Enrollment
Enrollment
Create and manage enrollment groups for tactical devices.
Follow these steps to enroll devices into a group.
Parent trust
Reading this Vardar node identity…
Tactical server group
Each listed field node keeps local operation, but can receive a signed Central Server settings override.
Connect this Vardar to a parent node
No operator password is exchanged. Create a public request here, let the chosen parent sign it, then paste the signed response back. This also works without internet.
Parent / child relationship
Reading node identity…
Policy
Configure device settings, applications and security for the selected enrollment group.
Settings
Node identity, parent trust and protected operator access.
Connect Vardar automatically
Create a one-node code in parent Admin, then paste it here. Vardar retrieves, verifies and installs the certificate automatically. Your local private keys and the parent's Admin password are never transferred.
Approve a local node from this parent
The code approves one server and expires after 10 minutes. Optionally bind it to the local node ID shown above on that server.
Set up this browser once
Download the private setup package, extract it and run setup-browser.ps1 on Windows or setup-firefox.sh on Ubuntu. The helper imports the local browser certificates for your user; you choose the Admin password in Vardar. Keep the package private.
DOWNLOAD BROWSER SETUPVardar for a USB drive
Download, extract onto a USB drive and install on a new Ubuntu 24.04 LTS amd64 machine without internet. Ubuntu uses the actual local network. The new Vardar generates its own keys, certificates and Admin access; existing accounts and cloud credentials are excluded.
Includes Vardar, DPC and USB support. TAK and QUIC services are not included. Parent trust is connected afterwards through Enrollment → Parent trust, using the public parent information in the ZIP.
DOWNLOAD VARDAR ZIPVerify release signature
Compare this public-key fingerprint before installation. The installer verifies the signed file inventory. Use the existing update procedure for a node already installed.
Vardar station
Chain of trust
Connect or change a parent through the signed request flow in Enrollment → Parent trust. A parent is not configured with a password.
Internet rendezvous
Used only after every local Vardar address has failed. The parent returns a short-lived endpoint signed by this Tactical server; it never receives device credentials.
Protected operator access
Admin requires a verified browser client certificate and password. Group accounts are restricted to their assigned group. Passwords are stored as protected verifiers.
Key rotation and reset
Role-key rotation and node reset are not one-click operations. They require a signed successor bundle, parent approval and field-node re-enrollment or trust migration.
Key control
Control StrongBox device identities and service access. Actions are queued to every selected device and remain pending until confirmed.
Policy signing key
Reading protected key state…
Policy-signing rotation remains blocked until a DPC trust-key transition is deployed. This prevents enrolled phones from being locked out.
Rotate StrongBox identities
Rotating destroys the existing private key on each phone, revokes its Vardar service tokens, generates a fresh StrongBox key pair and re-attests it to Vardar. Offline phones stay pending.
External TAK/QUIC certificate revocation remains the responsibility of the respective service server until Vardar CRL distribution is enabled.
Revoke issued service tokens
Immediately invalidates current Vardar service tokens. Trusted devices receive a fresh token on their next synchronization.
StrongBox key status
Revoke destroys the identity on the selected phone and leaves it blocked until you issue a later rotation. Rotate replaces it automatically.
Reading enrolled devices…
Other apps
Manage additional applications for the selected enrollment group. Upload, version and distribute APK files.
Upload and manage additional APK files. Assigned apps will be installed on devices in the selected enrollment group.
Application inventory
Loading APK inventory…
Network
APN and VPN
One address or URL per line. These are tried only after Vardar’s currently detected LAN address. Each endpoint must prove the pinned Vardar identity before the DPC sends credentials.
PTT
TAK
Node-wide application and server configuration · profile-specific map delivery
Map upload
Add maps to the selected profile. All devices in this profile receive them automatically when Ethernet or Wi-Fi can reach Vardar on the LAN. Follow transfer progress under Devices.
No maps registered yet.
Maps marked IN PROFILE are delivered automatically to current and newly enrolled devices in this profile. Check each device's chart and MB counter under Devices.
Devices
Manage enrolled devices, monitor trust state, and control device lifecycle.