> ## Documentation Index
> Fetch the complete documentation index at: https://partner.celum.io/llms.txt
> Use this file to discover all available pages before exploring further.

# The appliance start page

> What the start page at home.DOMAIN shows and what you can do there: open the applications, check health and backups, and install Celum releases.

Every appliance serves a start page at `https://home.DOMAIN`. It links to every application and shows whether they are healthy, how far the first boot has come and whether backups leave the machine. It is also where you install new Celum releases.

The start page has its own account, separate from Authentik, so it still works when Authentik is down.

## Sign in

![The start page sign-in form](https://mintcdn.com/celum-dev/2f91t1rxne2DuvYi/images/start-page/login.png?fit=max\&auto=format\&n=2f91t1rxne2DuvYi\&q=85\&s=998b4b0bac68257c65918f7142b9a1e0)

* **User name:** `admin`, unless you chose another at deployment.
* **Password:** the one you chose at deployment, or one generated on the first boot. Read a generated password on the console or over SSH:

  ```bash theme={null}
  celum-appliance status     # CREDENTIALS, row "Start page"
  ```

  It is also in `/root/celum-appliance-credentials.txt`.
* **Forgotten password:** set a new one over SSH, with at least 12 characters. Everyone signed in to the start page is signed out, and the generated password in `/root/celum-appliance-credentials.txt` stops working.

  ```bash theme={null}
  celum-appliance home password set
  ```

A session lasts 12 hours. After 5 wrong passwords from one address within 15 minutes, the page refuses that address until the 15 minutes are over.

> [!NOTE]
>
> The start page never shows a password, not even its own. `celum-appliance status` prints every credential the appliance generated, over SSH or on the console.

## The header

The header shows the appliance's state, its domain, the appliance release and when the page last checked. The state reads **Running**, **Starting up** while the first boot is still going, or the number of problems. The page refreshes itself every 10 seconds.

The release in the header is the release of the appliance image. After you update Celum, the **Updates** tab shows the Celum release that runs.

## Apps

![The Apps tab, with a tile for Celum, Authentik, Harbor, OpenBao, Omni and PowerDNS](https://mintcdn.com/celum-dev/2f91t1rxne2DuvYi/images/start-page/apps.png?fit=max\&auto=format\&n=2f91t1rxne2DuvYi\&q=85\&s=68f151dca8ec76135df821eeb8a0383b)

There is a tile for each application the appliance runs, with a link to it. The dot on a tile is green when every health check behind it answers. A component you turned off has no tile.

| Tile | Address | What it is for |
| - | - | - |
| Celum | `app.DOMAIN` | Managing clusters and VMs |
| Authentik | `auth.DOMAIN` | Users, groups and sign-in |
| Harbor | `harbor.DOMAIN` | Container images and Helm charts |
| OpenBao | `vault.DOMAIN` | Secrets |
| Omni | `omni.DOMAIN` | Talos clusters |
| PowerDNS | `pdns.DOMAIN` | DNS zones and records |

## Health

![The Health tab, with health checks and containers](https://mintcdn.com/celum-dev/2f91t1rxne2DuvYi/images/start-page/health.png?fit=max\&auto=format\&n=2f91t1rxne2DuvYi\&q=85\&s=a192fcfd370eec68cdf52a3699e472ea)

* **Health checks:** each application's answer to its health check, with the HTTP status and how long it took.
* **Containers:** every container on the appliance, with its state, health and restart count.

Look here first when the dot on a tile is not green.

## Bootstrap

This tab lists the stages of the first boot, done and pending. It reads **complete** once the appliance has finished setting itself up. To follow a first boot that is still running, use `journalctl -u celum-appliance-bootstrap -f` over SSH.

## Backups

![The Backups tab, with the secret store and the key escrow](https://mintcdn.com/celum-dev/2f91t1rxne2DuvYi/images/start-page/backups.png?fit=max\&auto=format\&n=2f91t1rxne2DuvYi\&q=85\&s=2997c08a0a7882df84061a21944bdcc9)

This tab shows whether the appliance could be rebuilt if its disk were lost:

* **Secret store:** when OpenBao was last snapshotted, how many snapshots are kept, and whether they were copied off the machine.
* **Key escrow:** when the bundle of keys a restore needs was last written, which keys it is sealed to, and whether it was copied off the machine.

**stays on this disk** means that nothing leaves the machine. To change that, give the appliance an S3 bucket for off-box backups; see [Off-box backups](https://partner.celum.io/appliance/deploy-qcow2.md#off-box-backups). A restore needs the private key file of one of the keys the escrow is sealed to, not just an SSH agent holding it.

The tab shows times and counts only. Over SSH, `celum-appliance status` has the details, under **BACKUPS**.

## Updates

![The Updates tab, with the running release, the latest release and earlier releases](https://mintcdn.com/celum-dev/2f91t1rxne2DuvYi/images/start-page/updates.png?fit=max\&auto=format\&n=2f91t1rxne2DuvYi\&q=85\&s=fbb3b7a8ab98a34ee3fc5bfd3b34e9a9)

Here you install a new Celum release, or go back to an earlier one. Only Celum's backend and frontend change. Harbor, Authentik, Omni and the other components stay at the versions in your appliance image.

1. **Enter the update account** once. Choose **Change account**, enter the robot account and secret from your licence, and choose **Test and save**. The appliance tests the account against the registry before it saves it, and never shows the secret again. If you gave the account at deployment, this is already done.
2. **Check again** asks the registry, `registry.celum.io`, for releases.
3. **Update to VERSION** installs the latest release. **Earlier releases** lists the others, with **Install** for a newer one and **Roll back** for an older one.

The page asks you to confirm before it starts. Celum restarts and is unavailable for a minute or two. If the new release does not come up, the appliance restores the release that was running. The **Last update** card shows the result and its log.

> [!WARNING]
>
> Rolling back does not undo the database changes a newer release made, so an older release may refuse to start.

You can install updates once the first boot has finished. Over SSH, the same commands are `celum-appliance update list`, `celum-appliance update apply VERSION` and `celum-appliance update status`.

## Login

This tab shows where to sign in to Celum for the first time: the Authentik address, the administrator user and the admin group. It does not show the password; see [Sign in to Celum](https://partner.celum.io/first-steps/after-deploy.md).

## What needs SSH

The start page does not change the appliance's configuration. Over SSH you:

* change the start page's password, with `celum-appliance home password set`;
* read passwords, with `celum-appliance status`;
* copy the appliance CA, from `/etc/celum-appliance/tls/ca.crt`;
* change settings and apply them, as described in [Change the configuration later](https://partner.celum.io/appliance/deploy-qcow2.md#change-the-configuration-later).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.