MiliMili
DOWNLOAD CONTACT
FREN
SOLUTIONSARCHITECTUREABOUTFAQSUPPORTPARTNERSBLOGDOWNLOADCONTACT
FREN
Documentation / Management Server

Install the Mili Management Server

The central console for your Mili fleet: admission, heartbeats, policies and the features that need it. Runs on macOS or Linux.

Overview

The Mili Management Server (the console) manages many Mili agents from one place: admission of new agents, heartbeats, policies and persona/guard-rail overlays, session review and the inter-agent activity graph.

macOS and Linux only. On macOS the console runs its own dedicated engine (a Colima profile named mili-mgmt); Docker Desktop is not required. On Linux it uses the host’s Docker. Its engine is independent of an agent’s, so an agent and the console can share one Mac. The console interface is in English.

What the Management Server unlocks

Several agent features depend on the Management Server. Once an agent calls home to a console and is accepted, these become available across your fleet:

Single sign-on (SSO)
Google Workspace, Microsoft Entra, Okta or generic OIDC. Sign-in is brokered by the console (OAuth 2.1 with PKCE).
Inbound MCP server with OAuth
Expose an agent as an MCP server that other clients connect to, with OAuth authorization served by the console.
Team chat bots
Connect the agent to Slack, Microsoft Teams and Telegram channels, managed centrally.
Org-wide policies and overlays
Push governance policies and a read-only corporate persona / guard-rail block to every agent.
Central fleet management
Contact book, memory library, task library, sessions and a full audit trail for every agent, from one dashboard.
Microsoft Office add-in
Serve the Word add-in over HTTPS on port 443 when Office integration is enabled.
Throughout this documentation, features that need the console are marked with a Requires Management Server badge.

Hardware requirements

The console is a lightweight Flask application plus a self-upgrade supervisor, far lighter than an agent.

ComponentMinimumRecommended
Operating systemmacOS 13+ · Linux x86-64 / arm64 (64-bit)—
Memory (RAM)8 GB16 GB
CPU2 cores4 cores
Free disk200 GB200 GB or more
On macOS the console engine is provisioned 2 CPU / 4 GB RAM / 200 GB disk by default. The CPU and memory are enough for a large fleet and leave most of a shared Mac free; the disk is deliberately generous because the engine VM's disk is sized once, when it is created, and cannot be grown afterwards without recreating the VM. It is sparse, so it only consumes what the console has actually stored. Override with MGMT_ENGINE_CPUS, MGMT_ENGINE_MEMORY and MGMT_ENGINE_DISK.

Ports and network

Agents reach the console on port 8080. The console serves that port over HTTPS from first start, using a self-signed certificate it generates itself.

PortDirectionPurpose
8080InboundConsole dashboard, and the endpoint agents call home to (https://localhost:8080)
443Inbound (optional)Dedicated HTTPS for the Microsoft Office add-in, active only when Office integration is enabled

Install the server

LinuxmacOS

Linux

Run as root. We strongly recommend generating a strong shared secret at install time:

# recommended: generate and set the fleet secret
$ MGMT_SECRET=$(openssl rand -hex 32) \
    bash -c "$(curl -fsSL https://www.mili.quebec/downloads/mgmt/install.sh)"

Or the plain one-liner (the installer mints a strong secret if you do not supply one):

$ curl -fsSL https://www.mili.quebec/downloads/mgmt/install.sh | sudo bash

Installs to /opt/mili-mgmt and uses the host’s Docker.

macOS

Run without sudo (the console engine is per-user):

$ MGMT_SECRET=$(openssl rand -hex 32) \
    bash -c "$(curl -fsSL https://www.mili.quebec/downloads/mgmt/install.sh)"

Installs to /Users/<you>/mili-mgmt. The first start builds the mili-mgmt engine VM and takes a few minutes.

When the installer finishes, the console is running at https://localhost:8080. Because it uses a self-signed certificate, your browser shows the same “connection isn’t private” warning as the agent does; click Advanced, then Proceed.

The shared secret (MGMT_SECRET)

MGMT_SECRET is the fleet-wide HMAC key every agent uses to authenticate its call-home. The installer prints it and persists it in .env (readable only by the owner). You can show it again at any time under Settings, then Call-Home Secret, which is also where a key rotation is started: a new primary secret is issued while the previous one stays valid as secondary until every agent has moved over.

Settings, Call-Home Secret: the fleet secret, the secondary secret and key rotation.
Settings, Call-Home Secret: the fleet secret, the secondary secret and key rotation.
The server refuses to start on a well-known placeholder secret. Always use a strong random value (openssl rand -hex 32). Anyone holding this secret can present an agent to your console for admission.

First sign-in

Open https://localhost:8080. On first run the console shows the same three-step wizard as the agent: create the administrator account (username defaults to admin, password at least 12 characters), scan the QR code in an authenticator app and confirm with a 6-digit code. There is no hard-coded default password.

First run: create the console administrator account.
First run: create the console administrator account.
Second step: enrol the authenticator (TOTP).
Second step: enrol the authenticator (TOTP).
Console sign-in: username, password and authenticator code.
Console sign-in: username, password and authenticator code.

SSL / TLS

The console generates a self-signed certificate at first start and serves port 8080 over HTTPS. To replace it with a certificate issued by your CA, open Settings, then SSL / TLS, and upload the certificate (.crt/.pem) and private key (.key/.pem). A restart is required afterwards. If you prefer to terminate TLS at a reverse proxy, the console honours X-Forwarded-Proto.

Settings, SSL / TLS: the auto-generated certificate and the upload controls.
Settings, SSL / TLS: the auto-generated certificate and the upload controls.
Port 443 is a separate listener used only for the Microsoft Office (Word) add-in, and only when Office integration is enabled. It is not needed for normal agent management.

Enrol your agents

On each Mili agent, open Settings, then Callhome, enter this console’s URL and the shared secret, save and restart the agent. See the agent guide, Connect to a server. Within a heartbeat interval the agent appears on the console dashboard under Pending approval. Click Accept to admit it to the fleet (or Reject).

A new agent waiting under Pending approval.
A new agent waiting under Pending approval.

Once accepted, the agent shows as online with its host, platform and version, and the fleet version bar tracks upgrades across agents.

The dashboard with an accepted, online agent.
The dashboard with an accepted, online agent.

Troubleshooting

SymptomWhat to do
Server will not start after installCheck .env holds a real MGMT_SECRET (not a placeholder). Regenerate with openssl rand -hex 32 and re-run.
macOS: “must run as the logged-in user”Re-run without sudo.
Agent never appears under Pending approvalIts call-home is being rejected: confirm the agent’s Callhome secret matches the console’s Call-Home Secret page, that it can reach port 8080, and that the agent was restarted after the change.

Data and backup

All runtime state (agent registrations, vault keys, encrypted secrets, conversations, memory and sessions) lives in a Docker named volume, mgmt_data. A re-install never wipes it. On macOS the volume lives inside the engine VM, so take a backup from Settings, then Server Backup and Restore, before removing the engine.