Production quickstart

Recommended topology

A production Axiom deployment uses three separate Ubuntu or Debian servers:

1. Management Server - Web UI, node registry, policy control plane, reputation database, licensing, and diagnostics.
2. SMB Proxy Node - inline SMB reverse proxy between clients and the real file server.
3. DNS Security Node - forwarding and caching DNS security service between clients or an internal DNS server and the configured upstream resolvers.

Use standalone_lab only for evaluation. Separate roles keep routing, capacity, and failure domains clear.

Correct installation order

1. Assign static IP addresses and working hostnames to all three servers.
2. Synchronize time on every server.
3. Install the Management Server first.
4. Sign in to Management and copy the enrollment token from Settings.
5. Install the SMB Proxy Node using the Management URL and token.
6. Install the DNS Security Node using the same Management URL and token.
7. Confirm both nodes appear under Nodes and report a recent heartbeat.
8. Configure policy, validate enforcement, and only then move production traffic.

Run the installer

Use the axiom-installer.sh file from the official release package or customer portal. Verify the checksum supplied with the release before execution.

chmod +x axiom-installer.sh
sudo ./axiom-installer.sh

When whiptail is installed, Axiom presents a terminal wizard. To force the plain CLI wizard:

sudo AXIOM_INSTALLER_CLI=1 ./axiom-installer.sh

The installer discovers NICs, writes /etc/axiom/axiom.toml, builds and installs /usr/local/bin/axiom-daemon, creates axiom.service, applies required Linux capabilities, and starts the service.

First checks

Run these commands on each server after installation:

sudo systemctl status axiom --no-pager
sudo journalctl -u axiom -n 120 -l --no-pager

On Management, open http://MANAGEMENT_IP:8443/ or https://MANAGEMENT_IP:8443/, depending on the TLS choice made during installation. Do not continue to data-plane deployment until the Web UI is reachable and the administrator can sign in.

Do not skip validation

Before production cutover, prove all of the following:

• Management can push a policy to each node on TCP 9443.
• Each node can report back to Management on TCP 8443.
• SMB clients reach the file server only through the SMB Proxy Node.
• A benign large-file transfer is counted accurately.
• A test hash marked known_bad with action Block is blocked in the client and logged in Management.
• DNS answers allowed domains, blocks an explicit test domain, serves local records, and reports upstream errors correctly.