The Air-gap Switch

One environment variable — CHINASKI_AIRGAP=1 — changes the application's network posture. Set it in the instance's env file and restart. The startup log line will say airgap: ENABLED (the installer writes the switch for you by default; fresh installs show it active from first boot).

The all-or-nothing semantics

The switch turns off the complete outbound list in one go — it's not a per-feature toggle. Disables at a glance:

• Webhooks (build, form, post, publish) are never delivered, and the automatic retry worker stops.
• Deploys from the CMS — the rsync and S3 push paths never run.
• Cloudflare Turnstile verification is skipped (logged as such), and the Turnstile widget is removed from the login and form pages even if keys are stored in settings.
• Admin email — every send (review notifications, approval/rejection mail, build notices) returns not-sent.
• Update manifest checks are not performed even if a manifest URL is configured — the feature becomes inert until air-gap is off.
• Spaces backup uploads don't happen; backups are still created (and kept) locally.

What still works

• The CMS itself: content editing, uploads, menus, settings, admin UI.
• Static builds with a twist: air-gap builds are strictly more strict about external references — GA4/GTM analytics are stripped from templates even when configured, and any snippet code referencing an external URL is stripped out of built pages so nothing loads from a CDN.
• Local backups still work: the daily system backup (DB + media), in-app tar.gz backups, verification, restore flows — none of these need connectivity. Only the optional Spaces off-site copy is out.
• Forms and local state still function — submissions are stored as usual; only email delivery and webhook delivery pause.

One note: the switch is signed/complete one-way all at once; re-enabling any single outbound feature means turning the switch off entirely (then selecting which features to use).