> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Configuration

> Configure the appliance's network — DHCP by default, or a static IPv4, pinned DNS, and NIC bonding for redundancy. Set it from the console or the admin UI.

The appliance boots with **zero-config DHCP** so it is always reachable on the address it leases — you can complete first-run over that address and configure a permanent one afterwards. Everything on this page can be done two ways: at the **console** (SSH or the VM console, no web UI required) or in the **admin UI** under **Network & TLS**.

<Info>
  Changing addressing restarts networking and briefly interrupts the web UI. On a
  cluster, change one node at a time and wait for it to rejoin before the next.
</Info>

## Default: DHCP

Out of the box the appliance requests an IPv4 lease. The current address is shown:

* on the **VM console login banner** (`IP address: …`), and
* from the console with `network status`.

DHCP is fine for evaluation, but production deployments should pin a **static IP** (a lease change would move the appliance's address and break bookmarks, TLS SANs, and cluster peers).

## Static IPv4

<Tabs>
  <Tab title="Admin UI">
    <Steps>
      <Step title="Open Network & TLS">
        Sign in as an owner → **Admin → Network & TLS → Static IP**.
      </Step>

      <Step title="Enter the address">
        Provide the interface, `IP/CIDR`, gateway, and one or more DNS servers, then apply. Every change requires password re-authentication and is audit-logged.
      </Step>

      <Step title="Reconnect">
        The stack restarts; reconnect at the new address. If you use an FQDN, point its DNS record at the new IP.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Console">
    ```bash theme={null}
    # network set <iface> <ip/cidr> <gateway> <dns1[,dns2]>
    network set eth0 10.0.10.20/24 10.0.10.1 10.0.10.53,1.1.1.1
    network status
    ```

    The external web host follows the new IP automatically **unless** you have pinned an FQDN (see [Web TLS certificate & hostname](/enclave/appliance/tls)); a pinned FQDN is preserved across IP changes.
  </Tab>
</Tabs>

<Note>
  On VMware/vCenter you can also supply the address, gateway, DNS, and hostname as
  **OVF/vApp properties** at deploy time — the appliance applies them on first boot,
  so it comes up on its final address with no console step.
</Note>

## DNS

If you keep DHCP for addressing but need specific resolvers (for split-horizon DNS, internal zones, or an FQDN that resolves internally), pin DNS without leaving DHCP:

<Tabs>
  <Tab title="Admin UI">
    **Admin → Network & TLS → Pin DNS (keep DHCP)** — enter the resolver list and apply.
  </Tab>

  <Tab title="Console">
    ```bash theme={null}
    network dns 10.0.10.53,10.0.10.54
    ```
  </Tab>
</Tabs>

## NIC bonding (redundancy)

For datacenter deployments that need link redundancy, bond two or more interfaces:

<Tabs>
  <Tab title="Admin UI">
    **Admin → Network & TLS → NIC bond** — pick the mode and member interfaces; optionally set a static IP on the bond.
  </Tab>

  <Tab title="Console">
    ```bash theme={null}
    # network bond <mode> <iface1,iface2[,...]> [<ip/cidr> <gateway> <dns>]
    network bond active-backup eth0,eth1 10.0.10.20/24 10.0.10.1 10.0.10.53
    ```
  </Tab>
</Tabs>

| Bond mode          | When to use                                                                               |
| ------------------ | ----------------------------------------------------------------------------------------- |
| **active-backup**  | No switch configuration needed — one link active, the other on standby. The safe default. |
| **802.3ad (LACP)** | Aggregated throughput + redundancy — requires a matching LACP port-channel on the switch. |

Member NICs are enslaved to the bond (never addressed individually) and marked optional so boot never blocks on a dead link.

## Reset to DHCP

To discard all operator network configuration (static or bond) and return to zero-config DHCP:

<Tabs>
  <Tab title="Admin UI">
    **Admin → Network & TLS → Reset to DHCP.**
  </Tab>

  <Tab title="Console">
    ```bash theme={null}
    network dhcp
    ```
  </Tab>
</Tabs>

## Firewall

The appliance exposes only **443/tcp** (the web UI and API) externally; a VIP-mode cluster additionally uses **VRRP** between nodes on the local segment. All inter-node cluster traffic (etcd, Patroni, replication) is mutually authenticated and restricted to the cluster members' addresses. No inbound port other than 443 needs to be opened to users.

## Next steps

<CardGroup cols={2}>
  <Card title="Web TLS certificate & hostname" icon="lock" href="/enclave/appliance/tls">
    Install your certificate and pin the canonical hostname used in links.
  </Card>

  <Card title="High availability & clustering" icon="layer-group" href="/enclave/appliance/clustering">
    Join nodes behind a floating VIP for automatic failover.
  </Card>
</CardGroup>