Welcome to Axiomize

First-day setup for support analysts. ~30–45 minutes start to finish.

Before you start

You should have received from your operator, via a secure channel:

You’ll also need:

Step 1 — Install the NetBird client

NetBird is the mesh VPN that connects you to internal services. Without it, nothing else on this page works.

macOS

brew install netbirdio/tap/netbird

Or download the .pkg installer from netbird.io/download.

Windows

Download the .msi installer from netbird.io/download. Run as administrator.

Windows + WSL users: install NetBird on the Windows side, not inside WSL. WSL does not control the laptop’s network adapters, so a WSL-installed client cannot route traffic correctly.

Linux (Debian/Ubuntu)

curl -fsSL https://pkgs.netbird.io/install.sh | sudo bash

Step 2 — Trust the Axiomize internal CA

Internal services (Keycloak, OpenBao, Grafana) use TLS certificates issued by our internal certificate authority. Installing these two CA files into your operating system’s trust store is what lets your browser and CLI tools validate them as legitimate.

Download both: axiomize-internal-root.crt axiomize-internal-intermediate.crt

macOS

  1. Open Keychain Access.
  2. File → Import Items → select both .crt files.
  3. For each: double-click → expand Trust → set When using this certificate to Always Trust.

Windows

Easiest via PowerShell as administrator:

Import-Certificate -FilePath axiomize-internal-root.crt `
  -CertStoreLocation Cert:\LocalMachine\Root
Import-Certificate -FilePath axiomize-internal-intermediate.crt `
  -CertStoreLocation Cert:\LocalMachine\CA

Or via the GUI: certlm.msc as administrator, install root into Trusted Root Certification Authorities and intermediate into Intermediate Certification Authorities.

Linux (Debian/Ubuntu)

sudo cp axiomize-internal-root.crt axiomize-internal-intermediate.crt \
    /usr/local/share/ca-certificates/
sudo update-ca-certificates
Windows + WSL: Windows trust and WSL trust are independent. Install in both — Windows so your browser trusts the certs, WSL so your shell tools (curl, openssl, bao) do.

Step 3 — First login

Start NetBird:

A browser window opens to a Keycloak login page. Sign in with the username + temporary password your operator gave you. Keycloak will then walk you through, in order:

  1. Set a permanent password. The temporary one becomes invalid.
  2. Enroll TOTP. A QR code appears — scan it with your authenticator app, then type back one of the codes the app shows you.

When both are done, the browser closes and NetBird finishes connecting. You’re on the mesh.

Step 4 — Verify your access

Open Grafana in a browser: https://monitoring.prod.local:3000/

Click Sign in with OAuth. The browser bounces through Keycloak (your existing session covers the auth) and lands you in Grafana with read access to the dashboards.

If the page loads with no TLS warning and you see dashboards, you’re fully onboarded. Confirm with your operator out-of-band.

Step 5 (optional) — Tools for SQL log analysis

If your work includes running SQL queries against the centralized log data, install:

Then add these to your shell rc file (required for the SeaweedFS S3 endpoint):

export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required

The operator will share a starter query library separately.

Troubleshooting