Enrollment
Enrollment
Create and manage enrollment groups for tactical devices.
Follow these steps to enroll devices into a group.
Parent trust
Reading this Vardar node identity…
Tactical server group
Each listed field node keeps local operation, but can receive a signed Central Server settings override.
Connect this Vardar to a parent node
No operator password is exchanged. Create a public request here, let the chosen parent sign it, then paste the signed response back. This also works without internet.
Parent / child relationship
Reading node identity…
Policy
Configure device settings, applications and security for the selected enrollment group.
Settings
Node identity, parent trust and protected operator access.
Connect Vardar automatically
Create a one-node code in parent Admin, then paste it here. Vardar retrieves, verifies and installs the certificate automatically. Your local private keys and the parent's Admin password are never transferred.
Approve a local node from this parent
The code approves one server and expires after 10 minutes. Optionally bind it to the local node ID shown above on that server.
Set up this browser once
Download the private setup package, extract it and run setup-browser.ps1 on Windows or setup-firefox.sh on Ubuntu. The helper imports the local browser certificates for your user; you choose the Admin password in Vardar. Keep the package private.
DOWNLOAD BROWSER SETUPVardar for a USB drive
Download, extract onto a USB drive and install on a new Ubuntu 24.04 LTS amd64 machine without internet. Ubuntu uses the actual local network. The new Vardar generates its own keys, certificates and Admin access; existing accounts and cloud credentials are excluded.
Includes Vardar, DPC and USB support. TAK and QUIC services are not included. Parent trust is connected afterwards through Enrollment → Parent trust, using the public parent information in the ZIP.
DOWNLOAD VARDAR ZIPVerify release signature
Compare this public-key fingerprint before installation. The installer verifies the signed file inventory. Use the existing update procedure for a node already installed.
Vardar station
Chain of trust
Connect or change a parent through the signed request flow in Enrollment → Parent trust. A parent is not configured with a password.
Protected operator access
Admin requires a verified browser client certificate and password. Group accounts are restricted to their assigned group. Passwords are stored as protected verifiers.
Key rotation and reset
Role-key rotation and node reset are not one-click operations. They require a signed successor bundle, parent approval and field-node re-enrollment or trust migration.
Other apps
Manage additional applications for the selected enrollment group. Upload, version and distribute APK files.
Upload and manage additional APK files. Assigned apps will be installed on devices in the selected enrollment group.
Application inventory
Loading APK inventory…
Network
APN and VPN
One address or URL per line. These are tried only after Vardar’s currently detected LAN address. Each endpoint must prove the pinned Vardar identity before the DPC sends credentials.
PTT
TAK
Node-wide application and server configuration · profile-specific map delivery
Map upload
Add maps to the selected profile. All devices in this profile receive them automatically when Ethernet or Wi-Fi can reach Vardar on the LAN. Follow transfer progress under Devices.
No maps registered yet.
Maps marked IN PROFILE are delivered automatically to current and newly enrolled devices in this profile. Check each device's chart and MB counter under Devices.
Devices
Manage enrolled devices, monitor trust state, and control device lifecycle.