Prepare for installation

Extract installation packages

To extract installation packages:

Log in to the APP server as a Linux installation user, by using Linux Terminal, Windows PuTTY, or any other SSH client:
```
$ ssh -i <path-to-private-key.pem> <username>@<hostname.example.com>
```
Here, <username> is Linux installation user.
In INSTALL_DIR, create a directory for the WorkFusion installation package, for example, /opt/workfusion/wf_installer. Grant the read access for this directory to all users:
```
$ sudo mkdir -p /opt/workfusion/wf_installer
$ sudo chmod 0755 /opt/workfusion/wf_installer
```
Make sure that the Linux installation user is an owner of the installation directory:
```
$ sudo chown -R <username>:<username> /opt/workfusion/
```
Download the provided installation package with any file retrieving tool, for example, wget or curl:
- If the Internet access is available on the server:
```
$ curl 'https://link_to_installer' --output /opt/workfusion/workfusion-full-package-<version>.tar.gz
```
- If the Internet access is not available on the APP server, download the Intelligent Automation Cloud installer and copy it as /opt/workfusion/workfusion-full-package-.tar.gz on the APP server.

Extract the downloaded package to the directory:

$ tar -xzvf /opt/workfusion/workfusion-full-package-<version>.tar.gz --strip 1 -C /opt/workfusion/wf_installer

Configure installation server

To configure the installation APP server, you must specify hostnames, ports, and installation parameters in the set of configuration files.

Specify DNS names

Before configuring installation parameters, you must already have DNS names mapped to the required servers.

To specify DNS names, in your PACKAGE_DIR directory, open the hosts.yml configuration file, and enter the prepared domain names of each component according to the selected setup type: HA or basic one.

$ vi hosts.yml

# The 'vi' text editor is used in the example

The DNS settings are different for the high-availability and basic setup. See the corresponding tab.

High-availability setup

Basic setup

vault_lb_hostname: host-vault-lb1.example.com
minio_lb_hostname: host-minio-lb1.example.com
nexus_lb_hostname: host-nexus-lb1.example.com
rabbitmq_lb_hostname: host-rabbitmq-lb1.example.com
mesos_lb_hostname: host-mesos-lb1.example.com
marathon_lb_hostname: host-marathon-lb1.example.com
workspace_lb_hostname: host-workspace-lb1.example.com
workfusion_lb_hostname: host-workfusion-lb1.example.com
bot_manager_lb_hostname: host-bot-manager-lb1.example.com
kibana_lb_hostname: host-kibana-lb1.example.com
ocr_lb_hostname: host-ocr-lb1.example.com
bi_lb_hostname: host-bi-lb1.example.com

mssql_hostname: host-mssql1.example.com
int_hostnames: host-int1.example.com,host-int2.example.com,host-int3.example.com
app_hostnames: host-ct1.example.com,host-ct2.example.com
ocr_hostnames: host-ocr1.example.com,host-ocr2.example.com
bi_hostnames: host-bi1.example.com,host-bi2.example.com
bep_master_hostnames: host-bepmaster1.example.com,host-bepmaster2.example.com,host-bepmaster3.example.com
bep_agent_hostnames: host-bepagent1.example.com,host-bepagent2.example.com,host-bepagent3.example.com
rpa_hostnames: host-rpa1.example.com,host-rpa2.example.com

Note that int_hostnames, app_hostnames, and bep_master_hostnames must have the same value.

int_hostnames: host-ct1.example.com
app_hostnames: host-ct1.example.com
bep_master_hostnames: host-ct1.example.com
ocr_hostnames: host-ocr1.example.com
bi_hostnames: host-bi1.example.com
bep_agent_hostnames: host-bepagent1.example.com
rpa_hostnames: host-rpa1.example.com
mssql_hostname: host-mssql1.example.com

# The following DNS names must be mapped to the IP address of the APP server.
vault_lb_hostname: host-vault-lb1.example.com
minio_lb_hostname: host-minio-lb1.example.com
nexus_lb_hostname: host-nexus-lb1.example.com
rabbitmq_lb_hostname: host-rabbitmq-lb1.example.com
mesos_lb_hostname: host-mesos-lb1.example.com
marathon_lb_hostname: host-marathon-lb1.example.com
workspace_lb_hostname: host-workspace-lb1.example.com
workfusion_lb_hostname: host-workfusion-lb1.example.com
bot_manager_lb_hostname: host-bot-manager-lb1.example.com
kibana_lb_hostname: host-kibana-lb1.example.com
ocr_lb_hostname: host-ocr-lb1.example.com
bi_lb_hostname: host-bi-lb1.example.com

For more information on the DNS, see the DNS names requirements.

Specify ports

To specify opened ports, on the APP server, in the PACKAGE_DIR directory, edit the ports.yml file.

$ vi hosts.yml

In the file, specify the TCP ports that you have opened, when preparing the environment. For more information, see Application Ports.

The example of ports.yml file...

# ALL Servers (INT, BEP Master, BEP Agent(s), APP, RPA, OCR)
nginx_port:                          '8080'  # Nginx HTTP port. Affects nginx configuration on all servers. All requests to 'nginx_port' are redirected to 'nginx_port_ssl'.
nginx_port_ssl:                      '8443'  # Nginx HTTPS port. The main port for accessing Control Tower and many other SPA services with http clients (for example, browsers). Affects all servers.
nginx_http_req_retry_port:           '11111' # Nginx HTTP port for internal product purpose. Used by client mTLS services for requests retries. Listens on 127.0.0.1.

# INT, BEP Master, APP
flask_watchdog_port:                 '10500'  # Flask watchdog port. Listens on 127.0.0.1 (HTTP). Used for failover monitoring of standby HA services.

# ALL Linux Servers (INT, BEP Master, BEP Agent(s), APP, OCR)
supervisord_port:                    '9900' # Supervisord port. Listens on 127.0.0.1 (HTTP).

# INT Server ports
tds_port:                            '9090'  # Spring Boot port where task-dispatcher is listening. Listens on 127.0.0.1 (HTTP).
tds_mtls_port:                       '9092'  # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests from to 'tds_port'. Validates client certs .
vault_port:                          '8200'  # Hashicorp Vault port. Listens on 0.0.0.0 (HTTPS).
nexus_port:                          '8082'  # Sonatype Nexus port. Listens on 127.0.0.1 (HTTP).
minio_port:                          '9000'  # Minio Server Port (S3 emulator). Listens on 127.0.0.1 (HTTP).
elasticsearch_port:                  '9200'  # Elasticsearch port. Listens on 0.0.0.0 (HTTPS).
logstash_filebeat_port:              '4567'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_metricbeat_port:            '4569'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_heartbeat_port:             '4571'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_bep_metrics_port:           '15072' # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_bep_logs_port:              '4570'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_vds92_port:                 '4568'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
rabbitmq_api_port:                   '15672' # RabbitMQ API port. Listens on 127.0.0.1 (HTTP).
rabbitmq_api_proxy_port:             '45672' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'rabbitmq_api_port'.
rabbitmq_amqp_port:                  '5672'  # RabbitMQ message Queue port. Listens on 0.0.0.0 (TLS ecrtypted AMQP).
zookeeper_port:                      '2181'  # Zookeeper port. Listens on 0.0.0.0.
flask_nexus_port:                    '10501' # Flask nexus port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_tds_port:                      '10502' # Flask task-dispatcher-service port. Listens on 127.0.0.1 (HTTP). Used for failover.

# APP Server ports
workfusion_port:                     '7080' # Tomcat port where Control Tower is listening. Listens on 127.0.0.1 (HTTP).
ct_hazelcast_port:                   '5702' # Do not change! Hazelcast port for Control Tower. Listens to 0.0.0.0. 
workspace_port:                      '5080' # Tomcat port where Workspace is listening. Listens on 127.0.0.1 (HTTP).
sqc_port:                            '4080' # Tomcat port where AutoQC is listening. Listens on 127.0.0.1 (HTTP).
sqc_mtls_port:                       '4084' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests using http to localhost's 'sqc_port'.
sqc_mtls_client_port:                '4082' # Nginx port. Listens on 127.0.0.1 (HTTP). Used by CT to send requests to SQC service. Forwards requests using HTTPS to LB, to SQC endpoint
bot_manager_port:                    '5555' # Spring Boot port where bot-manager service is listening. Listens on 127.0.0.1 (HTTP).
kibana_port:                         '5601' # Kibana port. Listens on 127.0.0.1 (HTTP).
flask_workfusion_port:               '10507' # Flask Control Tower port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_workspace_port:                '10508' # Flask Workspace port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_bot_manager_port:              '10509' # Flask Bot Manager port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_sqc_port:                      '10510' # Flask SQC port. Listens on 127.0.0.1 (HTTP). Used for failover.
wms_mtls_client_port:                '9095'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by CT to proxy requests to WMS service mtls endpoint.
ags_mtls_client_port:                '9077'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by CT to proxy requests to AGS service mtls endpoint.
vault_proxy_port:                    '8202'  # Load Balancer endpoint port for Vault
# NOTE: Additionally the following ports are also listening by haproxy on APP servers:
# lb_port; lb_port_ssl; tds_mtls_port; wms_mtls_port; ags_mtls_port; ams_mtls_port; amms_mtls_port; vault_port; elasticsearch_port
# Make sure you don't use them for any services on APP servers. All these ports are used on 0.0.0.0 by internal HAPROXY.
#
# NOTE: Additionally the following ports are used by Tomcat processes on APP servers:
# 'workfusion_port + 5'; 'workfusion_port + 8'; 'workspace_port + 5'; 'workspace_port + 8'; 'sqc_port + 5'; 'sqc_port + 8'. Make sure you don't use them for any services on APP server. All these ports are used only on 127.0.0.1.

# BEP Master ports
wms_port:                            '9091' # Spring Boot port where worker-management-service is listening. Listens on 127.0.0.1 (HTTP).
wms_mtls_port:                       '9093' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'wms_port'. Validates client certs.
ags_port:                            '9070' # Spring Boot port where automl-gateway-service is listening. Listens on 127.0.0.1 (HTTP).
ags_mtls_port:                       '9073' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'ags_port'. Validates client certs.
ams_port:                            '9071' # Spring Boot port where automl-model-service is listening. Listens on 127.0.0.1 (HTTP).
ams_mtls_port:                       '9075' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'ams_port'. Validates client certs.
amms_port:                           '9072' # Spring Boot port where automl-model-management-service is listening. Listens on 127.0.0.1 (HTTP).
amms_mtls_port:                      '9076' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'amms_port'. Validates client certs.
marathon_port:                       '8000' # Marathon Port. Listens on 127.0.0.1 (HTTP).
marathon_proxy_port:                 '8480' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'marathon_port'.
marathon_communication_port:         '15000' # The port used by Marathon for libprocess communication. Listens on 0.0.0.0 (HTTPS).
mesos_master_port:                   '5050' # Mesos master port. Listens on 0.0.0.0 (HTTPS).
vds_gateway_service_port:            '9080' # Spring Boot port where VDS Gateway Service is listening. Listens on 127.0.0.1 (HTTP). Only used when SPA9.2 AutoML is installed. Used for backward compatibility with SPA9.2 business-processes.
vds_scaling_service_port:            '9081' # Spring Boot port where VDS Scaling Service is listening. Listens on 127.0.0.1 (HTTP). Only used when SPA9.2 AutoML is installed. Used for backward compatibility with SPA9.2 business-processes.
vds_mesos_adapter_port:              '9052' # Spring Boot port where VDS Mesos Adapter Service is listening. Listens on 127.0.0.1 (HTTP). Only used when SPA9.2 AutoML is installed. Used for backward compatibility with SPA9.2 business-processes.
hazelcast_server_app_port:           '9061' # Spring-boot port where hazelcast-server is listening.
hazelcast_server_app_mtls_port:      '9063' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'hazelcast_server_app_port'. Validates client certs.
hazelcast_server_communication_port: '9702' # Hazelcast port for hazelcast-server.
flask_ags_port:                      '10503' # Flask automl-gateway-service port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_ams_port:                      '10504' # Flask automl-model-service port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_amms_port:                     '10505' # Flask automl-model-management-service port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_wms_port:                      '10506' # Flask worker-management-service port. Listens on 127.0.0.1 (HTTP). Used for failover.
tds_mtls_client_port:                '9097'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by WMS to proxy requests to TDS mtls endpoint.
ams_mtls_client_port:                '9085'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by AGS to proxy requests to AMS mtls endpoint.
amms_mtls_client_port:               '9087'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by AGS to proxy requests to AMMS mtls endpoint.

# BEP Agent ports
mesos_slave_port:                    '5051'        # Mesos Agent port. Listens on 0.0.0.0 (HTTPS).
mesos_slave_port_range:              '40000-44000' # Ports range on mesos Agent(s) used for communication with Mesos Master (ports from this range are opened randomly during tasks execution).
workfusion_mtls_client_port:         '7081'        # Nginx port. Listens on 127.0.0.1 (HTTP). Used by Workers to proxy requests to Control Tower mtls endpoint (internal-api).
# Additional ports listening on BEP Agent(s): {ags_mtls_client_port}

# OCR Server ports
ocr_port:                            '9002' # Spring Boot port where OCR Rest API is listening. Listens on 127.0.0.1 (HTTP).

# RPA Server ports
bot_manager_mtls_client_port:        '5555'
# Additional ports listening on RPA servers: {nginx_port}, {nginx_port_ssl}, {workfusion_mtls_client_port}, {ags_mtls_client_port}

Specify installation parameters

To set the installation parameters:

On the APP server, in the PACKAGE_DIR directory, change the permissions for the config.yml file:
```
$ sudo chmod 644 config.yml
```

Open the config.yml file, and in the parameter ansible_vault_password, change the ansible vault password:

$ vi config.yml

The password is used for encrypting the config.yml at the following step and will be asked several times during the installation of the components. We strongly recommend to secure and memorize it. When creating passwords, make sure they are strong enough and meet the following requirements:

# PASSWORDS POLICY
# - must contain standard English symbols
# - must be no shorter than 6 symbols and no longer than 20 symbols
# - must contain at least one uppercase character [A-Z]
# - must contain at least one lowercase character [a-z]
# - must contain at least one numeric character [0-9]
# - must contain at least one of the following special symbols unless limitations are explicitly described in comments: @#^*():,.}[]<>/
# - must NOT contain the following symbols: \"!?&'{$|`%;
# - must NOT contain spaces

Note: in the #MSSQL section, you must specify the corresponding MS SQL login names and passwords, that you have created earlier.

For the high availability setup only. In config.yml, in section HA mode, set the following mandatory parameter to enable the high availability mode.
- ha_mode: true–enable the HA mode.
Note: skip this step, if you are planning to setup IA Cloud Enterprise in the basic mode.
Optionally, on the APP server, run the following command to automatically generate passwords for the WorkFusion internal services according to product policies. We strongly recommend to change them manually for security reasons. Note that the command doesn't generate end-user password.
```
$ ./install.sh passwords generate
```
As a result, in config.yml, the passwords for most services, except for the following end-user ones, are created:
```
"wf_password"
"ldap_bind_password"
"mail_pass"
"tableau_dashboard_pass"
"tableau_automation_pass"
"windows_installation_pass"
"elk_admin_pass"
"ansible_vault_password”
"bot_relay_user_pass"
"bot_user_pass"
```
If you prefer to set the passwords manually, remember to use only Latin letters and allowed symbols. If needed, change other secrets and parameters, as well. After that, save and close the file.
Run the following command to encrypt the config.yml file:
```
$ ./install.sh encrypt config
```
Note that the installer will not let you start the installation until config.yml is encrypted.

If needed, you can later edit the encrypted file with the following commands:
```
$ cd /opt/workfusion/wf_installer
$ ./install.sh edit_config app
```

Prepare the certificates

To prepare certificates:

Login via SSH to the APP server and place prepared ca.crt, server.crt, and server.key to the PACKAGE_DIR/certificates/ directory. Skip the step, if you do not have them.

$ ls -la PACKAGE_DIR/certificates/
total 24
drwxr-xr-x.  3 ec2-user ec2-user   78 Sep 24 14:47 .
drwxr-xr-x. 12 ec2-user ec2-user 4096 Sep 27 17:20 ..
-rw-r--r--.  1 ec2-user ec2-user 2984 Sep 24 14:42 ca.crt
-rw-r--r--.  1 ec2-user ec2-user 4835 Sep 24 14:42 server.crt
-rw-r--r--.  1 ec2-user ec2-user 1674 Sep 24 14:42 server.key

Generate the additional client certs that are used internally by the Workfusion services for communication and authentication among each other. Execute the following command on the APP server:
```
$ ./install.sh certs generate
```
The command creates the _auth_internal/ directory inside the certificates/ directory and generates all required internal certs. If you haven't placed your ca.crt, server.crt, and server.key files to the /certificates directory, they also will be automatically generated (self-signed).
Here is how the certificates/ directory's content must look like...
```
$ cd PACKAGE_DIR/
$ tree certificates/
certificates/
|-- _auth_internal
|   |-- elk-ca.crt
|   |-- elk-ca.key
|   |-- kibana.crt
|   |-- kibana.key
|   |-- logstash.crt
|   |-- logstash.key
|   |-- logstash.p12
|   |-- mtls-ca.crt
|   |-- mtls-ca.key
|   |-- mtls-client.crt
|   |-- mtls-client.key
|   |-- vault_admin.crt
|   |-- vault_admin.p12
|   |-- vault_workfusion.crt
|   `-- vault_workfusion.p12
|-- ca.crt
|-- server.crt
`-- server.key
```

Install Workfusion license

To install the WorkFusion license, copy the provided license.properties file to the PACKAGE_DIR directory, for example, /opt/workfusion/wf_installer/license.properties.

If you perform installation on your own, request the license file from your WorkFusion Account Manager in the same way, as you receive the Tableau license.

Prepare Windows servers

Perform the following operations on all Windows servers.

To configure access for Intelligent Automation Cloud installation:

Connect to the remote Windows server via Remote Desktop or any other client as a Windows installation user (see Create installation users).
Run PowerShell as Administrator.

In PowerShell, run the following commands:

$url = "https://s3.amazonaws.com/workfusion-installer/blobs/artifacts/winrm-config/ConfigureRemotingForAnsible.ps1"
$file = "$env:c\ConfigureRemotingForAnsible.ps1"
(New-Object -TypeName System.Net.WebClient).DownloadFile($url, $file)
powershell.exe -ExecutionPolicy ByPass -File $file -Verbose

The script checks the current WinRM (PS Remoting), enables CredSSP authentication, creates SSL listener and configures firewall for WinRM HTTPS connections to allow Ansible to connect, authenticate, and execute PowerShell commands.

If the Internet access is not available on the target server:

Download the script from https://s3.amazonaws.com/workfusion-installer/blobs/artifacts/winrm-config/ConfigureRemotingForAnsible.ps1 and save it to the target windows server manually, for example, to C:\tmp\ConfigureRemotingForAnsible.ps1.
Run PowerShell as Administrator.

In PowerShell, run the following command:

powershell.exe -ExecutionPolicy ByPass C:\tmp\ConfigureRemotingForAnsible.ps1

WorkFusion Documentation

10.1.4

Hardware

High availability setup

Standard setup

Install Linux components

Install OCR Windows server

Logs management

Security settings in Control Tower