> ## Documentation Index
> Fetch the complete documentation index at: https://partner.celum.io/llms.txt
> Use this file to discover all available pages before exploring further.

# First steps after the deploy

> What to do once the appliance has come up: check it, trust its CA, sign in to Celum, and set up updates and backups.

The appliance has finished its first boot when its console shows the generated credentials. Then work through these steps once, in this order.

**1. Open the start page**

Open `https://home.DOMAIN` and sign in as `admin`. If the password was generated, read it on the console or over SSH:

```bash theme={null}
celum-appliance status     # CREDENTIALS, row "Start page"
```

The start page links to every application and shows their health, backups and updates. See [The appliance start page](https://partner.celum.io/first-steps/start-page.md).

Your browser warns about the certificate until you trust the appliance CA, in step 3.

**2. Check that everything runs**

The header should read **Running**, and the **Bootstrap** tab should read **complete**. If a tile on **Apps** is not green, open **Health**: it shows which check does not answer and which container is not running.

If the first boot stopped, its error is in `journalctl -u celum-appliance-bootstrap`. Fix the cause and run `celum-appliance bootstrap` again: it resumes where it stopped.

**3. Trust the appliance CA**

With `tls.mode: selfsigned`, the default, every certificate is signed by a CA the appliance created. Copy it, and add it to the trust store of every machine that uses the appliance:

```bash theme={null}
scp root@celum.example.com:/etc/celum-appliance/tls/ca.crt celum-ca.crt
```

Until a client trusts it, it fails before HTTP: `curl` reports `http=000`, which looks like a network fault. Talos nodes that join Omni need the same CA, through a `TrustedRootsConfig` document.

**4. Sign in to Celum**

Open `https://app.DOMAIN` and sign in through Authentik with the administrator email from the deployment. The start page's **Login** tab shows that email and the admin group.

If you left the administrator password blank at deployment, read the generated one with `celum-appliance status`, then change it in Authentik at `https://auth.DOMAIN`.

**5. Check IAM**

* **Deployed with the OVA's form:** IAM is enforced from the first boot. The administrator is a member of `celum-admins`, which Celum maps to its `Administrators` group, so your first sign-in has full access.
* **Deployed with an `appliance.yaml`**, as on the qcow2 or through the OVA's full-configuration field: IAM is off until you turn it on. Turn it on once you have signed in and confirmed you are in `celum-admins`, as described in [Sign in](https://partner.celum.io/appliance/deploy-qcow2.md#sign-in).

**6. Enter the update account**

On the start page's **Updates** tab, choose **Change account** and enter the robot account and secret from your licence. Skip this if you gave them at deployment. The tab then lists the Celum releases you can install.

**7. Make sure backups leave the machine**

Open the **Backups** tab. If it reads **stays on this disk**, a lost disk loses the secret store with it. Give the appliance an S3 bucket for off-box backups: the `backup_s3_*` settings in [Deploy on vSphere (OVA)](https://partner.celum.io/appliance/deploy-ova.md), or `backup.s3` in [Optional settings](https://partner.celum.io/appliance/deploy-qcow2.md#off-box-backups).

Keep the private key of at least one SSH key the key escrow is sealed to. A restore needs that key file, not just an SSH agent holding it.

**8. Accept Omni's EULA**

If you did not accept Sidero's EULA at deployment, Omni refuses every call until someone accepts it, including Celum's. Open `https://omni.DOMAIN` and accept it when you first sign in.

When these are done, the appliance is ready. Continue in Celum at `https://app.DOMAIN`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.