Install Management unattended with the ISO

Use an initialization seed to supply the Management ISO’s disk, network, time, application and optional SSH settings. The seed supplies settings for automatic state initialization after you stage the required files and retry setup. This installs the Management host and application. Continue in the Management browser to install the Appliance.

The seed contains file paths, not passwords or private keys. On first boot, setup stops until you stage the Management password and any optional credentials or certificates through explicitly enabled SSH. The procedure below uses the console to enable staging access and start the retry.

Prepare the VM and installation inputs

  1. Obtain the release’s Management ISO and checksum through the MTG Download Center. Verify its SHA-256 digest before use.

  2. Create an AMD64 Management VM with one dedicated state disk and the Management CPU, memory and storage allocations. Attach the ISO first in the boot order and retain hypervisor console access. See Management ISO deployment for VM preparation and boot checks.

  3. Record the intended network adapter’s exact MAC address and reserve the Management address and DNS name. Prepare reachable DNS and NTP services and the required network connections.

  4. Identify the state disk by its exact whole-disk link under /dev/disk/by-id/ or /dev/disk/by-path/ as seen inside the VM. Match its serial, size and hypervisor attachment. Do not select a partition, use a wildcard, or substitute /dev/sda.

If you need to inspect the disk identity, boot once without seed media and use temporary console-managed SSH. In that authenticated root session, inspect the disks and stable links:

lsblk -d -o NAME,SIZE,MODEL,SERIAL,WWN
ls -l /dev/disk/by-id/ /dev/disk/by-path/

Record the exact link, then shut down without initializing the disk. Stage credentials on the installation boot described below, because files under /run disappear at reboot.

Prepare the initialization seed

  1. Download the initialization seed template to your administrator workstation as autoinstall.conf.

  2. Replace the sample disk identity, MAC address, time server and Management DNS name with your deployment’s values.

  3. Choose networking, TLS and optional persistent SSH settings using the following sections.

The template starts with destructive authorization disabled:

# Unattended Management ISO initialization.
# Replace the disk identity, MAC, time server and Management DNS name.
# Set destructive_enabled=true only after reviewing the exact target.
schema_version=mtg.state-init.seed.v1
operation=initialize-state
destructive_enabled=false
accept_unsupported_disk_performance=false

state_disk=/dev/disk/by-id/REPLACE_WITH_WHOLE_DISK_ID
hostname=mtg-management
time_server=ntp.example.test

network_mode=dhcp
network_mac=02:00:00:00:00:10
network_address=
network_gateway=
network_dns=
network_search_domains=
network_connection_name=mtg-management
network_mtu=1500

management_hostname=management.example.test
management_https_port=443
management_tls_mode=self-signed
management_acme_directory_url=
management_acme_email=
management_password_file=/run/mtg-management-bootstrap-password

# Optional persistent host access, separate from the Management administrator.
ssh_enabled=false
ssh_authentication=none
host_password_file=
ssh_authorized_keys_file=

Use literal key=value assignments without shell quotes, spaces around =, variable expansion or duplicate keys. Unknown fields are rejected. Use # at the start of a line for comments. Keep passwords and private keys out of this file and the seed medium.

hostname names the FCOS host and defaults to mtg-management when omitted. management_hostname is the separate DNS name used for the Management HTTPS endpoint. The Management DNS name and HTTPS port are fixed for initialized state; choose them before installation. management_https_port defaults to 443; port 80 is reserved for ACME HTTP-01.

Select the network configuration

For DHCP, keep network_mode=dhcp, set the exact network_mac, and leave the address, gateway, DNS and search-domain fields empty. Use a DHCP reservation if Management needs a stable address.

For static IPv4, replace the corresponding template values, for example:

network_mode=static
network_address=192.0.2.10/24
network_gateway=192.0.2.1
network_dns=192.0.2.53,192.0.2.54
network_search_domains=example.test

Replace these documentation addresses with your actual network. Supply a gateway in the same subnet and one or two unique unicast IPv4 DNS servers, separated by commas without spaces. Search domains are optional. Keep the configured MTU compatible with the network.

On Proxmox, network_mode=cloud-init can use an attached, supported Proxmox cidata profile matching the exact MAC. Leave the static network fields empty in that mode. An applied Proxmox seed hostname takes precedence over hostname; validated seed public keys can also be retained. Proxmox metadata alone does not authorize disk initialization, enable SSH or replace the required Management password file. Use the portable DHCP or static mode when you do not need that adapter.

Select Management TLS

For a persistent self-signed certificate, keep management_tls_mode=self-signed and leave the ACME fields empty. After startup, compare the certificate fingerprint with the console before establishing browser trust.

For a supplied certificate, set management_tls_mode=supplied and leave the ACME fields empty. Prepare the hostname certificate and matching unencrypted PEM private key for SSH staging below.

For ACME, set these values for your CA:

management_tls_mode=acme
management_acme_directory_url=https://acme.example.test/directory
management_acme_email=administrator@example.test

The CA must reach the Management hostname on inbound TCP 80 for HTTP-01 validation. Check the served certificate after startup. Application health does not prove issuance completed; a temporary hostname certificate may still be served. See Management certificates for trust, renewal and later changes.

Choose persistent SSH access

Keep the template’s defaults to leave SSH disabled after initialization. To enable password-based host SSH, replace these fields:

ssh_enabled=true
ssh_authentication=password
host_password_file=/run/mtg-host-password

The host password is separate from management_password_file, which sets the initial Management administrator password. Only the host password’s hash persists. Setting that password alone does not enable SSH or choose a method. For public-key or either-method access, use the SSH seed settings and stage the requested public-key file.

Authorize the disk and create read-only media

Setting destructive_enabled=true authorizes erasing the exact selected state disk without another interactive confirmation. The disk performance test writes to that disk before partition creation. Rejection after the write test cannot restore its previous contents.

  1. Review the whole-disk identity against the VM configuration and confirm that the disk contains no data you need.

  2. Change destructive_enabled=false to destructive_enabled=true in your reviewed autoinstall.conf. Keep accept_unsupported_disk_performance=false for supported installations.

  3. On a workstation with xorriso, create an ISO containing only the reviewed configuration at its root:

    mkdir -p mtg-management-seed
cp autoinstall.conf mtg-management-seed/autoinstall.conf
xorriso -as mkisofs -V MTG_AUTOINSTALL -r \
  -o mtg-management-seed.iso mtg-management-seed

  4. Attach mtg-management-seed.iso as an additional virtual CD-ROM. Retain the Management boot ISO and keep it first in the boot order. Attach exactly one filesystem labeled MTG_AUTOINSTALL.

  5. Boot the VM and open its console.

Setup stops at Invalid unattended state media, reporting the missing staging file. Use the following steps to supply the files and retry. Missing credentials are checked before networking or disk writes.

Stage credentials and certificates

  1. If the host is unreachable, choose Configure temporary network in the unattended menu and configure the intended adapter. The seed supplies the persistent network settings later.

  2. Open Host access, set temporary credentials, select an authentication method and explicitly enable SSH. Follow the console procedure and verify the displayed host-key fingerprint before connecting as root.

  3. In the authenticated Bash root session, create the Management administrator password file with hidden input:

    umask 077
read -rsp 'Initial Management administrator password: ' management_bootstrap_password
printf '\n'
printf '%s\n' "$management_bootstrap_password" >/run/mtg-management-bootstrap-password
unset management_bootstrap_password
chmod 0600 /run/mtg-management-bootstrap-password

    Use one password line with at least 12 characters. The file must be root-owned, mode 0600, regular and not a symlink. If you changed management_password_file, write to that exact path instead.

  4. If you set host_password_file, create its separate file, even when SSH is disabled:

    umask 077
read -rsp 'Persistent host password: ' host_password
printf '\n'
printf '%s\n' "$host_password" >/run/mtg-host-password
unset host_password
chmod 0600 /run/mtg-host-password

    Use one line of at least 12 characters and at most 256 bytes, with no symlinks or hard links. The file must be root-owned and mode 0600. Its path must match host_password_file.

  5. If you set ssh_authorized_keys_file, transfer the public-key file to that exact path. Transfer only public keys, never private SSH keys.

  6. For supplied TLS, create the root-owned staging directory with mode 0700:

    install -d -m 0700 /run/mtg-management-tls

    Transfer the certificate chain as /run/mtg-management-tls/tls.crt and the matching unencrypted private key as /run/mtg-management-tls/tls.key over authenticated SSH. Keep both root-owned and set the key’s mode to 0600. The pair and Management hostname are validated before installation.

Do not reboot between staging and retry, because /run files and temporary access expire at reboot. Temporary SSH credentials do not transfer to persistent access. The explicit seed settings determine whether SSH starts after initialization.

Run setup and verify Management

  1. Return to the hypervisor console and select Retry unattended setup.

  2. Wait while the host validates the seed and staged files, activates the selected network, verifies the configured NTP source, tests the disk and initializes state. Use the console to monitor progress. Network changes can interrupt staging access, and initialization disconnects the temporary SSH session.

  3. Wait for healthy Management status and note the HTTPS URL and certificate fingerprint shown by the console.

  4. Open the configured Management URL and verify its certificate and hostname. Sign in through Gitea as mtg-admin with the Management password you staged.

  5. Check persistent SSH according to your seed settings. If enabled, verify the new host-key fingerprint at the console before connecting with the persistent credential. The temporary setup key and credentials no longer apply.

  6. Shut down cleanly to clear the original password files under /run, detach the initialization seed, then reboot with the Management boot ISO and state disk retained. If you used staging paths outside /run, remove those original password files separately. Verify Management health, HTTPS, administrator sign-in and the intended SSH policy again.

Management consumes its persistent pending bootstrap file after its first healthy start; supplied TLS staging files are consumed during installation.

Normal boots use the initialized state disk and do not replay attached seeds. A seed cannot rotate credentials, reopen SSH or reinitialize an existing Management instance. Keep the Management boot ISO attached for the VM’s lifetime; it is separate from the removable initialization seed.

Continue with connected or air-gapped Appliance preparation, then install the Appliance.

Correct a failure without erasing state

If the console reports an invalid seed or missing file, correct the configuration or staging input, then choose Retry unattended setup. For a changed configuration, shut down the VM, replace the seed CD-ROM with a corrected read-only ISO, then boot again. Restage the required /run files and retry; they do not survive shutdown. Removing an invalid seed alone does not unlock interactive initialization in that boot.

If network activation or time synchronization fails, check the selected MAC, address, routes, DNS and NTP reachability before retrying. The disk initializer runs only after those checks succeed.

If the disk is missing or ineligible, verify the exact whole-disk identity and its current attachment. Do not substitute another disk as a retry. Performance below 40 MiB/s for sequential reads or writes, fewer than 50 aggregate random IOPS, or an unmeasurable result stops unattended initialization by default. accept_unsupported_disk_performance=true explicitly accepts an unsupported setup; it does not bypass disk-identity or eligibility checks. The write test may already have overwritten data when performance is rejected.

If setup created a state filesystem or state discovery enters recovery, preserve the disk and inspect the console’s recovery status and logs. Do not erase the disk or treat another seed as a repair mechanism. If state is initialized but Management fails to start, use the console status and logs, troubleshooting and Management recovery procedures.