Create an account and a workspace

Create an account

An account identifies a person, not a machine. You use it to open the administration console, to create or join a workspace, then to authorize your devices. On first sign-in, VIGIL-MESH automatically creates a workspace attached to your account: you become the owner of this tenant.

1. 1
   Provide an identityProvide an email address and a password, or sign in through an identity provider if your organization offers one. The email is also used for access recovery.
2. 2
   Enable strong authenticationAdd a second factor (TOTP app or security key). The owner account governs the whole workspace: protect it first.
3. 3
   Open the consoleOnce signed in, you land in your workspace console. It gathers the device inventory, the networks, the access policies and the real-time topology. See /en/docs/console.

The workspace: your tenant

The workspace is VIGIL-MESH's unit of isolation. It is your tenant in a multi-tenant platform: your devices, your networks, your addresses, your MagicDNS names and your access policies live there, separated from those of other organizations. A device always belongs to one workspace, and only one.

• Identity perimeter: the keys and the members allowed to enroll machines are those of your workspace, not of a shared space.
• Addressing plan: the stable addresses assigned to your machines (within 100.64.0.0/10) and the MagicDNS names are specific to your tenant.
• Access policies: who can reach whom, network by network, is defined at the workspace level.
• Private vigie: if you host your own relay, it attaches to your workspace and serves it alone.

First settings

A few settings put in place from the start save rework later. Nothing is final, but naming and framing early keeps the console readable as the number of machines grows.

• Name the workspace: a clear name (team, site or project) helps you find your way if you manage several tenants.
• Invite a second administrator: so you never depend on a single account and can take turns.
• Plan your networks: a single workspace can carry several mesh networks (for example production and lab). See /en/docs/reseau-mesh to build them.
• Anticipate addressing and names: machines will receive a stable address and a MagicDNS name. See /en/docs/adressage-dns to understand the addressing plan.

Next step: enroll a machine

Once the workspace is in place, the next step is to bring your machines into it. That is enrollment: install the client on a workstation or a server, then authorize it in your tenant. Three methods exist — pre-authorized key, short-lived invitation or approval queue — depending on whether the machine is a headless server or a device operated by a person.