First boot and the setup wizard

Go to the appliance's address. An OVA answers on http://<appliance-ip>/; an appliance installed from the ISO is HTTPS-only, so use https://<appliance-ip>/ and accept the one-time certificate warning.

The appliance redirects to its setup page and shows Welcome to CID222 — first-boot setup with the ten steps listed down the left. First boot can take a few minutes while services start; a brief 502 during that window is normal.

Select Next.

The wizard advances to Admin account. Nothing is written yet.

Fill Admin username, Admin password (min 8 chars) and, optionally, Contact email (optional), then select Create admin & continue.

The account is created as a superadmin, the wizard signs the browser in as that account, and it shows Admin created — continue. This administrator is always local, so an unreachable domain controller can never lock you out of the appliance. The step cannot be repeated: once an account exists, the create-admin request is refused.

Review the five attribution mechanisms listed under User identity, then select Next or Skip.

The step is informational and records no choice: it explains the order in which the appliance puts a name on AI traffic — extension sign-in, a web gateway's supplied username, the Active Directory user-ID agent, a manual IP or CIDR mapping, and the enrolled-device bridge. Each is configured after setup, on its own page.

Select AI Gateway, Inline inspection (SWG/ICAP) or Both, then select Next.

The choice is recorded and decides which services the host starts when you finish. It has no Skip button, and you can change it afterwards under Settings → System Updates.

Leave Behind a corporate proxy? off and select Skip when the appliance reaches the internet directly or not at all. Otherwise turn it on, set HTTPS proxy to the proxy URL and No-proxy (comma-separated, optional) to the hosts that must bypass it, then select Next.

The values are staged on the appliance as cold configuration and take effect at Finish, not immediately. They are read by the components that make outbound connections — the LLM provider clients and the updater.

Choose Connected (cloud) or Air-gapped (local) and pick a Provider. A cloud provider takes its API key; a local one takes Model endpoint (LAN URL), and its key field reads API key (optional). Select Test connection, then select Next. Select Skip to add the provider later under Credentials.

A successful test reports Reachable with the measured latency; a failure reports the provider's own error. On save the credential is attached to the default tenant group, so every user inherits it. Choosing Air-gapped (local) narrows the provider list to the ones that accept a LAN endpoint.

Leave Use Active Directory / LDAP off and select Skip to stay on local accounts. Otherwise turn it on, fill Directory type, Group membership mode, Server URL, Bind DN (service account), Bind password, Base DN, User filter and Admin group DN (optional), select Test connection, then Save configuration.

Save configuration stays disabled until a test succeeds, so you cannot finish setup with a directory that does not bind. After saving, an optional panel lets you map one AD group to a Role and a CID group and select Add mapping & import now, which reports how many users it imported. Directory settings are database state and apply immediately.

Select Export activation request, send the downloaded file to your CID222 contact, and upload the .lic they return under Upload a license file (.lic). Select Skip to run on the built-in trial instead.

The panel above the field states the current licence state and shows this appliance's installation id. The full procedure, including the air-gapped transfer, is Licensing and activation.

Enter Proxy hostname (base URL) and API hostname (gateway), select Generate managed settings, then Copy. Select Skip if you are not routing Claude Code through this appliance yet.

The appliance creates a Claude Code tenant group, issues a scoped key and renders the managed-settings JSON. The key is shown once and is embedded in that JSON. Leave the hostname fields empty only if the appliance already knows its own names; otherwise the file is generated with placeholders and warns you before you paste it.

Select Finish setup.

The appliance marks setup complete, the 423 lock lifts, and the browser lands on the dashboard. It also asks the host to apply what was staged: the host reconciler establishes the installation identity, recreates the stack with the outbound-proxy settings and the services the chosen mode needs, and health-gates the result. Expect a short interruption while the stack is recreated.