Start the self-serve beta

This is the shortest supported beta path. Use Docker Compose for the first evaluation; move to Helm only after the container works against the same NATS environment.

What the access email provides

Do not start until the beta access email includes all of these:

• a versioned release-bundle URL and its SHA-256 checksum;
• an immutable Stream Trace image tag;
• scoped credentials for git.prod.antomic.net;
• the beta version and support contact.

The release bundle contains the production Compose file, its environment-file template, and the Helm chart. It must not contain your credentials.

Compatibility check

Choose an environment with Docker Compose, a reachable NATS server with JetStream, and at least one application stream you are authorized to inspect. For the first investigation, choose a LimitsPolicy stream.

The beta accepts one NATS URL with username/password or token credentials in the URL. A tls:// URL works when the server certificate is trusted by the container’s system trust store. NATS .creds files, NKeys, custom CA files, mTLS client certificates, and multiple seed URLs are not first-class beta configurations.

Historical search is unsupported for WorkQueuePolicy streams because workers remove acknowledged messages. Exclude InterestPolicy streams until you have reviewed the retention effect of adding Stream Trace’s managed consumer.

1. Download and verify the release

Set the values from the access email, then download the exact bundle:

export STREAM_TRACE_BUNDLE_URL='PASTE_THE_VERSIONED_URL'
export STREAM_TRACE_BUNDLE_SHA256='PASTE_THE_SHA256'

curl --fail --location --output stream-trace-beta.tgz "$STREAM_TRACE_BUNDLE_URL"
printf '%s  %s\n' "$STREAM_TRACE_BUNDLE_SHA256" stream-trace-beta.tgz | sha256sum --check
tar -xzf stream-trace-beta.tgz
cd stream-trace-beta

On macOS, replace the sha256sum command with:

printf '%s  %s\n' "$STREAM_TRACE_BUNDLE_SHA256" stream-trace-beta.tgz | shasum -a 256 --check

Stop if the checksum does not match.

2. Sign in to the registry

The access email supplies the two values below. Run docker login git.prod.antomic.net without putting the password in shell history:

export STREAM_TRACE_REGISTRY_USERNAME='PASTE_THE_USERNAME'
export STREAM_TRACE_REGISTRY_PASSWORD='PASTE_THE_PASSWORD'
printf '%s' "$STREAM_TRACE_REGISTRY_PASSWORD" | docker login git.prod.antomic.net \
  --username "$STREAM_TRACE_REGISTRY_USERNAME" \
  --password-stdin

3. Configure the first run

Copy the supplied template outside source control and restrict access to it:

cp deploy/compose/.env.example ./stream-trace.env
chmod 600 ./stream-trace.env
openssl rand -hex 32

Edit stream-trace.env and replace every placeholder. Use the immutable image tag from the email, your NATS URL, the generated value as the JWT signing secret, and a strong temporary bootstrap-admin password. For loopback-only HTTP set ST_AUTH_COOKIE_SECURE=false; keep it true behind HTTPS. Leave indexing and payload indexing disabled for this first run.

4. Start and sign in

docker compose -f deploy/compose/compose.yaml \
  --env-file ./stream-trace.env up -d
docker compose -f deploy/compose/compose.yaml \
  --env-file ./stream-trace.env ps
curl --fail http://127.0.0.1:4000/api/health/live
curl --fail http://127.0.0.1:4000/api/health/ready

Open http://127.0.0.1:4000 and sign in with the bootstrap administrator. After the first successful sign-in, remove the three ST_AUTH_BOOTSTRAP_ADMIN_* values from stream-trace.env and recreate the container with the same Compose command.

5. First useful investigation

The beta is activated when it answers a real question about your own NATS environment—not when the container merely starts:

1. Confirm your application stream appears in the stream inventory.
2. Open a LimitsPolicy stream and inspect its configuration and current state.
3. Open one consumer and inspect pending, acknowledged, or redelivery signals.
4. Follow one signal to the relevant currently retained message, DLQ case, or application trace when that data exists.
5. Write down the operational question and the answer Stream Trace gave you.

Success means your own NATS environment is connected and you completed one useful investigation. Historical and payload search remain optional; review indexing and retention effects before enabling them.

If setup fails

Check common issues, then email info@streamtrace.io with the immutable image tag, the failed step, the live and ready health output, and a bounded log excerpt:

docker compose -f deploy/compose/compose.yaml \
  --env-file ./stream-trace.env logs --since=30m stream-trace

Remove credentials, NATS URLs, message payloads, headers, and sensitive query values before sending logs. Do not send the environment file.