Docs Downloads Support
EN·TR·FR
Fidwyn
Request a Demo
v2.1Last updated 2026-07-20

Get started

Take a fresh Fidwyn appliance from power-on to a licensed, trusted, signed-in console. Fidwyn ships as a pre-baked golden image, so there is no operating system to install and no interactive installer to click through. A first-boot identity engine does the per-appliance work, and the steps below are the operator tasks that remain. Follow them in order; each one is a prerequisite for the next.

Requirements
  • A hypervisor (VMware, Proxmox, Hyper-V, KVM) or a bare-metal x86-64 host. Evaluation sizing: 8 vCPU, 16 GB RAM, 100 GB disk. Size production nodes per the deployment guide.
  • Optional: an NVIDIA GPU passed through to the appliance if you will use Augur's local AI. The appliance boots and runs fully without one, and only the AI features stay disabled.
  • The appliance ISO from the Download Center, plus its published SHA-256 and GPG signature.
  • A reachable static IPv4 address, subnet, gateway and DNS server for the appliance (DHCP is fine for an evaluation).
  • A license, or the ability to request one during setup (step 6).
Dependency: nothing here needs Active Directory, a database, a tenant or email. Those come after sign-in, in Administration. This guide has no upstream dependency; it is where every deployment starts.

1 · Verify the image

Check the ISO against the published checksum and GPG signature before you boot it. A mismatch means the media is wrong or tampered with, so stop and re-download.

# verify integrity and signature
sha256sum fidwyn-2.1.iso
gpg --verify fidwyn-2.1.iso.asc fidwyn-2.1.iso

2 · Create the VM and boot

  1. Create the machine. UEFI firmware, the sizing above, and one NIC on the network you will manage the appliance from. Attach the verified ISO as the boot device.
  2. Power on. The disk image is already partitioned and installed, so there is no OS setup. The appliance boots straight to its first-boot console.

3 · Assign the network address

At the first-boot console, set the appliance's static IP, subnet, gateway and DNS (or accept DHCP for a lab). This is the address you and your users will browse to, so give it a DNS A record if you can, since the certificate you install in step 8 should match that name.

4 · Let first-boot identity run

On first power-on the identity engine does the per-appliance work automatically: it regenerates per-appliance certificates and secrets (no two appliances share a key), unseals the vault, and brings every service up healthy. This is the sub-minute step and needs no input.

Nothing here contacts the internet. Certificate generation, vault unseal and service start all happen on the box. For fully air-gapped operation see Hardening.

5 · First sign-in

Browse to https://<appliance-ip>/ and sign in with the first-boot administrator credentials shown on the console. You are prompted to change the password immediately. This is the break-glass administrator, so store the new password in your own vault. You now have a working console; the last three steps make it production-ready.

6 · Activate the license

Open System Settings → License. Because Fidwyn runs offline, activation is a two-step exchange rather than a call home:

  1. Generate the request key. The console produces a request key bound to this appliance. Copy it.
  2. Get it signed. Send the request key to Fidwyn; you receive a signed license file in return.
  3. Activate. Paste the signed license back into License and apply. The tier, node count and feature flags (EPM, Augur) update immediately.
Until a license is activated, licensed features return a "license required" error. Activate before you configure EPM or Augur.

7 · Set the date and time

Under System Settings → Server Settings, set the timezone and an NTP source (or the time manually on an isolated network). Do this before you install certificates or bind a directory: token lifetimes, audit timestamps, session-recording clocks and certificate validity windows all depend on a correct clock.

8 · Install the server certificate

First-boot generated a self-signed certificate so the console is reachable immediately. For production, replace it under System Settings → Server Settings with a certificate from your own CA, issued to the DNS name from step 3, covering the web console and the session broker. Nothing about Fidwyn depends on a public certificate authority.

What to do next

Your appliance is now licensed, on the network, correctly clocked and trusted. Continue with the operational setup, in this order:

  • Administration: connect a directory (AD/LDAP), create tenants, add users and authorize them with access groups, wire up email, then onboard your first systems and vault their credentials.
  • Clustering & HA: if you are deploying more than one node, enroll the first node now and join the rest with a token.
  • Hardening: air-gap, SIEM forwarding and backups before you go live.
Was this helpful?
Next
Administration