Skip to main content

Quick Start

AlmaForge is a self-hosted platform for secure access to servers, databases, Kubernetes clusters, applications, and APIs. Control who can connect, to what, and for how long. Review audit events and replay recorded terminal sessions.

In about ten minutes, you'll install AlmaForge and run a demo on your own machine. You'll sign in through single sign-on (SSO), open an SSH session, and replay it. Then you'll switch demo accounts to request temporary access, approve the request, and review the audit log.

Self-paced demo

This demo runs on your own Mac or Linux machine. Send us a message and we'll share access to our full-featured demo cluster, or set up a call with you.

You need
macOS or Linux on amd64 or arm64. Windows is not supported yet.
A terminal and browser on the same machine
sudo for the system-wide install
The demo provides
A local cluster with a self-signed certificate
An SSO provider with four demo accounts
SSH access to your own machine

1. Install​

Terminal
curl -fL https://get.almaforge.com/install.sh | sh

The installer provides matching versions of alma, the command-line client, and almad, the server. It installs them system-wide, so enter your computer's password when sudo prompts. On macOS, it uses a signed installer package.

Install with a package manager

These instructions apply to APT-based (Ubuntu and Debian) distributions and their derivatives.

Supported APT-based Linux distributions

The APT package supports these distribution families. Check their upstream maintenance windows when choosing a production host:

DistributionCodenameVersionRelease DateUpstream EOL
UbuntuJammy22.04 LTSApril 2022April 2027
UbuntuNoble24.04 LTSApril 2024April 2029
DebianBookworm12June 2023July 2026 (regular), June 2028 (LTS)
DebianTrixie13August 2025August 2028 (regular), June 2030 (LTS)

See Debian release support for the distinction between regular support and LTS.

Other distributions with glibc 2.28+ may also work. Please contact us if you run into any issues.

The snippet below configures the https://get.almaforge.com repository and installs the almaforge package from the repository:

Terminal
sudo install -m 0755 -d /etc/apt/keyringscurl -sfLS https://get.almaforge.com/almaforge.gpg | \    gpg --dearmor | sudo tee "/etc/apt/keyrings/almaforge.gpg" >/dev/nullecho "deb [signed-by=/etc/apt/keyrings/almaforge.gpg] https://get.almaforge.com generic main" | \    sudo tee "/etc/apt/sources.list.d/almaforge.list"sudo apt-get updatesudo apt-get install -y almaforge
Required tools

curl, gpg, and sudo are often missing in stripped-down images.

Verify that almad is installed:

Terminal
almad versionAlmaForge v2026.1.26+g5ab8dcffcb
Downloadable artifacts

2. Start the demo​

Start the cluster as your normal user and keep this terminal open:

Terminal
alma demoAlmaForge local demo
AlmaForge is a self-hosted platform for secure access to servers,databases, Kubernetes clusters, applications, and APIs. It runsentirely inside your environment, with no SaaS dependency or telemetry.
Starting a real AlmaForge cluster on this machine... ready.
  UI   https://localhost:8443   self-signed, expect a browser warning
Sign in through Alma Demo Corp, the demo's single sign-on provider.Choose an account in your browser. No password is needed.Then approve the terminal sign-in.
  Superuser           Explore the full product with unrestricted access.  On-call engineer    Request temporary access to a protected resource.  On-call manager     Review, approve, or deny access requests.  Security engineer   Review audit activity and replay recorded sessions.
Anyone else signed in to this computer can use these accounts while the demo runs.
Press Enter to sign in.

The local cluster handles sign-in, permissions, and connections. It uses the same server and access controls as a production cluster.

3. Sign in​

Press Enter to open the sign-in page. Continue past the certificate warning for the demo's localhost address, then choose Superuser under Alma Demo Corp:

127.0.0.1:8442/authorize
Alma Demo Corp
Simulated corporate single sign-on
Select a demo account
Choose a user to explore AlmaForge from a different role and workflow:
SuperuserExplore the full product with unrestricted access.Roles: admin, access
On-call engineerRequest temporary access to a protected resource.Roles: member
On-call managerReview, approve, or deny access requests.Roles: reviewer
Security engineerReview audit activity and replay recorded sessions.Roles: auditor
note

The demo's identity provider grants passwordless access, including administrator access, to anyone who reaches it. Use it on localhost only.

Approve the terminal sign-in in your browser. The Web UI opens, and the terminal confirms your account:

text
Signed in as Superuser. Happy exploring. Try the CLI in another terminal:

  alma --proxy=localhost:8443 get nodes   # servers you can see
  alma --proxy=localhost:8443 ssh demo    # SSH to a server
  alma --proxy=localhost:8443 audit -f    # live audit events
  alma --proxy=localhost:8443 get roles   # RBAC configuration

Tell us about your experience: hello@almaforge.com

The demo keeps running. Ctrl-C stops it.

4. Open a session and replay it​

Open a second terminal window or tab. Connect to your own machine, which the demo names demo:

Terminal
alma --proxy=localhost:8443 ssh demo

--proxy sends the command to the demo even when this terminal is set up for another cluster. In the session, run whoami to see which account you're using, then exit. In the Web UI, open Recordings and play the finished session to see your command and its output.

5. Get access approved​

The On-call engineer requests the access role, which grants permission to connect to demo after approval.

  1. Sign out of the Web UI and sign in as On-call engineer. In Requests, submit a New Request for the access role with a reason.
  2. In a private browser window, open the UI address printed in the demo terminal. Sign in as On-call manager, open the engineer's request, and choose Approve Request.
  3. Return to the engineer's window, open the approved request, and choose Assume Role. Connect to demo from Resources using your local username. Run exit when finished.

To review the activity, sign out and sign in as Security engineer, then open Audit Log. See Just-in-Time Access for request policies.

Stop and resume​

Press Ctrl-C in the demo terminal to stop the cluster and identity provider. Run alma demo again to resume with the saved state and sign in.

Next steps​

Already have a cluster? Sign in with the CLI.

Read How it Works for the architecture.