Run pre-installation steps manually

Use the following guide to prepare for the setup of IA Cloud Enterprise in cases, when the company's policies forbid using root users or sudo permissions for installing software. This instruction will help you manually run the required preliminary steps and proceed with the installation of the product as a runtime user

Introduction

The following steps require the root privileges:

Creation of users and groups.
Creation of directories and assigning permissions to them.
Extracting installation package.
Installing required RPMs.
Setting sysctl and ulimits parameters.
Assigning setcap capabilities to a customer-facing web server (HAProxy).

Intelligent Automation Cloud Enterprise requires a shared network folder. Existing NAS can be used. Otherwise, steps will be provided further to deploy NFS on one of the IA Cloud servers.

Before the installation of Intelligent Automation Cloud Enterprise, run the following steps as the root user to prepare the installation environment.

Prepare Linux servers

To prepare the Linux servers for installation:

As a user with sudo or root permissions, log in to any Linux server, that you are going to use for installation:
```
ssh -i ~/.ssh/<your-ssh-key> <root-user>@<linux-server>
```
Create a primary group for the runtime user, if you don't have the group yet. Skip this step if you want to use the existing Active Directory group or existing local Linux group. Remember that the group and GID must be the same on each server.
```
groupadd wfuser
```
Create the runtime user, if you don't have it yet, and add it to the group created on step 3. Skip this step if you want to use an existing Active Directory user or an existing local Linux user. Remember that the user and its UID must be the same on each server.
```
useradd -m -g wfuser wfuser
```
Note: In this guide, WFUSER acts as a Linux installation user, which is required for IA Cloud installation only. Make sure that WFUSER has all the SSH access to all Linux servers (for multi-point setup) or the SSH access from the APP to other Linux servers (for the single-point installation).
Create the installation directory (here, /opt/workfusion), and set the runtime user as an owner of this directory.
```
$ mkdir /opt/workfusion
$ chmod 0755 /opt/workfusion
$ chown wfuser:wfuser /opt/workfusion
```

Create a shared directory (here, /opt/workfusion/shared), and set the runtime user as an owner of this directory.

$ mkdir /opt/workfusion/shared
$ chmod 0755 /opt/workfusion/shared
$ chown wfuser:wfuser /opt/workfusion/shared

Extract the installation package:
1. On the designated server, in the /opt/workfusion/ directory, create a directory for the IA Cloud installation package, for example, /opt/workfusion/wf_installer. Grant the read access for this directory to all users:
```
$ mkdir -p /opt/workfusion/wf_installer
$ chmod 0755 /opt/workfusion/wf_installer
$ chown wfuser:wfuser /opt/workfusion/wf_installer
$ cd /opt/workfusion/wf_installer
```
2. Download the IA Cloud installation package with any available method. If Internet access is available on the server, use the following example, and remember to specify the link to the installer:
```
curl -o 'workfusion-full-package.tar.gz' '<link-to-IA-Cloud-installation-package>'
```
3. Extract the downloaded package to the directory:
```
tar -xzvf /opt/workfusion/wf_installer/workfusion-full-package.tar.gz --strip 1 -C /opt/workfusion/wf_installer
```

Install the required packages:

yum -y localinstall /opt/workfusion/wf_installer/sources/unzip* \
                    /opt/workfusion/wf_installer/sources/sshpass* \
                    /opt/workfusion/wf_installer/sources/openssl* \
                    /opt/workfusion/wf_installer/sources/openssl-libs* \
                    /opt/workfusion/wf_installer/sources/rsync* \
                    /opt/workfusion/wf_installer/sources/python-setuptools* \
                    /opt/workfusion/wf_installer/sources/coreutils*

Note: if you already have an installed later version of a component, after step 7, run the following command to avoid possible conflicts of versions:

yum -y downgrade <component>
# for example, yum -y downgrade unzip*

Configure the ulimits for the maximum number of open files and the number of processing units available:
1. Calculate ulimits values based on the following example. Use your "number of vCPU" values for the calculations:
  - item: "nofile", value: "number of vCPU * 25000"
  - item: "nproc", value: "number of vCPU * 1280"
2. Copy the following example to a text editor and replace the default values (here, 200000 and 10240), with the numbers that you have calculated on the previous step. Here, the example is provided for eight vCPU. If you have other values, use them for the calculations.After that, copy the changed entire command to your command-line tool and execute it.
```
cat << EOF >> /etc/security/limits.conf
*       -     nofile  200000
*       -     nproc   10240
EOF
```

Create the systemd service for supervisord management tool that is used for all IA Cloud services:

Calculate ulimits values based on the following example. Use your "number of vCPU" values for the calculations.
- LimitNOFILE: "number of vCPU * 25000"
- LimitNPROC: "number of vCPU * 1280"

Copy the following example to a text editor and replace the default values (here, 200000 and 10240), with the values that you have calculated on the previous step. Here, the example is provided for eight vCPU. If you have other values, use them for the calculations.After that, copy the changed command to your command-line tool and execute it.

cat << EOF > /etc/systemd/system/supervisord.service
[Unit]
Description=supervisord
Requires=local-fs.target
After=local-fs.target

[Service]
Type=simple
Restart=on-failure
RestartSec=10
StartLimitInterval=300
StartLimitBurst=5
User=wfuser
Group=wfuser

LimitNOFILE=200000
LimitNPROC=10240

ExecStartPre=/bin/bash -c 'while [ ! -f /opt/workfusion/python-site/bin/supervisord ]; do sleep 1; done; exit 0'
ExecStart=/bin/bash -c 'source /opt/workfusion/environment.sh && /opt/workfusion/python-site/bin/supervisord -c /opt/workfusion/supervisord/conf/supervisord.conf'
TimeoutSec=300

[Install]
WantedBy=multi-user.target
EOF

Run the following commands to enable autostart for the supervisord service:
```
$ systemctl daemon-reload
$ systemctl enable supervisord
```
Repeat steps 1-10 on each Linux server.

Set up server with Bot Manager service

By default, the Bot Manager runs on the APP server.

Install the required packaged dependencies for Bot Manager Service as root:

yum -y localinstall /opt/workfusion/wf_installer/sources/libXfont* \
                    /opt/workfusion/wf_installer/sources/libfontenc* \
                    /opt/workfusion/wf_installer/sources/libXdmcp* \
                    /opt/workfusion/wf_installer/sources/xorg-x11-server-common* \
                    /opt/workfusion/wf_installer/sources/libX11* \
                    /opt/workfusion/wf_installer/sources/libX11-common* \
                    /opt/workfusion/wf_installer/sources/libXau* \
                    /opt/workfusion/wf_installer/sources/libxcb* \
                    /opt/workfusion/wf_installer/sources/libxkbfile* \
                    /opt/workfusion/wf_installer/sources/pixman* \
                    /opt/workfusion/wf_installer/sources/xkeyboard-config* \
                    /opt/workfusion/wf_installer/sources/xorg-x11-xkb-utils* \
                    /opt/workfusion/wf_installer/sources/freerdp* \
                    /opt/workfusion/wf_installer/sources/avahi-libs* \
                    /opt/workfusion/wf_installer/sources/cups-libs* \
                    /opt/workfusion/wf_installer/sources/flac-libs* \
                    /opt/workfusion/wf_installer/sources/freerdp-libs* \
                    /opt/workfusion/wf_installer/sources/freerdp-plugins* \
                    /opt/workfusion/wf_installer/sources/gsm* \
                    /opt/workfusion/wf_installer/sources/libICE* \
                    /opt/workfusion/wf_installer/sources/libSM* \
                    /opt/workfusion/wf_installer/sources/libX11* \
                    /opt/workfusion/wf_installer/sources/libX11-common* \
                    /opt/workfusion/wf_installer/sources/libXau* \
                    /opt/workfusion/wf_installer/sources/libXcursor* \
                    /opt/workfusion/wf_installer/sources/libXext* \
                    /opt/workfusion/wf_installer/sources/libXfixes* \
                    /opt/workfusion/wf_installer/sources/libXi* \
                    /opt/workfusion/wf_installer/sources/libXinerama* \
                    /opt/workfusion/wf_installer/sources/libXrender* \
                    /opt/workfusion/wf_installer/sources/libXtst* \
                    /opt/workfusion/wf_installer/sources/libXv* \
                    /opt/workfusion/wf_installer/sources/libasyncns* \
                    /opt/workfusion/wf_installer/sources/libogg* \
                    /opt/workfusion/wf_installer/sources/libsndfile* \
                    /opt/workfusion/wf_installer/sources/libvorbis* \
                    /opt/workfusion/wf_installer/sources/libxcb* \
                    /opt/workfusion/wf_installer/sources/libxkbfile* \
                    /opt/workfusion/wf_installer/sources/pcsc-lite-libs* \
                    /opt/workfusion/wf_installer/sources/pulseaudio-libs*

note

If you already have an installed later version of a component, after this step, run the following command to avoid possible conflicts of versions:

yum -y downgrade <component>
# for example, yum -y downgrade gsm*

Set up server with Workfusion service

By default, Workfusion service runs on the APP server.

To set up a server with Workfusion service, as root unpack the HAProxy binary and enable HAProxy to run under runtime user on privileged ports (below 1025):

$ mkdir -p /opt/workfusion/haproxy/bin
$ cd /opt/workfusion/wf_installer/
$ tar -xvf sources/haproxy-2.0.5-wf-bundled.tar.gz --strip=1 -C /opt/workfusion/haproxy/bin/
$ chmod 0750 /opt/workfusion/haproxy/bin/haproxy
$ chown -R wfuser:wfuser /opt/workfusion/haproxy/bin
$ /usr/sbin/setcap CAP_NET_BIND_SERVICE=+eip /opt/workfusion/haproxy/bin/haproxy

Set up server with BEP Master service

By default, BEP Master service runs on the APP server for the basic setup or on the BEP Master server in case of the high-availability setup.

To set up a server with BEP Master service:

Install the required packaged dependencies for BEP Master as root:

yum -y localinstall /opt/workfusion/wf_installer/sources/libevent* \
               /opt/workfusion/wf_installer/sources/nfs-utils*

Create the directory to mount to as root:

$ mkdir /opt/workfusion/vds-data
$ chmod 0755 /opt/workfusion/vds-data
$ chown wfuser:wfuser /opt/workfusion/vds-data

Note: VDS (Virtual Data Since) is the former name for the BEP component.

Prepare a shared directory:

Setup your own NFS-server

Use external NAS

If you are not going to use external NAS, setup the NFS-server:

Enable and start rpcbind as root:

$ systemctl enable rpcbind
$ systemctl daemon-reload
$ systemctl start rpcbind
$ systemctl status rpcbind

Create an NFS-server configuration file as root:

cat << EOF > /etc/sysconfig/nfs
# TCP port rpc.lockd should listen on.
LOCKD_TCPPORT=32800
# UDP port rpc.lockd should listen on.
LOCKD_UDPPORT=32700
#
# Optional arguments passed to rpc.nfsd. See rpc.nfsd(8)
RPCNFSDARGS=""
# Optional arguments passed to rpc.mountd. See rpc.mountd(8)
RPCMOUNTDOPTS=""
# Port rpc.mountd should listen on.
MOUNTD_PORT=20048
#
# Optional arguments passed to rpc.statd. See rpc.statd(8)
STATDARG=""
# Optional arguments passed to sm-notify. See sm-notify(8)
SMNOTIFYARGS=""
#
# Optional arguments passed to rpc.idmapd. See rpc.idmapd(8)
RPCIDMAPDARGS=""
#
RPCGSSDARGS=""
#
# Enable usage of gssproxy. See gssproxy-mech(8).
GSS_USE_PROXY="yes"
#
# Optional arguments passed to blkmapd. See blkmapd(8)
BLKMAPDARGS=""
EOF

In the exports file /etc/exports, add the following line, by pasting and running the example as root:

cat << EOF >> /etc/exports
/opt/workfusion/vds-data *(fsid=0,rw,async,no_root_squash,no_subtree_check,insecure)
EOF

Start the NFS-server:

$ systemctl enable nfs-server
$ systemctl start nfs-server
$ systemctl status nfs-server

Only if external NAS is going to be used:

Prepare the shared folder on NAS.

Paste and run the following command as root to ensure that the folder is mounted at startup:

cat << EOF >> /etc/fstab
<nas_server_hostname>:/path/to/shared/folder /opt/workfusion/vds-data nfs rw,bg,retrans=5000,rsize=8192,vers=3,wsize=8192,timeo=14,intr 0 0
EOF

Remember to specify your <nas_server_hostname> and </path/to/shared/folder>.

Mount the NFS shared folder as root.
```
mount /opt/workfusion/vds-data
```

Set up server with BEP Agent service

By default, BEP Agent service runs on the BEP Agent server.

To set up a server with BEP Agent service:

Install the required packages for BEP Agent Server(s) as root:

yum -y localinstall /opt/workfusion/wf_installer/sources/libevent* \
                    /opt/workfusion/wf_installer/sources/libtiff* \
                    /opt/workfusion/wf_installer/sources/jbigkit-libs* \
                    /opt/workfusion/wf_installer/sources/libjpeg-turbo* \
                    /opt/workfusion/wf_installer/sources/boost* \
                    /opt/workfusion/wf_installer/sources/boost-atomic* \
                    /opt/workfusion/wf_installer/sources/boost-chrono* \
                    /opt/workfusion/wf_installer/sources/boost-context* \
                    /opt/workfusion/wf_installer/sources/boost-date-time* \
                    /opt/workfusion/wf_installer/sources/boost-filesystem* \
                    /opt/workfusion/wf_installer/sources/boost-graph* \
                    /opt/workfusion/wf_installer/sources/boost-iostreams* \
                    /opt/workfusion/wf_installer/sources/boost-locale* \
                    /opt/workfusion/wf_installer/sources/boost-math* \
                    /opt/workfusion/wf_installer/sources/boost-program-options* \
                    /opt/workfusion/wf_installer/sources/boost-python* \
                    /opt/workfusion/wf_installer/sources/boost-random* \
                    /opt/workfusion/wf_installer/sources/boost-regex* \
                    /opt/workfusion/wf_installer/sources/boost-serialization* \
                    /opt/workfusion/wf_installer/sources/boost-signals* \
                    /opt/workfusion/wf_installer/sources/boost-system* \
                    /opt/workfusion/wf_installer/sources/boost-test* \
                    /opt/workfusion/wf_installer/sources/boost-thread* \
                    /opt/workfusion/wf_installer/sources/boost-timer* \
                    /opt/workfusion/wf_installer/sources/boost-wave* \
                    /opt/workfusion/wf_installer/sources/libicu* \
                    /opt/workfusion/wf_installer/sources/redhat-lsb_core* \
                    /opt/workfusion/wf_installer/sources/at* \
                    /opt/workfusion/wf_installer/sources/avahi-libs* \
                    /opt/workfusion/wf_installer/sources/bc* \
                    /opt/workfusion/wf_installer/sources/cups-client* \
                    /opt/workfusion/wf_installer/sources/cups-libs* \
                    /opt/workfusion/wf_installer/sources/ed* \
                    /opt/workfusion/wf_installer/sources/m4* \
                    /opt/workfusion/wf_installer/sources/mailx* \
                    /opt/workfusion/wf_installer/sources/patch* \
                    /opt/workfusion/wf_installer/sources/psmisc* \
                    /opt/workfusion/wf_installer/sources/redhat-lsb-submod-security* \
                    /opt/workfusion/wf_installer/sources/spax* \
                    /opt/workfusion/wf_installer/sources/time*

Create a directory for NFS mount point as root:

$ mkdir /opt/workfusion/vds-data
$ chmod 0755 /opt/workfusion/vds-data
$ chown wfuser:wfuser /opt/workfusion/vds-data

In /etc/fstab, add the following line, as root:
```
cat << EOF >> /etc/fstab
<bep_master_hostname>:/opt/workfusion/vds-data /opt/workfusion/vds-data nfs rw,bg,retrans=5000,rsize=8192,vers=3,wsize=8192,timeo=14,intr 0 0
EOF
```
NOTE: in case of using external NAS replace <bep_master_hostname>:/opt/workfusion/vds-data with actual NAS server hostname and shared folder path.
Mount the NFS-shared folder as root:
```
mount /opt/workfusion/vds-data
```

Set up server with Elasticsearch service

By default, the Elasticsearch service runs on the INT server.

To set up a server with the Elasticsearch service:

Set required sysctl parameters by executing the following command as root:

cat << EOF > /etc/sysctl.d/elasticsearch.conf
vm.max_map_count=262144
EOF

Apply the configuration as root:

sysctl -p /etc/sysctl.d/elasticsearch.conf

As root, set required ulimits for Elasticeearch: memlock=unlimited

cat << EOF >> /etc/security/limits.conf
wfuser  soft    memlock unlimited
wfuser  hard    memlock unlimited
EOF

After you follow all the steps in the instruction, proceed to the preparation of the configuration files and installation. Remember not to run the command ./install.sh preinstall <server-name> on the Linux servers, as you have just manually performed the same operations as the script does in an automatic way. Proceed to the installation commands ./install.sh install <server-name> instead.

WorkFusion Documentation

10.1.4

Hardware

High availability setup

Standard setup

Install Linux components

Install OCR Windows server

Logs management

Security settings in Control Tower

Introduction

Prepare Linux servers

Set up server with Bot Manager service

note

Set up server with Workfusion service

Set up server with BEP Master service

Set up server with BEP Agent service

Set up server with Elasticsearch service