For the latest version, please use Virtual Appliance 1.0.3!

Deploy Management with the ISO

This is the ISO deployment option. You can also run Management with Docker on an operator workstation or your own Linux VM.

Create and boot the Management VM, initialize its state disk and sign in to the Management application. You need hypervisor console access. Appliance node installation follows after Management is ready.

Prerequisites

Prepare the Management resources, reserve its IP addresses and DNS name and configure the firewall rules.

Each customer can download the release’s Management ISO from the MTG Download Center. Obtain the release’s checksum and verify the ISO’s SHA-256 digest against it before attaching the ISO.

For an air-gapped installation, download the ISO and checksum on a connected workstation and transfer both into the isolated environment. The ISO includes Management and its internal services. Prepare the separate appliance release and boot media using the Air-gapped Installation Instructions.

The ISO ships with SSH enabled and root / root for convenience during initial setup and diagnostics. You must restrict SSH before first boot, configure it according to your organization’s policy and rotate the factory host credentials before production use. Arrange the release’s persistent configuration procedure with MTG as described in Required ISO host SSH setup.

Create and boot the VM

  1. Upload the Management ISO to storage available to the selected hypervisor host.

  2. Create an AMD64 VM with 2 virtual CPUs, 4096 MiB memory and one dedicated 100 GB writable state disk. Give the VM an identifiable name, such as your planned Management hostname.

  3. Attach a network adapter to the network from which Management will reach the appliance nodes, DNS and NTP services. Record its MAC address and its intended DHCP reservation or static IPv4 settings.

  4. Attach the Management ISO as boot media. Put it first in the VM’s boot order and keep it attached throughout the VM’s lifetime.

  5. Restrict TCP 22 to approved maintenance sources before starting the VM. Keep SSH blocked from application-client networks and the Internet and retain hypervisor console access.

  6. Start the VM and open its console. Confirm that the Management installation menu appears.

The host runs from the ISO on every boot. Do not detach the ISO after initialization or change the boot order to the state disk. The state disk stores persistent data and does not contain an installed operating system.

Confirm that the console can show system information and the intended network adapter and disk. Continue with the settings below.

If the console does not appear, check ISO attachment, checksum, boot order and the VM console. If an existing-state or recovery screen appears unexpectedly, verify the attached disk’s identity before proceeding. Do not initialize a disk that belongs to another Management instance. See Troubleshooting.

Prepare the Settings

Setting What to enter

Host name

The host name, default mtg-management.

Network

The intended interface, DHCP or static IPv4 configuration, gateway and DNS as applicable.

Timeserver

A reachable NTP hostname or IPv4 address. Management starts only after time is synchronized.

Public Management DNS name

A name resolving to the host’s reachable address. Use this name in the browser and certificate.

HTTPS port

Default 443.

Private node IP

Default 10.41.0.1; choose a nonconflicting RFC1918 address before initialization.

Administrator password

At least 12 characters. This sets the initial mtg-admin password for Management.

TLS mode

Persistent self-signed certificate, supplied certificate, or ACME.

The public Management name, HTTPS port and private node IP are fixed for this Management state. Choose them before initialization. TLS mode and certificates can be changed later through Manage Certificates.

For a supplied certificate, stage the certificate and key before selecting that mode. For ACME, prepare the CA’s HTTPS directory URL, account email and HTTP-01 reachability to the Management hostname on port 80.

Initialize and Sign in

  1. Choose Initialize Management in the console installation menu.

  2. Select the dedicated state disk. Compare its complete identity with the hypervisor configuration; disks are not preselected.

  3. Enter networking, NTP and Management settings. Enter the administrator password when prompted; input is hidden.

  4. Select the TLS mode and provide its required settings.

  5. Review the selected disk and settings.

    Initialization erases the selected Management state disk. Confirm only when it is the intended disk and contains no data you need.

  6. Confirm that the selected disk can be erased. Wait while Management initializes its state and starts. Keep the VM and ISO available.

  7. Use Refresh Status to inspect startup without restarting services. Wait for healthy Management status and note the public HTTPS URL and certificate fingerprint shown by the console.

  8. Open that URL from the operator workstation. For self-signed TLS, compare the presented certificate with the console fingerprint through your trusted console connection before establishing browser trust.

  9. Sign in through Gitea as mtg-admin, using the password entered during setup.

  10. Complete Required ISO host SSH setup: apply your organization’s SSH policy, rotate the factory host credentials using the agreed persistent procedure and reboot to verify the settings and rejection of the factory credentials. Complete this step before production use.

Host SSH access and the Management administrator account are separate. The Management password does not grant host SSH access.

Supply a Certificate

This workflow applies during setup and when replacing the Management HTTPS certificate. Use authenticated root SSH to the Management host and verify the host key through a trusted channel.

During initial setup, keep factory SSH access restricted to approved maintenance sources. After initialization, complete the required SSH configuration and credential rotation. For later certificate changes, use the customer-controlled credentials and approved SSH policy.

  1. Create the staging directory on the host:

    install -d -m 0700 /run/mtg-management-tls

  2. Transfer the hostname certificate as tls.crt and its matching unencrypted private key as tls.key over SSH to that directory. Both files must be root-owned; set the key’s permissions to 0600.

  3. Select supplied-certificate mode during initialization, or choose Manage Certificates in the running console. The console validates the pair and the configured hostname before installing it.

  4. Verify the certificate served at the Management URL from the browser. Successful installation consumes the staged files.

Use SSH staging for supplied certificates; attached certificate-import media is not supported. Keep private keys out of command arguments and logs. Finish active Management operations before changing certificates or TLS mode. Switching between ACME and an external certificate mode restarts Management; replacing an external pair restarts its ingress service.

Self-signed certificates persist across normal boots. The host does not renew them or warn about expiry. For ACME, Traefik handles issuance and renewal, but the application can be healthy before certificate issuance finishes. Check browser trust and the served certificate after setup.

Verify and Continue

Management setup is complete when the console reports healthy status, the intended DNS name reaches the application over HTTPS, the expected certificate is served and administrator sign-in succeeds. Before production use, you must also verify the required SSH policy and rotated host credentials after reboot.

Next, follow connected or air-gapped appliance preparation, then install the appliance. If setup or startup fails, inspect console system information and logs. Check the configured network and NTP source before restarting. Preserve an unexpectedly initialized or failed disk for diagnosis; use Troubleshooting or Recovery options rather than erasing it as a retry.