Install and activate
Take a CID222 appliance from a sizing decision to a licensed, TLS-secured system serving traffic — the paths, the order, what each step needs, and how long it takes.
- Version: 0.4
- Role: admin_user
CID222 ships as a virtual appliance. You size a host, import the image or boot the installer, complete a first-boot wizard, activate a licence, give the appliance a name and a certificate, and then it serves traffic. The whole path works with no internet connection; where an air-gapped deployment differs, each page says so explicitly.
Start with Choose your install path if this is the first appliance you have deployed, or if the deployment differs from the last one. It states the seven decisions that shape everything after them and which of them are expensive to reverse.
Decide these four things before you allocate the virtual machine
- Memory. Undersizing is the most common cause of a failed evaluation, and the figure depends on which services your package runs. Take it from Requirements and sizing.
- Egress, or a deliberate decision to have none. Which model the appliance talks to, and whether that model is in a vendor cloud or on your LAN.
- A name. The appliance answers on names your clients resolve. An IP-only deployment works, but every client must then trust the appliance's own certificate authority.
- A licence, or the trial. A licence is issued against the appliance's installation id, which does not exist until the appliance does — so the file is requested after the install, not before.
Warning
Read Requirements and sizing before you allocate the virtual machine, not after the first out-of-memory kill.
The order, and how long each step takes
The guide is written to be followed top to bottom. Steps 1 to 4 are mandatory on every deployment; 5 onwards depend on what you are deploying.
| # | Step | Typical time | Needed when |
|---|---|---|---|
| 1 | Choose your install path | 15 minutes, with the network and platform owners in the room | Always |
| 2 | Requirements and sizing | 10 minutes | Always |
| 3 | Network prerequisites | 30 minutes, mostly waiting on a firewall change | Always |
| 4a | Install on a hypervisor | 20 to 60 minutes, dominated by moving the image | OVA path |
| 4b | Install from the ISO | 30 to 60 minutes on the online flavour | Installer path |
| 5 | First boot and the setup wizard | 10 to 20 minutes, in one browser session | Always |
| 6 | Licensing and activation | Minutes on the appliance; the wait is your CID222 contact issuing the file | Unless you are evaluating on the trial |
| 7 | Naming, DNS and TLS | 30 minutes on the appliance; days if an external CA has to sign | Before any client connects |
| 8 | Optional services | Varies with what the package includes | When the package includes more than the core services |
| 9 | Hardening checklist | 30 minutes | Before the appliance carries real traffic |
| 10 | Backup and restore | 30 minutes to establish, then per your schedule | Before the appliance carries real traffic |
Update the appliance and Decommission an appliance belong to the appliance's life rather than to its install, and are written to be read on the day you need them.
What each page covers
- Choose your install path — install medium, connectivity, deployment shape, licence, identity, certificate authority and update channel, and what each choice commits you to.
- Requirements and sizing — memory, CPU, disk and optional GPU, per package.
- Network prerequisites — inbound ports, an egress matrix per deployment mode, corporate and TLS-inspecting proxies, DNS, time, and the tests that prove a path is really open.
- Install on a hypervisor — one page per platform. VMware and Proxmox are lab-verified; Hyper-V and generic KVM are written but labelled unverified.
- Install from the ISO — the boot menu, the branch for each network it meets, the provisioning stages and what a stop at each one means.
- First boot and the setup wizard — every step, what each answer changes downstream, what cannot be changed afterwards, and how to recover a half-finished wizard.
- Licensing and activation — trial to licensed, tier changes, seat limits, air-gapped activation, expiry, renewal, and what fails closed.
- Naming, DNS and TLS — the appliance CA, a public or internal certificate, an IP-only deployment, a TLS-inspecting proxy in the path, and renewal.
- Update the appliance — the online channel and the offline bundle, what an update touches, the downtime window, and what rollback really restores.
- Hardening, backup and restore, decommission — bringing the appliance into service properly and taking it out cleanly.
Limits and known gaps
- The setup wizard runs once. There is no supported way to re-run it; every answer is changed afterwards from its own Settings page.
- Backup, restore and decommissioning are manual. No scheduled backup, no restore workflow, no remote wipe. The procedures documented here are what the appliance's layout supports.
- A licence is bound to the installation id. Changing that identity invalidates the licence and takes a re-issue to recover.
If a step fails
Every install page ends with links into the guided runbooks. The runbooks read the appliance's own diagnostics snapshot, so they work before you have an LLM configured and with no internet access.
Last updated on