Flash, boot, claim — provisioned in minutes
One golden image for every site. Mint a token in the console, flash the CM4, boot the box, and claim it right from its own setup page. No per-device builds, no SD-card surgery.
Five steps, no command line.
From clicking “Add Probe” to a box serving your LAN — anyone on the team can do it.
On the Edge page, click Add Probe. We mint a one-time, tenant-bound token and hand you a tiny claim.json — checked against your plan's Probe limit.
Write the single OrbIPAM image to your CM4 with Raspberry Pi Imager or balenaEtcher. One image for every site — nothing per-device to build.
Power on the CM4. With no token yet, it comes up unclaimed and serves its own Provisioning Page on the LAN.
Open http://<orbiclient-ip> in a browser on the same network and drop in your claim.json. The box redeems the token and registers to your tenant.
It appears in your Edge page under Pending. Pick the site it serves — and it's live: DNS, DHCP, PKI, and edge tools, all from one box.
Flash the CM4 with the golden image.
The same OrbIPAM image works on any Raspberry Pi Compute Module 4 carrier. Write it once; the box figures out the rest.
Grab the OrbIPAM image (.img.xz) from the console — the same file for every appliance.
Raspberry Pi Imager (recommended) or balenaEtcher. Both are free, on macOS / Windows / Linux.
Put the carrier board in USB-boot / eMMC mode (rpiboot) so the module shows up as a drive — or flash the microSD if your carrier uses one.
Raspberry Pi Imager → Choose OS → Use custom → select the .img.xz → Choose storage (the CM4 / SD) → Write. (balenaEtcher: Flash from file → Select target → Flash.)
Eject, seat the module on its carrier, connect network + power, and power on. First boot brings up the Provisioning Page.
Tip: in Raspberry Pi Imager, the OrbIPAM image is a “custom” image — no OS customization needed. Identity is added later by uploading your claim.json.
What's in the golden image.
Hardened OS + the Probe agent
Debian (Bookworm) tuned for the edge, with the agent installed as a service, auto-starting and self-healing on boot.
Edge PKI + step-ca, ready to enroll
The device generates its own edge CA on first claim and pulls your tenant's root CA — devices trust it, block pages go green, no manual cert work.
DNS, DHCP + the :443 block page
dnsmasq + the trusted block-page server are pre-wired; the box starts serving the LAN as soon as it's claimed and assigned a site.
All tool dependencies baked in
tcpdump, traceroute, scapy, step/step-ca — every Network Tool works out of the box, no post-flash installs.
No identity baked in
The image is generic and identical everywhere. The only per-device thing is the claim.json you upload — so one image safely fits every customer.
Auto-updates, no re-flash
Once claimed, the agent stays current over its mTLS channel: new tools and fixes land without ever touching the SD card again.