Getting Started — Guardian — VeilNet documentation

Required Inputs

A guardian needs three inputs. VeilNet hands over two of them on hard media, such as a USB stick, and you provide the third.

Input	From	What it is
The realm credential	VeilNet	A single file, `guardian_credential`. It carries the private key of your realm's root, so keep it with your secrets and never with the images. It cannot be taken back once it is handed over.
The anchor binaries	VeilNet	`anchord-linux-amd64` and `anchorctl-linux-amd64`, pinned to your realm's tree. A pair built for another tree refuses to sign.
A host and its settings	You	A Linux x86_64 host with Docker, its Compose plugin, openssl and python3. You also choose the one address that your operators and machines will use.

Installing the Stack

Run these steps on the host, in the guardian checkout. Setup asks no questions, so the same steps work for an unattended install. For each step in detail, see Deploying a Guardian.

0 of 5 done

01
$ cp anchord-linux-amd64 anchorctl-linux-amd64 ./bin/
If a binary loses its execute bit on removable media, setup restores it and prints made bin/anchord-linux-amd64 executable.

https://guardian.example.gov shows the compliance profile's system-use notice, then the sign-in page.
The secrets directory holds the settings, the credential, every generated secret and the internal certificate authority.

Guardian console — First runIllustrative

Dashboardguardian-adminThis deployment has a realm credential to be givenThe stack is up: sign-in works and this console serves. Everything that would mint or renew is waiting for one artifact.Three steps1Put the credential on the hostOne base64 artifact from VeilNet. It carries the realm root's private half, so it goes in secrets/ with everything else the stack keeps.scp guardian_credential admin@guardian.example.gov:~/guardian/secrets/2Validate itformatVersion and kind are checked by equality. A tier with no sub-realm levels is flagged now, before a tree is designed that cannot be built../setup.sh3Restart the APIIt reads the credential at boot, seals the root seed into the state store and never returns it.docker compose restart apiThe credential carries this deployment's realm root, so it travels with the secrets and by hand. Once it is ingested, this page is replaced by the dashboard.

Signing In and Securing Accounts

0 of 3 done

01
Open your guardian's address and accept the system-use notice. Sign in as a.morgan with the temporary password in secrets/first-admin.env. The console asks you to set up a one-time code and choose a new password. Then delete the password file:
$ rm secrets/first-admin.env
Create every later account on the console's Accounts page. See Accounts. In brokered mode, there is no first administrator. Your identity provider holds the accounts, and its groups hold the roles.

Commissioning Bootstrap Nodes

Bootstrap nodes are a few of your own machines in the guardian realm, each with a public address. Every machine finds the network through them, and they relay traffic for every machine below them.

The admin node of the guardian realm also connects to the bootstrap nodes, so it has nothing to connect to until you commission the first one.

0 of 3 done

In the console, open Nodes, choose Commission node and pick the guardian realm. Enter a name and the public address the machine will listen on, as host:port, for example 203.0.113.10:4700. The console shows the manifest once. Download it and hand it to the machine's operator with the same care as an SSH host key.

Adding Sub-realms and Machines

Sub-realms keep groups of machines apart, because a machine exchanges data only with machines in its own realm. Your realm credential decides whether you can create sub-realms. If it allows none, setup warns SUB-REALMS ARE NOT AVAILABLE, and you commission every machine into the guardian realm.

0 of 3 done

As an admin, open Realms and choose New sub-realm. Enter a name, a description and an IPv4 range of /30 or larger, then choose Mint sub-realm. Telemetry shows the sub-realm's admin node as starting, then running.

Verifying the Tree

The Stack & compliance page shows three steps as done: realm credential ingested, bootstrap nodes commissioned and telemetry collected.
Telemetry shows In-band running in every realm. Each realm's admin node has reached your bootstrap nodes and receives reports from its members.
Settings → Realm control shows whether console control is on and which powers your realm credential grants.

Guardian console — Stack & complianceIllustrative

Stack & complianceguardian-adminStack & complianceWhat this stack can check about itself. Host prerequisites — FIPS kernel, encrypted volumes, time sync, PKI, log shipping — are the deployer's and are not verified here.After first runIngest the realm credentialsecrets/guardian_credential · root seed sealed into the state store.verified by the APICommission the bootstrap nodesPublicly reachable nodes in the guardian realm — the bootstrap list in every manifest.verified by the APIGo to the guardian realm →Collect telemetryEvery manifest carries an export block to this stack's collector; flows are on unless turned off per node.verified by the APIMake the people who sign insetup.sh --first-admin makes the first guardian admin; everyone after it is made on the Accounts page.the deployer's to confirm — the stack cannot see itGo to Accounts →Replace the bootstrap adminCreate the real break-glass admin in the identity service's administration realm, confirm it can sign in, then disable bootstrap-admin.the deployer's to confirm — the stack cannot see itOpen the identity service's users ↗Exercise the outage pathMake the upstream identity provider unreachable and confirm break-glass still reaches the console.the deployer's to confirm — the stack cannot see itBuild the FIPS Node basebuild-node-fips.sh · NODE_BASE=guardian/node-fips:24.21.0 · 30–60 min compile.the deployer's to confirm — the stack cannot see itConfigurationProfileau-ismIdentity modestandaloneApp URLhttps://guardian.example.govAPI URLhttps://guardian.example.govCertificateinternalOTLP endpointguardian.example.gov:443Node credential90 days · 90 at mostNODE_BASEnode:24-trixie-slimPublished portsfront door443the only published port: the console, sign-in at /auth, node renewal, OTLPConsole, API, identity service, collector—reached through the front door onlyState store, metrics store—nothing outside the stackadmin nodes (in the API)UDP outdial this guardian's own bootstrap nodes; nothing dials in

Required Inputs

Installing the Stack

Copy the anchor binaries+

Copy the realm credential+

Fill in the settings+

Run setup with a first administrator+

Trust the internal certificate+

Signing In and Securing Accounts

Sign in as the first administrator+

Replace the bootstrap administrator+

Ship the audit trail and test break-glass access+

Commissioning Bootstrap Nodes

Commission each bootstrap node+

Enrol the bootstrap node+

Check the admin node+

Adding Sub-realms and Machines

Mint a sub-realm+

Commission each machine+

Enrol the machine+

Verifying the Tree