The appliance start page

Every appliance serves a start page at https://home.DOMAIN. It links to every application and shows whether they are healthy, how far the first boot has come and whether backups leave the machine. It is also where you install new Celum releases. The start page has its own account, separate from Authentik, so it still works when Authentik is down.

​

Sign in

• User name: admin, unless you chose another at deployment.
• Password: the one you chose at deployment, or one generated on the first boot. Read a generated password on the console or over SSH:
  celum-appliance status     # CREDENTIALS, row "Start page"
  
  It is also in /root/celum-appliance-credentials.txt.
• Forgotten password: set a new one over SSH, with at least 12 characters. Everyone signed in to the start page is signed out, and the generated password in /root/celum-appliance-credentials.txt stops working.
  celum-appliance home password set
  

A session lasts 12 hours. After 5 wrong passwords from one address within 15 minutes, the page refuses that address until the 15 minutes are over.

​

The header

The header shows the appliance’s state, its domain, the appliance release and when the page last checked. The state reads Running, Starting up while the first boot is still going, or the number of problems. The page refreshes itself every 10 seconds. The release in the header is the release of the appliance image. After you update Celum, the Updates tab shows the Celum release that runs.

​

Apps

There is a tile for each application the appliance runs, with a link to it. The dot on a tile is green when every health check behind it answers. A component you turned off has no tile.

​

Health

• Health checks: each application’s answer to its health check, with the HTTP status and how long it took.
• Containers: every container on the appliance, with its state, health and restart count.

Look here first when the dot on a tile is not green.

​

Bootstrap

This tab lists the stages of the first boot, done and pending. It reads complete once the appliance has finished setting itself up. To follow a first boot that is still running, use journalctl -u celum-appliance-bootstrap -f over SSH.

​

Backups

This tab shows whether the appliance could be rebuilt if its disk were lost:

• Secret store: when OpenBao was last snapshotted, how many snapshots are kept, and whether they were copied off the machine.
• Key escrow: when the bundle of keys a restore needs was last written, which keys it is sealed to, and whether it was copied off the machine.

stays on this disk means that nothing leaves the machine. To change that, give the appliance an S3 bucket for off-box backups; see Off-box backups. A restore needs the private key file of one of the keys the escrow is sealed to, not just an SSH agent holding it. The tab shows times and counts only. Over SSH, celum-appliance status has the details, under BACKUPS.

​

Updates

Here you install a new Celum release, or go back to an earlier one. Only Celum’s backend and frontend change. Harbor, Authentik, Omni and the other components stay at the versions in your appliance image.

1. Enter the update account once. Choose Change account, enter the robot account and secret from your licence, and choose Test and save. The appliance tests the account against the registry before it saves it, and never shows the secret again. If you gave the account at deployment, this is already done.
2. Check again asks the registry, registry.celum.io, for releases.
3. Update to VERSION installs the latest release. Earlier releases lists the others, with Install for a newer one and Roll back for an older one.

The page asks you to confirm before it starts. Celum restarts and is unavailable for a minute or two. If the new release does not come up, the appliance restores the release that was running. The Last update card shows the result and its log. You can install updates once the first boot has finished. Over SSH, the same commands are celum-appliance update list, celum-appliance update apply VERSION and celum-appliance update status.

​

Login

This tab shows where to sign in to Celum for the first time: the Authentik address, the administrator user and the admin group. It does not show the password; see Sign in to Celum.

​

What needs SSH

The start page does not change the appliance’s configuration. Over SSH you:

• change the start page’s password, with celum-appliance home password set;
• read passwords, with celum-appliance status;
• copy the appliance CA, from /etc/celum-appliance/tls/ca.crt;
• change settings and apply them, as described in Change the configuration later.