Prepare for installation

Extract installation packages

important

Skip this step, if you have prepared the environment in the manual mode. For more information, see Run pre-installation steps manually.

To extract installation packages:

Log in to the APP server as a Linux installation user, by using Linux Terminal, Windows PuTTY, or any other SSH client:
```
$ ssh -i <path-to-private-key.pem> <username>@<hostname.example.com>
```
Here, <username> is Linux installation user.
In INSTALL_DIR, create a directory for the WorkFusion installation package, for example, /opt/workfusion/wf_installer. Grant the read access for this directory to all users:
```
$ sudo mkdir -p /opt/workfusion/wf_installer
$ sudo chmod 0755 /opt/workfusion/wf_installer
```
Make sure that the Linux installation user is an owner of the installation directory:
```
$ sudo chown -R <username>:<username> /opt/workfusion/
```
Download the provided installation package with any file retrieving tool, for example, wget or curl:
- If the Internet access is available on the server:
```
$ curl 'https://link_to_installer' --output /opt/workfusion/workfusion-full-package-<version>.tar.gz
```
- If the Internet access is not available on the APP server, download the Intelligent Automation Cloud installer and copy it as /opt/workfusion/workfusion-full-package-.tar.gz on the APP server.

Extract the downloaded package to the directory:

$ tar -xzvf /opt/workfusion/workfusion-full-package-<version>.tar.gz --strip 1 -C /opt/workfusion/wf_installer

Configure installation server

To configure the installation APP server, you must specify hostnames, ports, and installation parameters in the set of configuration files.

Specify DNS names

Before configuring installation parameters, you must already have DNS names mapped to the required servers.

To specify DNS names, in your PACKAGE_DIR directory, open the hosts.yml configuration file, and enter the prepared domain names of each component according to the selected setup type: HA or basic one.

$ vi hosts.yml

# The **vi** text editor is used in the example:

The DNS settings are different for the high-availability and basic setup. See the corresponding tab.

HA setup

Basic setup

vault_lb_hostname: host-vault-lb1.example.com
minio_lb_hostname: host-minio-lb1.example.com
nexus_lb_hostname: host-nexus-lb1.example.com
rabbitmq_lb_hostname: host-rabbitmq-lb1.example.com
mesos_lb_hostname: host-mesos-lb1.example.com
marathon_lb_hostname: host-marathon-lb1.example.com
workspace_lb_hostname: host-workspace-lb1.example.com
workfusion_lb_hostname: host-workfusion-lb1.example.com
bot_manager_lb_hostname: host-bot-manager-lb1.example.com
kibana_lb_hostname: host-kibana-lb1.example.com
ocr_lb_hostname: host-ocr-lb1.example.com
bi_lb_hostname: host-bi-lb1.example.com

mssql_hostname: <listener-ip-address>
int_hostnames: host-int1.example.com,host-int2.example.com,host-int3.example.com
app_hostnames: host-ct1.example.com,host-ct2.example.com
ocr_hostnames: host-ocr1.example.com,host-ocr2.example.com #ignore if you install OCR on Windows hosts
ocrwin_hostnames: host-ocr1.example.com,host-ocr2.example.com #ignore if you install OCR on Linux hosts
bi_hostnames: host-bi1.example.com,host-bi2.example.com
bep_master_hostnames: host-bepmaster1.example.com,host-bepmaster2.example.com,host-bepmaster3.example.com
bep_agent_hostnames: host-bepagent1.example.com,host-bepagent2.example.com
rpa_hostnames: host-rpa1.example.com,host-rpa2.example.com

Example of hosts.yml file for the standard 8S+ environment:

# The following DNS names must be mapped to the IP address of the APP server.
vault_lb_hostname: host-vault-lb1.example.com
minio_lb_hostname: host-minio-lb1.example.com
nexus_lb_hostname: host-nexus-lb1.example.com
rabbitmq_lb_hostname: host-rabbitmq-lb1.example.com
mesos_lb_hostname: host-mesos-lb1.example.com
marathon_lb_hostname: host-marathon-lb1.example.com
workspace_lb_hostname: host-workspace-lb1.example.com
workfusion_lb_hostname: host-workfusion-lb1.example.com
bot_manager_lb_hostname: host-bot-manager-lb1.example.com
kibana_lb_hostname: host-kibana-lb1.example.com
ocr_lb_hostname: host-ocr-lb1.example.com
bi_lb_hostname: host-bi-lb1.example.com

# Provide DNS names of Enterprise Edition servers
mssql_hostname: host-mssql1.example.com
int_hostnames: host-int1.example.com
app_hostnames: host-ct1.example.com
ocr_hostnames: host-ocr1.example.com #ignore if you install OCR on a Windows host
ocrwin_hostnames: host-ocr1.example.com #ignore if you install OCR on a Linux hosts
bi_hostnames: host-bi1.example.com
bep_master_hostnames: host-bepmaster1.example.com
bep_agent_hostnames: host-bepagent1.example.com
rpa_hostnames: host-rpa1.example.com

Example of hosts.yml file for the Compact 5S+ environment:

Note that int_hostnames, app_hostnames, and bep_master_hostnames must have the same value.

# The following DNS names must be mapped to the IP address of the APP server.
vault_lb_hostname: host-vault-lb1.example.com
minio_lb_hostname: host-minio-lb1.example.com
nexus_lb_hostname: host-nexus-lb1.example.com
rabbitmq_lb_hostname: host-rabbitmq-lb1.example.com
mesos_lb_hostname: host-mesos-lb1.example.com
marathon_lb_hostname: host-marathon-lb1.example.com
workspace_lb_hostname: host-workspace-lb1.example.com
workfusion_lb_hostname: host-workfusion-lb1.example.com
bot_manager_lb_hostname: host-bot-manager-lb1.example.com
kibana_lb_hostname: host-kibana-lb1.example.com
ocr_lb_hostname: host-ocr-lb1.example.com
bi_lb_hostname: host-bi-lb1.example.com

# Provide DNS names of Intelligent Automation Cloud servers
int_hostnames: host-ct1.example.com
app_hostnames: host-ct1.example.com
bep_master_hostnames: host-ct1.example.com
ocr_hostnames: host-ocr1.example.com #ignore if you install OCR on a Windows host
ocrwin_hostnames: host-ocr1.example.com #ignore if you install OCR on a Linux hosts
bi_hostnames: host-bi1.example.com
bep_agent_hostnames: host-bepagent1.example.com
rpa_hostnames: host-rpa1.example.com
mssql_hostname: host-mssql1.example.com

For more information on the DNS, see the DNS names requirements.

Specify ports

To specify opened ports, on the APP server, in the PACKAGE_DIR directory, edit the ports.yml file.

$ vi hosts.yml

In the file, specify the TCP ports that you have opened, when preparing the environment. For more information, see Application Ports.

The example of ports.yml file...

# ALL Servers (INT, BEP Master, BEP Agent(s), APP, RPA, OCR)
nginx_port:                          '8080'  # Nginx HTTP port. Affects nginx configuration on all servers. All requests to 'nginx_port' are redirected to 'nginx_port_ssl'.
nginx_port_ssl:                      '8443'  # Nginx HTTPS port. The main port for accessing Control Tower and many other SPA services with http clients (for example, browsers). Affects all servers.
nginx_http_req_retry_port:           '11111' # Nginx HTTP port for internal product purpose. Used by client mTLS services for requests retries. Listens on 127.0.0.1.

# INT, BEP Master, APP
flask_watchdog_port:                 '10500'  # Flask watchdog port. Listens on 127.0.0.1 (HTTP). Used for failover monitoring of standby HA services.

# ALL Linux Servers (INT, BEP Master, BEP Agent(s), APP, OCR)
supervisord_port:                    '9900' # Supervisord port. Listens on 127.0.0.1 (HTTP).

# INT Server ports
tds_port:                            '9090'  # Spring Boot port where task-dispatcher is listening. Listens on 127.0.0.1 (HTTP).
tds_mtls_port:                       '9092'  # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests from to 'tds_port'. Validates client certs .
vault_port:                          '8200'  # Hashicorp Vault port. Listens on 0.0.0.0 (HTTPS).
nexus_port:                          '8082'  # Sonatype Nexus port. Listens on 127.0.0.1 (HTTP).
minio_port:                          '9000'  # Minio Server Port (S3 emulator). Listens on 127.0.0.1 (HTTP).
elasticsearch_port:                  '9200'  # Elasticsearch port. Listens on 0.0.0.0 (HTTPS).
logstash_filebeat_port:              '4567'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_metricbeat_port:            '4569'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_heartbeat_port:             '4571'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_bep_metrics_port:           '15072' # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_bep_logs_port:              '4570'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
logstash_vds92_port:                 '4568'  # Logstash port. Listens on 0.0.0.0 (HTTPS).
rabbitmq_api_port:                   '15672' # RabbitMQ API port. Listens on 127.0.0.1 (HTTP).
rabbitmq_api_proxy_port:             '45672' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'rabbitmq_api_port'.
rabbitmq_amqp_port:                  '5672'  # RabbitMQ message Queue port. Listens on 0.0.0.0 (TLS ecrtypted AMQP).
zookeeper_port:                      '2181'  # Zookeeper port. Listens on 0.0.0.0.
flask_nexus_port:                    '10501' # Flask nexus port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_tds_port:                      '10502' # Flask task-dispatcher-service port. Listens on 127.0.0.1 (HTTP). Used for failover.

# APP Server ports
workfusion_port:                     '7080' # Tomcat port where Control Tower is listening. Listens on 127.0.0.1 (HTTP).
ct_hazelcast_port:                   '5702' # Do not change! Hazelcast port for Control Tower. Listens to 0.0.0.0. 
workspace_port:                      '5080' # Tomcat port where Workspace is listening. Listens on 127.0.0.1 (HTTP).
sqc_port:                            '4080' # Tomcat port where AutoQC is listening. Listens on 127.0.0.1 (HTTP).
sqc_mtls_port:                       '4084' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests using http to localhost's 'sqc_port'.
sqc_mtls_client_port:                '4082' # Nginx port. Listens on 127.0.0.1 (HTTP). Used by CT to send requests to SQC service. Forwards requests using HTTPS to LB, to SQC endpoint
bot_manager_port:                    '5555' # Spring Boot port where bot-manager service is listening. Listens on 127.0.0.1 (HTTP).
kibana_port:                         '5601' # Kibana port. Listens on 127.0.0.1 (HTTP).
flask_workfusion_port:               '10507' # Flask Control Tower port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_workspace_port:                '10508' # Flask Workspace port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_bot_manager_port:              '10509' # Flask Bot Manager port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_sqc_port:                      '10510' # Flask SQC port. Listens on 127.0.0.1 (HTTP). Used for failover.
wms_mtls_client_port:                '9095'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by CT to proxy requests to WMS service mtls endpoint.
ags_mtls_client_port:                '9077'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by CT to proxy requests to AGS service mtls endpoint.
vault_proxy_port:                    '8202'  # Load Balancer endpoint port for Vault
# NOTE: Additionally the following ports are also listening by haproxy on APP servers:
# lb_port; lb_port_ssl; tds_mtls_port; wms_mtls_port; ags_mtls_port; ams_mtls_port; amms_mtls_port; vault_port; elasticsearch_port
# Make sure you don't use them for any services on APP servers. All these ports are used on 0.0.0.0 by internal HAPROXY.
#
# NOTE: Additionally the following ports are used by Tomcat processes on APP servers:
# 'workfusion_port + 5'; 'workfusion_port + 8'; 'workspace_port + 5'; 'workspace_port + 8'; 'sqc_port + 5'; 'sqc_port + 8'. Make sure you don't use them for any services on APP server. All these ports are used only on 127.0.0.1.

# BEP Master ports
wms_port:                            '9091' # Spring Boot port where worker-management-service is listening. Listens on 127.0.0.1 (HTTP).
wms_mtls_port:                       '9093' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'wms_port'. Validates client certs.
ags_port:                            '9070' # Spring Boot port where automl-gateway-service is listening. Listens on 127.0.0.1 (HTTP).
ags_mtls_port:                       '9073' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'ags_port'. Validates client certs.
ams_port:                            '9071' # Spring Boot port where automl-model-service is listening. Listens on 127.0.0.1 (HTTP).
ams_mtls_port:                       '9075' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'ams_port'. Validates client certs.
amms_port:                           '9072' # Spring Boot port where automl-model-management-service is listening. Listens on 127.0.0.1 (HTTP).
amms_mtls_port:                      '9076' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'amms_port'. Validates client certs.
marathon_port:                       '8000' # Marathon Port. Listens on 127.0.0.1 (HTTP).
marathon_proxy_port:                 '8480' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'marathon_port'.
marathon_communication_port:         '15000' # The port used by Marathon for libprocess communication. Listens on 0.0.0.0 (HTTPS).
mesos_master_port:                   '5050' # Mesos master port. Listens on 0.0.0.0 (HTTPS).
vds_gateway_service_port:            '9080' # Spring Boot port where VDS Gateway Service is listening. Listens on 127.0.0.1 (HTTP). Only used when SPA9.2 AutoML is installed. Used for backward compatibility with SPA9.2 business-processes.
vds_scaling_service_port:            '9081' # Spring Boot port where VDS Scaling Service is listening. Listens on 127.0.0.1 (HTTP). Only used when SPA9.2 AutoML is installed. Used for backward compatibility with SPA9.2 business-processes.
vds_mesos_adapter_port:              '9052' # Spring Boot port where VDS Mesos Adapter Service is listening. Listens on 127.0.0.1 (HTTP). Only used when SPA9.2 AutoML is installed. Used for backward compatibility with SPA9.2 business-processes.
hazelcast_server_app_port:           '9061' # Spring-boot port where hazelcast-server is listening.
hazelcast_server_app_mtls_port:      '9063' # Nginx port. Listens on 0.0.0.0 (HTTPS) and proxies requests to 'hazelcast_server_app_port'. Validates client certs.
hazelcast_server_communication_port: '9702' # Hazelcast port for hazelcast-server.
flask_ags_port:                      '10503' # Flask automl-gateway-service port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_ams_port:                      '10504' # Flask automl-model-service port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_amms_port:                     '10505' # Flask automl-model-management-service port. Listens on 127.0.0.1 (HTTP). Used for failover.
flask_wms_port:                      '10506' # Flask worker-management-service port. Listens on 127.0.0.1 (HTTP). Used for failover.
tds_mtls_client_port:                '9097'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by WMS to proxy requests to TDS mtls endpoint.
ams_mtls_client_port:                '9085'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by AGS to proxy requests to AMS mtls endpoint.
amms_mtls_client_port:               '9087'  # Nginx port. Listens on 127.0.0.1 (HTTP). Used by AGS to proxy requests to AMMS mtls endpoint.

# BEP Agent ports
mesos_slave_port:                    '5051'        # Mesos Agent port. Listens on 0.0.0.0 (HTTPS).
mesos_slave_port_range:              '40000-44000' # Ports range on mesos Agent(s) used for communication with Mesos Master (ports from this range are opened randomly during tasks execution).
workfusion_mtls_client_port:         '7081'        # Nginx port. Listens on 127.0.0.1 (HTTP). Used by Workers to proxy requests to Control Tower mtls endpoint (internal-api).
# Additional ports listening on BEP Agent(s): {ags_mtls_client_port}

# OCR Server ports
ocr_port:                            '9002' # Spring Boot port where OCR Rest API is listening. Listens on 127.0.0.1 (HTTP).

# RPA Server ports
bot_manager_mtls_client_port:        '5555'
# Additional ports listening on RPA servers: {nginx_port}, {nginx_port_ssl}, {workfusion_mtls_client_port}, {ags_mtls_client_port}

Specify installation parameters

To specify the installation parameters:

Open the config.yml file, and in the parameter ansible_vault_password, change the ansible vault password:

$ vi config.yml

The password is used for encrypting the config.yml at the following step and will be asked several times during the installation of the components. We strongly recommend to secure and memorize it. When creating passwords, make sure they are strong enough and meet the following requirements:

# PASSWORDS POLICY
# - must contain standard English symbols
# - must be no shorter than 6 symbols and no longer than 20 symbols
# - must contain at least one uppercase character [A-Z]
# - must contain at least one lowercase character [a-z]
# - must contain at least one numeric character [0-9]
# - must contain at least one of the following special symbols unless limitations are explicitly described in comments: @#^*():,.}[]<>/
# - must NOT contain the following symbols: \"!?&'{$|`%;
# - must NOT contain spaces

Note: in the #MSSQL section, you must specify the corresponding MS SQL login names and passwords, that you have created earlier.

For the high availability setup only. In config.yml, in section HA mode, set the following mandatory parameter to enable the high availability mode.
- ha_mode: true – enable the HA mode.
Note: skip this step, if you are planning to setup IA Cloud Enterprise in the basic mode.
Optionally, on the APP server, run the following command to automatically generate passwords for the WorkFusion internal services according to product policies. We strongly recommend to change them manually for security reasons. Note that the command doesn't generate end-user password.
```
$ ./install.sh passwords generate
```
As a result, in config.yml, the passwords for most services, except for the following end-user ones, are created:
```
"wf_password"
"ldap_bind_password"
"mail_pass"
"tableau_dashboard_pass"
"tableau_automation_pass"
"windows_installation_pass"
"elk_admin_pass"
"ansible_vault_password”
"bot_relay_user_pass"
"bot_user_pass"
```
If you prefer to set the passwords manually, remember to use only Latin letters and allowed symbols. If needed, change other secrets and parameters, as well. After that, save and close the file.
Run the following command to encrypt the config.yml file:
```
$ ./install.sh encrypt config
```
Note that the installer will not let you start the installation until config.yml is encrypted.

If needed, you can later edit the encrypted file with the following commands:
```
$ cd /opt/workfusion/wf_installer
$ ./install.sh edit_config app
```

Prepare the certificates

To prepare certificates:

Login via SSH to the installation server and place prepared ca.crt, server.crt, and server.key to the PACKAGE_DIR/certificates/ directory. Skip the step, if you do not have them.

$ ls -la PACKAGE_DIR/certificates/
total 24
drwxr-xr-x.  3 ec2-user ec2-user   78 Sep 24 14:47 .
drwxr-xr-x. 12 ec2-user ec2-user 4096 Sep 27 17:20 ..
-rw-r--r--.  1 ec2-user ec2-user 2984 Sep 24 14:42 ca.crt
-rw-r--r--.  1 ec2-user ec2-user 4835 Sep 24 14:42 server.crt
-rw-r--r--.  1 ec2-user ec2-user 1674 Sep 24 14:42 server.key

Generate the additional client certs that are used internally by the Workfusion services for communication and authentication among each other. Execute the following command on the APP server:
```
$ ./install.sh certs generate
```
The command creates the _auth_internal/ directory inside the certificates/ directory and generates all required internal certs. If you haven't placed your ca.crt, server.crt, and server.key files to the /certificates directory, they also will be automatically generated (self-signed).
Here is how the certificates/ directory's content must look like...
```
$ cd PACKAGE_DIR/
$ tree certificates/
certificates/
|-- _auth_internal
|   |-- elk-ca.crt
|   |-- elk-ca.key
|   |-- kibana.crt
|   |-- kibana.key
|   |-- logstash.crt
|   |-- logstash.key
|   |-- logstash.p12
|   |-- mtls-ca.crt
|   |-- mtls-ca.key
|   |-- mtls-client.crt
|   |-- mtls-client.key
|   |-- vault_admin.crt
|   |-- vault_admin.p12
|   |-- vault_workfusion.crt
|   `-- vault_workfusion.p12
|-- ca.crt
|-- server.crt
`-- server.key
```

Distribute configuration files accross other servers

After you prepare the required configuration on the main installation server, you must distribute the PACKAGE_DIR/certificates folder, along with config.yml, hosts.yml, ports.yml, and rpa.yml files across all other Linux servers.

Upload configuration files to servers

Create the wf_configs.tar.gz archive with these files:

$ tar czvf wf_configs.tar.gz certificates config.yml hosts.yml ports.yml rpa.yml

Copy wf_configs.tar.gz to all other servers.

For that a python SimpleHTTPServer can be used. Start the HTTP server on any APP Server's port, which is accessible by other servers:

Example: SimpleHTTPServer is on port 9999
```
python -m SimpleHTTPServer 9999
```
After running this command in a specific directory, the content of the directory can be downloaded via HTTP (see further).

Transfer configuration to other Linux servers

The following steps must be performed on each Linux server, except APP.

To prepare other Linux servers:

cd /opt/workfusion/wf_installer

# install curl to download configs from the app server over http (or you can copy wf_configs.tar.gz using any other available option)
$ yum -y install curl
$ curl -o 'wf_configs.tar.gz' http://app_hostname:9999/wf_configs.tar.gz

Unpack configuration files and certificates:

$ tar xzvf wf_configs.tar.gz -C /opt/workfusion/wf_installer/

Repeat steps 1-2 on all other Linux servers.

Transfer configuration to Windows servers

To prepare Windows servers:

Log in to a targer server, as Administrator, and download wf_configs.tar.gz from the SimpleHTTPServer on the APP server via browser or any other convenien means.
Unpack wf_configs.tar.gz.
Repeat steps 1-2 on all other Windows servers.

Prepare MS SQL server

On the APP server, check that MS SQL meets the requirements:
```
$ ./install.sh precheck mssql
```
If all checks have passed successfully, run the following command to grant necessary permissions for database schemes.
```
$ ./install.sh configure mssql
```

Install the WorkFusion license

Run the following step on the APP server.

To install the license, copy the provided license.properties file to the PACKAGE_DIR directory, for example, /opt/workfusion/wf_installer/license.properties.

WorkFusion Documentation

10.1.4

Hardware

High availability setup

Standard setup

Install Linux components

Install OCR Windows server

Logs management

Security settings in Control Tower

Extract installation packages

important

Configure installation server

Specify DNS names

Specify ports

Specify installation parameters

Prepare the certificates

Distribute configuration files accross other servers

Upload configuration files to servers

Transfer configuration to other Linux servers

Transfer configuration to Windows servers

Prepare MS SQL server

Install the WorkFusion license