MCM Platform — Internal Reference Guide

Confidential — For Internal Operations and RevDau DevOps Teams Only.
This document details the low-level architecture, container configuration, internal security layers, scripting engines, and credentials management of the MCM (Multi-Cloud Management) Platform.

1. Service Inventory

The table below lists all platform services, including internal core components, optional customer-facing modules, security SIEM (Wazuh), and infrastructure observability components.

2. Internal Configuration Reference (internal_config.env)

Location: /opt/mcm/internal_config.env

This configuration file is generated during the CI packaging stage and contains image references, container tag details, and platform definitions. It should not be modified manually.

3. Certificate Architecture Deep Dive

MCM uses a dual Certificate Authority model to secure both application-level traffic (via the MCM Root CA) and security monitoring telemetry (via the Wazuh CA).

3.1 Keystore and Truststore Internals

Java services require secure cryptographic storage formatted as PKCS12 archives:

• keystore.p12: Holds the individual service's private key, certificate, and CA chain.
  • Alias: mcm
  • Encryption Password: Read from KEYSTORE_PASSWORD in /etc/mcm/secrets.env
• truststore.p12: Holds trusted certificates representing entities the service can communicate with.
  • Alias mcm: Points to the MCM Root CA (ca.crt).
  • Alias wazuh-root-ca: Points to the Wazuh Root CA (root-ca.pem).
  • Aliases <domain>-<index>: Points to certificates fetched recursively from TRUSTED_DOMAINS (e.g. login.microsoftonline.com-0, login.microsoftonline.com-1).
  • Encryption Password: Read from TRUSTSTORE_PASSWORD in /etc/mcm/secrets.env

3.2 Configuration Fingerprint and Rotation

To prevent unnecessary certificate generation, the generate-certs.sh script tracks changes using /var/lib/mcm/.config_fingerprint.

The fingerprint is an MD5 hash calculated from:

Fingerprint = MD5(HOST_SERVER_IP | DOMAIN | TRUSTED_DOMAINS | MD5(secrets.env))

If the fingerprint changes or is missing:

1. The entire directory /var/lib/mcm/ is backed up to /var/backups/mcm/backup_<YYYYMMDD_HHMMSS>/.
2. A new MCM Root CA is generated at /var/lib/mcm/certs/ca.key and ca.crt.
3. Each microservice's keystore, truststore, and self-signed certificate are regenerated.
4. Wazuh certificates are regenerated using the generator container.
5. A new .config_fingerprint file is written.

4. Wazuh SIEM Complete Reference

Wazuh operates as an independent security enclave using standard ports and configuration bindings.

4.1 Deployment Profile: mcm-secops

Wazuh components are deployed dynamically under the mcm-secops compose profile:

• wazuh.manager: Central engine analyzing logs, auditing system files, and running active responses.
• wazuh.indexer: High-performance indexer storing and querying alerts.
• wazuh.dashboard: Kibana-derived security interface mapping compliance frameworks (PCI-DSS, CIS, GDPR).
• init-wazuh-security: Secures indexer REST endpoints with randomized passwords on first boot.

4.2 Certificate Generation & Distribution

Wazuh requires a strict directory structure of certificates under /var/lib/mcm/wazuh/certs/. The generator configuration (certs.yml) is generated dynamically:

nodes:
  indexer:
    - name: wazuh.indexer
      ip: wazuh.indexer
      root_ca: root-ca
  server:
    - name: wazuh.manager
      ip:
        - <HOST_SERVER_IP>
        - 127.0.0.1
      root_ca: root-ca
  dashboard:
    - name: wazuh.dashboard
      ip: wazuh.dashboard
      root_ca: root-ca

The generator container (wazuh-certs-generator) writes a set of tar files, which are extracted, flattened, and permissions fixed to 755 for secure access.

5. Docker Compose Profiles & Full Architecture

The following diagram represents the complete networking architecture, profiles, and backend inter-dependencies, including the Wazuh (mcm-secops) and Elastic Agent (mcm-observability) services.

6. Script Internals Reference

6.1 Package Build Flow (build-and-publish.sh)

This script runs on the DevOps CI/CD pipeline server (e.g. Jenkins or GitHub Runner) to build and publish the deployment archive:

6.2 Installation Flow (install.sh)

This script is executed by the customer administrator during fresh installation:

6.3 Operation Scripts Summary

All scripts are located in /opt/mcm/scripts/:

• start.sh:
  1. Detects system IP via set-public-ip.sh and updates internal_config.env.
  2. Generates credential file via generate-secrets.sh.
  3. Generates keystores and certs via generate-certs.sh.
  4. Extracts and distributes MongoDB field encryption keys (MONGO_MASTER_KEY).
  5. Starts docker compose services for active profiles.
• stop.sh: Stops and removes running containers under active docker compose profiles.
• restart.sh: Runs stop.sh, executes start.sh configuration pipeline, and performs docker compose up -d --force-recreate.
• cleanup.sh: Highly Destructive. Stops all services, prunes all docker resources, deletes all persistent data volumes, and clears configurations.
• generate-secrets.sh: Generates random passwords via pwgen and writes to /etc/mcm/secrets.env. Injects secrets directly into APISIX, Keycloak JSON templates, and service-specific application YAML overrides.
• remove.sh: Prunes containers and optionally networks, volumes, and images from the host.

7. Container Networking

All containers communicate over an isolated Docker bridge network:

• Name: apisix-net
• Subnet: Managed by the Docker daemon (typically 172.18.0.0/16)

Containers are addressed internally by their service names defined in the docker-compose.yml file. APISIX resolves upstream services (e.g. http://mcm-api:9091/) using Docker's internal DNS server (127.0.0.11).

8. Complete Environment Variable Reference

8.1 User Configuration (/etc/mcm/user_config.env)

This file controls the global deployment variables and active modules:

8.2 Secrets (/etc/mcm/secrets.env)

This file is auto-generated during the first installation if GENERATE_SECRETS=true. All passwords are randomly generated using pwgen:

8.3 Internal & System-managed Variables (/opt/mcm/internal_config.env)

These variables are immutable and set by the DevOps deployment process:

9. Complete Port Reference

9.1 Host-Exposed Ports

| 8200 | TCP | APM Server | apm-server | Inbound | APM metric collection port | | 8220 | TCP | Fleet Server | fleet-server | Inbound | Elastic agent enrollment | | 9000 | TCP | Wazuh Indexer | wazuh.indexer | Inbound | Wazuh database API | | 9200 | TCP | Elasticsearch | elasticsearch | Inbound | Elasticsearch API port | | 27018| TCP | MongoDB | mongodb | Inbound | External database connection | | 55000| TCP | Wazuh Manager | wazuh.manager | Inbound | Wazuh REST API endpoint |

9.2 Internal-Only Ports (apisix-net Network)

10. Complete Docker Volume Reference

The table below describes all persistent Docker volumes, data contents, and ownership requirements.

11. Init Container Details

Before core application microservices start up, special init containers perform prerequisites configuration:

1. init-apisix: Wait until APISIX gateway is listening. Resolves the DNS bindings for the active domain name/IP, injects config into APISIX, and configures routes inside etcd.
2. init-elasticsearch: Generates built-in user credentials and assigns cluster index roles for Elasticsearch.
3. init-kibana: Configures indices patterns, default views, and Kibana system credentials.
4. init-wazuh-security: Configures certificate authentication for security endpoints and loads default administrative rules.
5. init-observability-fleet: Connects Elastic Fleet server, registers enrollment tokens, and sets up APM ingestion pipelines.

12. Deployment Artifacts Reference

12.1 Artifact Structure

The MCM deployment artifact is a compressed tarball containing everything needed for installation:

mcm_artifacts_<VERSION>.tar.gz
├── install.sh                          # Fresh installation script
├── upgrade.sh                          # Upgrade script (preserves configuration)
├── version.txt                         # Artifact version identifier
├── opt/
│   └── mcm/
│       ├── docker-compose.yml          # Docker Compose service definitions
│       ├── internal_config.env         # Image versions, registry, system config
│       ├── scripts/                    # Operational scripts
│       │   ├── install-deps.sh         #   Install system dependencies
│       │   ├── start.sh                #   Start all services
│       │   ├── stop.sh                 #   Stop all services
│       │   ├── restart.sh              #   Restart all services
│       │   ├── cleanup.sh              #   Full reset (destructive)
│       │   ├── remove.sh               #   Remove containers and volumes
│       │   ├── pull-images.sh          #   Pull latest Docker images
│       │   ├── service.sh              #   Update a single service
│       │   ├── generate-secrets.sh     #   Auto-generate passwords and secrets
│       │   ├── generate-certs.sh       #   Auto-generate TLS certificates
│       │   ├── set-public-ip.sh        #   Detect and set host public IP
│       │   ├── safe-remove.sh          #   Prune unused Docker resources
│       │   ├── healthcheck.sh          #   Health check utility
│       │   └── utils.sh                #   Shared utility functions
│       ├── apisix/                     # APISIX gateway configuration
│       ├── init-apisix/                # APISIX route initialization
│       ├── keycloak/                   # Keycloak realm import files
│       ├── mongodb/                    # MongoDB initialization scripts
│       ├── init-elasticsearch/         # Elasticsearch user/role setup
│       ├── kibana/                     # Kibana configuration
│       ├── init-kibana/                # Kibana initialization
│       ├── filebeat/                   # Filebeat log shipping configuration
│       ├── wazuh/                      # Wazuh SIEM configuration
│       └── init-wazuh-keycloak/        # Wazuh-Keycloak SSO integration
├── etc/
│   ├── mcm/
│   │   ├── user_config.env             # User-editable configuration
│   │   ├── mcm-api/                    # MCM API overrides
│   │   ├── mcm-governance-api/         # Governance API overrides
│   │   ├── mcm-finops-api/             # FinOps API overrides
│   │   ├── mcm-secops-api/             # SecOps API overrides
│   │   ├── mcm-orchestration-api/      # Orchestration API overrides
│   │   ├── mcm-discovery-api/          # Discovery API overrides
│   │   └── mcm-ai-api/                 # AI API overrides
│   └── systemd/
│       └── system/
│           └── mcm.service             # Systemd service unit file
└── images/                             # Bundled Docker images (all included)
    ├── revdau_mcm-ui.tar               #   MCM UI image
    ├── revdau_mcm-api.tar              #   MCM API image
    ├── revdau_mcm-governance-api.tar   #   Governance API image
    ├── revdau_mcm-finops-api.tar       #   FinOps API image
    ├── revdau_mcm-secops-api.tar       #   SecOps API image
    ├── revdau_mcm-orchestration-api.tar #  Orchestration API image
    ├── revdau_mcm-discovery-api.tar    #   Discovery API image
    ├── revdau_mcm-ai-api.tar           #   AI API image
    ├── apache__apisix.tar              #   APISIX gateway image
    ├── bitnami__etcd.tar               #   etcd image
    ├── postgres.tar                    #   PostgreSQL image
    ├── keycloak.tar                    #   Keycloak image
    ├── elasticsearch.tar               #   Elasticsearch image
    ├── mongo.tar                       #   MongoDB image
    ├── kibana.tar                      #   Kibana image
    ├── filebeat.tar                    #   Filebeat image
    ├── linuxserver__yq.tar             #   yq init container image
    ├── wazuh__wazuh-manager.tar        #   Wazuh Manager image
    ├── wazuh__wazuh-indexer.tar        #   Wazuh Indexer image
    ├── wazuh__wazuh-dashboard.tar      #   Wazuh Dashboard image
    └── wazuh__wazuh-certs-generator.tar #  Wazuh certificate generator image

12.2 Versioning Scheme

MCM follows Semantic Versioning (SemVer): MAJOR.MINOR.PATCH (e.g. 1.0.0). The version is embedded in the artifact filename and in the version.txt file.

12.3 Artifact Delivery

• Format: gzip-compressed tar archive (.tar.gz)
• Typical Size: 10–15 GB (includes all Docker images)
• Delivery: Secure file transfer, USB, or pre-signed URL.
• Option C — Cloud Storage (Pre-Signed URL): If provided:

  curl -L -o mcm_artifacts_1.0.0.tar.gz "<PRE_SIGNED_URL_PROVIDED_BY_REVDAU>"

12.4 Directory Layout on Host

13. Detailed Docker Compose Profiles

13.1 Profile Overview

MCM uses Docker Compose profiles to modularize the deployment:

13.2 Enabling / Disabling Modules

To modify active modules, edit COMPOSE_PROFILES in /etc/mcm/user_config.env and run sudo bash /opt/mcm/scripts/restart.sh.

14. Internal Component Endpoints & Swagger

For troubleshooting or internal configurations, the following direct routes can be accessed:

14.1 Health Check Endpoints

14.2 Internal Access Details