cp-agentic-mcp-playground

# Check Point Agentic MCP Playground <p align="left"> <img src="https://img.shields.io/badge/License-MIT-blue.svg" /> <img src="https://img.shields.io/badge/Docker-Compose-blue?logo=docker" /> <img src="https://img.shields.io/badge/n8n-Automation-orange?logo=n8n" /> <img src="https://img.shields.io/badge/langflow-Workflow-green?logo=langflow" /> <img src="https://img.shields.io/badge/Ollama-LLM-grey" /> <img src="https://img.shields.io/badge/Check%20Point-MCP-magenta?" /> <img src="https://img.shields.io/badge/Status-Production%20Ready-success" /> </p> > **A Production-Ready Local Playground for Agentic AI with Check Point MCP Servers** > > Bring up n8n + NetBox + Batfish + Ollama + Flow UIs + Qdrant + a full fleet of Check Point MCP servers with: > > ```bash > docker compose --profile cpu up -d > ``` --- ## Quick Overview A **production-ready, multi-service Docker Compose stack** that brings up a full local AI + Check Point MCP (Model Context Protocol) environment: - **n8n** – workflow automation + MCP tools orchestrator - **PostgreSQL** – n8n backend database - **Auto-provisioner** – creates the n8n instance owner **and** installs `n8n-nodes-mcp` - **Ollama** – local LLMs; CPU **or** NVIDIA GPU; auto model pull - **Open WebUI** – chat UI for Ollama / LLMs - **Langflow** – visual AI flow builder - **Flowise** – LLM orchestration UI - **Qdrant** – vector database for embeddings - **NetBox** – DCIM/IPAM platform (with dedicated Postgres + Redis) - **Batfish** – network analysis engine with MCP bridge and CLI utility containers - **OpenClaw gateway** – local-first gateway configured for `ollama-cpu` - **OpenClaw MCP server** – Streamable HTTP bridge for OpenClaw sessions - **n8n admin MCP server** – stdio MCP server for n8n API administration - **Check Point MCP servers** – dedicated HTTP sidecars on the Docker network The goal is a **single lab stack** for building, testing, and demoing AI + Check Point workflows: - Instance owner is **auto-configured** - `n8n-nodes-mcp` is **pre-installed** - MCP servers are reachable as **HTTP tools** from inside n8n --- ## Navigation - [📦 Quick Start](#-quick-start) - [🔧 Tech Stack & Layout](#-tech-stack--layout) - [⚙️ Environment--env](#%EF%B8%8F-environment-env) - [🏗️ Build & Profiles](#%EF%B8%8F-build--profiles) - [🎯 n8n Provision & Auto-Import](#-n8n-provision--auto-import) - [🧰 NetBox + n8n Examples](#-netbox--n8n-examples) - [🛰️ Batfish Services](#%EF%B8%8F-batfish-services) - [🌐 URLs & MCP Endpoints](#-urls--mcp-endpoints) - [🤖 Ollama Models](#-ollama-models) - [💾 Data & Persistence](#-data--persistence) - [📚 Guides](#-guides) - [🚀 Production Deployment](docs/operations/PRODUCTION_DEPLOYMENT.md) - [💿 Backup & Recovery](docs/operations/BACKUP_RECOVERY.md) - [🔍 Troubleshooting](#-troubleshooting) - [🔄 Updating & Resetting](#%EF%B8%8F-updating--resetting) --- ## Quick Start <details> <summary><strong>1. Requirements</strong></summary> - **Docker Engine** + **Docker Compose v2** - Free ports from `.env` (e.g. `5678`, `5432`, `8000`, `9997`, `9996`, `7320`, `3000`, `3001`, `7860`, `6333`, `11434`, `73xx`, …) - Outbound Internet access from containers (for: - Pulling images - Installing community nodes - Pulling Ollama models) - All commands executed from the folder containing `docker-compose.yml` and `.env` **Optional – GPU Profile** - NVIDIA GPU on the host - **NVIDIA Container Toolkit** installed - `nvidia-smi` works on the host </details> <details> <summary><strong>2. Minimal Happy Path</strong></summary> 1. Clone external MCP/gateway repositories used by this stack: ```bash mkdir -p mcp-servers-source cd mcp-servers-source git clone https://github.com/openclaw/openclaw.git git clone https://github.com/rodgco/openclaw-mcp-server.git git clone https://github.com/illuminaresolutions/n8n-mcp-server.git cd .. ``` 2. Run the setup script to generate a secure `.env` file: ```bash ./setup.sh ``` (Or manually create a `.env` file if you prefer, see [Environment](#%EF%B8%8F-environment-env)). 3. Build the custom n8n image: ```bash docker compose build n8n ``` 4. Start the CPU stack: ```bash docker compose --profile cpu up -d ``` 5. Wait 30–60 seconds for: - Postgres - NetBox (and its Postgres/Redis dependencies) - Batfish + Batfish MCP bridge + Batfish CLI - n8n - Provisioner (owner + `n8n-nodes-mcp`) - Optional `n8n-import` (workflows/credentials) 6. Browse to your UIs: - <http://localhost:5678> - <http://localhost:8000> - <http://localhost:9997> - Log in with the owner credentials from `.env` </details> <details> <summary><strong>3. GPU Profile</strong></summary> If you want Ollama to use GPU instead of CPU: ```bash # Start GPU profile docker compose --profile gpu-nvidia up -d # Or CPU + GPU together docker compose --profile cpu --profile gpu-nvidia up -d ``` To avoid repeating profiles each time: ```bash export COMPOSE_PROFILES=cpu docker compose up -d ``` </details> --- ## Tech Stack & Layout ### Stack Summary | Component | Purpose | |----------------|----------------------------------------------| | n8n | Automation engine + MCP orchestrator | | PostgreSQL | n8n backend DB | | n8n-provision | Owner creation + `n8n-nodes-mcp` installation| | n8n-import | Optional workflow & credential auto-import | | Ollama | Local LLM server (CPU / GPU) | | Open WebUI | Chat UI for Ollama | | Flowise | LLM orchestration / low-code builder | | Langflow | Visual AI flow builder | | Qdrant | Vector database | | NetBox | DCIM/IPAM web platform | | Batfish | Network config analysis engine | | Batfish MCP | Batfish API bridge for automations | | Batfish CLI | pybatfish utility container | | OpenClaw | Agent gateway (default model `llama3.2:3b`) | | OpenClaw MCP | HTTP MCP bridge into OpenClaw sessions | | n8n admin MCP | stdio MCP server for n8n API operations | | MCP sidecars | Check Point MCP tools as HTTP servers | ### Repository Layout ```bash . ├─ docker-compose.yml # Multi-service stack (CPU / GPU profiles) ├─ .env # Passwords / ports / admin values ├─ docker/ │ └─ n8n/ │ └─ Dockerfile # Custom n8n image (MCP CLIs + wrappers baked in) ├─ scripts/ │ └─ n8n-provision.sh # Sidecar: owner setup + login + community node install ├─ n8n/ │ ├─ backup/ # Workflows/credentials to auto-import (optional) │ └─ custom-nodes/ # Extra n8n nodes (persisted) ├─ langflow/ │ └─ flows/ # Example Langflow flows ├─ qdrant/ # Local backup / collections for Qdrant └─ mcp-servers-source/ ├─ openclaw/ # OpenClaw official source repo ├─ openclaw-mcp-server/ # OpenClaw MCP server source (rodgco) └─ n8n-mcp-server/ # n8n admin MCP server source ``` --- ## Environment (`.env`) Create a `.env` next to `docker-compose.yml`: ```env # ───────── n8n DB ───────── POSTGRES_USER=admin POSTGRES_PASSWORD=change_me POSTGRES_DB=n8n POSTGRES_PORT=5432 # ───────── NetBox ───────── NETBOX_IMAGE=netboxcommunity/netbox:latest NETBOX_PORT=8000 NETBOX_POSTGRES_DB=netbox NETBOX_POSTGRES_USER=netbox NETBOX_POSTGRES_PASSWORD=change_me NETBOX_SECRET_KEY=long_random_netbox_secret NETBOX_SUPERUSER_NAME=admin NETBOX_SUPERUSER_EMAIL=admin@netbox.local NETBOX_SUPERUSER_PASSWORD=change_me NETBOX_BASE_URL=http://netbox:8080 NETBOX_API_TOKEN= # ───────── Batfish ───────── BATFISH_IMAGE=batfish/allinone:latest BATFISH_PORT=9997 BATFISH_WORKER_PORT=9996 BATFISH_BASE_URL=http://batfish:9997 BATFISH_MCP_PORT=7320 BATFISH_MCP_URL=http://batfish-mcp:3020 BATFISH_MCP_API_KEY=change_me BATFISH_DEFAULT_NETWORK=demo BATFISH_DEFAULT_SNAPSHOT=snapshot # ───────── n8n Web ───────── N8N_PORT=5678 N8N_ENCRYPTION_KEY=long_random_encryption_key N8N_USER_MANAGEMENT_JWT_SECRET=supersecretjwtkey # ───────── n8n Owner / Admin ───────── N8N_ADMIN_EMAIL=admin@cpdemo.com N8N_ADMIN_FIRST_NAME=Admin N8N_ADMIN_LAST_NAME=User N8N_ADMIN_PASSWORD=change_me # ───────── n8n Basic Auth ───────── N8N_BASIC_AUTH_USER=admin N8N_BASIC_AUTH_PASSWORD=change_me # ───────── Ollama ───────── OLLAMA_HOST=ollama-cpu:11434 OLLAMA_PORT=11434 # ───────── Other UIs ───────── OPEN_WEBUI_PORT=3000 FLOWISE_PORT=3001 LANGFLOW_PORT=7860 QDRANT_PORT=6333 # ───────── MCP (fill what you use) ───────── DOC_CLIENT_ID= SECRET_KEY= DOC_REGION= MANAGEMENT_HOST= SMS_API_KEY= TE_API_KEY= REPUTATION_API_KEY= SPARK_MGMT_CLIENT_ID= SPARK_MGMT_SECRET_KEY= SPARK_MGMT_REGION= SPARK_MGMT_INFINITY_PORTAL_URL= HARMONY_SASE_CLIENT_ID= HARMONY_SASE_SECRET_KEY= HARMONY_SASE_REGION= CPINFO_LOG_LEVEL=info ``` > 💡 **Tip** > - `N8N_ADMIN_*` is used by the provisioner to call `/rest/owner/setup`. > - `N8N_BASIC_AUTH_*` must match what the provisioner uses to authenticate. > - Only populate the MCP variables for the services you actually use (or comment out those services in `docker-compose.yml`). --- ## Build & Profiles ### Build the Custom n8n Image The Check Point MCP sidecars reuse a **custom n8n base image** with MCP CLIs and wrappers baked in. ```bash docker compose build n8n ``` This produces an image (e.g. `custom-mcp-n8n:custom`) which includes: - All relevant `@chkp/*` MCP CLI packages - Wrapper scripts in `/usr/local/bin` for each MCP service: - `mcp-documentation` - `mcp-https-inspection` - `mcp-quantum-management` - `mcp-management-logs` - `threat-emulation-mcp` - `threat-prevention-mcp` - `spark-management-mcp` - `reputation-service-mcp` - `harmony-sase-mcp` - `quantum-gw-cli-mcp` - `quantum-gw-connection-analysis-mcp` - `quantum-gaia-mcp` - `cpinfo-analysis-mcp` ### Start the Stack **CPU stack:** ```bash docker compose --profile cpu up -d ``` **GPU (NVIDIA) Ollama stack:** ```bash docker compose --profile gpu-nvidia up -d ``` **Both profiles:** ```bash docker compose --profile cpu --profile gpu-nvidia up -d ``` Set a default profile: ```bash export COMPOSE_PROFILES=cpu docker compose up -d ``` --- ## n8n Provision & Auto-Import ### Provisioner (`n8n-provision`) The `n8n-provision` sidecar runs **once** and performs: 1. Wait for `http://n8n:5678/healthz` 2. Create the owner via `/rest/owner/setup` (using `N8N_ADMIN_*`) 3. Login using `N8N_BASIC_AUTH_*` and owner credentials 4. Install `n8n-nodes-mcp` (idempotent – HTTP 400 “already installed” is fine) 5. Exit Safe to re-run; it will **skip** already-completed steps. ### Auto-Import (`n8n-import`) If you place exported assets in: - `./n8n/backup/credentials` - `./n8n/backup/workflows` the `n8n-import` container will, after everything is healthy: ```bash n8n import:credentials --separate --input=/backup/credentials n8n import:workflow --separate --input=/backup/workflows ``` Leave these folders empty to skip auto-import. --- ## NetBox + n8n Examples Three NetBox example workflows are included in: - `n8n/backup/workflows/netbox-list-devices.json` - `n8n/backup/workflows/netbox-list-prefixes.json` - `n8n/backup/workflows/netbox-find-device-by-name.json` These are imported by `n8n-import` with the rest of the backup workflows. ### Setup 1. Create a NetBox API token in NetBox UI (`http://localhost:8000`) under user profile API tokens. 2. Set `NETBOX_API_TOKEN` in `.env`. 3. Ensure `NETBOX_BASE_URL` remains `http://netbox:8080` for in-network n8n calls. 4. Restart n8n services: ```bash docker compose --profile cpu up -d n8n n8n-import ``` Each workflow starts with a manual trigger and can be adjusted quickly by editing the `NetBox Config` node. --- ## 🛰️ Batfish Services The stack includes three Batfish-related containers on the same `demo` network: - `batfish` - Batfish all-in-one engine (`9997` coordinator API, `9996` worker service) - `batfish-mcp` - Batfish API bridge service (`/healthz`, `/tools`, `/networks`, `/questions`, `/query`) - `batfish-cli` - pybatfish utility container for interactive troubleshooting Included n8n workflow example: - `n8n/backup/workflows/batfish-mcp-list-networks.json` ### Setup 1. Set `BATFISH_MCP_API_KEY` in `.env` (auto-generated by `setup.sh` if you choose random secrets). 2. Start or restart the stack: ```bash docker compose --profile cpu up -d ``` 3. Test bridge health: ```bash curl http://localhost:${BATFISH_MCP_PORT:-7320}/healthz ``` 4. Query bridge endpoint (requires API key): ```bash curl -H "X-API-Key: ${BATFISH_MCP_API_KEY}" http://localhost:${BATFISH_MCP_PORT:-7320}/networks ``` 5. Use CLI container: ```bash docker compose exec batfish-cli sh python -c "from pybatfish.client.session import Session; Session(host='batfish'); print('batfish session ok')" ``` --- ## URLs & MCP Endpoints ### Main Web UIs | Service | URL | |--------------|-----------------------------| | n8n | <http://localhost:5678> | | Open WebUI | <http://localhost:3000> | | Flowise | <http://localhost:3001> | | Langflow | <http://localhost:7860> | | Qdrant | <http://localhost:6333> | | NetBox | <http://localhost:8000> | | Batfish | <http://localhost:9997> | | Batfish MCP Bridge | <http://localhost:7320> | | Ollama (API) | <http://localhost:11434> | | OpenClaw | <http://localhost:18789> | | OpenClaw MCP | <http://localhost:3721/mcp> | `n8n-admin-mcp-server` is stdio-only (no HTTP endpoint). ### MCP Servers – Internal Docker URLs Use these from **n8n MCP HTTP nodes** (same `demo` network): - Documentation MCP → `http://mcp-documentation:3000` - HTTPS Inspection MCP → `http://mcp-https-inspection:3001` - Quantum Management MCP → `http://mcp-quantum-management:3002` - Management Logs MCP → `http://mcp-management-logs:3003` - Threat Emulation MCP → `http://threat-emulation-mcp:3004` - Threat Prevention MCP → `http://threat-prevention-mcp:3005` - Spark Management MCP → `http://spark-management-mcp:3006` - Reputation Service MCP → `http://reputation-service-mcp:3007` - Harmony SASE MCP → `http://harmony-sase-mcp:3008` - Quantum GW CLI MCP → `http://quantum-gw-cli-mcp:3009` - Quantum GW Connection Analysis MCP → `http://quantum-gw-connection-analysis-mcp:3010` - Quantum Gaia MCP → `http://quantum-gaia-mcp:3011` - CPInfo Analysis MCP → `http://cpinfo-analysis-mcp:3012` - OpenClaw MCP → `http://openclaw-mcp-server:3721/mcp` ### MCP Servers – From the Host If ports are published: - Documentation MCP → <http://localhost:7300> - HTTPS Inspection MCP → <http://localhost:7301> - Quantum Management MCP → <http://localhost:7302> - Management Logs MCP → <http://localhost:7303> - Threat Emulation MCP → <http://localhost:7304> - Threat Prevention MCP → <http://localhost:7305> - Spark Management MCP → <http://localhost:7306> - Reputation Service MCP → <http://localhost:7307> - Harmony SASE MCP → <http://localhost:7308> - Quantum GW CLI MCP → <http://localhost:7309> - Quantum GW Connection Analysis MCP → <http://localhost:7310> - Quantum Gaia MCP → <http://localhost:7311> - CPInfo Analysis MCP → <http://localhost:7312> - OpenClaw MCP → <http://localhost:3721/mcp> From another machine, use `http://<docker-host-ip>:73xx`. ### Batfish Service URLs - Batfish (internal) → `http://batfish:9997` - Batfish MCP Bridge (internal) → `http://batfish-mcp:3020` - Batfish MCP Bridge (host) → <http://localhost:7320> ### n8n MCP Node Configuration In n8n’s MCP client nodes (e.g., `mcpClientTool`): - **Connection Type / Mode**: `http` - **Base URL**: `http://<mcp-service-name>:<port>` (e.g., `http://threat-emulation-mcp:3004`) - **Do NOT** set “Package” or “Command” to `@chkp/...`. If package fields are set, n8n will try `npx @chkp/...` in the container and you’ll see: - `npm warn exec The following package was not found and will be installed` - `Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@chkp/mcp-utils'` HTTP mode + sidecars = clean, predictable behavior. --- ## 🔌 n8n Pipe for Open WebUI The included `n8n_pipe.py` allows Open WebUI to talk to n8n workflows. ### Configuration 1. **Default URL**: The pipe is pre-configured to send requests to `http://n8n:5678/webhook/n8n-pipe`. 2. **Multiple Workflows**: You can use this pipe with **any** n8n workflow. - In Open WebUI, go to **Admin Panel** -> **Functions** (or **Pipes**). - Select the **N8N Pipe**. - Edit the **N8N URL** valve to point to your desired workflow's webhook URL (e.g., `http://n8n:5678/webhook/my-custom-agent`). - You can even duplicate the pipe file to have multiple named pipes pointing to different agents! ### Workflow Requirements For a workflow to work with this pipe, it must: 1. Start with a **Webhook** node. 2. Method: `POST`. 3. Path: Matches the URL you configured (e.g., `n8n-pipe`). 4. Respond using a **Respond to Webhook** node. --- ## Ollama Models The `ollama-pull-*` sidecar waits for the Ollama API and then pulls the configured models, for example: - `llama3.1:latest` - `nomic-embed-text:latest` To change which models are pulled, edit the `command:` in the `ollama-pull-*` services inside `docker-compose.yml`. To inspect or prune models inside the Ollama container: ```bash ollama list ollama rm <model-name> ``` --- ## Data & Persistence The stack uses named Docker volumes so you can destroy containers and keep data. | Volume | Description | |-------------------|-----------------------------------------------| | `n8n_storage` | n8n config, user data, some cached metadata | | `postgres_storage`| PostgreSQL database for n8n | | `netbox_postgres_storage` | PostgreSQL database for NetBox | | `netbox_media_storage` | NetBox user-uploaded media and reports | | `batfish_storage` | Batfish snapshots and analysis workspace | | `ollama_storage` | Ollama models and data | | `qdrant_storage` | Qdrant collections | | `open-webui` | Open WebUI data | | `flowise` | Flowise data | | `langflow` | Langflow data | Example: backup `n8n_storage` to a local tarball: ```bash docker run --rm -v n8n_storage:/data -v "$(pwd)":/backup busybox \ tar czf /backup/n8n_storage.tgz -C /data . ``` --- ## Troubleshooting ### A) `n8n-import`: “Mismatching encryption keys” Make sure **all n8n-related containers** (`n8n`, `n8n-import`, `n8n-provision`) use the **same** `N8N_ENCRYPTION_KEY` value from `.env`. ### B) Provisioner: HTTP 400 “Package already installed” Normal on re-runs. As long as you see `n8n-nodes-mcp` in **Settings → Community Nodes**, you’re good. ### C) MCP node shows `@chkp/...` install errors If logs show: - `npm warn exec The following package was not found and will be installed` - `Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@chkp/mcp-utils'` …then the node is in **package mode**. Switch it to **HTTP** and point at the correct MCP URL, e.g.: ```text http://management-logs-mcp:3003 ``` ### D) Cannot reach MCP from inside Docker From the `n8n` container, use the **service name**, not `localhost`: ```bash docker compose exec n8n sh # Inside curl http://mcp-documentation:3000/ ``` If that works, the MCP sidecar is healthy and reachable. ### E) Postgres connection issues Check the DB logs: ```bash docker compose logs postgres | tail -n 50 ``` Ensure: - `POSTGRES_USER`, `POSTGRES_PASSWORD`, `POSTGRES_DB` match between `postgres`, `n8n`, and `n8n-import`. ### F) GPU not detected - Ensure you use the `gpu-nvidia` profile. - Verify NVIDIA toolkit: ```bash docker run --rm --gpus all nvidia/cuda:12.3.2-base nvidia-smi ``` If this fails, fix GPU drivers / toolkit before using the GPU profile. --- ## Updating & Resetting ### Updating - **n8n-nodes-mcp** – update via n8n UI (Settings → Community Nodes) or adjust the version in your provisioner / Dockerfile and rebuild. - **Check Point MCP CLIs** – adjust versions in `docker/n8n/Dockerfile` and rebuild: ```bash docker compose build n8n ``` - **Base Images** – To update the underlying `n8n` version (fixes "n8n is not running the latest version"): ```bash # This pulls the latest base image AND rebuilds your custom image in one step docker compose build --pull n8n # Then restart the service docker compose --profile cpu up -d n8n ``` > **Note**: Do not run `docker compose pull n8n`. This will fail because it tries to pull your *local custom image* from Docker Hub. Always use `build --pull`. (adjust profiles as needed). ### Full Reset (Lab-Style) If you want a **clean slate** (fresh DB, no workflows, no credentials, no chat history): ```bash # WARNING: deletes all volumes for selected profiles docker compose --profile cpu down -v docker compose --profile cpu up -d ``` This re-creates the entire environment from zero, re-runs the provisioner, and re-imports any assets in `./n8n/backup`. --- --- --- ## 📚 Guides Detailed documentation for specific workflows and agents: - **[Lakera Playground Guide](docs/guides/n8n_Lakera_Playground_Guide.md)**: A complete guide to the Lakera Guard workflow, including a technical deep dive into each node and security logic. - **[Threat Prevention Agent Guide](docs/guides/CheckPoint_Threat_Prevention_Guide.md)**: Documentation for the Check Point Threat Prevention agent, covering the AI agent, MCP client, and policy management. --- ## 🚀 Production Deployment This playground is now **production-ready** with enterprise-grade features: ### Quick Production Checklist 1. **Generate Secure Configuration** ```bash ./setup.sh ./scripts/validate-env.sh ``` 2. **Run Health Checks** ```bash ./scripts/health-check.sh --profile cpu ``` 3. **Set Up Automated Backups** ```bash # Add to crontab for daily backups 0 2 * * * /path/to/scripts/backup-volumes.sh --retention-days 30 ``` 4. **Enable CI/CD** - GitHub Actions workflows are in `.github/workflows/` - Automated testing and security scanning on every push ### Production Documentation - **[Production Deployment Guide](docs/operations/PRODUCTION_DEPLOYMENT.md)** - Comprehensive guide covering: - Security hardening & SSL/TLS configuration - Secret management (Docker Secrets, Vault, etc.) - Scaling & high availability - Monitoring & observability - Compliance (SOC2, GDPR, etc.) - **[Backup & Recovery Guide](docs/operations/BACKUP_RECOVERY.md)** - Complete backup strategy: - Automated volume backups - Disaster recovery procedures - RTO/RPO definitions - Point-in-time recovery ### Automated Testing Run integration tests locally: ```bash # Run full test suite ./tests/integration-test.sh # Test specific profile PROFILE=cpu ./tests/integration-test.sh ``` CI/CD automatically runs tests on every push and pull request. --- ## Security Best Practices 1. **Use the Setup Script**: Always use `./setup.sh` to generate strong, random passwords for your environment. 2. **Protect `.env`**: Your `.env` file contains sensitive credentials. Never commit it to version control. 3. **API Keys**: Be careful when entering API keys. Ensure you trust the environment where you are running this stack. 4. **Network Isolation**: This stack is designed for local development. If deploying to a shared network, ensure proper firewall rules are in place.