SecondStack pilot - prerequisites

This is what we need in place before the install. The values you type here are collected into a text block on the Handover tab, which you then send to us.

Nothing you enter leaves this browser. Secrets are forgotten when you close the tab. The rest stays in this browser's local storage until you press Forget everything.

The address users will open. It is filled into the DNS records and redirect URIs below.

1. Infrastructure

One Linux VM with a public IP. We run the install over SSH.

Cloud provider
SizeStandard_D8s_v5 or Standard_D8as_v5 (8 vCPU, 32 GB)m7i.2xlarge or m7a.2xlarge (8 vCPU, 32 GB)8 vCPU, 32 GB RAM, x86-64
ImageUbuntu Server 24.04 LTS
Disk256 GB Premium SSD256 GB gp3256 GB SSD
Public IPStaticElastic IPStatic IPv4
Create the VM
How to
  1. portal.azure.com → Virtual machines → Create → Azure virtual machine.
  2. Image: Ubuntu Server 24.04 LTS - x64 Gen2. Size: Standard_D8s_v5.
  3. Authentication type: SSH public key. SSH public key source: Use existing public key, and paste our key from the last item below.
  4. Disks tab: OS disk size 256 GiB, type Premium SSD.
  5. Networking tab: Public IP → Create new, assignment Static.
  6. Review + create. Then copy the Public IP address from the VM's Overview page.
How to
  1. EC2 console → Key pairs → Actions → Import key pair. Paste our key from the last item below.
  2. Instances → Launch instances.
  3. AMI: Ubuntu Server 24.04 LTS, 64-bit (x86). Instance type: m7i.2xlarge.
  4. Key pair: the one you imported.
  5. Configure storage: 256 GiB, gp3.
  6. Launch instance.
  7. Elastic IPs → Allocate Elastic IP address, then Actions → Associate with the instance. Copy that address.
How to
  1. Order a VM with the size, image and disk from the table above.
  2. Make sure it has a public IPv4 address that does not change.
  3. If the provider asks for an SSH key, paste our key from the last item below.
Open the inbound ports
  • 443 and 80 from anywhere
  • 22 from our IP address (we send it to you)
  • Everything else closed
How to
  1. Open the VM → Networking → Network settings → Create port rule → Inbound port rule.
  2. Rule 1: Source Any, Service HTTPS, Action Allow.
  3. Rule 2: Source Any, Service HTTP, Action Allow.
  4. Rule 3: Source IP Addresses with our address, Service SSH, Action Allow.
  5. If Azure already made an SSH rule open to Any, delete it.
How to
  1. Open the instance → Security tab → its security group → Edit inbound rules.
  2. Rule 1: Type HTTPS, Source Anywhere-IPv4.
  3. Rule 2: Type HTTP, Source Anywhere-IPv4.
  4. Rule 3: Type SSH, Source Custom with our address.
  5. Delete any other inbound rule, then Save rules.
How to
  1. Set these rules in your provider's firewall.
  2. If the provider has no firewall, skip this. We set one up on the VM during the install.
Add two DNS A records
→ VM public IP
*. → VM public IP
How to

This depends on where the domain is hosted (Azure DNS, Cloudflare, GoDaddy, Route 53 and so on). In general:

  1. Open the DNS zone of your company domain.
  2. Add a record of type A. Name: the portal hostname. Value: the VM public IP.
  3. Add a second A record. Name: the same hostname with *. in front. Value: the same IP.
  4. Most providers want the name without the company domain, for example ai-portal and *.ai-portal.
  5. If the provider offers a proxy option (the orange cloud in Cloudflare), turn it off for both records.
Give us SSH access
A user with sudo and this key in ~/.ssh/authorized_keys:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOrGKWq5jXr85BV3C0uFNuDCBxbgr5+zELmMI6lqA5B Dmitriy Alergant

2. Single sign-on

Users sign in through your identity provider. Only the users and groups you assign to the app get in.

Identity provider
We will send you the steps for
Nothing to prepare until then.
Register the app
How to
  1. Open entra.microsoft.com → App registrations → New registration.
  2. Name: anything, for example AI Portal.
  3. Supported account types: Accounts in this organizational directory only.
  4. Redirect URI: platform Web, with this value:
  5. Select Register. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.
Create a client secret
How to
  1. In the app: Certificates & secrets → New client secret.
  2. Pick the longest expiry your policy allows, then Add.
  3. Copy the Value column now. Entra shows it only once.
Add two app roles: User and Admin
How to
  1. In the app: App roles → Create app role.
  2. Display name User, allowed member types Users/Groups, value User, any description. Apply.
  3. Repeat with Admin.
Add the acct token claim
How to
  1. In the app: Token configuration → Add optional claim.
  2. Token type ID, tick acct, Add.
Add the Microsoft Graph permissions
Application permissions, used to read the users and groups assigned to this app.
How to
  1. In the app: API permissions → Add a permission → Microsoft Graph → Application permissions.
  2. Add these five:
    • Application.Read.All
    • Group.Read.All
    • GroupMember.Read.All
    • User.Read.All
    • User.EnableDisableAccount.All
  3. Select Grant admin consent. This needs a Global Administrator or Privileged Role Administrator.
Assign the pilot users
How to
  1. Open Enterprise applications and select the same app.
  2. Properties → set Assignment required? to Yes → Save.
  3. Users and groups → Add user/group. Select the pilot users or a group, with the role User.
  4. Do the same for the platform admins, with the role Admin.

3. Sources of intelligence

The platform has no models of its own. It calls the providers with your keys and they bill you directly. Tick each source you plan to use.

Models via API billing

Create an API key
At console.anthropic.com. Check that the spend limit covers the pilot.
Create an API key
At platform.openai.com. Check that the spend limit covers the pilot.
Deploy the models you want
How to
  1. In the Azure portal, create an Azure OpenAI resource, or open the one you have.
  2. Select Go to Azure AI Foundry portal → Deployments → Deploy model. Deploy each model you want and note the deployment names.
  3. Back in the Azure portal, open the resource → Keys and Endpoint. Copy the Endpoint and KEY 1.
Create an API key
In Google AI Studio: aistudio.google.com → Get API key.

Subscriptions

Recommended extras

Create an API key
At exa.ai.
Create an API key at OpenRouter or TypeSafe.ai
At openrouter.ai or typesafe.ai. One of the two is enough.

4. Integrations

Agents act in these systems as the signed-in user, with that user's permissions. Tick the ones you want in the pilot. More can be added after the install.

Check that your workspace allows a custom Slack app
If app installs need admin approval, get it before the install date.
Book a call with your Slack admin
We create the Slack app with them during the install.
Register a second Entra ID app
How to
  1. entra.microsoft.com → App registrations → New registration.
  2. Supported account types: Accounts in this organizational directory only.
  3. Redirect URI: platform Web, with this value:
  4. Certificates & secrets → New client secret. Copy the Value.
Add the Microsoft Graph permissions
How to
  1. In the app: API permissions → Add a permission → Microsoft Graph → Delegated permissions.
  2. Add what you want agents to reach:
    • Mail: Mail.ReadWrite, Mail.Send
    • Calendar: Calendars.ReadWrite
    • Files: Files.ReadWrite.All
    • SharePoint: Sites.ReadWrite.All
    • Always: openid, profile, email, offline_access
  3. For read-only access, use the .Read versions.
  4. If your tenant does not let users consent, select Grant admin consent.
Create a Google Cloud project and enable the APIs
How to
  1. console.cloud.google.com → create a project.
  2. APIs & Services → Library. Enable: Gmail API, Google Drive API, Google Calendar API, Google Docs API, Google Sheets API.
  3. OAuth consent screen: user type Internal.
Create an OAuth client
How to
  1. APIs & Services → Credentials → Create credentials → OAuth client ID.
  2. Application type: Web application.
  3. Authorized redirect URI:
Allow the portal in Atlassian Administration
How to
  1. admin.atlassian.com → Connectors → Atlassian MCP server → Add domain.
  2. Enter:
  3. Your email domain must be verified in Atlassian.
Create a GitHub App in your organization
How to
  1. Organization Settings → Developer settings → GitHub Apps → New GitHub App.
  2. Callback URL:
  3. Tick Expire user authorization tokens. Leave Request user authorization (OAuth) during installation unticked.
  4. Setup URL, with Redirect on update ticked:
  5. Webhook: untick Active.
  6. Repository permissions: Contents and Pull requests Read and write; Metadata, Actions and Checks Read-only.
  7. Create the app. Then generate a client secret and a private key.
Install the app on your organization
Select the repositories agents may access.

Handover

Generated from what you entered on the other tabs. Items still open are listed as well.

This block contains secrets. Send it over the agreed secure channel, never by email or chat.