{
    "product": "Cenvero Stratum",
    "generated_at": "2026-08-03T07:16:17+00:00",
    "format": "cenvero-docs-v1",
    "document_count": 1,
    "documents": [
        {
            "slug": "quickstart",
            "title": "Quick Start",
            "category": null,
            "url": "https://stratum.cenvero.com/docs/quickstart",
            "headings": [
                {
                    "level": 1,
                    "text": "Quick Start"
                },
                {
                    "level": 2,
                    "text": "1. Define a network"
                },
                {
                    "level": 2,
                    "text": "2. Attach a workload to an endpoint"
                },
                {
                    "level": 2,
                    "text": "3. Add a firewall policy"
                },
                {
                    "level": 2,
                    "text": "4. Define a load-balanced VIP"
                },
                {
                    "level": 2,
                    "text": "5. Confirm"
                },
                {
                    "level": 2,
                    "text": "Where to go next"
                }
            ],
            "word_count": 505,
            "markdown": "# Quick Start\n\nThis walkthrough takes an installed, activated node and gets a workload onto a\nmanaged network with DHCP, DNS, and a firewall policy — end to end.\n\nIf you have not installed the agent yet, start with\n[Installation](/docs/installation).\n\n## 1. Define a network\n\nA *network* is a managed private network: an IP CIDR whose usable host addresses\nare each materialized into an **endpoint profile** (an IP paired with a generated\nMAC). Create one with the CLI:\n\n```bash\nsudo cenvero-str-ctl network create \\\n  --name app-net \\\n  --cidr 10.20.0.0/24 \\\n  --gateway 10.20.0.1\n```\n\nStratum allocates the segment on the workload bridge, starts a DHCP server\nfor the pool, and serves authoritative DNS for the network's zone.\n\nList what you have:\n\n```bash\ncenvero-str-ctl network list\n```\n\n```text\n{\n  \"data\": {\n    \"networks\": [\n      {\n        \"id\": \"net-069088314b4e4712\",\n        \"name\": \"app-net\",\n        \"cidr\": \"10.20.0.0/24\",\n        \"gateway\": \"10.20.0.1\",\n        \"vlan\": 0,\n        \"tenant_id\": \"\",\n        \"created_at\": \"2026-07-24T20:53:31Z\"\n      }\n    ]\n  },\n  \"status\": \"ok\"\n}\n```\n\nNote the generated `id` — the other `network` commands refer to a network by\nthat id, not by its name.\n\n## 2. Attach a workload to an endpoint\n\nClaim a free endpoint for your workload. Stratum returns the endpoint's IP and a\ngenerated MAC, wires it into the bridge, and programs the data plane (including\nthe IP↔MAC anti-spoof binding) for it:\n\n```bash\nsudo cenvero-str-ctl network attach net-069088314b4e4712 --ip 10.20.0.50\n```\n\nConfigure your workload's interface with the returned MAC and it picks up the\nendpoint's IP from DHCP, a working default gateway, and DNS — no guest agent\nrequired.\n\n```bash\ncenvero-str-ctl network endpoints net-069088314b4e4712\n```\n\n```text\n{\n  \"data\": {\n    \"endpoints\": [\n      {\n        \"id\": \"ep-3f2a91c7\",\n        \"network_id\": \"net-069088314b4e4712\",\n        \"ip\": \"10.20.0.50\",\n        \"mac\": \"52:54:00:ab:cd:01\",\n        \"state\": \"bound\"\n      }\n    ]\n  },\n  \"status\": \"ok\"\n}\n```\n\n## 3. Add a firewall policy\n\nEach firewall rule is a single JSON object. Allow inbound HTTP and HTTPS to the\nendpoint, and let it reach out. Ports are matched one at a time, so HTTP and\nHTTPS are two rules:\n\n```bash\nsudo cenvero-str-ctl firewall allow '{\"chain\":\"forward\",\"dest_ip\":\"10.20.0.50\",\"protocol\":\"tcp\",\"dest_port\":443,\"stateful\":true}'\n\nsudo cenvero-str-ctl firewall allow '{\"chain\":\"forward\",\"dest_ip\":\"10.20.0.50\",\"protocol\":\"tcp\",\"dest_port\":80,\"stateful\":true}'\n\nsudo cenvero-str-ctl firewall allow '{\"chain\":\"forward\",\"source_ip\":\"10.20.0.50\",\"stateful\":true}'\n```\n\n`\"stateful\": true` puts the flow in the connection-tracking table so return\ntraffic is admitted automatically. See [Firewall](/docs/networking/firewall) for\nthe full policy model and every rule field.\n\n## 4. Define a load-balanced VIP\n\nDeclare an L4 virtual IP, then attach a backend to it so you can scale\nhorizontally later:\n\n```bash\nsudo cenvero-str-ctl lb create '{\"id\":\"web-lb\",\"frontend_ip\":\"10.20.0.10\",\"frontend_port\":80,\"protocol\":\"tcp\",\"algorithm\":\"least-conn\"}'\n\nsudo cenvero-str-ctl lb add-backend '{\"vip_id\":\"web-lb\",\"id\":\"web-1\",\"ip\":\"10.20.0.50\",\"port\":80,\"weight\":1}'\n```\n\nAdd and remove backends live with `lb add-backend` / `lb remove-backend`. See\n[Load Balancer](/docs/networking/load-balancer).\n\n## 5. Confirm\n\n```bash\ncenvero-str-ctl status\n```\n\nYou now have a workload on a managed network with DHCP, DNS, a firewall policy,\nand a load-balancer VIP defined — all from one agent.\n\n## Where to go next\n\n- **[Configuration](/docs/configuration)** — the node configuration model in depth.\n- **[Clustering Overview](/docs/clustering/overview)** — stretch the network across hosts.\n- **[CLI Reference](/docs/cli)** — every command in one place.\n"
        }
    ]
}