First boot and the setup wizard

Go to the appliance's address. An OVA answers on http://<appliance-ip>/; an appliance installed from the ISO is HTTPS-only, so use https://<appliance-ip>/ and accept the one-time certificate warning.

The appliance redirects to its setup page and shows Welcome to CID222 — first-boot setup with the ten steps listed down the left. First boot can take a few minutes while services start; a brief 502 during that window is normal.

Select Next.

The wizard advances to Admin account. Nothing is written yet.

Fill Admin username, Admin password (min 8 chars) and, optionally, Contact email (optional), then select Create admin & continue.

The account is created as a superadmin, the wizard signs the browser in as that account, and it shows Admin created — continue. This administrator is always local, so an unreachable domain controller can never lock you out of the appliance. The step cannot be repeated: once an account exists, the create-admin request is refused.

The wizard opens License immediately after the administrator. To use the built-in trial, review its end date and select Next. To activate a paid package, select Export activation request, send the file to your CID222 contact, and upload the returned .lic under Upload a license file (.lic) before continuing.

This step is mandatory because its entitlements drive the later package list. It has no Skip button. The full connected and air-gapped exchange is in Licensing and activation.

Review the five attribution mechanisms listed under User identity, then select Next or Skip.

The step is informational and records no choice: it explains the order in which the appliance puts a name on AI traffic — extension sign-in, a web gateway's supplied username, the Active Directory user-ID agent, a manual IP or CIDR mapping, and the enrolled-device bridge. Each is configured after setup, on its own page.

Select AI Gateway, Inline inspection (SWG/ICAP) or Both, then select Next.

The choice is recorded and decides which services the host starts when you finish. It has no Skip button, and you can change it afterwards under Settings → System Updates.

Leave Behind a corporate proxy? off and select Skip when the appliance reaches the internet directly or not at all. Otherwise turn it on, set HTTPS proxy to the proxy URL and No-proxy (comma-separated, optional) to the hosts that must bypass it, then select Next.

The values are staged on the appliance as cold configuration and take effect at Finish, not immediately. They are read by the components that make outbound connections — the LLM provider clients and the updater.

The Packages step lists optional compose services unlocked by the active trial or licence. Each row reports Suitable, Degraded, Unsuitable or Unknown from the hardware inventory and shows the requirement note from the signed service catalogue.

Choose Install now to add the service during host reconciliation, Later to put it in the pending-install queue, or Skip to leave it unselected. Mandatory core and guard services do not appear because they are not operator choices. An empty list means this package unlocks only the always-on core. Do not interpret Unknown as suitable: it means first boot did not produce a readable hardware report.

Choose Connected (cloud) or Air-gapped (local) and pick a Provider. A cloud provider takes its API key; a local one takes Model endpoint (LAN URL), and its key field reads API key (optional). Select Test connection, then select Next. Select Skip to add the provider later under Credentials.

A successful test reports Reachable with the measured latency; a failure reports the provider's own error. On save the credential is attached to the default tenant group, so every user inherits it. Choosing Air-gapped (local) narrows the provider list to the ones that accept a LAN endpoint.

Leave Use Active Directory / LDAP off and select Skip to stay on local accounts. Otherwise turn it on, fill Directory type, Group membership mode, Server URL, Bind DN (service account), Bind password, Base DN, User filter and Admin group DN (optional), select Test connection, then Save configuration.

Save configuration stays disabled until a test succeeds, so you cannot finish setup with a directory that does not bind. After saving, an optional panel lets you map one AD group to a Role and a CID group and select Add mapping & import now, which reports how many users it imported. Directory settings are database state and apply immediately.

Enter Proxy hostname (base URL) and API hostname (gateway), select Generate managed settings, then Copy. Select Skip if you are not routing Claude Code through this appliance yet.

The appliance creates a Claude Code tenant group, issues a scoped key and renders the managed-settings JSON. The key is shown once and is embedded in that JSON. Leave the hostname fields empty only if the appliance already knows its own names; otherwise the file is generated with placeholders and warns you before you paste it.

Select Finish setup.

The appliance marks setup complete, the 423 lock lifts, and the browser lands on the dashboard. It also asks the host to apply what was staged: the host reconciler establishes the installation identity, merges the Install now package choices into the active profile, preserves Later choices in the pending queue, recreates the stack with the outbound-proxy settings and entitled services, and health-gates the result. Expect a short interruption while the stack is recreated.