Deploy Management with the ISO

This is the ISO deployment option. You can also run Management with Docker on an operator workstation or your own Linux VM.

Create and boot the Management VM, initialize its state disk and sign in to the Management application. You need hypervisor console access. Appliance node installation follows after Management is ready. For seed-driven setup, use Install Management unattended with the ISO.

Prerequisites

Prepare the Management resources, reserve its IP addresses and DNS name and configure the firewall rules.

Each customer can download the release’s Management ISO from the MTG Download Center. Obtain the release’s checksum and verify the ISO’s SHA-256 digest against it before attaching the ISO.

For an air-gapped installation, download the ISO and checksum on a connected workstation and transfer both into the isolated environment. The ISO includes Management and its internal services. Prepare the separate appliance release and boot media using the Air-gapped Installation Instructions.

The ISO defaults to SSH disabled and has no factory host password. Use the hypervisor console for setup. If file staging requires SSH, enable temporary access explicitly. Keep TCP 22 restricted to approved maintenance sources.

Create and boot the VM

Upload the Management ISO to storage available to the selected hypervisor host.
Create an AMD64 VM with one dedicated writable state disk. Allocate CPU, memory and storage using the Management hardware requirements. Give the VM an identifiable name, such as your planned Management hostname.
Attach a network adapter to the network from which Management will reach the appliance nodes, DNS and NTP services. Record its MAC address and its intended DHCP reservation or static IPv4 settings.
Attach the Management ISO as boot media. Put it first in the VM’s boot order and keep it attached throughout the VM’s lifetime.
Restrict TCP 22 to approved maintenance sources before starting the VM. Keep SSH blocked from application-client networks and the Internet and retain hypervisor console access.
Start the VM and open its console. Confirm that the Management installation menu appears.

The host runs from the ISO on every boot. Do not detach the ISO after initialization or change the boot order to the state disk. The state disk stores persistent data and does not contain an installed operating system.

Confirm that the console can show system information and the intended network adapter and disk. Continue with the settings below.

If the console does not appear, check ISO attachment, checksum, boot order and the VM console. If an existing-state or recovery screen appears unexpectedly, verify the attached disk’s identity before proceeding. Do not initialize a disk that belongs to another Management instance. See Troubleshooting.

Prepare the Settings

Setting What to enter

Setting	What to enter
Host name	The host name, default `mtg-management`.
Network	The intended interface, DHCP or static IPv4 configuration, gateway and DNS as applicable.
Timeserver	A reachable NTP hostname or IPv4 address. Management starts only after time is synchronized.
Public Management DNS name	A name resolving to the host’s reachable address. Use this name in the browser and certificate.
HTTPS port	Default `443`.
Administrator password	At least 12 characters. This sets the initial `mtg-admin` password for Management.
TLS mode	Persistent self-signed certificate, supplied certificate, or ACME.

Host name

The host name, default mtg-management.

Network

The intended interface, DHCP or static IPv4 configuration, gateway and DNS as applicable.

Timeserver

A reachable NTP hostname or IPv4 address. Management starts only after time is synchronized.

Public Management DNS name

A name resolving to the host’s reachable address. Use this name in the browser and certificate.

HTTPS port

Default 443.

Administrator password

At least 12 characters. This sets the initial mtg-admin password for Management.

TLS mode

Persistent self-signed certificate, supplied certificate, or ACME.

The public Management name and HTTPS port are fixed for this Management state. Choose them before initialization. TLS mode and certificates can be changed later through Manage Certificates.

For a supplied certificate, stage the certificate and key before selecting that mode. For ACME, prepare the CA’s HTTPS directory URL, account email and HTTP-01 reachability to the Management hostname on port 80.

Initialize and Sign in

Choose Initialize Management in the console installation menu.
Select the dedicated state disk. Compare its complete identity with the hypervisor configuration; disks are not preselected.
Enter networking, NTP and Management settings. Enter the administrator password when prompted; input is hidden.
Select the TLS mode and provide its required settings.

Review the selected disk and settings.

Initialization erases the selected Management state disk. Confirm only when it is the intended disk and contains no data you need. The performance test writes to the disk before state creation; aborting after that test cannot restore previous contents.

Confirm that the selected disk can be erased. The host tests disk read/write performance before creating state. If results are unsupported, choose Abort setup or explicitly Accept unsupported to continue with an unsupported installation. Wait while Management initializes its state and starts. Keep the VM and ISO available.
Use Refresh Status to inspect startup without restarting services. Wait for healthy Management status and note the public HTTPS URL and certificate fingerprint shown by the console. For ACME, inspect the served certificate too. A healthy status does not prove issuance completed; a temporary hostname certificate may still be served.
Open that URL from the operator workstation. For self-signed TLS, compare the presented certificate with the console fingerprint through your trusted console connection before establishing browser trust.
Sign in through Gitea as mtg-admin, using the password entered during setup.
Leave host SSH disabled unless you need remote maintenance. If needed, configure persistent access through the console after initialization. Reboot and verify the intended policy before production use. Persistent access survives later reboots.

Host SSH access and the Management administrator account are separate. The Management password does not grant host SSH access.

Supply a Certificate

This workflow applies during setup and when replacing the Management HTTPS certificate. Use authenticated root SSH to the Management host and verify the host key through a trusted channel.

At the console, open Host access, configure credentials and a method, and explicitly enable SSH if it is disabled. Before initialization this access is temporary. Initialization closes it and does not copy the temporary credentials. For later certificate changes, use your configured persistent access and keep SSH restricted to approved maintenance sources. Verify the fingerprint shown by the console; the durable host key differs from the temporary setup key.

Create the staging directory on the host:

install -d -m 0700 /run/mtg-management-tls

Transfer the hostname certificate as tls.crt and its matching unencrypted private key as tls.key over SSH to that directory. Both files must be root-owned; set the key’s permissions to 0600.
Select supplied-certificate mode during initialization, or choose Manage Certificates in the running console. The console validates the pair and the configured hostname before installing it.
Verify the certificate served at the Management URL from the browser. Successful installation consumes the staged files.

Use SSH staging for supplied certificates. Keep private keys out of command arguments and logs. Finish active Management operations before changing certificates or TLS mode. Applying a changed certificate pair or TLS mode restarts the whole Management container. Retain required downloads first, then sign in again and reconnect the Appliance after the restart.

Self-signed certificates persist across normal boots. The host does not renew them or warn about expiry. For ACME, Traefik handles issuance and renewal, but the application can be healthy before certificate issuance finishes. Check browser trust and the served certificate after setup.

Verify and Continue

Management setup is complete when the console reports healthy status, the intended DNS name reaches the application over HTTPS, the expected certificate is served and administrator sign-in succeeds. Before production use, verify after reboot that SSH remains disabled or follows your explicitly configured persistent policy.

Next, follow connected or air-gapped appliance preparation, then install the appliance. If setup or startup fails, inspect console system information and logs. Check the configured network and NTP source before restarting. Preserve an unexpectedly initialized or failed disk for diagnosis; use Troubleshooting or Recovery options rather than erasing it as a retry.