Connect Nexus

Sail can’t answer anything without Msty Nexus. Every model call, web search and tool call goes through it, and Sail holds no model keys of its own.

This page covers the server side: networking, certificates and scripted installs. For the clicks in Sail, see Pair Sail with Nexus.

Where Nexus can run

Anywhere Sail can reach over HTTP(S): the same server, another machine on your network, or another site. Sail always calls Nexus, never the other way round, so Nexus needs no route back to Sail.

Install and run Nexus with its own instructions. Sail’s Compose file doesn’t include it.

Sail needs Nexus 0.7 or later, and checks the version when it connects.

Let Sail reach it

Sail refuses private and internal addresses by default, so a mistyped URL can’t reach into your network. If Nexus has a private address, allow it in .env:

SAIL_OUTBOUND_ALLOW=nexus.internal

You can list several hosts or networks, separated by commas, such as nexus.internal,10.0.0.0/8. Hosts in this list may also use plain http://, which is fine on a private network.

Nexus on the same server, outside Docker? Use the host’s address as Docker sees it, and allow it:

services:
  sail:
    extra_hosts:
      - "host.docker.internal:host-gateway"

SAIL_OUTBOUND_ALLOW=host.docker.internal

Then use http://host.docker.internal:3939 as the Nexus address.

If Nexus uses a certificate from your own certificate authority, Sail must trust it. See Trust a private certificate authority.

Connect

Way	Use it when
Pairing	Your Nexus has Connected apps. An admin enters the address in Sail, and a Nexus admin approves. Sail’s access renews every day.
Access token	Your Nexus doesn’t have Connected apps yet, or you script the install.

Pairing

Done in the browser, in the setup wizard or under Admin → Nexus. See Pair Sail with Nexus.

No Nexus Console? Approve from the Nexus host:

msty-nexusctl apps approve K7QM-4ZP2

Access token, scripted

1. Create a token on the Nexus host:

   msty-nexusctl tokens create --name "Sail" --role inference

2. Save it as a secret file, and set the address:

   printf %s '<token>' > secrets/nexus-token

   SAIL_NEXUS_URL=https://nexus.internal:3939

3. Start Sail with the Nexus Compose file:

   docker compose -f compose.yaml -f compose.nexus.yaml up -d

The connection then shows as read-only in Admin → Nexus. Replies over a token connection don’t show cost in usage reports.

Check it works

In Admin → Nexus, you should see Connected, the Nexus version, and a list of models. Click Check again after any change in Nexus.

Web search shows Available when your Nexus has a search gateway. Without one, assistants answer from what they know and say so.