Getting Started
Set up the DEC-1 for the first time
This guide walks you through setting up VaultDEC DEC-1 for the first time.
What You'll Need
- VaultDEC DEC-1 unit (NanoPi R6S with pre-flashed firmware)
- 2× Ethernet cables for the data plane (connecting router to protected server)
- 1× Ethernet cable for the management port (connecting to your management network)
- USB-C power supply (5V/9V/12V/20V, 65W recommended for full load)
- A laptop or workstation on the management network for initial configuration
Overview
VaultDEC has three physical network ports:
| Port | Speed | Role |
|---|---|---|
| WAN | 2.5 GbE | Connects to your router / internet |
| LAN | 2.5 GbE | Connects to your protected server |
| MGMT | 1 GbE | Management access (separate network) |
The WAN and LAN ports form an invisible bridge. Traffic passes through transparently — your protected server's network configuration doesn't change at all.
The MGMT port is on a completely separate network. This is where you access the dashboard and where the heartbeat signal originates.
Setup Steps
1. Physical Installation
Connect the cables in this order:
- LAN port → Protected server (e.g., your backup server)
- WAN port → Router (internet-facing connection)
- MGMT port → Management switch (your internal admin network, NOT your production network)
- USB-C power — the unit boots automatically
2. Verify Bridge Operation
Once powered on, your protected server should maintain its existing network connection as if VaultDEC wasn't there. Test by confirming the server can still reach the internet and download from its backup source (e.g., Cloudflare R2).
3. Access the Dashboard
VaultDEC's dashboard is not always running. It's an ephemeral interface that you enable on demand via SSH.
From your laptop on the management network:
ssh vaultdec@<mgmt-ip> enable-dashboard 30mThis opens the web dashboard for 30 minutes, after which it automatically closes. Navigate to http://<mgmt-ip>:8080 in your browser.
4. Configure Detection
In the dashboard, set your:
- Detection Mode — STANDARD, STRICT, or VAULT (see Detection Modes)
- Action Mode — LIVE (real kills), AUDIT (log only), or TEST (testing)
- Protected Device MAC — The MAC address of the server you're protecting
5. Verify Monitoring
The dashboard shows real-time upload and download speeds for your protected device. During normal operation, you should see download traffic (your server pulling from R2) and minimal upload traffic.
Next Steps
- Installation — Detailed physical installation guide
- Network Setup — Network topology and management network configuration
- Detection Modes — Understanding STANDARD, STRICT, and VAULT