> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# First-run setup

> Bring a freshly deployed Enclave appliance online — console access, SSH key enrolment, the first account, and network configuration.

<Info>
  This guide covers the very first boot of a newly deployed appliance: enrolling
  SSH access, creating the first account, and setting the network address. It is
  for the person who deployed the OVA.
</Info>

## What you see on the VM console

On first boot the appliance prints an access banner on the hypervisor console
(vSphere/Workstation **Console** tab):

* **Web UI** — the address to open in a browser.
* **IP address** — the current address, shown **live** at every login prompt
  (it stays accurate through DHCP changes).
* **One-time console password** for the `enclaveadmin` console account (you must
  change it at first login).
* **First-signup code** — a single-use entitlement code that authorises creating
  the first account in the web UI.

Only someone with hypervisor console access can read these values.

## Step 1 — Enrol an SSH public key (required)

For security, the appliance ships with **no SSH access** — nothing to steal, and
no vendor-held key. Before you can create the first account, the web UI requires
you to enrol **your own** SSH public key. Your private key never leaves your
machine.

<Steps>
  <Step title="Generate a key pair (if you don't have one)">
    * **OpenSSH:** `ssh-keygen -t ed25519 -C you@company` — then copy the contents of the `.pub` file.
    * **PuTTYgen:** generate a key, then copy the *“Public key for pasting into OpenSSH authorized\_keys”* box, or use *Save public key* and paste that file.

    Supported types: **RSA (≥ 2048-bit), ECDSA (P-256/384/521), Ed25519**. Both
    the OpenSSH one-line format and the PuTTY/SSH2 (`---- BEGIN SSH2 PUBLIC KEY ----`)
    format are accepted.
  </Step>

  <Step title="Open the appliance and paste the key">
    Browse to `https://<appliance-ip>` (accept the self-signed warning for now).
    On the **Appliance Setup** screen, paste your **public** key and select
    **Enrol key & continue**.
  </Step>

  <Step title="SSH is enabled">
    The appliance installs your key for the `enclaveadmin` account and enables
    **key-only** SSH (password authentication stays off). You can now
    `ssh enclaveadmin@<appliance-ip>` to reach the restricted console remotely.
  </Step>
</Steps>

<Note>
  Enrolment is a one-time gate: once the first account exists it is locked, and
  SSH keys are managed from the console (`ssh-add-key`) thereafter.
</Note>

## Step 2 — Create the first account

After the key is enrolled, the signup form appears. Create the first
organisation account using the **first-signup code** from the console banner.
This account is the appliance owner.

## Step 3 — Set the network address

By default the appliance uses **DHCP** and is reachable at the address it leases.
To assign a fixed address you have three options:

* **At deploy time (vApp properties).** vCenter/ESXi shows a *Customize template*
  step with fields for **IPv4 Address (CIDR)**, **Gateway**, **DNS**, **NTP**, and
  **Hostname**. Leave blank for DHCP. These are applied at first boot.
* **From the web UI.** **Admin → Network & TLS** lets the owner set the
  hostname/FQDN (see [Web TLS certificate & hostname](/deployment/appliance/tls)).
* **From the console.** `network set <iface> <ip/cidr> <gateway> <dns>` (list
  interfaces with `network show`).

<Warning>
  A stable **FQDN** is strongly recommended for production: emailed links
  (invitations, password resets) embed the appliance address, and a trusted TLS
  certificate requires a hostname. Front the appliance with a DNS name before
  inviting users.
</Warning>

## Step 4 — Time synchronisation

Accurate time (UTC) is required for KMS, TLS, and licence operations. Set an NTP
server at deploy time (vApp **NTP** field) or on the console with
`time ntp <server>`. See the [main appliance guide](/deployment/private-appliance#time-and-clock-synchronisation).

## Next steps

* [Web TLS certificate & hostname](/deployment/appliance/tls) — remove the browser warning.
* [Licensing & Activation](/deployment/appliance/licensing) — activate beyond the trial.
* [KMS](/deployment/appliance/kms) and [Storage](/deployment/appliance/storage) — required before file uploads.