OS Compatibility & Prerequisites

Node.js Runtime

• VersionNode.js 20 LTS or 22 LTS
• Package Managernpm 10+ (bundled with Node.js)
• Installcurl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -

Python Runtime

• VersionPython 3.10+ (for AI/ML modules)
• Packagespip, venv, wheel
• PurposeAI chatbot, RCA forensics, ML pipelines

System Packages

• Build Toolsgcc, g++, make, autoconf
• Librarieslibssl-dev, libffi-dev, zlib1g-dev
• Utilitiescurl, wget, git, unzip, jq

Container Runtime (Optional)

• DockerDocker Engine 24+ or Docker Desktop
• ComposeDocker Compose v2.20+
• KubernetesK8s 1.28+ (for HA deployments)

PostgreSQL Configuration

• max_connections200 (Standard) / 500 (Enterprise)
• shared_buffers25% of available RAM
• effective_cache_size75% of available RAM
• work_mem64 MB
• wal_levelreplica (for HA setups)
• SSLEnabled for production

Database User Setup

-- Create dedicated database & user
CREATE USER minusnow WITH PASSWORD 'secure_password';
CREATE DATABASE minusnow_db OWNER minusnow;

-- Grant privileges
GRANT ALL PRIVILEGES ON DATABASE minusnow_db TO minusnow;

-- Enable extensions (connect to minusnow_db first)
\c minusnow_db
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS "pg_trgm";

Application Server User

• Userminusnow (non-root, dedicated)
• Shell/bin/bash
• Home Dir/opt/minusnow
• SudoNot required for normal operation
• File AccessRead/write to /opt/minusnow, /var/log/minusnow

# Create application user
sudo useradd -r -m -d /opt/minusnow -s /bin/bash minusnow
sudo mkdir -p /var/log/minusnow
sudo chown minusnow:minusnow /var/log/minusnow

Agent User

• Usermnow-agent (dedicated service account)
• SudoRequired for autohealing module
• Sudoers EntryScoped to specific commands only
• Groupsmnow-agent, systemd-journal

# Create agent user with controlled sudo
sudo useradd -r -s /usr/sbin/nologin mnow-agent
echo "mnow-agent ALL=(ALL) NOPASSWD: \
  /bin/systemctl restart *, \
  /bin/systemctl start *, \
  /bin/systemctl stop *, \
  /usr/bin/apt, \
  /usr/bin/yum, \
  /usr/bin/dnf, \
  /usr/sbin/reboot" \
  | sudo tee /etc/sudoers.d/mnow-agent

Linux — User & Permissions

• Service Usermnow-agent (shared agent user)
• Sudo RequiredYes — scoped to specific commands
• Groupsmnow-agent, systemd-journal
• CapabilitiesService restart/start/stop, package install/update, disk cleanup (tmpwatch, journalctl --vacuum), scheduled reboot

# Sudoers for autohealing (Linux)
mnow-agent ALL=(ALL) NOPASSWD: \
  /bin/systemctl restart *, \
  /bin/systemctl start *, \
  /bin/systemctl stop *, \
  /usr/bin/apt install -y *, \
  /usr/bin/apt upgrade -y, \
  /usr/bin/yum install -y *, \
  /usr/bin/yum update -y, \
  /usr/bin/dnf install -y *, \
  /usr/sbin/reboot, \
  /usr/bin/journalctl --vacuum-size=*, \
  /usr/bin/find /tmp -type f -mtime +7 -delete

Windows — User & Permissions

• Service AccountNT SERVICE\MinusNowAgent or domain MSA
• Local AdminRequired for service control and patch operations
• CapabilitiesRestart-Service, Start/Stop-Service, WSUS/WU patch apply, Disk Cleanup, scheduled reboot

# Grant minimal autohealing permissions (PowerShell)
$svc = "MinusNowAgent"
sc.exe sdset $svc "D:(A;;RPWPDTRC;;;SY)(A;;CCLCSWRPWPDTLOCRRC;;;BA)"

# Or add to local Administrators group
Add-LocalGroupMember -Group "Administrators" `
  -Member "NT SERVICE\MinusNowAgent"

Linux — User & Permissions

• Service Usermnow-agent (shared)
• Sudo RequiredNo — read-only access is sufficient
• Groupsmnow-agent, systemd-journal, docker (if container monitoring)
• Read Access/proc, /sys, /var/log, /etc/os-release

# Ensure agent can read system metrics
sudo usermod -aG systemd-journal mnow-agent
# For Docker container monitoring (optional)
sudo usermod -aG docker mnow-agent

Windows — User & Permissions

• Service AccountNT SERVICE\MinusNowAgent
• Admin RightsNot required for basic metrics
• WMI AccessRequired — add to WMI Users group
• Perf CountersAdd to Performance Monitor Users group

# Add to performance monitoring groups (PowerShell)
Add-LocalGroupMember -Group "Performance Monitor Users" `
  -Member "NT SERVICE\MinusNowAgent"

# Enable WMI access for the service account
winmgmt /verifyrepository

Linux — User & Permissions

• Scan Usermnow-agent — read-only scan requires no sudo
• Patch Usermnow-agent (with sudo) or dedicated mnow-patch
• Sudo (patch)Required — scoped to package managers
• Read Access/var/lib/dpkg, /var/lib/rpm, /proc/version, kernel info

# Sudoers for patch management
mnow-agent ALL=(ALL) NOPASSWD: \
  /usr/bin/apt update, \
  /usr/bin/apt upgrade -y, \
  /usr/bin/apt install -y *, \
  /usr/bin/yum update -y, \
  /usr/bin/yum install -y *, \
  /usr/bin/dnf upgrade -y, \
  /usr/bin/dnf install -y *

# Optional: create dedicated patch user
sudo useradd -r -s /usr/sbin/nologin mnow-patch
echo "mnow-patch ALL=(ALL) NOPASSWD: /usr/bin/apt*, /usr/bin/yum*, /usr/bin/dnf*" \
  | sudo tee /etc/sudoers.d/mnow-patch

Windows — User & Permissions

• Scan UserNT SERVICE\MinusNowAgent (no admin for scan)
• Patch UserNT SERVICE\MinusNowPatch (optional dedicated) or admin agent
• Local AdminRequired for patch installation
• WSUS IntegrationIf using WSUS, service account needs WSUS Reporter role

# Optional: create dedicated patch service account
New-LocalUser -Name "MinusNowPatch" `
  -Description "MinusNow Patch Management" `
  -PasswordNeverExpires -UserMayNotChangePassword
Add-LocalGroupMember -Group "Administrators" `
  -Member "MinusNowPatch"

Linux — User & Permissions

• Service Usermnow-agent (shared)
• Sudo RequiredNo — read-only log access
• Groupssystemd-journal, adm (for /var/log access)
• Read Paths/var/log/syslog, /var/log/messages, /var/log/kern.log, /var/log/auth.log, app-specific log dirs

# Grant log read access
sudo usermod -aG adm mnow-agent
sudo usermod -aG systemd-journal mnow-agent

# Grant read access to application logs
sudo setfacl -R -m u:mnow-agent:rX /var/log/nginx
sudo setfacl -R -m u:mnow-agent:rX /var/log/postgresql
sudo setfacl -R -m u:mnow-agent:rX /opt/app/logs

Windows — User & Permissions

• Service AccountNT SERVICE\MinusNowAgent
• Admin RightsNot required for event log reading
• Event Log AccessAdd to Event Log Readers group
• Log SourcesApplication, System, Security, IIS, SQL Server logs

# Grant event log read access (PowerShell)
Add-LocalGroupMember -Group "Event Log Readers" `
  -Member "NT SERVICE\MinusNowAgent"

# Verify access
Get-WinEvent -LogName Application -MaxEvents 1

Linux — User & Permissions

• Service Usermnow-agent (shared)
• Sudo RequiredNo — read-only hardware and software enumeration
• Read Access/sys/class/dmi, /proc/cpuinfo, /proc/meminfo, /etc/*-release
• Tools Usedlshw, dmidecode (if available), ip, ss, package managers

# Ensure agent can read hardware info
# dmidecode requires root — agent uses /sys fallback
ls /sys/class/dmi/id/  # Available without root
cat /sys/class/dmi/id/product_name
cat /sys/class/dmi/id/sys_vendor

# Network interface enumeration (no root needed)
ip -j addr show
ss -tlnp

Windows — User & Permissions

• Service AccountNT SERVICE\MinusNowAgent
• Admin RightsNot required for basic inventory
• WMI AccessRequired — Win32_ComputerSystem, Win32_OperatingSystem, Win32_Product
• Registry ReadHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

# Verify WMI access for inventory
Get-WmiObject Win32_ComputerSystem | Select Manufacturer,Model
Get-WmiObject Win32_OperatingSystem | Select Caption,Version
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Select DisplayName, DisplayVersion | Sort DisplayName

Server Infrastructure

• ☐ OS InstalledSupported OS from compatibility matrix
• ☐ HardwareMeets minimum specs for your tier
• ☐ DNSFQDN configured for the platform
• ☐ TLS CertificateValid SSL cert (or use Let's Encrypt)
• ☐ NTPTime synchronization configured
• ☐ FirewallRequired ports opened per matrix

Software Dependencies

• ☐ Node.jsv20 LTS or v22 LTS installed
• ☐ Python3.10+ installed (for AI modules)
• ☐ PostgreSQL14-16 installed and running
• ☐ Redis7.0+ installed (recommended)
• ☐ Build Toolsgcc, make, libssl-dev present
• ☐ GitGit 2.30+ installed

User & Permissions

• ☐ App Userminusnow user created
• ☐ DB UserPostgreSQL user and database created
• ☐ Agent Usermnow-agent with sudoers (for autohealing)
• ☐ DB Monitormnow_monitor read-only DB user created
• ☐ Log Accessmnow-agent in adm + systemd-journal groups
• ☐ Log Directory/var/log/minusnow writable
• ☐ Patch Usermnow-patch (optional, for separated patch ops)

Network & Connectivity

• ☐ Outbound HTTPSAccess to update servers
• ☐ Internal Ports5000, 5432, 6379 reachable between nodes
• ☐ Agent Port8443 reachable from managed hosts
• ☐ SMTPEmail relay configured (for notifications)