Skip to content
ChurchillChurchillChurchill

Quick start

This page is a short orientation, not the full procedure. It lays out the fastest path from a fresh account to your first protected application, and links to the detail page for each step. You are done when the application shows running on Protected apps and its host reports healthy in Fleet.

Work through the steps in order.

From zero to protected

Section titled “From zero to protected”

  1. Sign in to the console. Use your operator identity and password, or select Use security key if you have a passkey registered. See Signing in.

  2. On a fresh tenant, stand up your CAB first. The first time the owner signs in, the console walks you through the CAB ceremony before anything else opens. Invite at least two members. Each member creates a passkey from their invitation and approves the genesis baseline, then the baseline seals. Application registration stays gated until it does. See Setting up your CAB.

  3. Start the Register application wizard. Open Protected apps and select + Register application. Confirm the tenant, environment, and CIDR scope, then select Issue provisioning code. The code is one-time and expires after 15 minutes by default. See Provisioning codes.

  4. Run chrlctl on the host. chrlctl is the Churchill Host CLI. The wizard’s connect step gives you the commands: download chrlctl for your architecture, verify its hash, and run sudo ./chrlctl register --code chrl1-aeabky-3iovzg-…-osa6d4 with your code pasted in whole. On a terminal it walks you through the application to protect, the paths to monitor, and whether to record interactive logins, and registers nothing until you confirm the summary. The host then pairs outbound, and the wizard advances on its own while chrlctl uploads the configuration. See Running chrlctl.

  5. Review and submit. Check the discovered binary path, unit, and hashes. Give the application a name. Then submit. This stages a change request for your CAB. Nothing deploys yet. See Registering an application.

  6. Get CAB approval and publish. CAB members approve the change request with their passkeys. Once quorum is reached, publish the change from its detail view. The host picks up the signed bundle on its next poll and protection starts. See Approvals and quorum.

  7. Confirm in the console. The host appears in Fleet and reports heartbeats, and the application’s lifecycle chip reads running on Protected apps. See Fleet and Verifying enrollment.