> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/one-host.md). # Quick start — one host Stand up a complete OpenIAM deployment on one host in an afternoon — the shortest path from a bare Enterprise Linux server to a console you can sign in to. This is the shortest supported path to a working OpenIAM deployment: one Enterprise Linux host, the bundled database, and the console open in a browser at the end of it. **It is the same procedure as the full route, with the decisions made for you.** Every command here comes from the pages it links to, and each step names the page that explains it. When something does not match, the linked page is the authority — this one is the fast lane, not a second version of the truth. **Take this route for an evaluation, a demonstration, or a development environment.** For production, work through [*Choose your route*](/installation/choose-your-route.md) instead: the decisions this page makes for you — bundled database, HTTP, a single host — are the ones a production deployment needs to make deliberately. ## What this builds, and how long it takes
You getOne host running the complete platform — application services, database, message broker, cache, graph and search tiers — with the console reachable
TimeTwo to three hours, of which about twenty minutes needs you at the keyboard
HostsOne
DowntimeOne host restart, scheduled by the installation
ReversibleRebuild the host. The package can be removed, but configuration, the service account and host settings remain
## Before you start **One host, provisioned and reachable:**
Operating systemEnterprise Linux 9 or 10
Memory48 GB
Disk on /80 GB free
SwapOff
Accessroot, or full sudo
Outbound HTTPSTo download.openiam.com. Without it, follow Obtain the software first and stage the components by hand
Those are the non-production figures from [*What you need*](/installation/what-you-need.md). Production is higher, and the installation checks against whichever environment you select in step 3. **Set aside about an hour of unattended run time.** Most of it is the initialisation building each tier. ## Set these first {% code overflow="wrap" %} ```bash export OPENIAM_VERSION= export OPENIAM_URL= ``` {% endcode %} *** ## Build it ### 1. Check the host — 5 minutes {% code overflow="wrap" %} ```bash grep -o 'platform:el[0-9]*' /etc/os-release free -g | awk '/^Mem:/ {print $2" GB memory"}' df -h / | awk 'NR==2 {print $4" free on /"}' swapon --show hostname -f timedatectl show -p NTPSynchronized --value ``` {% endcode %} **Expected:** `platform:el9` or `platform:el10`, 48 GB or more, 80 GB or more free, **no output from `swapon`**, a fully qualified hostname, and `yes` for the clock. Swap must be off. If a device is listed: {% code overflow="wrap" %} ```bash swapoff -a ``` {% endcode %} and remove its entry from `/etc/fstab` so it stays off across restarts. [*Prepare the host*](/installation/rpm/rpm-single-node/prepare-the-host.md) has the full check, including ports and firewall. ### 2. Install the package — 5 minutes, then a restart {% code overflow="wrap" %} ```bash dnf install -y tar yum install -y "./openiam-$OPENIAM_VERSION.noarch.x86_64.rpm" ``` {% endcode %} > **The host restarts one minute after this completes.** OpenIAM runs with raised file-descriptor limits and the package restarts the host once so they take effect. Run this inside your change window. To cancel the restart, run `shutdown -c` within that minute. After the host is back: {% code overflow="wrap" %} ```bash ulimit -Hn ``` {% endcode %} **Expected: `65536`.** ### 3. Run the initialisation — 45 to 75 minutes **Start a terminal multiplexer first.** The run takes most of an hour and a dropped SSH session ends it: {% code overflow="wrap" %} ```bash dnf install -y screen screen -S openiam-install openiam-cli init ``` {% endcode %} Detach with **Ctrl+A** then **D**; reattach with `screen -r openiam-install`. **The answers for this route**, in the order the installation asks: | It asks | Answer | | -------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Environment | `1` — non-production | | Internet access | `y` | | Install MariaDB locally? | `y`. It runs `mariadb-secure-installation`; set a root password and record it | | A username and password for each of the eight schemas, then the message broker, the cache and its watchers, then the search tier | **Type your own values at every prompt.** Each offers a default; the values you enter here become the live credentials for the life of the deployment and are written into the secret store, not a file you can edit later | | Enable TLS for the cache? | `n` for an evaluation | | Create the schemas and their accounts? | `y`, then give the database super-user name and password. It is used once and not stored | | Is this a managed database service? | `n` | | Engine, baseline version, the eight schema names, and a host and port for each schema | Accept the defaults. **The host and port are asked once per schema — eight times** | | Install the OpenIAM reverse proxy module? | `y`. This is how users reach the platform, and it opens ports 80 and 443 | | Install the Prometheus and Grafana monitoring stack? | `n` for an evaluation | **Your typing is not echoed.** The installation then prints the values back for you to confirm before it proceeds. **Treat that screen as sensitive** and do not paste it into a ticket or a chat. **While you wait:** a `CRITICAL SECTION` banner marks each point where the installation needs you; between them it runs unattended. While the graph storage tier starts, the output includes Java messages about the cluster having no nodes yet — the installation waits and continues once it reports `Cassandra is ready to use`. [*Install*](/installation/rpm/rpm-single-node/install.md) explains every answer, and covers a remote database, a separate partition, and an air-gapped host. ### 4. Record what the run gives you — 5 minutes Two things come out of the installation and cannot be re-derived: * **The secret store's unseal keys and root token.** They are what opens the store if it is ever sealed. * **The initial administrator account** for the console. Both are in the run output and in the log: {% code overflow="wrap" %} ```bash grep -iE 'unseal|root token|administrator' /usr/local/openiam/init.log ``` {% endcode %} Put them where your organisation keeps break-glass credentials. Then **treat `init.log` as sensitive** — copy it somewhere appropriate and remove it from the host. ### 5. Verify — 15 minutes **Allow up to 15 minutes for a cold start** before you judge the result. The application services wait for the infrastructure tier, so a check run the moment the installation finishes will show services still coming up. {% code overflow="wrap" %} ```bash openiam-cli status pgrep -c -u openiam java curl -s http://localhost:9080/openiam-esb/actuator/health | jq -r '.status' curl -s -o /dev/null -w '%{http_code}\n' "http://$OPENIAM_URL/idp/login" ``` {% endcode %} **Expected:** every service listed by `status`, twenty or more Java processes, `UP` from the service bus, and `200` or a `30x` from the sign-in page. **This is a smoke test.** [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md) is the real verification — it checks each infrastructure tier and each interface individually, and its output is what you keep with your build record. ### 6. First sign-in — 15 minutes Open the console: {% code overflow="wrap" %} ``` http://$OPENIAM_URL/webconsole ``` {% endcode %} **Arrive on the name you intend to publish**, not on an IP address — the setup sequence pre-fills the next step from the address you came in on. Sign in with the initial administrator account from step 4. The console then walks you through three things: 1. **Change the administrator password.** Record it in your password manager. 2. **Create the first content provider** — the address OpenIAM answers on. For this route: | Field | Value | | -------------------------------- | -------------------------------------------------------------------------------------- | | **Content Provider Name** | `default` | | **Domain Pattern** | Your `OPENIAM_URL`, without a scheme or a path | | **Authentication Cookie Domain** | The same name, or a parent domain of it | | **Application supports SSL?** | `No` while you are serving HTTP end to end. Set it to `Yes` the moment TLS is in front | | **Application Servers** | `http://localhost:8080` | 3. **Set your challenge questions.** Then **allow about five minutes** for the platform to refresh its caches. Sign out and sign back in: you should arrive at the console rather than the setup sequence. [*First sign-in*](/installation/rpm/rpm-single-node/first-sign-in.md) explains each field and what to do when one is rejected. *** ## Verify it One pass over the finished deployment: {% code overflow="wrap" %} ```bash echo "== package"; rpm -q openiam echo "== marker"; ls /usr/local/openiam/initialized echo "== services"; pgrep -c -u openiam java echo "== bus"; curl -s http://localhost:9080/openiam-esb/actuator/health | jq -r '.status' echo "== console"; curl -s -o /dev/null -w '%{http_code}\n' "http://$OPENIAM_URL/webconsole" echo "== self"; curl -s -o /dev/null -w '%{http_code}\n' "http://$OPENIAM_URL/selfservice" ``` {% endcode %} Keep the output with your build record. ## If it goes wrong | What you see | What it means | What to do | | -------------------------------------------------------- | ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------- | | A message that free disk space or available RAM is short | The host is below the requirement for the environment you selected | Provision to [*What you need*](/installation/what-you-need.md) and run again | | `Disable the swap and run openiam-cli init again` | A swap device is active | `swapoff -a`, remove the `/etc/fstab` entry, run again | | `OpenIAM is already initialized` | This host has been initialised before | Reinstall the package for a clean host | | Services still restarting 15 minutes after the run | Usually still starting | Give it the full 15 minutes, then [*Troubleshoot*](/installation/rpm/rpm-single-node/troubleshoot.md) | | `Service Not Available` in the browser | The proxy cannot reach the interface router | [*Configure the reverse proxy*](/installation/rpm/rpm-single-node/configure-the-reverse-proxy.md) | | The setup sequence returns after you complete it | The cache refresh has not finished | Wait five minutes and sign in again | [*Troubleshoot*](/installation/rpm/rpm-single-node/troubleshoot.md) maps start-up and runtime symptoms to causes. ## What this procedure does not cover * **TLS.** This route leaves the deployment on HTTP. [*Enable HTTPS*](/installation/rpm/rpm-single-node/enable-https.md) is the next step for anything beyond a first look, and the content provider's **Application supports SSL?** answer changes with it. * **A database on your own server.** This route installs the bundled MariaDB. See [*Use a remote database*](/installation/rpm/rpm-single-node/use-a-remote-database.md). * **A separate partition.** This route installs into `/usr/local/openiam` on the root filesystem. If your capacity is elsewhere, decide before the initialisation — [*Install on a separate partition*](/installation/rpm/rpm-single-node/separate-partition.md). * **An air-gapped host.** [*Obtain the software*](/installation/obtain-the-software.md) covers staging the components by hand. * **Redundancy.** One host is one failure domain. [*Scope and availability*](/installation/scope-and-availability.md) states what each shape does and does not protect against. * **Backup.** Nothing here is backed up until you set it up — [*Back up and restore*](/installation/rpm/rpm-single-node/back-up-and-restore.md). * **Tuning and application configuration.** Default sizing, and no managed systems, roles or policies. See [Configuration tuning reference](/installation/tuning.md) and the [Administration Guide](/administration-guide/admin.md). ## Related * [*Choose your route*](/installation/choose-your-route.md) — the full set of routes, for a production build * [*Quick start — Kubernetes*](/installation/cluster.md) * [*Enable HTTPS*](/installation/rpm/rpm-single-node/enable-https.md) — the next step * [*Configure*](/installation/rpm/rpm-single-node/configure.md) — what to review now the console works * [*Ports*](/installation/rpm/rpm-single-node/ports.md) *Applies to OpenIAM 2026.8.1.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/installation/one-host.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.