MCM Platform — Single VM Deployment Guide

Get MCM up and running in under 30 minutes. This guide provides the essential commands, network requirements, and validation steps for deploying the platform on a Single VM.

1. Prerequisites & VM Specifications

Ensure your target virtual machine meets the following minimum specifications:

2. Network & Connectivity Requirements

Deploying the MCM platform on a Single VM requires provisioning the underlying hosting server. The instance should be configured with the operating system and resources specified in Prerequisites & VM Specifications (Ubuntu 24.04 LTS, 8 CPU, 32 GB RAM, 150 GB Disk).

3. Firewall & Security Rules

To secure the single-node deployment, only administrative SSH and web traffic (HTTP/HTTPS) should be allowed inbound. Since the platform utilizes Docker Swarm internally, all cluster management ports (2377, 7946, 4789) must remain blocked from external inbound access to prevent unauthorized cluster probes.

Security Rule Rationale

1. Port 22 (TCP): Used for administrative SSH access to the host.
2. Port 80 (TCP): Used for standard HTTP traffic. Port 80 automatically redirects incoming requests to secure HTTPS (port 443) so users do not experience connection errors if they access the site via http://.
3. Port 443 (TCP): Used for the primary secure application gateway access.
4. Ports 1514 & 1515 (TCP): Used internally by the Wazuh Security Agent for security event monitoring, log collection (port 1514), and agent registration/enrollment (port 1515) with the Wazuh Manager container (Required when the SecOps module is enabled).

# 1. Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# 2. Allow SSH and Web traffic
sudo ufw allow 22/tcp comment "SSH Administrative Access"
sudo ufw allow 80/tcp comment "HTTP Gateway Redirection"
sudo ufw allow 443/tcp comment "HTTPS Ingress Gateway"

# 3. Allow SecOps Wazuh Agent ports (Optional - Required if SecOps module is enabled)
sudo ufw allow 1514/tcp comment "Wazuh Agent Log Collection (SecOps module)"
sudo ufw allow 1515/tcp comment "Wazuh Agent Enrollment (SecOps module)"

# 4. Enable the firewall
sudo ufw enable

# 1. Allow SSH access to tagged instances
gcloud compute firewall-rules create mcm-allow-ssh \
    --network=mcm-vpc \
    --allow=tcp:22 \
    --source-ranges=[YOUR_ADMIN_IP] \
    --target-tags=mcm-single-vm

# 2. Allow HTTPS and HTTP access from anywhere
gcloud compute firewall-rules create mcm-allow-web \
    --network=mcm-vpc \
    --allow=tcp:80,tcp:443 \
    --source-ranges=0.0.0.0/0 \
    --target-tags=mcm-single-vm

# 3. Allow SecOps Wazuh Agent ports (Optional - Required if SecOps module is enabled)
gcloud compute firewall-rules create mcm-allow-secops \
    --network=mcm-vpc \
    --allow=tcp:1514,tcp:1515 \
    --source-ranges=[YOUR_SUBNET_CIDR] \
    --target-tags=mcm-single-vm

Outbound Connection Requirements

The MCM platform requires outbound HTTPS (port 443) connectivity to the following main domains:

4. Installation Procedure

Download & Execute the Installer

1. Connect to the server via SSH (run on your local terminal):

   ssh [VM_SSH_USER]@<SERVER_IP>

2. Download the platform deployment archive: Log in to the MCM Registry portal at https://registry.mcm.revdau.ai/license using your MCM credentials.

   Navigate to the License page to view your MCM App Credentials (Username and Password) and available release versions under Download installation package:

   

   Copy the wget download command, replace <your MCM App password> with your MCM App password, and execute it on your server to download the platform deployment archive:

   wget --user="your_email@example.com" --password="your_mcm_app_password" \
     "https://registry.mcm.revdau.ai/api/mcm-app/downloads/package?version=1.1.0" -O mcm_artifacts_1.1.0.tar.gz

   (Note: Swap the version number in the URL to download a different release).

3. Extract the downloaded archive:

   tar -xzf mcm_artifacts_1.1.0.tar.gz

4. Navigate into the directory and run the installer:

   cd mcm_artifacts
   sudo chmod +x install.sh
   sudo bash install.sh --single-vm

Installation Details:

• Installation Time: Installation takes 15–30 minutes. Outbound internet access is required on the server during installation to install dependencies.
• Docker Permissions: The installer configures a docker user group and adds the current user to it. To execute Docker commands without sudo post-installation, run newgrp docker in your current terminal session, or log out and log back in.

Once the installer completes, open the application in your web browser:

Platform Activation & Onboarding

When you access the MCM platform gateway for the first time, you must activate the installation using your subscription details:

1. Retrieve Your Subscription Key

Once your purchase is approved, you will receive a subscription details email from the MCM team containing your Username (Registered Email ID) and Password/Token:

2. Activate the Subscription

Open the application URL (https://<DOMAIN_OR_IP>) in your web browser. You will be greeted by the Subscription Activation page. Enter the Username (Email ID) and Password/Token received in your email, then click Activate:

3. Create the Administrator User

Once the subscription is activated, you will be redirected to the Create User page. Enter the details for the primary platform administrator (First Name, Last Name, Email, MSP Name, and Legal Name) and click Submit:

4. Log In to the Platform

After submitting, you will be redirected to the main login portal.

For a walkthrough of the login process, managing credentials, and exploring user dashboards, please refer to the Getting Started User Guide.

5. Operations & Health Verification

You can verify the status and health of all deployed services by executing the healthcheck script (Optional):

sudo bash /opt/mcm/scripts/healthcheck.sh

General Verification and Control

For verification steps, stack teardown commands, and utility control scripts (starting, stopping, restarting, or upgrading the platform components), please refer to the Helper Scripts and Commands Guide.

For custom domain configuration and SSL/TLS certificate management, please refer to the Domain and TLS Certificate Configuration Guide.

For troubleshooting configuration, certificate, or service initialization errors, refer to the Troubleshooting Guide.