Skip to main content
The appliance has finished its first boot when its console shows the generated credentials. Then work through these steps once, in this order.
1

Open the start page

Open https://home.DOMAIN and sign in as admin. If the password was generated, read it on the console or over SSH:
The start page links to every application and shows their health, backups and updates. See The appliance start page.Your browser warns about the certificate until you trust the appliance CA, in step 3.
2

Check that everything runs

The header should read Running, and the Bootstrap tab should read complete. If a tile on Apps is not green, open Health: it shows which check does not answer and which container is not running.If the first boot stopped, its error is in journalctl -u celum-appliance-bootstrap. Fix the cause and run celum-appliance bootstrap again: it resumes where it stopped.
3

Trust the appliance CA

With tls.mode: selfsigned, the default, every certificate is signed by a CA the appliance created. Copy it, and add it to the trust store of every machine that uses the appliance:
Until a client trusts it, it fails before HTTP: curl reports http=000, which looks like a network fault. Talos nodes that join Omni need the same CA, through a TrustedRootsConfig document.
4

Sign in to Celum

Open https://app.DOMAIN and sign in through Authentik with the administrator email from the deployment. The start page’s Login tab shows that email and the admin group.If you left the administrator password blank at deployment, read the generated one with celum-appliance status, then change it in Authentik at https://auth.DOMAIN.
5

Check IAM

  • Deployed with the OVA’s form: IAM is enforced from the first boot. The administrator is a member of celum-admins, which Celum maps to its Administrators group, so your first sign-in has full access.
  • Deployed with an appliance.yaml, as on the qcow2 or through the OVA’s full-configuration field: IAM is off until you turn it on. Turn it on once you have signed in and confirmed you are in celum-admins, as described in Sign in.
6

Enter the update account

On the start page’s Updates tab, choose Change account and enter the robot account and secret from your licence. Skip this if you gave them at deployment. The tab then lists the Celum releases you can install.
7

Make sure backups leave the machine

Open the Backups tab. If it reads stays on this disk, a lost disk loses the secret store with it. Give the appliance an S3 bucket for off-box backups: the backup_s3_* settings in Deploy on vSphere (OVA), or backup.s3 in Optional settings.Keep the private key of at least one SSH key the key escrow is sealed to. A restore needs that key file, not just an SSH agent holding it.
8

Accept Omni's EULA

If you did not accept Sidero’s EULA at deployment, Omni refuses every call until someone accepts it, including Celum’s. Open https://omni.DOMAIN and accept it when you first sign in.
When these are done, the appliance is ready. Continue in Celum at https://app.DOMAIN.