Install the Edge appliance

In this tutorial, we install an Edge appliance on your network, enrol it with a single-use code, and check that it's healthy. The Edge appliance is an agent that runs on your network and only opens outbound HTTPS connections to the service. Today it serves privileged access: recorded SSH sessions, a web terminal and credential rotation. It runs as a Docker container, or as a systemd service on Debian or Ubuntu.

In the console, open Operate, Edge appliances. First create a site, then choose Add appliance, with a name. The enrolment code appears. It's shown only once, and expires in thirty minutes. Use Copy command: it carries the address, the organisation and the code. On the host, first create the host secret: thirty-two random bytes that seal the appliance's keys.

Keep it outside the image, and include it in your backups. Without it, the appliance has to be enrolled again. Then run the copied command. The appliance only needs outbound port 443 to the service and to recording storage, plus access to the targets' ports. Keep the status page for the management networks only. The appliance log shows a six-digit code.

In the console, choose Confirm and type it. Both sides compute the code from the enrolment keys: the server never sends it. The state becomes Active. Under Configuration, choose the modules, the sync interval and the management networks. Saving is a policy change: approve it on your phone or with your passkey. The console flags problems on the appliance's row: no heartbeat, clock skew, certificate expiring.

Keep NTP running on the host. To update, recreate the container with the same volume and the same secret: no new code needed. And that's it: the appliance enrolled, confirmed and healthy. In the next tutorial, we'll look at the audit trail and GDPR requests.