Deploying Verge3D in an air-gapped, self-hosted environment
Verge3D is an exceptional choice if you need to develop and/or serve 3D web applications entirely on-premises. From the ground up, Verge3D is designed to be self-hosted, that's why all its network capabilities are made optional. This way you can protect the privacy of your data, make your setup secure against remote attacks, avoid vendor lock-in, or meet some harsh regulatory compliance standards. Last but not least, by using a self-hosted solution, you can make your infrastructure more flexible, cost-efficient, and robust in the long term.
Even though Verge3D is web-based in its nature, you can operate it in a completely air-gapped environment. This claim is true for both the development and runtime usage of 3D apps.
Verge3D features using internet connection
The following optional features require connecting to Soft8Soft servers or third-party services (Amazon):
- Verge3D Network — remote folder, web hosting, and content delivery network
- Asset Store and Electron builds — serving demos and examples, providing Electron builds for creating desktop apps
- Update checks — periodically checking for new Verge3D updates
Verge3D Network
Verge3D Network is a remote storage, web hosting, and content delivery service that is implemented as a feature of the App Manager. However, none of your data is synced by default. The uploading should be explicitly initiated by clicking on the upload button. If you have uploaded something to the remote folder by mistake, you can easily delete your data without leaving any traces.
Also, the URL to your remote folder is kept private and can't be discovered by a third party unless you explicitly share it.
As stated before, Verge3D Network is completely optional and can be easily replaced with your own web hosting (private or public).
Asset Store and Electron builds
Asset Store is a ready-only repository of Soft8Soft's demos and examples. There is no telemetry sent, so the access is safe (this is the same as if you've downloaded some file from the internet). The same applies to the Electron builds retrieved when converting your 3D apps to desktop apps (we host a full mirror of selected and tested Electron builds by ourselves).
However, in a completely isolated environment, you may have no internet access at all. In such the case you can just pre-download the corresponding ZIP archives and add in your Verge3D installation by hand. See here for more info on how to do that.
Update checks
App Manager checks for new Verge3D updates periodically. It does not send any data to our servers. However, to make sure there are no automated connections made from your Verge3D installation, you can disable the update checks in the App Manager settings (uncheck General → Notify about Verge3D updates). This way you must check for the Verge3D updates by yourself.
In any case, Verge3D does not update itself automatically. All updates are handled manually, as described in the User Manual.
Air-gapping the development system
To completely eliminate all possibilities that any data leaves your perimeter, use a firewall to disable outbound connections to the following hosts:
| Host | Notes |
|---|---|
| *.soft8soft.com | Soft8Soft servers (e.g. cdn.soft8soft.com) |
| v3d.net | Verge3D link shortener |
| *.amazonaws.com | Amazon AWS (e.g. s3-eu-central-1.amazonaws.com) |
For more data control, you can assign a pre-configured corporate proxy in the App Manager settings.
Alternatively, operate Verge3D in a completely offline fashion as described in the Verge3D admin guide.
Another important thing that you should pay attention to is keeping the App Manager's external interface off (uncheck General → Enable external server interface):
This setting is disabled by default and should not be enabled unless you explicitly allow other devices in your local (or in some rare cases global) network using the App Manager (e.g. for testing). With this feature on, a perpetrator — for example, a malicious insider in your organization — can not only access and download your apps (including their sources), but also modify them by injecting malicious logic or even destroy them altogether.
We also recommend configuring a firewall to restrict the hosts that are allowed to connect to your system.
External dependencies
Verge3D does not rely on any external dependencies. Installed software uses libraries and utilities provided as part of the distribution, while the engine part, which powers the actual 3D apps, bundles everything inside the pre-built v3d.js runtime.
The exception is when you rebuild the engine or the Puzzles Editor from the source code with the Developer Kit (Verge3D Enterprise feature). For that you will need access to the NPM repository.
Running Verge3D apps
Verge3D apps do not make any connections beyond retrieving the assets (geometry, textures, puzzles, sounds) from the same web directory the app itself is running in. The security of your setup is entirely up to how you configure and protect your web server.
One exception is using the network-aware puzzles (such as load data, send data, or place order). For them you should carefully select the URLs so that your data (or internet activity) is not leaked to a third party.
Verge3D also offers completely server-less methods of distributing 3D apps:
- Creating desktop applications with Electron
- Creating mobile applications with Apache Cordova
- Creating SCORM-based e-learning apps
- Using all-in-one HTML export (see videos for Blender, 3ds Max, Maya)
Getting support
Verge3D documentation is freely available online. You also receive an offline version as part of your Verge3D distribution — see here on how to enable it.
As for the technical support, posting sensitive information on the forums might be forbidden by your company policy. This way, rely on the private technical support services offered with the Verge3D Enterprise license.
See also
Verge3D System Administrator's Guide
Setting up Internet Information Services for hosting Verge3D apps
