Installation

CIQ Enterprise Linux Manager (ELM) is distributed as the elm-server RPM. The RPM installs a native, rootful Podman deployment and a systemd service that runs the published ELM container images. For environments without internet access, also read Air-gapped considerations.

Prerequisites

• An RPM-based Linux host with Podman and systemd.
• An enterprise license for RLC Pro, RLC Pro AI, or RLC Pro Hardened purchased through CIQ Portal. Cloud customers should contact CIQ Support about ELM access.
• The Depot Client, authenticated with your credentials from CIQ Portal.
• Network access to depot.ciq.com and credentials from CIQ Portal that can pull the ELM images.
• An ext4 or XFS filesystem with enough space for the repositories you plan to mirror.

ELM uses hard links when composing content views. Source content and content-view storage must therefore remain on the same filesystem.

Install the server

1. Enable the ELM product repository and install the server:

   sudo depot enable elm
   sudo dnf install elm-server
   

2. Review /etc/elm-server.conf, which is owned by root and has mode 0600:

   sudo $EDITOR /etc/elm-server.conf
   

   Set ADMIN_PASSWORD to a known initial administrator password. If the value is blank or admin during installation, the RPM replaces it with a random value. The database, session, and encryption secrets also receive random values when their defaults are insecure.

3. Authenticate Podman to CIQ Depot using the username and access token from CIQ Portal:

   sudo install -d -m 0700 /etc/containers
   sudo podman login depot.ciq.com --authfile /etc/containers/auth.json
   sudo chmod 600 /etc/containers/auth.json
   

4. Encrypt the registry credential for systemd:

   sudo install -d -m 0700 /etc/credstore.encrypted
   sudo systemd-creds encrypt \
     --name=registry-auth \
     /etc/containers/auth.json \
     /etc/credstore.encrypted/elm-server-registry-auth
   sudo chmod 600 /etc/credstore.encrypted/elm-server-registry-auth
   

   Create the systemd drop-in directory, then open the credential configuration:

   sudo install -d -m 0755 /etc/systemd/system/elm-server.service.d
   sudo $EDITOR /etc/systemd/system/elm-server.service.d/credentials.conf
   

   Add:

   [Service]
   LoadCredentialEncrypted=registry-auth:/etc/credstore.encrypted/elm-server-registry-auth
   

   Encrypted credentials are normally bound to the host. Generate this file on each server instead of copying it between machines.

5. Start ELM:

   sudo systemctl daemon-reload
   sudo systemctl enable --now elm-server
   sudo journalctl -u elm-server -b --no-pager
   

6. Open http://<elm-server>:8080, sign in as admin, and change the administrator password immediately.

Enable optional services

The server configuration uses role flags:

ENABLE_WEB=true
ENABLE_DB=true
ENABLE_MCP=false
ENABLE_TFTP=false
ENABLE_DHCP=false

Set ENABLE_TFTP=true and ENABLE_DHCP=true only after reviewing the DHCP_* network values. When DHCP is enabled, ELM_SERVER is required and must be a URL that target hosts can reach. See Provisioning.

The optional read-only MCP service is described in MCP server.

Restarting elm-server recreates its managed containers. Repository and database data remain in the elm_elm_data and elm_db_data Podman volumes.

Configure HTTPS

Place the certificate and key in the dedicated certificate directory, then configure:

TLS_CERT_DIR=/opt/elm/certs
TLS_CERT_FILE=/certs/tls.crt
TLS_KEY_FILE=/certs/tls.key

Restart the service:

sudo systemctl restart elm-server

ELM then serves HTTPS on APP_PORT_HTTPS (default 8443) in addition to HTTP on APP_PORT (default 8080). To move existing agents to HTTPS, set the canonical Base URL under Settings → General. Agents adopt that address at their next successful check-in.

Next steps

• Walk through the end-to-end workflow in Getting started.
• For an isolated deployment, review Air-gapped considerations.