# Demo stack defaults and the hardened shape

Every lab shortcut of the demo stack, the hardened shape that keeps it on the host's loopback, and what keeps it running for a team.


Thedemostacktradessafetyforashortfirstrun:itsloginsarepublic,itservesplainHTTPandthelauncheropensitsportsoneveryinterfaceofthehost.Thispagelistseachofthosedefaults,thehardenedshapethatkeepsthestackonthehost'sloopback,andwhatanoperatorneedstokeepthestackrunningforateam.[Tryitonthedemostack](https://docs.straza.ai/evaluate/try-it-on-the-demo-stack/index.md)isthetutorialthatwalksthestack.##DemodefaultsandthehardenedshapeThelandingpageendswithitslabshortcuts,thechoicesthatkeepthedemoshortandthatadeploymentofyourownwouldnotmake.Somechangeinthehardenedshape.|Labshortcut|Inthehardenedshape||---|---||Everypasswordthelandingpageprintsiscommittedtotherepository.SoarethePostgreslogins,themidPointserviceaccount,theseed-bootstrapaccount,theKeycloakclientsecret,objects-demo'stwotokensandtheKibanasecrets.|Stays.Thehardenedshapemakestheseloginsreachablefromthehostonly.||PlainHTTPeverywhereexceptthephoneapproveron8443,whosecertificatestrazadmakesitself.|Stays.Thetraffictravelsonlyonthehost'sloopbackandinsideyourSSHtunnel.[TLSandexposure](https://docs.straza.ai/guides/operate/tls-and-exposure/index.md)coversadeploymentthatfacesanetwork.||Theminimumattestationis`none`,soanyinstalloftheclientgetsasession.Theenterprisedefault`managed`refusesaplainenrollmentuntilamanagedinstallhasregistereditshash.|Stays.Bothshapesset`STRAZA_MIN_ATTESTATION=none`.||Keycloakletstheseederandjoe'schatfacesigninwithapassword,andjoe'schat-facepasswordisinhisseedobject.midPoint'sKeycloakconnectorsignsinasKeycloak'smasteradmin.|Stays.Theagents'ownsessionsrideEd25519keysmadeinsidetheirservicecontainersandnevercommitted.||Thepushrelayison,andntfy.shandthebrowserpushservicesareallowedpushtargets.Apushcarriesareferencetotherequest,neveritscontent.|Stays.||midPointmasterstheStrazaroles`straza-admin`,`straza-enroll-browser`and`straza-enroll-mobile`.|Stays,becausethisisthedesignedenterpriseshapeforproductiontoo.||Theports8400,8420,8443,8480and8087listenoneveryinterface.|Boundto127.0.0.1andreachedoverSSH.|Inthebasefile,Keycloaklistenson8480,strazadon8420and8443,thelandingpageon8400andmidPointon8087,alloneveryinterface.Docker'sowniptablesrulesrunbeforefirewalldorufw,soahostfirewalldoesnotcoverthem.Theloopbackoverlay,`compose.loopback.yaml`,rebindsthoseportsto127.0.0.1andpinstheadvertisedapproverURLto`https://127.0.0.1:8443`.Elasticsearch,Kibanaandthedemochatfacebindloopbackontheirown.Thepinshowsin`/version`:onastackthelauncherstarted,its`approver.public_url`istheaddressthelauncherpicked,andinthehardenedshapeitis`https://127.0.0.1:8443`.Onahostthattheinternetcanreach,neverrunthelauncher,because`up.sh`startsthebasefilealone.Startthebasefilewiththeloopbackoverlayinstead,fromthestackdirectory:Terminal,ontheDockerhost:```shcddeploy/compose/eval-stackdockercompose-fcompose.yaml-fcompose.loopback.yamlup-d--build```Composebuildswhatchangedandstartsthestack,and`dockercomposeps`thenshowseverypublishedporton`127.0.0.1`,asin[Whatruns](#what-runs).Toaddtheotheroverlays,namethemafterthesetwointheordersiem,demo.Thewalkedstackrunsallfour,`-fcompose.yaml-fcompose.loopback.yaml-fcompose.siem.yaml-fcompose.demo.yaml`,sothelatercommandsonthispagepassallfour.Passonlythefilesyoustartedwith.Theoverlaysandtheprofileeachaddonepart:|Fileorsetting|Adds|Note||---|---|---||`compose.loopback.yaml`|TheloopbackbindsandthepinnedapproverURL|NeedsDockerCompose2.24orlater,for`!override`||`compose.siem.yaml`|ElasticsearchandKibana,fedbyastrazadsink|About1.5to2GiBofmemorymore,bythefile'sownestimate||`compose.demo.yaml`|Thechatface`demo`,and`straza-harness`,theClaudeCodeboxthatrunsasjoe|Buildsfromacheckoutofthestraza-agents-demorepositorybesidethisone,whichisnotpublic||`COMPOSE_PROFILES=pg`inthestackdirectory's`.env`|adaptive-pg-mcpastheMCPserver`postgres`,infrontoffourdemodatabasesonmidPoint'sPostgresserver|Offbydefault|Withoutthestraza-agents-democheckout,leave`-fcompose.demo.yaml`outofeverycommand,andjoethenhasnoruntimeonthestack,whichleavessamastheoneworkingagentthatyoucanwatch.ReachastackonanothermachineoverSSH.`tunnels.shuser@host`onLinuxormacOSand`tunnels.batuser@host`onWindowsforward8400,8420,8443,8480,8087,5601and8477tothesameportsonyourworkstation.TheyneednothingbutanSSHclient,andthebrowserstillopenseveryaddressas`localhost`.ThescriptprintstheportsitforwardsandkeepstheconnectionopenuntilyoupressCtrl+C.##PassthesamefileseverytimeTwoshapesexist,andyoukeeptheoneyoustartedwith.Thelauncherstartsthebasefilealone.Inthehardenedshape,everylater`up`,`ps`,`logs`and`down`passesthefilesyoustartedwith,intheorderbase,loopback,siem,demo.Thefilechaindecideswhatstrazadreads.-Thebasefilemounts`straza.rs-mode.yaml`at`/etc/straza/straza.yaml`,andthesiemoverlaymounts`siem/straza-siem.yaml`atthesamecontainerpath.Composemergesvolumesbycontainerpath,sothelaterfilewins,andstrazadreadsexactlyoneconfigfile.Thatsecondfilerepeatsthe`oauth`and`admin`blocksofthefirstandaddsthe`sinks`listthatpostseveryauditandrevocationeventtoElasticsearch.-Dropthesiemfilefromonecommand,andthenextrecreatemountsthebaseconfigagain.Thesinkisgoneandnothingreportsit.-Dropthedemofile,andcomposeforgetsthe`demo`,`straza-harness`and`straza-harness-service`services.`up`skipsthem,`down`orphansthem,andeverystepthatneedsjoestopsworking.Confirmwhichconfigfiletherunningserverholds:Terminal,ontheDockerhost:```shdockerinspectstraza-eval-strazad-1--format'{{range.Mounts}}{{ifeq.Destination"/etc/straza/straza.yaml"}}{{.Source}}{{end}}{{end}}'|sed's#.*/eval-stack/##'``````textsiem/straza-siem.yaml```Thesinkisalivewhentheindexfills,whichthiscountshowsfromtheDockerhost:Terminal,ontheDockerhost:```shcurl-s-uelastic:strazasiemhttp://127.0.0.1:9200/straza-events/_count```ElasticsearchanswersaJSONobjectwhose`count`isthenumberofauditandrevocationeventsdeliveredsofar,anditgrowswitheverydecision.WhileElasticsearchisdown,strazadparkstheeventsitcannotpost,andtheconsole's**Overview**sayssounder**Needsattention**,withabuttonthatreplaysthem,**Replayelastic**onthisstack.StartElasticsearchagainwiththesamefiles,thenreplay.##WhatrunsListeverycontainer,theone-shotjobsthathaveexitedincluded,fromthestackdirectory.Thecommandpassesthefourfilesofthehardenedshape.Onastackthat`up.sh`started,pass`compose.yaml`alone.Terminal,ontheDockerhost,inthestackdirectory:```shdockercompose-fcompose.yaml-fcompose.loopback.yaml-fcompose.siem.yaml-fcompose.demo.yamlps-a--format'table{{.Service}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}'```Thewalkedstackrunsthepgprofiletoo,anditsElasticsearchandKibanawerenotrunning,sotheirrowsread`Exited`.```tableSERVICEIMAGESTATUSPORTSadaptive-pg-mcpghcr.io/strazahq/adaptive-pg-mcp:0.1.1@sha256:b3c7f9a1a9eea68762bb6cc3afa8e8ab804746d86e09a0d2c1263a3bb6881df2Up7hoursagent-keys-initbusybox:1.36Exited(0)9daysagoconnector-jarcurlimages/curl:8.7.1Exited(0)2weeksagodemostraza-eval-demoUp12hoursdemo-toolsstraza-eval-demo-toolsUp12hoursdocs-buildghcr.io/gohugoio/hugo:v0.165.0@sha256:608a19e34f86de36773503adbaab174fc28a6e338dc7904e03c70320b003a153Exited(0)2weeksagodocs-publishpython:3.13-alpineExited(0)2weeksagoelasticsearchdocker.elastic.co/elasticsearch/elasticsearch:8.14.3Exited(137)13hoursagoeval-seedalpine:3.20Exited(0)35hoursagokc-connector-buildmaven:3.9-eclipse-temurin-17Exited(0)2weeksagokeycloakquay.io/keycloak/keycloak:26.0Up7hours(healthy)8443/tcp,9000/tcp,127.0.0.1:8480->8080/tcpkibanadocker.elastic.co/kibana/kibana:8.14.3Exited(0)11daysagokibana-setupdocker.elastic.co/elasticsearch/elasticsearch:8.14.3Exited(0)2weeksagolandingnginx:1.27-alpineUp7hours127.0.0.1:8400->80/tcpmcp-midpoint-httpghcr.io/strazahq/midpoint-mcp-server:0.6.0@sha256:0b24ff42bb60eeb78a756f5db8b24e25a3cfc7887517cf8151e9c4e957194a00Up7hoursmidpointevolveum/midpoint:4.10.3-alpineUp7hours(healthy)127.0.0.1:8087->8080/tcpmidpoint-dbpostgres:16-alpineUp7hours5432/tcpmidpoint-initevolveum/midpoint:4.10.3-alpineExited(0)2weeksagomidpoint-partition-guardpostgres:16-alpineExited(0)2weeksagonatsnats:2Up7hours4222/tcp,6222/tcp,8222/tcpobjects-demostraza-eval-objects-demoUp12hours3002/tcppg-showcase-initpostgres:16-alpineExited(0)4daysagosiem-setupdocker.elastic.co/elasticsearch/elasticsearch:8.14.3Exited(0)26hoursagostraza-data-initbusybox:1.36Exited(0)26hoursagostraza-dbpostgres:16Up7hours(healthy)5432/tcpstrazadstraza-eval-strazadUp5hours127.0.0.1:8420->8420/tcp,127.0.0.1:8443->8443/tcpuni-connector-buildcurlimages/curl:8.7.1Exited(0)2weeksagoviews-demostraza-eval-views-demoUp12hoursstraza-harnessstraza-eval-straza-harnessUp12hoursstraza-harness-servicestraza-eval-straza-harness-serviceUp12hours(healthy)agent-samstraza-eval-agent-samUp12hours(healthy)agent-sam-servicestraza-eval-agent-sam-serviceUp12hours(healthy)```Thelong-runningservicesformthesegroups:|Group|Services||---|---||Identity|`keycloak`,Keycloak26indevmode,whichimportstherealm`straza`atboot.`midpoint`,midPoint4.10.3,withitsown`midpoint-db`.||Straza|`strazad`intheenterpriseprofilewiththeconsoleembedded,`straza-db`and`nats`.NATSpublishesnoport,becausetheagents'servicesgetthekill-switchpushoverstrazad'sown`/v1/push`route.||Thegovernedside|`demo-tools`,`views-demo`,`objects-demo`and`mcp-midpoint-http`,theMCPserversthatonlythegatewayreaches.midPoint'sserverrunseverycallasthepersonsignedin,and`adaptive-pg-mcp`joinsthemwiththepgprofile.`landing`isthenginxbehindthelandingpageandthedocsunder`/docs/`.||Agents|`agent-sam`,thealways-onautonomousagent,with`agent-sam-service`besideit.Withthedemooverlay,`straza-harness`,apinnedClaudeCodethatyoudrivewith`dockerexec`,with`straza-harness-service`besideit,and`demo`,thechatfaceon127.0.0.1:8477.||SIEM,fromthesiemoverlay|`elasticsearch`and`kibana`.|Eachofthetwoservicecontainersruns`strazaservice`,theStrazabackgroundservice,fromitsagent'simageunderitsownaccount,uid64000.Itkeepstheagent'skeyinavolumethatonlyitmounts,anditsharesonlythesocketdirectorywithitsagent,sonothingtheagentrunscanreadthekey.Thechatface`demo`hasnoservice,becauseitsgatewaylaneasksKeycloakforarealmandaclientthatthisstackdoesnothave.Everythinglistedas`Exited(0)`isaone-shotjobthatrantocompletionwhileitsdependentswaitedonit.Afailedjobthereforestopsthebootinsteadofleavingahalf-builtstack.-Theinitjobsfixvolumeownership,createthemidPointschemaandpre-createtheshadowpartitionsthatmidPoint4.10.3otherwisecreatesinthewrongorder.-TheconnectorjobscheckthevendoredStrazaconnectorjaragainstitspinnedchecksumandbuildtheKeycloakconnectorfromsource.AStrazajarthatdoesnotmatchthepinstopstheboot.-`docs-build`and`docs-publish`renderthesedocs,comment-free,onevery`up`.-`siem-setup`and`kibana-setup`preparetheingestpipelineandthedashboards.-`pg-showcase-init`makesthedemodatabaseswhenthepgprofileison.-`eval-seed`istheseeder,which[Bringitup,downandback](#bring-it-up-down-and-back)describes.midPointloadstheStrazaconnectorjarfromtherepository,pinnedbychecksum,andtheseederstopswithanerrorwhenmidPointcannotdiscoverit.ThemidPointMCPserverrunsfromitsreleasedimage,`ghcr.io/strazahq/midpoint-mcp-server`,pinnedbydigest,soitneedsnocheckout.Itsreleaseworkflowattestshowtheimagewasbuilt,whichthiscommandchecks.Itexits0andprintsnothingwhentheattestationholds,and`--formatjson`printstheattestationitself.Terminal,anymachinewiththeGitHubCLI:```shghattestationverifyoci://ghcr.io/strazahq/midpoint-mcp-server:0.6.0--ownerStrazahq;echo"exit$?"``````textexit0```##ThecastEverypersonandagentexcepttwolocalaccountsisborninmidPointandreachesStrazaoverSCIM,whiletheseederdrivestherestofthesetupinthisorder:1.Itsignsinthewaytheconsoledoes,asthetransient`seed-bootstrap`useronafirstbootandasaliceonare-run.Itmintsafull-scopeadminAPItokennamed`eval-seed`foritsownrun,whichexpirestwohoursafterthemintandisrevokedwhentheseederexits.ThenitmintstheadminAPItokenthatmidPointholds,named`midpoint`.2.NextitcreatestheStraza-bornroles:thebusinessroles`developer`,`operator`and`analyst`,theapproverrole`sec-approvers`andtheStrazarole`auditor`.3.ItimportsthemidPointobjectsandwaitsformidPointtoprovisiontheworkingagents.4.ThroughtheadminAPIitinstallstheMCPservers,sotheconsoleand`strazactl`canchangethem,andcreateseachapplicationroleontheoneserveritreaches,withitsaccessrow.5.Itregisterstheagents'Ed25519publickeysandactivatestheseededpolicysets:`agent-guardrails`andthegatesofeachapplicationrolethathasany.6.davegetstherolethatadministerseveryMCPserver,andcaroltherolethe`demo-tools`servernamesatitsownregistration.7.Last,onafirstboot,theseederremovestheadminrolefrom`seed-bootstrap`,locksitinStrazaanddisablesitsKeycloaklogin.Sponsorshipistheaccountabilityedge.alicesponsorsjoeandsam,sowheneitherraisesagatedcall,Strazasendstherequesttoherintheconsole,ontheself-servicepageandonherenrolledphone.joeissupervisedandsamisautonomous,andanautonomousagentcanneverapproveitsownrequest.|Name|Who|AccessfrommidPoint|Login||---|---|---|---||alice|employee,theaccountableperson,managerofdev-ops|`straza-admin`,`sec-approvers`andtheenrollroles,sponsorofjoeandsam|Keycloak,`alice`/`alice`||ivan|employee,thesecondapprover|`sec-approvers`andaKeycloaklogin,notools|Keycloak,`ivan`/`Ev4l-St4ck!26`||joe-java-developer-agent|supervisedAIagent,theidentityoftheharnessandthechatface|the`developer`businessrole,aKeycloaklogin,memberofdev-ops|Ed25519keyforsessions,Keycloakpassword`Ev4l-St4ck!26`forthechatface||sam-sre-agent|autonomousAIagentofthe`agent-sam`container|the`operator`businessrole|Ed25519keyonly,nopasswordanywhere||nina-data-analyst-agent,pam-personal-agent|anautonomousAIagentandcarol'spersonalagent,bothwithoutroles|nothinguntilyouassignaroleinmidPoint|none||jana|employee,thenewhireofthescripteddemo|norolesbydesign|none||carol|employeeindev-ops,theserveradminofthedemo|`AR:mcp-admin-demo-tools`,therolethe`demo-tools`servernamesatitsregistration,andaKeycloaklogin|Keycloak,`carol`/`Ev4l-St4ck!26`||dave|employee,theglobalMCPadminofthedemo|`BR:Straza-global-mcp-admin-access`,whichhandsout`straza-global-mcp-admin`overeveryMCPserver,andaKeycloaklogin|Keycloak,`dave`/`Ev4l-St4ck!26`||erin,frank,grace,judy|employeesinmidPointonly,frankamanager|none|none||heidi|externalcontractor|noroles|none||mcp-service|technicalaccountofthemidPointMCPserver|twoscopedmidPointroles,nosuperuser|midPointRESTonly,passwordintheseedobjects||seed-bootstrap|transientlocaladmintheseederdrivesonafirstboot|adminwhileseeding,thendemoted,lockedanddisabled|passwordintherealmimportandtheseeder,unusedafterseeding||break-glass|localemergencyadminthatstrazadcreatesoneverystore|standingadmin|printedonceinthestrazadlogatfirstboot,usedonlyontheemergencysign-in|Everylogininthestackispublicbydesign,whichisthereasonthehardenedshapebindseveryporttoloopback.alicesignsintotheconsolethroughKeycloakas`alice`/`alice`,and`strazactl`runsonanadminAPItokenthatshemintsthere.Thelandingpage'sAccountstableliststheloginsofalice,ivan,carol,daveandjoebesidethoseofthemidPoint,KeycloakandKibanaadministrators.Committedfilesofthestackholdthemcp-serviceandseed-bootstrappasswordstoo,andoperatingthestackneverneedsthem.Theseeder'sworkshowsinfourlistings.Eachistrimmedtotherowsadefaultbootmakes:thewalkedstackalsoranthepgprofile,whichaddstheserver`postgres`,itsthreeapplicationroles,itsadminroleandtheset`postgres-helpdesk-access`,anditheldrowsotherwalkshadadded.TherolelistingleavesouttheIDcolumn.Terminal,administration:```shstrazactlrolesliststrazactlappsliststrazactlpolicyliststrazactluserslist``````tableNAMEKINDSERVERDESCRIPTIONanalystbusiness-Theanalystrole:composesdemo-tools-readersandmidpoint-self-service.Nobodyholdsitatboot;assignittoninainmidPointandwatchherlandinStraza.auditorstraza-Read-onlyoversight:audit,sessionsandtranscripts.Openstheconsole,neveragenttools.demo-tools-readersapplicationdemo-toolsRead-onlyreachintothedemo-toolsserver:thetoolsthatonlyreadorcompute,namedonebyone.Definedbythatserver'sownadminandassignedbytheidentitymanager.demo-tools-sandboxapplicationdemo-toolsEverytoolofthedemo-toolsserver,toolsaddedlaterincluded.Composedbythedeveloperrole;get-sumisaholdandget-envisaticketindemo-tools-sandbox-access.developerbusiness-Thedeveloperrole:composesdemo-tools-sandbox,everytoolofthedemo-toolsserver,views-demo-tools,theMCPAppsexampleserver,objects-demo-tools,thereposerver,andmidpoint-self-service,themidPointreadsplusrequest_role.joeholdsitfrommidPoint.mcp-admin-demo-toolsstraza-AdministerstheMCPserverdemo-tools:itsconnection,credentials,settingsandhealth,neveritsremoval.Itopenstheconsole'sMCPserversareaforthatserveronly.mcp-admin-midpointstraza-AdministerstheMCPservermidpoint:itsconnection,credentials,settingsandhealth,neveritsremoval.Itopenstheconsole'sMCPserversareaforthatserveronly.mcp-admin-objects-demostraza-AdministerstheMCPserverobjects-demo:itsconnection,credentials,settingsandhealth,neveritsremoval.Itopenstheconsole'sMCPserversareaforthatserveronly.mcp-admin-views-demostraza-AdministerstheMCPserverviews-demo:itsconnection,credentials,settingsandhealth,neveritsremoval.Itopenstheconsole'sMCPserversareaforthatserveronly.midpoint-operationsapplicationmidpointEverytoolofthemidPointserver.Composedbytheoperatorrole;everywritewaitsforthepersonbehindthecallinmidpoint-operations-access.midpoint-self-serviceapplicationmidpointThemidPointreadsplustheself-servicepairwhoami,ping,list_requestable_rolesandrequest_role.Composedbythedeveloperandanalystroles;request_roleneedsapprovalinmidpoint-self-service-access.objects-demo-toolsapplicationobjects-demoEverytooloftheobjects-demoserver,tenreposbehindtoolsthatnametherepotheyreach.Composedbythedeveloperrole.operatorbusiness-Theoperatorrole:composesdemo-tools-readers,theread-onlytoolsthedemo-toolsserver'sadmindefined,andmidpoint-operations,everymidPointtoolwitheverywriteneedingapproval.samholdsitfrommidPoint.sec-approversapprover-Thedecidersofapprovalrequestsforgovernedagents.Reachesnotools.Theidentitymanagerassignsandcertifiesitsholders.straza-adminstraza-Strazaadministrationstraza-draft-configstraza-Letsanagentproposeconfigdraftsthroughthebuilt-instrazaMCPserver'stoolsstraza__draft_submitandstraza__draft_status.Apersonpublishesthem.Itopensnoconsolearea,andstraza-admindoesnotincludeit.straza-enroll-browserstraza-Mayenrollasigned-inbrowserasanapprovaldevice.straza-enroll-mobilestraza-Mayenrolltheirownphoneasanapprovaldevice.straza-global-mcp-adminstraza-AdministerseveryMCPserver:registration,changes,credentialsandreach.Itopenstheconsole'sMCPserversarea,neveragenttools.views-demo-toolsapplicationviews-demoEverytooloftheviews-demoserver,theMCPAppsexamplewhoseget-timeopensaclockview.Composedbythedeveloperrole.NAMEVERSIONRUNTIMESTATUSREASONSOURCETOOLSREACHEDBYCHECKEDdemo-tools2026.8.31remoterunning-api14demo-tools-readers,demo-tools-sandbox8sagomidpoint0.6.0remoterunning-api39midpoint-operations,midpoint-self-service8sagoobjects-demo1.0.0remoterunning-api5objects-demo-tools8sagoviews-demo2.0.3remoterunning-api1views-demo-tools8sagoNAMEPRIORITYSTATUSIDagent-guardrails150Live01a1547c-7ecd-71f4-9e6d-e60755917566demo-tools-readers-access100Live01a1547c-7e44-742f-a728-12403ab4ff1edemo-tools-sandbox-access100Live01a1547c-7c03-7a18-949a-dbfff1ea0e53midpoint-operations-access100Live01a1547c-7d15-7706-9935-3062c54d5c69midpoint-self-service-access100Live01a1547c-7c8c-7491-ba50-d9e2e3ad1bc2USERNAMESTATUSORIGINEMAILIDaliceactivescimalice@example.com01a1547c-188b-79d9-93b1-334e1fb5a148break-glassactivelocal01a1547a-1c8b-7064-9dd5-4c8856981e74carolactivescimcarol.jensen@example.com01a1547c-a30a-7058-9fbf-5eb0ed3f09badaveactivescimdave.okafor@example.com01a1547c-8e36-73cd-8305-5f90f470cef8ivanactivescimivan.petrov@example.com01a1547c-2abb-71bc-a830-b3b118950435joe-java-developer-agentactivescimjoe@agents.example.com01a1547c-366e-7767-97eb-caa598255d94sam-sre-agentactivescimsam@agents.example.com01a1547c-3f3d-7238-b13b-b5b6090ba343seed-bootstrapactivelocalseed-bootstrap@example.invalid01a1547a-327b-7c5b-87e4-ea07c76cba71```Everypersonandagentwiththeorigin`scim`wascreatedinmidPointandprovisionedfromthere.`break-glass`and`seed-bootstrap`arethetwolocalaccounts.Onthewalkedstack`nina-data-analyst-agent`wasalsopresent,becauseawalkhadassignedhertheanalystroleinmidPoint.Fourkindsofroleappear.`developer`,`operator`and`analyst`arebusinessrolesthatpeopleandagentshold.Eachcomposesapplicationroles,andthoseapplicationrolesarewhattheactivePolicySetsmatch.Anapplicationrolereachesoneserverandbelongstoit,sotheSERVERcolumnnamesthatserverandmidPointshowstheroleasthatserver'srole.`sec-approvers`decidesapprovalsandholdsnotools.AStrazarolesuchas`auditor`carriesrightsinsideStrazaitselfandnoagenttools.FourMCPserverscomefromtheseeder,andafifthwiththepgprofile:|Server|Whatitis||---|---||`demo-tools`|TheMCPreferenceserver,publishedonnoport||`midpoint`|midPoint'sownMCPserver.EachcallrunsinmidPointasthepersonsignedin,andanagentrunsonitssponsor'ssign-inoncethesponsorallowsitontheself-servicepage.Itsviewsareturnedon||`views-demo`|TheMCPAppsexampleserver,whoseclockviewachatapprendersthrough`/mcp/views-demo`,as[ShowMCPAppsviews](https://docs.straza.ai/guides/serve-mcp-apps/show-views/index.md)shows||`objects-demo`|Atestserverwithtenreposbehindtoolsthatmarkwhichargumentnamestherepo.Strazaliststhemwiththeserver'slistingcredential,anditsconsolepagegainsaRepostab||`postgres`|adaptive-pg-mcpinfrontofthefourdemodatabases,withthepgprofileonly|##Bringitup,downandbackOfallthejobs,theseederfinisheslast,anditslog,whereeverylinecarriesthe`[seed]`prefix,istheboot'sverdict.`WARNING`markspopulationthatdidnotlandandneverfailstheseed.`FATAL`endstherunwithanon-zeroexit,so`ps-a`shows`eval-seed`as`Exited(1)`.Thelogkeepseveryrunofthecontainer,soreaditfromtheendandexpecttheblockthatopenswith`EVALSTACKREADY`:Terminal,ontheDockerhost,inthestackdirectory:```shdockercompose-fcompose.yaml-fcompose.loopback.yaml-fcompose.siem.yaml-fcompose.demo.yamllogs--no-log-prefixeval-seed|grep-n-E'READY|FATAL|WARNING'``````text166:[seed]EVALSTACKREADY-theagentworkforcewasborninmidPointand```Youshouldsee:TheREADYline,andno`WARNING`or`FATAL`line.Aseederthatdiesisrunagainwith`upeval-seed`onthesamefiles,anditconverges,becauseeverystepisidempotent.Rolesanswerthattheyarealreadypresent,theseeder'searliertokensarerevokedandmintedagain,andaPolicySetthatexistsisnevertouched.Onare-runtheseedersignsinasalice,since`seed-bootstrap`isnolongeranadmin.Statelivesinfifteennamedvolumeswiththedemooverlay,andelevenwithoutit.`down`without`-v`removeseverycontainerandkeepseverythingthatmatters:-bothPostgresstoresandmidPoint'shome-strazad'sdatavolume,withthekey-encryptionkey,theapproverTLSpairitmadeitself,theWebPushkeyandtherelaytoken-thestatevolumesofthe`strazaservice`containers,withtheagents'privatekeysandenrollments,andthesocketvolumestheysharewiththeiragents-theMavencacheandthedocsThenext`up-d`bringsthesamestackbackwiththesamecertificatepin,soenrolledphoneskeepworking.Keycloakistheexception.Itrunsindevmodewithnovolume,soarecreateofthe`keycloak`containerloseseverychangemadeinitsadminconsoleandeveryloginmidPointmadethere.Therealmimportbringsback`alice`and`seed-bootstrap`,enabled.TheotherloginsreturnoncemidPointprovisionsthemagain,whicharunoftheseederstarts.`down-v--remove-orphans`wipesthevolumes,andthenextbootisafreshbootwithnewkeysandanewpin,sophonesscanagain.##VerifyAfteran`up`,confirmtheversionandtheprofile`enterprise`with`curl-shttp://localhost:8420/version`,asthetutorialdoes.Thenconfirmthatthedocsareserved:Terminal,anymachinethatreachesthestack:```shcurl-s-o/dev/null-w'%{http_code}\n'http://localhost:8400/docs/``````text200```Thelastcheckis`agent-sam`reporting`(healthy)`inthelistingof[Whatruns](#what-runs).Itshealthcheckpassesonlywhilesam'sgovernedheartbeatpasses.Theheartbeatrunseverytenminutes,soasamdisabledinmidPointturnsthecontainerunhealthywithintenminutes,andenablingsamagainhealsitwithnorestart.##Whensomethingrefuses|Whatyousee|Why|Whattodo||---|---|---||`Straza:approvalticket…ispending.`from`strazaexec`|Aticketruleholdsthecommanduntilapersondecides|Decideitunder**Approvals**,thenrunthesamecommandagainwithinthegrantwindow||Thesamesentenceagain,withanewreference,afteranapproval|Thegrantwasusedoncealready,oritshourpassed|Approvethenewticket,thenrunthesamecommandagain||`Straza:userisdisabled.ContactyouradministratorRefusingtorun.`from`strazaexec`|TheagentisdisabledinmidPoint,andStrazarefusesitssession|EnabletheagentinmidPoint||`eval-seed`reads`Exited(1)`|Theseederhita`FATAL`step|Readitslogfromtheend,fixthecauseitnames,thenrun`upeval-seed`onthesamefiles||**Needsattention**onOverviewsaysasinkholdsparkedevents|Thesink'starget,Elasticsearchhere,didnotanswer|StartElasticsearchwiththesamefiles,thenpress**Replayelastic**|##Anagentwithaloginsamhasnologinanywhere,sostoppingsamneedsonlyStraza.joealsohasaKeycloakloginforthechatface,givenbyanexplicitassignmentinmidPoint.WhenmidPointdisablesjoe,itsendsthesamestatustobothofitsresources:StrazadeactivateshimoverSCIM,andKeycloakturnshisloginoff.DisablingalogininKeycloakalonestopsnewsign-insandleavesrunningStrazasessionsalive.DeactivatingoverSCIMaloneleavestheloginusable.Aleaverflowhastodoboth,andhereitdoesbecausemidPointprovisionsbothresourcesfromtheonestatus.AsktheKeycloakadminAPIwhetherjoe'sloginison,withthelabadminlogin`admin`/`admin`:Terminal,KeycloakadminAPI:```shKCT=$(curl-s-dclient_id=admin-cli-dusername=admin-dpassword=admin-dgrant_type=passwordhttp://localhost:8480/realms/master/protocol/openid-connect/token|jq-r.access_token)curl-s-H"Authorization:Bearer$KCT"'http://localhost:8480/admin/realms/straza/users?username=joe-java-developer-agent&exact=true'|jq'.[0].enabled'```Itanswers`true`whilejoeisenabledand`false`aftermidPointdisableshim.Itanswers`null`whenKeycloakholdsnologinforjoe,asafterarecreateofthe`keycloak`containerbeforetheseederhasrunagain.##TearitdownStopthestackanddeleteitsvolumes.Nameeveryoverlayyoueverstarted,becausecomposestopsonlytheservicesitcanseeinthefilesyoupass.Terminal,ontheDockerhost,fromtherepositoryroot:```shdockercompose-fdeploy/compose/eval-stack/compose.yaml\-fdeploy/compose/eval-stack/compose.loopback.yaml\-fdeploy/compose/eval-stack/compose.siem.yaml\-fdeploy/compose/eval-stack/compose.demo.yamldown-v--remove-orphans```Composestopsandremoveseverycontainer,networkandnamedvolumeoftheproject.Thenext`up`isafreshboot.Howthispagewaschecked:On2026-11-02theseranagainstthedemostackonthishost,builtatv1.0.0-1695-gdec5ce12andstartedwiththefourfiles:thecontainerlisting,theconfigmount,theseederverdict,thedocscheck,thevolumecountandtheKeycloakquery.Thestack'sElasticsearchwasstopped,sotheindexcountdidnotrun.Nothingranthatwouldrestartorremovethesharedstack:notthelauncher,thefour-file`up`,thetunnelsortheteardown.ItsKeycloakhadbeenrecreatedwithoutaseederrun,soitheldnologinforjoe,andjoe'sdisablewasnotrepeatedforthispage.