Set Up the Target Host

Transfer the bundle you built in Build the Air-Gap Bundle to the target host, import it, and run the setup wizard. Run every command below on the air-gapped target host.

1. Transfer the bundle

Move the tarball and its .sha256 checksum file to the target host using your approved transfer mechanism; any filesystem location works. Then verify the transfer:

sha256sum -c manifest-self-hosted-<version>-<YYYYMMDD>.tar.sha256

Run this from the directory holding both files; it prints OK when the tarball matches. If verification fails, the tarball was corrupted in transit — re-transfer it, and re-run export-bundle on the prep host if it fails again.

2. Install the CLI

The bundle carries the manifest-installer binary under bin/, so the target host needs no separate download. Extract it onto your PATH:

tar -xf manifest-self-hosted-<version>-<YYYYMMDD>.tar bin/manifest-installer
chmod +x bin/manifest-installer
sudo mv bin/manifest-installer /usr/local/bin/

Verify the install:

manifest-installer --version

3. Import the bundle

manifest-installer import-bundle /path/to/manifest-self-hosted-<version>-<YYYYMMDD>.tar

This unpacks the bundle into ~/.local/share/manifest/: platform packages into versions/, vulnerability data into data/. import-bundle verifies the tarball's integrity before writing anything. The target host now has everything a connected host would have after download, with no AWS credentials or network access needed; the tarball can be deleted.

📘

Disk space

Importing needs free space in ~/.local/share/manifest/ (or wherever XDG_DATA_HOME points) roughly equal to the bundle's size — about twice that, roughly 10 GB today, if the tarball sits on the same filesystem.

4. Run the setup wizard

manifest-installer setup

The wizard prompts for deployment-specific values such as the base domain, the administrator email, and (optionally) SMTP, OIDC, and CA certificate settings. On re-runs, prompts default to your previous answers.

📘

If the wizard renders incorrectly

Over a serial console, a limited SSH client, or a screen reader, the full-screen interface can render garbled. Run TERM=dumb manifest-installer setup to get the same questions as a plain line-by-line prompt flow with no screen redrawing.

Where your configuration is stored

Every answer — plus workload credentials the installer generates (database passwords and similar) — is written to ~/.config/manifest/config.yaml (mode 0600, inside a 0700 directory). That includes the sensitive values: the SMTP password, the OIDC client secret, the license key, and the generated workload passwords. config.yaml is the single durable copy of these values.

Choose encryption

Because sensitive values live in this file, the wizard asks for an encryption choice before it writes anything; nothing is pre-selected. Once config.yaml exists, a setup re-run keeps your existing decision. To change it later, run manifest-installer setup --prompt-encryption, or use deploy-config encrypt / deploy-config rekey (below).

When encryption is on, only the sensitive values are encrypted, in place; the rest of config.yaml stays human-readable and diffable.

Back up config.yaml — and understand key loss

• Back up config.yaml after setup and after any later configuration change. With encryption on, the file is safe to store in an ordinary backup system; keep the passphrase (or your age/GPG secret key) somewhere separate, such as a password manager or key escrow. If you chose the password-protected key option, back up age-key.age too.
• Before your first deploy, losing the key or the file is harmless: delete config.yaml if it still exists, re-run setup, and make a fresh choice.
• After deploy, the generated workload passwords in config.yaml are load-bearing — the running platform was initialized with them and they cannot be regenerated. If you lose the ability to decrypt the file and have no backup, the installation cannot be reconstructed.
• Hedge against a lost key by re-keying the file to a second recipient (a teammate's key or an escrow key): manifest-installer deploy-config rekey --age <age1...> (or --gpg <fingerprint>).

Maintain the configuration

The deploy-config command groups the maintenance operations over config.yaml:

manifest-installer deploy-config validate                  # check completeness; offers to fill defaults and newly required values
manifest-installer deploy-config edit                      # decrypt into your editor, re-encrypt on save
manifest-installer deploy-config rekey --age <age1...>     # add a recipient (second operator or escrow key)
manifest-installer deploy-config encrypt --age <age1...>   # encrypt a plaintext config.yaml after the fact
manifest-installer deploy-config decrypt                   # print the decrypted config to stdout (reveals secrets)

If your ops team prepared config.yaml on a separate machine and you brought it across the air gap, copy it to ~/.config/manifest/config.yaml on the target host — together with its age-key.age key file if setup generated a password-protected key — then confirm it is complete for the version you're deploying:

manifest-installer deploy-config validate

For help, contact Manifest support at [email protected].