Onboard a worker

Bring a worker online with auto-provisioning. You bake only your gateway key into the golden image and boot the box — it self-registers on the provider automatically, with its IP detected for you. No worker id to mint, copy, or bake. Onboarding is permissionless; you keep the machine and engy only gets a management SSH channel into the image. The same image serves both confidential (TEE) and regular GPU boxes — engy detects which at verification.

Flow at a glance

Prerequisites

• A hotkey that has claimed a gateway credential (your miner key) — do it under Gateway key first. All your workers are attributed to, and verified against, that same key.
• A GPU host able to run the engy golden serve image and reach the provider over HTTPS. A confidential-computing host (Intel TDX / AMD SEV-SNP CPU + NVIDIA GPU-CC) gets a hardware attestation; a regular GPU box is verified by engy over SSH instead.

Step 1 — Build & boot the golden image

Pull the engy golden serve image:

Boot it with only your gateway key in its environment:

That is the only value you bake. The provider URL is already baked into the image per environment, and you do not set a worker id or a model at boot — the worker id is assigned by the provider and the model is chosen later, in the dashboard (step 3).

The image authorises onlyengy's baked management SSH key; any host-injected key is ignored — engy, not the host, owns that channel.

Step 2 — Self-register (automatic)

On boot the image registers the box with the provider — sending its hardware signature, your gateway key, and its GPU. engy records the request's source IP as the box's reachable address (so a box behind NAT need not know its own public IP). Your server then appears on the Servers page at status booted, with its IP shown. Nothing to copy or paste. A reboot re-registers the same server (keyed by its hardware signature), so it is never duplicated.

Step 3 — Declare the model + SSH port

Open the server (click its id). Once it is booted, a Register endpoint form appears:

• model — pick from the dropdown (the models engy serves).
• ssh port — the port engy's runner reaches over SSH. The host is pre-filled from the IP recorded at self-register; override it only if engy should reach the box at a different address.

Submit → the worker moves to declared and the runner picks it up.

Steps 4 & 5 — Verification & activation (engy)

engy's runner drives declared → reachable → verifying → verified automatically. It reaches the box over the management SSH channel and verifies it — a hardware enclave attestation on a TEE box, or an SSH reach + baked-key identity check on a regular GPU box. At verified engy brings serving up and activates it → provisioned, live and serving.

Managing your workers

• Retry — a failed/stuck worker isn't auto-retried; click retry to re-run onboarding with the same endpoint.
• Fix a mistake — if onboarding failed on a wrong SSH port or model, open the worker and use Update endpoint to correct the values and re-drive (the form is pre-filled).
• Delete / clean up — delete (with confirmation) any non-active worker to remove it from your list. It's a soft-delete; an active worker can't be deleted this way.

Status reference

Troubleshooting

• Not appearing on the board — the boot self-register didn't reach the provider. Check the container actually received ENGY_MINER_KEY, the box has a GPU, and it can reach the provider over HTTPS.
• failed — read the reason on the worker's page. Common causes: the SSH port isn't reachable from engy, a wrong gateway key, or (on a TEE box) missing CC evidence. Correct via Update endpoint and re-drive, or retry.