Install the Edge appliance (Docker or systemd)

The Edge appliance is an agent that runs in your network and connects to the service with outbound HTTPS only. Today it serves privileged access (recorded SSH sessions). It runs as a Docker container (Linux x86_64) or a systemd service (Debian 12/13, Ubuntu 24.04).

Before you start

1. In the console, create the appliance and note the Edge URL, the organization and the enrolment code (see Enrol the appliance). The code lasts 30 minutes and works once.
2. Create the host secret: 32 random bytes that seal the appliance's keys. Keep it out of the image and include it in the volume's backups; without it the appliance must be enrolled again.

sudo install -d -m 0700 /etc/authguard-edge
openssl rand -hex 32 | sudo tee /etc/authguard-edge/host.key >/dev/null
sudo chmod 0600 /etc/authguard-edge/host.key

Network

Docker

Run the container with the persistent volume, the secret mounted read-only, the variables AUTHGUARD_EDGE_URL, AUTHGUARD_EDGE_TENANT, AUTHGUARD_EDGE_ENROLMENT_CODE and AUTHGUARD_EDGE_PUBLIC_URL, the ports above and a read-only filesystem. The full command is what the console copies with «Copy command». Then docker logs authguard-edge shows the confirmation code.

systemd

Install the authguard-edge binary, the system user, the environment file and the unit, and enable it. The confirmation code appears in journalctl -u authguard-edge.

Updating

Pull the new image and recreate the container with the same volume and secret. No new code is needed.

Diagnostics

docker exec authguard-edge authguard-edge diag shows the version, the key custody («Keys in software (no TPM)» in Docker) and the agent's status.