taliiq-host
Install a self-hosted Taliiq host with outbound-only networking
Self-hosted hosts are in private preview and not yet available on Taliiq Cloud production. Pairing and host callback endpoints are disabled there until general availability. Connect with us if you need early access.
taliiq-host is the customer-installable package that wraps Taliiq's agent runtime. It pairs with your organization from the dashboard (Infrastructure → Hosts) and keeps a persistent outbound WebSocket to Taliiq Cloud.
Networking
| Direction | Required? |
|---|---|
| Outbound HTTPS to Taliiq API | Yes (pairing) |
| Outbound WSS to host gateway | Yes (run) |
| Inbound ports on your firewall | No |
The host dials out — the same egress pattern as the LiveKit worker. You do not need to open inbound ports or terminate TLS on the customer network.
Install & pair
In the dashboard open Infrastructure → Hosts → Deploy host. Choose Self-hosted and a profile (Connected on any plan; sovereign profiles require Enterprise).
Copy the install command (includes a 15-minute pairing code).
On the target machine:
pip install taliiq-host
taliiq-host pair --code XXXXXX --api-base https://api.taliiq.com
taliiq-host runOr with Docker Compose from the package:
docker compose run --rm taliiq-host pair --code XXXXXX
docker compose up -dConfirm the host shows online in the dashboard within about a minute.
CLI
| Command | Purpose |
|---|---|
taliiq-host pair --code … | Exchange the pairing code for a host key (shown once, stored encrypted) |
taliiq-host run | Open outbound WSS, heartbeat every 30s, accept commands |
taliiq-host status | Offline-capable status from local SQLite |
taliiq-host config show | Print the last config envelope |
taliiq-host doctor | Connectivity, clock skew, disk, config freshness |
Destination and profile are immutable after pairing. Re-pair to change them.
Connected host tools
Connected hosts keep voice, chat, and Observe in Taliiq Cloud while executing approved operations inside your network.
- Open Tools & Actions → Create New → Host Tool.
- Choose an online connected host and one plugin:
- Shell — one argv command prefix per line, such as
systemctl status. Commands never run through a shell string. - Filesystem — one absolute root per line, with read-only or read/write access.
- Internal HTTP — one exact hostname per line. Wildcards, credentials in URLs, and redirects are rejected.
- Shell — one argv command prefix per line, such as
- Attach the tool from the agent wizard's Actions tab.
- On the host detail page, select Push config after changing a policy.
Every attempt is written to the host's local audit.jsonl without argument values or credentials. Commands time out after 30 seconds by default, output is capped, and work above the host concurrency limit is rejected for retry. Host detail shows recent status and duration; session-level events remain in Taliiq Cloud Observe.
For local development, pair with http://127.0.0.1:8000, keep taliiq-host run active, create an allowlisted echo shell tool, attach it to a test agent, and ask the agent to invoke it.
Isolate
From host detail, Isolate tells the host to stop accepting commands and drain in-flight work. The host reports isolated and stays that way until you clear local state or re-pair.
Related
- Dashboard: Infrastructure → Hosts
- Architecture contract: product docs / engineering
taliiq-hostarchitecture