ollama default) |
- Click "Add endpoint".
All three fields are required.
Part C: Describe the model🔗
Finally, describe the model served at that endpoint so Scirix knows what it can do.
- Fill in the provider form.
| Field | What to enter | Example |
|---|---|---|
| Name | A display name for this provider. | acme/qwen3-coder |
| Backend | The server software. Defaults to ollama. | ollama |
| Model | The model identifier. The route prefix is added automatically if you leave it off (see the note below). | ollama_chat/qwen3-coder:30b |
| API key | Only shown if the chosen backend requires one. Ollama and vLLM do not. | |
| Capabilities | Checkboxes for what the model can do. Defaults to chat_completion. See Capabilities. | chat_completion, tool_use |
| Provider groups | Which groups this provider joins. You must pick at least one. |
- Click "Add provider".
Validation to be aware of:
- You must add the tailnet endpoint (Part B) before adding the provider.
- If the backend requires an API key, it must be filled in.
- At least one provider group must be selected.
What happens next: Scirix builds the model address from your endpoint (http://<tailnet address>:<port>) and routes all traffic to it through your pool's private tailnet gateway. A message confirms that the provider will be served through your pool's tailnet gateway once the reconciler applies it, usually in under a minute.
The Continue button for Step 4 unlocks once the provider is added. Until then, the status line reads: "Register the tailnet, endpoint, and model to continue."
Managing tailnets after onboarding🔗
You can manage tailnets at any time under Settings, then Your tailnets (/settings/tailnets). There you can:
- Register additional tailnets, using the same name and auth key form.
- Add more endpoints to a tailnet. The endpoint form also asks which Agent pool serves it.
- Enable, disable or remove a tailnet.
- Check each endpoint's sync status:
pending,appliedorfailed. A failed endpoint shows an error snippet to help you fix it.
Each tailnet entry shows whether an auth key is stored, its endpoint count, and whether a platform administrator has disabled it.
Step 5 for your own hardware🔗
Continue with The embedding index to choose which model builds the search index.