Installation
Hardware requirements and physical setup
Hardware Requirements
VaultDEC DEC-1 Specifications
The DEC-1 is built on the NanoPi R6S platform with the RK3588S processor.
| Component | Specification |
|---|---|
| CPU | Rockchip RK3588S (4× A76 @ 2.4GHz + 4× A55 @ 1.8GHz) |
| Memory | 8GB LPDDR4X @ 2133MHz |
| Storage | 32GB eMMC (HS400) + MicroSD slot |
| Data Plane | 2× 2.5GbE RTL8125BG (PCIe bus) |
| Management | 1× 1GbE RTL8211F (native SoC) |
| USB | 1× USB 3.0 Type-A, 1× USB 2.0 Type-A |
| Power | USB-C (PD: 5V/9V/12V/20V), 65W recommended |
| Temp Range | 0°C to 70°C |
Additional Equipment
- 2× Cat6 Ethernet cables (for data plane)
- 1× Cat5e/Cat6 Ethernet cable (for management)
- USB-C PD power supply (65W recommended)
- Unmanaged switch or VLAN port for management network
Physical Setup
Port Identification
Looking at the front of the DEC-1 (NanoPi R6S):
┌────────────────────────────────┐
│ [WAN 2.5G] [LAN 2.5G] [MGMT 1G] │
│ Green LED Green LED Green LED │
└────────────────────────────────┘Each port has a dedicated status LED:
- Solid green — Link established
- Blinking green — Traffic flowing
- Off — No link
Cable Connections
Step 1: Connect the LAN port (middle 2.5G) to your protected server.
Step 2: Connect the WAN port (left 2.5G) to your router or upstream switch.
Step 3: Connect the MGMT port (right 1G) to your management network.
Important: The management port MUST be on a separate network from the data plane. Do not connect it to the same switch as your router or protected server. See Network Setup for details.
Step 4: Connect USB-C power. The unit boots automatically.
Boot Sequence
On power-up, VaultDEC goes through the following sequence:
- Hardware init (~5s) — RK3588S boot, eMMC load
- Namespace creation (~2s) — Data plane isolation established
- Bridge formation (~3s) — WAN and LAN ports bridged, ghost mode enabled
- Guardian-core start (~1s) — Packet monitoring begins
- Guardian-mgmt start (~1s) — Heartbeat begins transmitting
- System LED: solid red — System armed and monitoring
Total boot time: approximately 12 seconds from power-on to fully armed.
Verifying Installation
Bridge Transparency Test
From your protected server, verify internet connectivity:
ping 8.8.8.8
curl -I https://your-backup-source.comIf these work, the bridge is transparent and your server doesn't know VaultDEC is there.
Heartbeat Verification
If you have cloud monitoring enabled, check your VaultDEC dashboard at vaultdec.com/dashboard for the device heartbeat. Status should show ARMED.
Management Access Test
From a device on your management network:
ssh vaultdec@<mgmt-ip> enable-dashboard 15mIf the SSH connection succeeds and returns "Dashboard enabled for 15 minutes," your management plane is operational.