Skip to main content
The appliance boots with zero-config DHCP so it is always reachable on the address it leases — you can complete first-run over that address and configure a permanent one afterwards. Everything on this page can be done two ways: at the console (SSH or the VM console, no web UI required) or in the admin UI under Network & TLS.
Changing addressing restarts networking and briefly interrupts the web UI. On a cluster, change one node at a time and wait for it to rejoin before the next.

​
Default: DHCP

Out of the box the appliance requests an IPv4 lease. The current address is shown:
  • on the VM console login banner (IP address: …), and
  • from the console with network status.
DHCP is fine for evaluation, but production deployments should pin a static IP (a lease change would move the appliance’s address and break bookmarks, TLS SANs, and cluster peers).

​
Static IPv4

1

Open Network & TLS

Sign in as an owner → Admin → Network & TLS → Static IP.
2

Enter the address

Provide the interface, IP/CIDR, gateway, and one or more DNS servers, then apply. Every change requires password re-authentication and is audit-logged.
3

Reconnect

The stack restarts; reconnect at the new address. If you use an FQDN, point its DNS record at the new IP.
On VMware/vCenter you can also supply the address, gateway, DNS, and hostname as OVF/vApp properties at deploy time — the appliance applies them on first boot, so it comes up on its final address with no console step.

​
DNS

If you keep DHCP for addressing but need specific resolvers (for split-horizon DNS, internal zones, or an FQDN that resolves internally), pin DNS without leaving DHCP:
Admin → Network & TLS → Pin DNS (keep DHCP) — enter the resolver list and apply.

​
NIC bonding (redundancy)

For datacenter deployments that need link redundancy, bond two or more interfaces:
Admin → Network & TLS → NIC bond — pick the mode and member interfaces; optionally set a static IP on the bond.
Member NICs are enslaved to the bond (never addressed individually) and marked optional so boot never blocks on a dead link.

​
Reset to DHCP

To discard all operator network configuration (static or bond) and return to zero-config DHCP:
Admin → Network & TLS → Reset to DHCP.

​
Firewall

The appliance exposes only 443/tcp (the web UI and API) externally; a VIP-mode cluster additionally uses VRRP between nodes on the local segment. All inter-node cluster traffic (etcd, Patroni, replication) is mutually authenticated and restricted to the cluster members’ addresses. No inbound port other than 443 needs to be opened to users.

​
Next steps

Web TLS certificate & hostname

Install your certificate and pin the canonical hostname used in links.

High availability & clustering

Join nodes behind a floating VIP for automatic failover.