Manual

First boot

First boot connects the local Pool, prepares its local SR and establishes the first administrator Account. Root on dom0 and an hv Account are different identities. Have the Host console and its management URL available; there is no default hv Account or default password.

Check the host

The installer enables the toolstack, hv-agent, first-boot services and hv. The installed dashboard should therefore start without manually enabling those services. From a recovery shell, these read-only checks help separate a boot failure from a browser problem:

rc-status
rc-service xapi status
rc-service hv-agent status
rc-service hv status
xl info
ip address
ip route

Use the address printed on the Host console. Public-profile administration normally uses https://HOST:8443/; private-profile administration normally uses https://HOST/. Replace HOST with the actual management address. Verify the server's TLS identity through your deployment's trusted process.

Create the first account

If administrator details were supplied to the installer, sign in with those details. First boot consumes the prepared administrator record and does not reset a subsequently changed password.

Otherwise, the Host console displays a one-time setup token and the setup page address. The token is valid for 24 hours and works once. Its QR code contains the token alone: scanning it does not require the phone to connect to hv.

1. Read the setup token from the Host console.
2. Open the printed /setup URL in the browser.
3. Enter the token, e-mail, username and the new password twice. The password must be at least 12 characters.
4. Select Create the administrator and then sign in.

The first Account receives Fleet administrator access and administrator access to the default Silo. A wrong, expired or spent token creates no Account. While no Account exists, a Host administrator can issue a replacement through the local hv setup-token command documented in the CLI reference; keep its output private. Do not share console photographs containing the token.

Add a second factor

Two-factor authentication is optional by default on both installation profiles. To add it, open Settings, Security, then Set up two-factor authentication. Scan the displayed authenticator QR code, enter the current code and store the recovery codes shown once. The phone reads the key locally; it need not reach the Host.

A Fleet or Silo policy may require enrollment. An Account subject to that policy without an active second factor needs the enrollment flow, including an enrollment code when requested. See users and access before turning on a mandatory policy.

Verify and resolve problems

Confirm the local Pool, Host and SR appear, then open the Personal project created for the Account. Missing inventory may mean xapi or the first-boot bootstrap is still unavailable. Inspect service status and logs before trying to register the local Pool again.

If the dashboard cannot be reached, check the profile's port and management routing. If sign-in is rate limited, wait for the limit to expire and correct the failing input. A successful login is the starting point for creating a VM, followed by checks of VM storage and networking.