// Offline Depot Generator Help & guide

VCF Offline Depot Generator

Configure once, get a one-shot installer that deploys an Apache or nginx offline software depot for VMware Cloud Foundation 9.x dark-site installs. Live preview updates as you type — vhost config, directory tree, verification script, systemd hardening, landing page, and a fully automated deploy script with Let's Encrypt cert handling.

VCF 9.0 / 9.1 Apache · nginx Ubuntu · RHEL · Photon Let's Encrypt Self-Signed · BYO Cert VCFDT Ready Broadcom KB 312168

Disclaimer: Generated configs follow Broadcom KB 312168 and observed VCFDT 9.1 output as of May 2026. Always verify against current Broadcom documentation before deploying to production. VirtualBytes accepts no responsibility for issues arising from depots deployed using this tool.

Configuration

Live

1Web Server

Engine

Target OS

2Endpoint

Depot FQDN

vhost name, TLS cert SAN, depot URL

HTTPS Port

VCF Version

Document Root

Must have PROD/ as immediate child

3Authentication

Basic Auth Username

Required by SDDC Manager / VCF Installer

4TLS Certificate

Cert Strategy

ACME Email

Required by certbot for expiry notices

ACME Challenge

DNS-01 required for internal-only FQDNs

ACME Server

Cloudflare API Token optional

Scoped token with Zone:DNS:Edit on the depot FQDN's zone. Installer writes to /root/.secrets/cloudflare.ini (mode 0600). Leave blank if you'll stage credentials manually.

AWS Access Key ID optional

AWS Region

AWS Secret Access Key optional

IAM user/role needs route53:ChangeResourceRecordSets on the depot's hosted zone. Installer writes to /root/.aws/credentials (mode 0600). Leave both blank if you'll stage credentials manually.

5Depot Content

VCF Lifecycle Bundles

PROD/COMP + metadata + vsan/hcl

ESXi / vLCM Image Depot

vendor-addons, components, base-images

VCF Ops & Automation

Operations, Automation, Identity

Photon TDNF Repo

Appliance patches mirror

Note: The Photon TDNF repo is what the VCF appliances (vCenter, NSX Manager, SDDC Manager, VCF Ops — all Photon-based) pull OS patches from. It is independent of your depot host OS — you can serve a Photon repo from an Ubuntu or RHEL host. Disable only if you don't plan to patch appliance OSes via this depot.

6Installer Options

Configure firewall

ufw or firewalld rules

Auto-generate htpasswd

Prompts for password at runtime

Schedule cert renewal

systemd timer for certbot

Include VCFDT setup

Stub commands for binary download

7Deploy Mode

Depot Host Connectivity

Online: depot host has internet — runs install.sh on the depot host directly, pulls packages from distro repos and certbot from Let's Encrypt.
Offline: depot host is air-gapped — run prep.sh on an internet-connected workstation (same OS) to download all packages into a tarball, transfer to the depot host, then run install.sh --offline /path/to/deps.tar.gz.

1scp install.sh root@host:/root/

2ssh root@host

3chmod +x install.sh && sudo ./install.sh

View generated output

Generated Artifacts

7 Files

DEPLOY

Run the installer as root on a fresh Ubuntu/RHEL/Photon host: sudo ./install.sh or with non-interactive password sudo DEPOT_PASS='...' ./install.sh. The script is idempotent — safe to re-run after fixing input. It installs the web server, configures TLS via certbot (or self-signed/BYO), sets up basic auth, builds the directory tree per Broadcom KB 312168, drops a landing page, schedules cert renewal, runs a smoke test, and prints a ready-to-paste depot URL for SDDC Manager. Use the embedded --uninstall flag to remove configs while preserving data.

Copied