> Section: [1. Introduction](https://jaque.sh/docs/get-started/quickstart.md)
> Next: get-started/from-nagios
> Index: https://jaque.sh/llms.txt


The cheapest way to know whether jaque is worth your time is to run it
against a machine you own and watch it decide, on its own, whether anything
is wrong. This page gets you from the binary to that first decision: one
host in CUE, one run, and the three HTTP surfaces every engine serves
without being asked. It assumes nothing beyond the binary and a network
address to ping.

Status: there is no public release and no public repository during the
pre-alpha; the binary is handed directly to people granted access.
Everything below is exercised by the project's own tests and dogfooding.
See [Status](https://jaque.sh/docs/project/status.md).

## 1. Get jaque

You start with the binary: one static executable and nothing else to
install. There is no build step and no runtime
dependency to satisfy first. The event log, the state machine, the
scheduler and the dashboard are compiled into it.

## 2. Write a config

A Nagios host, once the templates are stripped away, is an `address` and
a `check`. jaque's CUE config is that shape with nothing added. Save this as
`jaque.cue`:

```cue
hosts: gw: {
	address: "192.168.1.1"
	check: {type: "icmp", host: address}
}
```

This is a complete, loadable configuration: one host named `gw`, checked by
ICMP every 60 seconds, three consecutive failures before the problem goes
hard. Both numbers are schema defaults, filled in by CUE, not by code that
guesses. Point `address` at something on your own network, or at
`127.0.0.1` to check the machine you are sitting on.

The reason a config this short loads is that the schema is closed and
complete: every field you did not write has a default, and every field you
misspell is an error naming the field. [Why CUE](https://jaque.sh/docs/concepts/why-cue.md)
is the argument; [CUE in practice](https://jaque.sh/docs/config/cue-in-practice.md) is the
walkthrough.

## 3. ICMP needs one sysctl

The `icmp` check opens an unprivileged datagram socket rather than a raw
one, so jaque never needs root. Most Linux distributions ship with that
socket type disabled for every group, and the symptom is not an error at
startup but an UNKNOWN result with "permission denied" on the first check.
Enable it once:

```sh
sudo sysctl -w net.ipv4.ping_group_range="0 2147483647"
```

A narrower group range works as well if you prefer it.

## 4. Run it

```sh
jaque -config jaque.cue
```

The engine writes one structured log line per state transition. Nothing is
notified: a fresh config wires no contacts, and jaque never invents a
recipient. What you see is the engine deciding OK, WARNING, CRITICAL or
UNKNOWN for each object as results arrive, and walking the soft attempts
before it commits to a hard state. [State model](https://jaque.sh/docs/concepts/state-model.md)
is the rulebook for those lines.

## 5. What you get for free

With the default `-listen 127.0.0.1:8080`, the same process serves three
things on one port:

The dashboard at `http://127.0.0.1:8080/`: every host and service, its
current state, and the actions an operator reaches for first (acknowledge,
downtime). See [Dashboard](https://jaque.sh/docs/ui/dashboard.md).

`/metrics`: Prometheus exposition format, about the engine itself rather
than your hosts -- event log lag, scheduler drift, check durations. Scrape
it with anything that speaks the format. See
[Metrics](https://jaque.sh/docs/observability/metrics.md).

`/status.json`: a machine-readable snapshot of every object, the same
shape `-snapshot-out` writes at shutdown. Its first use is a liveness
probe; see [Status JSON](https://jaque.sh/docs/api/status-json.md).

Set `-listen ""` to turn all three off, which is what a process running as
a pure `engine` or `worker` target does anyway.

## 6. Where to go next

[CUE in practice](https://jaque.sh/docs/config/cue-in-practice.md) adds services, shares a
template across hosts, and wires contacts so a hard state reaches someone.
[Concepts](https://jaque.sh/docs/concepts/state-model.md) explains the state machine that
produced the log lines you watched. If the config you care about already
exists as a Nagios tree, [From Nagios](https://jaque.sh/docs/get-started/from-nagios.md) compiles it instead
of asking you to retype it.

## 7. Security considerations

The default `-listen` address is loopback. Binding it anywhere else exposes
the dashboard, `/metrics` and `/status.json` to that network with no
authentication of their own; put a reverse proxy or a network policy in
front first, as [Security](https://jaque.sh/docs/deployment/security.md) describes. The ICMP
sysctl grants every process in the range the ability to send echo
requests, which is the least privilege that makes the check work.