# Runbook

## Service Overview

mcat is a web application for testing MCIAS login policies. It runs a TLS
web server that lets users log in via MCIAS with a configurable service
name and tag set.

## Health Check

1. Open `https://<host>:8443/login` in a browser.
2. If the login form renders, the service is healthy.

## Common Operations

### Start

```bash
systemctl start mcat
```

### Stop

```bash
systemctl stop mcat
```

### View Logs

```bash
journalctl -u mcat -f
```

### Run Locally

```bash
make mcat
./mcat server --config srv/mcat.toml
```

## Configuration

Config file: `/srv/mcat/mcat.toml`

After changing config, restart the service:

```bash
systemctl restart mcat
```

## TLS Certificate Renewal

1. Replace `/srv/mcat/certs/cert.pem` and `/srv/mcat/certs/key.pem`.
2. Restart: `systemctl restart mcat`.

## MCIAS Unreachable

If MCIAS is down, logins and token validation will fail. Users will see
generic error messages. Check MCIAS connectivity:

```bash
curl -k https://<mcias-host>:8443/v1/health
```

## Escalation

If the issue is not covered above, check MCIAS logs and status. mcat has
no local state — all authentication is delegated to MCIAS.