MCM Platform — 3-Tier Deployment Guide

About this architecture

The 3-tier orchestrated deployment is the recommended architecture for production environments. It separates services by role into three distinct tiers to strengthen security isolation and optimize system performance:

• Tier 1: Access Node (VM1): Hosts the gateway interface. This is the only node exposed to public traffic.
• Tier 2: App Node (VM2): Hosts the core backend microservices and the User Interface (UI).
• Tier 3: DB Node (VM3): Hosts the storage layers.

3-Tier Network Architecture

1. Prerequisites & VM Specifications

Ensure that your physical, virtual (on-premises), or cloud virtual machines meet the following minimum configuration requirements:

Baseline Network Prerequisites

The 3-tier architecture requires the following network conditions:

• VM1 (Access Node): Must be reachable by end users — either via a public IP, VPN, or internal corporate network.
• VM2 (App Node) & VM3 (DB Node): Must have private IP connectivity to VM1 and to each other. These nodes do not need to be reachable from outside your network.
• Outbound Internet Access:
  • All VMs: Require outbound internet access during installation to download system dependencies (Docker, packages, etc.).
  • VM2 (Runtime): Requires persistent outbound internet access because the MCM microservices connect to cloud provider APIs (AWS, Azure) for resource orchestration, inventory sync, and cost metrics.

For detailed port mappings, security groups, and domain firewall rules, see Section 2: Network & Security Requirements.

2. Network & Security Requirements

All three VMs must be placed within a network where they can route traffic to each other using private IPs. A single subnet (or separate subnets for strict tiering) can be used depending on your network topology.

Example IP layout (using 10.0.0.0/16):

• Subnet 1 (10.0.1.0/24) — Hosts VM1 (mcm-access).
• Subnet 2 (10.0.2.0/24) — Hosts VM2 (mcm-app).
• Subnet 3 (10.0.3.0/24) — Hosts VM3 (mcm-db).

On-Premises & Private Cloud Setup

If you are deploying on physical servers or a private virtualized environment:

1. VM Provisioning: Provision 3 virtual machines meeting the CPU, RAM, and Disk specifications listed in Section 1: Prerequisites & VM Specifications.
2. Network Layout & IP Assignment:
   • VM1 (mcm-access): Assign an IP address accessible by your target users (can be a public IP or a private IP if accessed via an internal corporate network, VPN, or local load balancer).
   • VM2 (mcm-app) & VM3 (mcm-db): Assign static private IP addresses. Ensure VM1, VM2, and VM3 have mutual private IP routing to communicate with each other.
3. Firewall & Egress Configuration: Configure your network firewall appliances or host-level firewalls (e.g. UFW) using the Port Requirements and Outbound Connection Requirements tables below.

Port Requirements

The following ports must be open between the VMs. Configure these in your firewall, security groups, or host-level rules (e.g., UFW) as needed:

Outbound Connection Requirements

The MCM platform requires outbound HTTPS (port 443) connectivity to the following main domains:

AWS & Azure Infrastructure Setup

If you are provisioning resources on a public cloud, navigate to the dedicated guide for your provider to set up your network, security groups, and VM instances:

• 👉 Go to the AWS Deployment Guide
• 👉 Go to the Azure Deployment Guide

Once your cloud infrastructure and VMs are provisioned, return to Section 3: Installation Procedure of this guide to complete the platform setup.

3. Installation Procedure

Pre-Deployment Checklist

Before you begin:

• Ensure that the SSH user on VM2 and VM3 belongs to the sudo group.

• Ensure SSH password authentication is enabled on VM2 and VM3 to allow key distribution.

  Run the following commands on VM2 and VM3 to configure a password and temporarily enable authentication:

  # Set a password for the SSH user (e.g. ubuntu)
  sudo passwd [VM_SSH_USER]
  
  # Enable password authentication drop-in config
  echo "PasswordAuthentication yes" | sudo tee /etc/ssh/sshd_config.d/00-mcm-temp-auth.conf
  sudo systemctl restart ssh

Download & Execute the Installer

Procedure

1. SSH into VM1 (Access Node):

   ssh [VM1_USER]@<VM1_IP>
   # or (using a private key)
   ssh -i /path/to/key.pem [VM1_USER]@<VM1_IP>

2. Download the MCM platform deployment archive: Log in to the MCM Registry portal at https://registry.mcm.revdau.ai/license using your MCM credentials.

   Navigate to the License page to view your MCM App Credentials (Username and Password) and available release versions under Download installation package:

   

   Copy the wget download command, replace <your MCM App password> with your MCM App password, and execute it on your server to download the platform deployment archive:

   wget --user="your_email@example.com" --password="your_mcm_app_password" \
     "https://registry.mcm.revdau.ai/api/mcm-app/downloads/package?version=1.1.0" -O mcm_artifacts_1.1.0.tar.gz

   (Note: Swap the version number in the URL to download a different release).

3. Extract the downloaded archive:

   tar -xzvf mcm_artifacts_1.1.0.tar.gz

4. Navigate into the installation directory, and run the installer script:

   cd mcm_artifacts
   sudo chmod +x install.sh
   sudo bash install.sh --three-tier

5. The installer will prompt for VM2 and VM3 connection details:

   • Enter VM1 IP (Access Node): Type the IP address of VM1.
   • Enter VM2 IP (App Node): Type the IP address of VM2.
   • Enter VM2 SSH Username: Type the SSH username for VM2.
   • Enter SSH Password for VM2: Type the user password for VM2.

   (The installer will repeat this for VM3.)

6. Installer Execution Tasks:

   • Configures SSH key authentication between all nodes
   • Runs pre-deployment checks (hardware, network, port connectivity)
   • Initializes the container orchestration cluster
   • Distributes configurations and container images to all nodes
   • Deploys the application stack

   If any check fails, the installer reports the exact error — fix the issue and re-run.

   Post-Deployment Warm-up: After the installer finishes, wait at least 5 minutes for all services to initialize.

Once the initialization is complete, open the application in your web browser:

Platform Activation & Onboarding

When you access the MCM platform gateway for the first time, you must activate the installation using your subscription details:

1. Retrieve Your Subscription Key

Once your purchase is approved, you will receive a subscription details email from the MCM team containing your Username (Registered Email ID) and Password/Token:

2. Activate the Subscription

Open the application URL (https://<DOMAIN_OR_IP>) in your web browser. You will be greeted by the Subscription Activation page. Enter the Username (Email ID) and Password/Token received in your email, then click Activate:

3. Create the Administrator User

Once the subscription is activated, you will be redirected to the Create User page. Enter the details for the primary platform administrator (First Name, Last Name, Email, MSP Name, and Legal Name) and click Submit:

4. Log In to the Platform

After submitting, you will be redirected to the main login portal.

For a walkthrough of the login process, managing credentials, and exploring user dashboards, please refer to the Getting Started User Guide.

4. Operations & Health Verification

You can verify the status and health of all deployed services by executing the healthcheck script (Optional) on VM1 (Access Node):

sudo bash /opt/mcm/scripts/healthcheck.sh

General Verification and Control

For verification steps, stack teardown commands, and utility control scripts (starting, stopping, restarting, or upgrading the platform components), please refer to the Helper Scripts and Commands Guide.

For custom domain configuration and SSL/TLS certificate management, please refer to the Domain and TLS Certificate Configuration Guide.

For troubleshooting configuration, certificate, or service initialization errors, refer to the Troubleshooting Guide.