MCM Platform — 3-Tier Deployment GuideCopy Anchor Link

About this architectureCopy Anchor Link

The 3-tier orchestrated deployment is the recommended architecture for production environments. It separates services by role into three distinct tiers to strengthen security isolation and optimize system performance:

• Tier 1: Access Node (VM1): Hosts the gateway interface. This is the only node exposed to public traffic.
• Tier 2: App Node (VM2): Hosts the core backend microservices and the User Interface (UI).
• Tier 3: DB Node (VM3): Hosts the storage layers.

3-Tier Network ArchitectureCopy Anchor Link

1. Prerequisites & VM SpecificationsCopy Anchor Link

Ensure that your physical, virtual (on-premises), or cloud virtual machines meet the following minimum configuration requirements:

Baseline Network PrerequisitesCopy Anchor Link

The 3-tier architecture requires the following network conditions:

• VM1 (Access Node): Must be reachable by end users — either via a public IP, VPN, or internal corporate network.
• VM2 (App Node) & VM3 (DB Node): Must have private IP connectivity to VM1 and to each other. These nodes do not need to be reachable from outside your network.
• Outbound Internet Access:
  • All VMs: Require outbound internet access during installation to download system dependencies (Docker, packages, etc.).
  • VM2 (Runtime): Requires persistent outbound internet access because the MCM microservices connect to cloud provider APIs (AWS, Azure) for resource orchestration, inventory sync, and cost metrics.

For detailed port mappings, security groups, and domain firewall rules, see Section 2: Network & Security Requirements.

2. Network & Security RequirementsCopy Anchor Link

All three VMs must be placed within a network where they can route traffic to each other using private IPs. A single subnet (or separate subnets for strict tiering) can be used depending on your network topology.

Example IP layout (using 10.0.0.0/16):

• Subnet 1 (10.0.1.0/24) — Hosts VM1 (mcm-access).
• Subnet 2 (10.0.2.0/24) — Hosts VM2 (mcm-app).
• Subnet 3 (10.0.3.0/24) — Hosts VM3 (mcm-db).

On-Premises & Private Cloud SetupCopy Anchor Link

If you are deploying on physical servers or a private virtualized environment:

1. VM Provisioning: Provision 3 virtual machines meeting the CPU, RAM, and Disk specifications listed in Section 1: Prerequisites & VM Specifications.
2. Network Layout & IP Assignment:
   • VM1 (mcm-access): Assign an IP address accessible by your target users (can be a public IP or a private IP if accessed via an internal corporate network, VPN, or local load balancer).
   • VM2 (mcm-app) & VM3 (mcm-db): Assign static private IP addresses. Ensure VM1, VM2, and VM3 have mutual private IP routing to communicate with each other.
3. Firewall & Egress Configuration: Configure your network firewall appliances or host-level firewalls (e.g. UFW) using the Port Requirements and Outbound Connection Requirements tables below.

Port RequirementsCopy Anchor Link

The following ports must be open between the VMs. Configure these in your firewall, security groups, or host-level rules (e.g., UFW) as needed:

Outbound Connection RequirementsCopy Anchor Link

The MCM platform requires outbound HTTPS (port 443) connectivity to the following main domains:

AWS & Azure Infrastructure SetupCopy Anchor Link

If you are provisioning resources on a public cloud, navigate to the dedicated guide for your provider to set up your network, security groups, and VM instances:

• 👉 Go to the AWS Deployment Guide
• 👉 Go to the Azure Deployment Guide

Once your cloud infrastructure and VMs are provisioned, return to Section 3: Installation Procedure of this guide to complete the platform setup.

3. Installation ProcedureCopy Anchor Link

Pre-Deployment ChecklistCopy Anchor Link

Before you begin:

• Ensure that the SSH user on VM2 and VM3 belongs to the sudo group.

• Ensure SSH password authentication is enabled on VM2 and VM3 to allow key distribution.

  Run the following commands on VM2 and VM3 to configure a password and temporarily enable authentication:

  Copy Text

  # Set a password for the SSH user (e.g. ubuntu)
  sudo passwd [VM_SSH_USER]
  
  # Enable password authentication drop-in config
  echo "PasswordAuthentication yes" | sudo tee /etc/ssh/sshd_config.d/00-mcm-temp-auth.conf
  sudo systemctl restart ssh

Step 1: Account Registration & Portal AccessCopy Anchor Link

Follow these steps on the MCM Nexus Portal to set up your account:

1. Visit MCM Portal Landing Page: Navigate to https://nexus.mcm.revdau.ai and click the Continue button.

   

2. Complete the Sign-Up Form: Fill in your organizational and contact details in the registration form to create your account.

   

3. Receive Verification & Credentials Email: Check your inbox for the welcome email containing your initial credentials and verification details.

   

4. Sign In to MCM Portal: Go to the login screen and sign in using your registered email and temporary password.

   

5. Set Your Account Password: On your first login, configure a secure password for your account.

   

Step 2: License Request & Approval WorkflowCopy Anchor Link

1. Access Portal Workspace Dashboard: After logging in, access your workspace dashboard.

   

2. Navigate to the Request Tab: Click on the Request tab in the top navigation bar.

   

3. Submit License Request & Wait for Approval: Fill out and submit your license entitlement request.

   
   Administrator Approval

   The MCM Administrator team reviews and approves submitted license requests. Once approved, the software package download and license entitlements become accessible under the License tab.

Step 3: Generate Download Command & Server DeploymentCopy Anchor Link

1. Open the License Tab: Navigate to the License tab (/license) to view your MCM App Credentials (Username and Token).

   

2. Select Release Version & Copy Download Command: Under Download installation package, select version 1.2.0 from the dropdown and click Copy to copy the pre-authenticated wget command.

   

3. SSH into VM1 (Access Node):

   Copy Text

   ssh [VM1_USER]@<VM1_IP>
   # or using private key
   ssh -i /path/to/key.pem [VM1_USER]@<VM1_IP>

4. Execute the Copied Download Command:

   Copy Text

   wget --user="your_email@example.com" --password="your_mcm_app_password" \
     "https://nexus.mcm.revdau.ai/api/mcm-app/downloads/package?version=1.2.0" -O mcm_artifacts_1.2.0.tar.gz

5. Extract and Launch the Installer:

   Copy Text

   tar -xzf mcm_artifacts_1.2.0.tar.gz
   cd mcm_artifacts
   sudo chmod +x install.sh
   sudo bash install.sh --three-tier

6. Provide Node Connection Details: The installer prompts for connection inputs:

   • Enter VM1 IP (Access Node): Type the IP address of VM1.
   • Enter VM2 IP (App Node): Type the IP address of VM2.
   • Enter VM2 SSH Username & Password: Type the SSH credentials for VM2.
   • (Repeats for VM3)

7. Wait for Post-Deployment Warm-up: After completion, wait approximately 5 minutes for all container services to initialize.

Step 4: Platform Activation & Super Admin SetupCopy Anchor Link

Once deployment completes, navigate to https://<VM1_IP_OR_DOMAIN>/subscription in your browser:

1. Activate Subscription: Enter your registered Username and Password/Token received via email, then click Activate.

   

2. Create Organization Administrator: Enter the details for the primary platform super administrator and submit.

   

3. Log In to Platform: Log in with your administrator credentials and proceed to the Getting Started User Guide.

4. Operations & Health VerificationCopy Anchor Link

You can verify the status and health of all deployed services by executing the healthcheck script (Optional) on VM1 (Access Node):

sudo bash /opt/mcm/scripts/healthcheck.sh

General Verification and ControlCopy Anchor Link

For verification steps, stack teardown commands, and utility control scripts (starting, stopping, restarting, or upgrading the platform components), please refer to the Helper Scripts and Commands Guide.

For custom domain configuration and SSL/TLS certificate management, please refer to the Domain and TLS Certificate Configuration Guide.

For troubleshooting configuration, certificate, or service initialization errors, refer to the Troubleshooting Guide.