Skip to main content

Set up your first Edge tenant

Updated

Set up a new client site on Edge in four steps: provision a tenant, check its gateway, review its policy, and enrol the first device.

1. Provision a tenant

  1. In the Hub, go to Edge → Tenants (/edge/tenants).
  2. Click New tenant.
  3. Enter a Display name for the site, such as Acme Dental — HQ.
  4. Choose a Region. Each option shows the city and country the concentrator runs in, so pick the one closest to the client's users. Only regions with a real point of presence are listed.
  5. Click Provision tenant.

The tenant appears in the list with the state provisioning and changes to active when it's ready. There's no plan to pick; the tenant's plan is read-only.

2. Check the gateway

Provisioning a tenant creates its concentrator. Go to Edge → Gateways (/edge/gateways) to see it. Each row shows:

  • tenant
  • region
  • health
  • egress IP
  • registered peers
  • host traffic this month
  • last seen

The page refreshes automatically. "Healthy" means more than the host answering: Edge checks that it is live and that peers have completed a handshake in the last 10 minutes. A gateway that is live but not serving peers shows as degraded.

Gateways are platform-managed. You can't rebuild one yourself, so contact The One Stack support if a gateway stays unreachable or degraded.

3. Review the tenant

Click the tenant in Tenants to open its page. Under Network you'll find:

  • Static egress IP: the address the client's traffic leaves from. Click Manage to open Static IPs. "Reputation: never checked" means exactly that: no reputation check has been run.
  • Overlay CIDR: the tunnel's internal address range, plus how many devices are enrolled. Click View peers to see them.
  • Policy: whether a policy is enforcing, and what happens if the cloud concentrator can't be reached. If this isn't set, the platform default is fail open. Click Edit policy to change it.

Under Fleet & controls are:

  • Peers (with WireGuard keys that have expired or expire within 14 days)
  • Sessions (7d)
  • Split Tunneling (bypass rules)
  • Geo-Blocking (block or allow by country)
  • Bandwidth (usage and QoS policies)
  • Device Enrollment

At the bottom of the page you can rename the tenant. The plan is read-only. Deleting a tenant asks you to type its name to confirm.

4. Enrol the first device

  1. On the tenant page, open Device Enrollment. Then click New Enrollment Link.
  2. In New Enrollment Link, fill in:
    • an optional Label, such as Marketing Team Laptops
    • Max Uses: 1 for a single device, up to 500
    • Expires In: from 24 hours to 30 days, or never. The default is 72 hours.
  3. Click Create token.
  4. Copy the token now. It is only shown once. The dialog also shows a QR code for enrolling a mobile device.
  5. Give the token to the end user. They enter it in The One Edge client app during device setup.

The token list shows uses, expiry and status for each token. While a token still has uses left, you can also download a WireGuard config file (.conf) from its row. Each download uses up one enrollment. "Unlimited (500)" really means 500. No token is truly unlimited.

When the device connects, it appears under the tenant's Peers, and its gateway starts showing peer handshakes.

Edge is software only. Devices connect with The One Edge client app; there's no on-site appliance to install.

Next