Deploy Management with the ISO

This is the ISO deployment option. You can also run Management with Docker or Podman on an operator workstation or your own Linux VM.

Create and boot the Management VM, initialize its state disk, and sign in to the Management application. You need hypervisor console access. Appliance node installation follows after Management is ready.

Before you begin

Prepare the Management resources and network plan. Obtain the release’s Management ISO and checksum through the MTG ISO download directory. Verify the ISO’s SHA-256 digest against the published checksum before attaching it.

Create and boot the VM

  1. Upload the Management ISO to storage available to the selected hypervisor host.

  2. Create an AMD64 VM with 2 virtual CPUs, 4096 MiB memory and one dedicated 100 GB writable state disk. Give the VM an identifiable name, such as your planned Management hostname.

  3. Attach a network adapter to the network from which Management will reach the appliance nodes, DNS and NTP services. Record its MAC address and its intended DHCP reservation or static IPv4 settings.

  4. Attach the Management ISO as boot media. Put it first in the VM’s boot order and keep it attached throughout the VM’s lifetime.

  5. Start the VM and open its console. Confirm that the Management installation menu appears.

The host runs from the ISO on every boot. Do not detach the ISO after initialization or change the boot order to the state disk. The state disk stores persistent data and does not contain an installed operating system.

Confirm that the console can show system information and the intended network adapter and disk. Continue with the settings below, or use Unattended setup to reuse prepared setup settings.

If the console does not appear, check ISO attachment, checksum, boot order and the VM console. If an existing-state or recovery screen appears unexpectedly, verify the attached disk’s identity before proceeding. Do not initialize a disk that belongs to another Management instance. See Troubleshooting.

Prepare the Settings

Setting What to enter

Host name

The host name, default mtg-management.

Network

The intended interface, DHCP or static IPv4 configuration, gateway and DNS as applicable.

Time server

A reachable NTP hostname or IPv4 address. Management starts only after time is synchronized.

Public Management DNS name

A name resolving to the host’s reachable address. Use this name in the browser and certificate.

HTTPS port

Default 443.

Private node IP

Default 10.41.0.1; choose a nonconflicting RFC1918 address before initialization.

Administrator password

At least 12 characters. This sets the initial mtg-admin password for Management.

TLS mode

Persistent self-signed certificate, supplied certificate, or ACME.

The public Management name, HTTPS port and private node IP are fixed for this Management state. Choose them before initialization. TLS mode and certificates can be changed later through Manage Certificates.

For a supplied certificate, stage the certificate and key before selecting that mode. For ACME, prepare the CA’s HTTPS directory URL, account email and HTTP-01 reachability to the Management hostname on port 80.

Initialize and Sign in

  1. Choose Initialize Management in the console installation menu.

  2. Select the dedicated state disk. Compare its complete identity with the hypervisor configuration; disks are not preselected.

  3. Enter networking, NTP and Management settings. Enter the administrator password when prompted; input is hidden.

  4. Select the TLS mode and provide its required settings.

  5. Review the selected disk and settings.

    Initialization erases the selected Management state disk. Confirm only when it is the intended disk and contains no data you need.

  6. Confirm that the selected disk can be erased. Wait while Management initializes its state and starts. Keep the VM and ISO available.

  7. Use Refresh Status to inspect startup without restarting services. Wait for healthy Management status and note the public HTTPS URL and certificate fingerprint shown by the console.

  8. Open that URL from the operator workstation. For self-signed TLS, compare the presented certificate with the console fingerprint through your trusted console connection before establishing browser trust.

  9. Sign in through Gitea as mtg-admin, using the password entered during setup.

Host SSH access and the Management administrator account are separate. The Management password does not grant host SSH access.

Screenshot pending: Management console after initialization

Capture healthy startup status, the public HTTPS URL and the certificate fingerprint using a demonstration hostname. Do not show password entry or private keys.

Supply a Certificate

This workflow applies during setup and when replacing the Management HTTPS certificate. Use authenticated root SSH to the Management host and verify the host key through a trusted channel.

  1. Create the staging directory on the host:

    install -d -m 0700 /run/mtg-management-tls

  2. Transfer the hostname certificate as tls.crt and its matching unencrypted private key as tls.key over SSH to that directory. Both files must be root-owned; set the key’s permissions to 0600.

  3. Select supplied-certificate mode during initialization, or choose Manage Certificates in the running console. The console validates the pair and the configured hostname before installing it.

  4. Verify the certificate served at the Management URL from the browser. Successful installation consumes the staged files.

Use SSH staging for supplied certificates; attached certificate-import media is not supported. Keep private keys out of command arguments and logs. Finish active Management operations before changing certificates or TLS mode. Switching between ACME and an external certificate mode restarts Management; replacing an external pair restarts its ingress service.

Self-signed certificates persist across normal boots. The host does not renew them or warn about expiry. For ACME, Traefik handles issuance and renewal, but the application can be healthy before certificate issuance finishes. Check browser trust and the served certificate after setup.

Verify and Continue

Management setup is complete when the console reports healthy status, the intended DNS name reaches the application over HTTPS, the expected certificate is served and administrator sign-in succeeds.

Next, make the intended release bundle available and install the appliance. If setup or startup fails, inspect console system information and logs. Check the configured network and NTP source before restarting. Preserve an unexpectedly initialized or failed disk for diagnosis; use Troubleshooting or Recovery options rather than erasing it as a retry.