Install the Mili Management Server
The central console for your Mili fleet — onboarding, heartbeats, policies and the features that need it. Runs on macOS or Linux.
Overview
The Mili Management Server (the “console”) manages many Mili agents from one place: onboarding, heartbeats, policies and persona/guard-rail overlays, session review, and the inter-agent activity graph.
mili-mgmt) — Docker Desktop is not required. On Linux it uses the host’s Docker. Its engine is independent of an agent’s, so an agent and the console can share one Mac.What the Management Server unlocks
Several agent features depend on the Management Server. Once an agent calls home to a console, these become available across your fleet:
Hardware requirements
The console is a lightweight Flask application plus a self-upgrade supervisor — far lighter than an agent.
| Component | Minimum | Recommended |
|---|---|---|
| Operating system | macOS 13+ · Linux x86-64 / arm64 (64-bit) | — |
| Memory (RAM) | 4 GB | 8 GB |
| CPU | 2 cores | 4 cores |
| Free disk | 20 GB | 40 GB |
MGMT_ENGINE_CPUS, MGMT_ENGINE_MEMORY and MGMT_ENGINE_DISK.Ports & network
Agents reach the console on port 8080. For production, front that port with TLS so call-home runs over HTTPS (see SSL below).
| Port | Direction | Purpose |
|---|---|---|
8080 | Inbound | Console dashboard, and the endpoint agents call home to (http://localhost:8080) |
443 | Inbound (optional) | Dedicated HTTPS for the Microsoft Office add-in — active only when Office integration is enabled and TLS is configured |
Install the server
Linux
Run as root. We strongly recommend generating a strong shared secret at install time:
$ MGMT_SECRET=$(openssl rand -hex 32) \
bash -c "$(curl -fsSL https://www.mili.quebec/downloads/mgmt/install.sh)"
Or the plain one-liner (the installer mints a strong secret if you don’t supply one):
Installs to /opt/mili-mgmt and uses the host’s Docker.
macOS
Run without sudo (the console engine is per-user):
bash -c "$(curl -fsSL https://www.mili.quebec/downloads/mgmt/install.sh)"
Installs to /Users/<you>/mili-mgmt. The first start builds the mili-mgmt engine VM and takes a few minutes.
http://localhost:8080.The shared secret (MGMT_SECRET)
MGMT_SECRET is the fleet-wide key that every agent uses to authenticate its call-home. The installer prints it and persists it in .env (readable only by the owner). Keep it safe — agents you enrol from this console are keyed to it.
openssl rand -hex 32. Anyone holding this secret can enrol agents into your fleet.
First sign-in
Open http://localhost:8080. On first run the console shows a setup wizard — create the administrator account (username defaults to admin, password at least 12 characters) and enrol a TOTP second factor. There is no hard-coded default password.
SSL / TLS
The console serves its dashboard on port 8080. For agents to call home over HTTPS in production, either enable TLS on the console (upload a certificate or let it generate a self-signed one) or terminate TLS at a reverse proxy in front of it — the console honours X-Forwarded-Proto.
Enrol your agents
On each Mili agent, open Settings → Call Home and enter this console’s URL and the shared secret. Within a heartbeat interval the agent appears on the dashboard. See the agent guide → Connect to a server.
Troubleshooting
| Symptom | What to do |
|---|---|
| Server won’t start after install | Check .env holds a real MGMT_SECRET (not a placeholder). Regenerate with openssl rand -hex 32 and re-run. |
| macOS: “must run as the logged-in user” | Re-run without sudo. |
| Agents don’t appear on the dashboard | Confirm each agent’s Call Home URL and shared secret match this console, and that it can reach port 8080. |
Data & backup
All runtime state — agent registrations, vault keys, encrypted secrets, conversations, memory and sessions — lives in a Docker named volume, mgmt_data. A re-install never wipes it. On macOS the volume lives inside the engine VM, so take a backup from Settings → Backup before removing the engine.