Network & Proxy

All calls from the MinT client to the cluster go over HTTPS. Enterprise offers more options at the network access layer than Community: VPC, private links, and firewall policies are all available. With private delivery, the cluster can even be installed entirely inside the customer's intranet.

Community: public TLS

Community accesses mint.macaron.xin (mainland mint-cn.macaron.xin) over public TLS, with certificates issued by a public CA. This suits evaluation and small-scale production.

Enterprise: VPC / private link / firewall policies

Enterprise network access can be summarized as "VPC, private links, firewall policies." The specific form is negotiated during onboarding with a solutions architect, covering three types of needs:

• VPC peering / VPC private endpoint. The customer's VPC establishes peering or a private endpoint with the Mind Lab cluster VPC, so traffic stays on the cloud provider's backbone.
• Private-link access. A cloud provider's private link connects the customer's IDC to the cluster.
• Firewall policies and outbound allowlists. The customer applies a precise allowlist to outbound traffic, permitting only the enterprise tenant endpoint.

Private deployment: standalone intranet cluster

For regulated industries (government, finance, healthcare, etc.), MinT Enterprise supports full private deployment: the cluster is installed inside the customer's intranet, and all data and model weights stay behind the customer's firewall. Private delivery includes:

• Dependency images and offline install packages, supporting one-click startup in a fully air-gapped environment.
• A consistent console and SDK, from exactly the same source as the public-cloud version, with no version fork.
• Optional SM-crypto, SSO, AD integration, and log forwarding.
• Private model hosting: the LoRA and merged weights produced by training can be packaged directly as offline deployment bundles.

How the client points to the enterprise tenant endpoint

Whichever network form you choose, the client is configured the same way — point MINT_BASE_URL at the enterprise tenant's access address:

export MINT_BASE_URL=https://<your-enterprise-endpoint>/

The specific address is provided by the Mind Lab team when the cluster is delivered.

Common connectivity issues

If _require_api_key throws an error or the preflight times out, check:

• Whether MINT_BASE_URL correctly points to the enterprise tenant endpoint.
• Whether the enterprise tenant endpoint is reachable from the customer's network (whether VPC / private link / firewall allowlist is configured).
• For private deployment, whether DNS can resolve the cluster domain.