Skip to main content
Version: 10.3

Prepare for installation

Before installing Work.AI, you have to configure the environment.

First, make sure that:

  • An application user exists on each server according to the requirements.
  • The installation directory (for example, /opt/workfusion) exists on the Master server, and the application user is its owner.

Get installation package​

  1. In the installation directory, create another folder for the WorkFusion's PACKAGE_DIR installation package, for example, /opt/workfusion/wf_installer. Grant the read access to the directory to all users:

    $ mkdir -p /opt/workfusion/wf_installer
    $ chmod 0755 /opt/workfusion/wf_installer

  2. Download the provided installation package with any file retrieving tool, for example, wget or curl:

    $ curl 'https://LINK_TO_INSTALLER' --output /opt/workfusion/workfusion-full-package-<VERSION>.tar.gz

    If the Master server has no Internet access, download the installer and copy it as /opt/workfusion/workfusion-full-package-.tar.gz on the Master server.

  3. Extract the downloaded package to the directory:

    $ tar -xzvf /opt/workfusion/workfusion-full-package-<VERSION>.tar.gz --strip 1 -C /opt/workfusion/wf_installer

Configure installation server​

To configure the Master server, specify hostnames, ports, and installation parameters in the configuration files.

Specify hostnames​

Before configuring installation parameters, you must already have proper DNS resolution configured of all servers hostnames.

In your PACKAGE_DIR directory, open the hosts.yml configuration file and enter the prepared hostnames of each component according to the selected setup type: High Availability (HA) or the Basic one. 

$ vi hosts.yml

# The 'vi' text editor is used in the example
# Press 'i' to enter the editing mode.
# Add the required DNS name.
# After you add the values, press <Esc>, then type ":wq", and press <Return> to save the changes and quit the editing mode.
info

When specifying DNS names in hosts.yml, use lowercase letters only.

The DNS settings are different for the high availability and basic setup. See the corresponding tab below.

mssql_hostname: host-mssql1.example.com
master_hostnames: host-master1.example.com
agent_hostnames: host-agent1.example.com
rpa_hostnames: host-rpa1.example.com
bi_hostnames: host-bi1.example.com
superset_hostnames: host-superset1.example.com
ocrwin_hostnames: # Starting from 10.1.4.1, Windows-based OCR is not supported for new installations. Keep the value of the ocrwin_hostnames parameter empty. You can use windows-based OCR if you perform an upgrade from the previous version and already have WinOCR.

# Mandatory DNS aliases
vault_lb_hostname: host-vault-lb1.example.com
s3_lb_hostname: host-s3-lb1.example.com
s3_ui_lb_hostname: host-s3-ui-lb1.example.com
nexus_lb_hostname: host-nexus-lb1.example.com
rabbitmq_lb_hostname: host-rabbitmq-lb1.example.com
mesos_lb_hostname: host-mesos-lb1.example.com
marathon_lb_hostname: host-marathon-lb1.example.com
workspace_lb_hostname: host-workspace-lb1.example.com
workfusion_lb_hostname: host-workfusion-lb1.example.com
bot_manager_lb_hostname: host-bot-manager-lb1.example.com
kibana_lb_hostname: host-kibana-lb1.example.com
ocr_lb_hostname: host-ocr-lb1.example.com
bi_lb_hostname: host-bi-lb1.example.com
keycloak_lb_hostname: host-auth-lb1.example.com
superset_lb_hostname: host-analytics-lb1.example.com

Specify ports​

First, make sure you have opened the network equipment ports used by components for internal communications. After that, on the Master server, in the PACKAGE_DIRdirectory, edit the ports.yml file to specify the ports.

$ vi ports.yml
See sample ports.yml file
# !IMPORTANT
# It is highly advised NOT to changed any ports in this ports.yml file as they are used for product components inter-communication and are NOT externally facing.
# The ports which you might have a reason to change are located in config.yml.

# If you decide to change any ports here:
# - ensure that NONE of the ports in this file have duplicated values (ports on linux and windows machines may have duplicates);
# - ensure ports defined in ports.yml don't conflict with ports defined in config.yml (lb_port, lb_port_ssl, ssh_port, winrm_port (for windows hosts))
# - ensure you don't use privileged port values from range '1-1024'.
# - 80/443 can ONLY be used for lb_port/lb_port_ssl settings in config.yml.

# Don't change the ports which are marked "Don't change it" in comment. Otherwise installation or upgrade may fail.

# However, there might be several reasons when you want to change some ports here, in ports.yml:
#
# 1. You have a firewall policy which restricts 80/443 ports from EXTERNAL access from browsers (or internally for inter-server communication).
# For example, you've changed "lb_port/lb_port_ssl" ports in config.yml from 80/443 to 8080/8443.
# In this case you need to change "nginx_port/nginx_port_ssl" in ports.yml to different values to avoid port conflicts, for example to "8088/8444"
#
# 2. You have a firewall policy in your network which restricts some port from this file for INTERNAL communication between servers of WorkFusion Work.AI environment.
# In this case you have information about which exact ports are restricted. If don't find them in this file, it's OK. You don't need to change anything.
# If you find some restricted port, read port description firstly. You need to change it ONLY if it listens on '0.0.0.0'.
# If port is marked as "Listens on 127.0.0.1" it means that it doesn't take part in communication between any servers, and binds to local interface. Thus firewall restriction will not take affect.

# ALL Servers (MASTER, AGENT, RPA)
nginx_port:                          '8080'  # Listens on 0.0.0.0. Nginx HTTP port. Redirects requests to "nginx_port_ssl".
nginx_port_ssl:                      '8443'  # Listens on 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components.
nginx_status_port:                   '50080' # Listens on 127.0.0.1. Nginx HTTP port for statistics page. Used for monitoring.

# Master server ports
tds_port:                               '9090'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where task-dispatcher is listening.
tds_mtls_port:                          '9092'  # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests from to 'tds_port'. Validates client certs .
vault_port:                             '8200'  # Listens on 0.0.0.0 (HTTPS). Hashicorp Vault port.
vault_cluster_port:                     '8201'  # Listens on 0.0.0.0 (HTTPS). Port on which Vault listens for server-to-server cluster requests. Only active nodes have active listeners. When a node becomes active it will start cluster listeners, and when it becomes standby it will stop them.
nexus_port:                             '8082'  # Listens on 127.0.0.1 (HTTP). Sonatype Nexus port.
etcd_cluster_port:                      '2380'  # Listens on 0.0.0.0 (HTTPS). ETCD cluster port.
etcd_port:                              '2379'  # Listens on 0.0.0.0 (HTTPS). ETCD server port.
s3_api_port:                         '9000'  # Listens on 127.0.0.1 (HTTP). S3 API port (S3 emulator).
s3_ui_port:                          '9001'  # Listens on 127.0.0.1 (HTTP). S3 UI port (for access from browser).
elasticsearch_port:                     '9200'  # Listens on 0.0.0.0 (HTTPS). Elasticsearch port.
elasticsearch_transport_port:           '9300'  # Listens on 0.0.0.0 (HTTPS). Elasticsearch port to bind for communication between nodes (used in HA mode).
logstash_filebeat_port:                 '4567'  # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_metricbeat_port:               '4569'  # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_heartbeat_port:                '4571'  # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_bep_metrics_port:              '15072' # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_bep_logs_port:                 '4570'  # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_ocr_metrics_port:              '15073' # Listens on 0.0.0.0 (HTTPS). Logstash port.
rabbitmq_api_port:                      '15672' # Listens on 127.0.0.1 (HTTP). RabbitMQ API port.
rabbitmq_api_proxy_port:                '9064'  # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'rabbitmq_api_port'.
rabbitmq_amqp_port:                     '5672'  # Listens on 0.0.0.0 (TLS ecrtypted AMQP). RabbitMQ message Queue port.
rabbitmq_erlang_distr_server_port:      '25672' # Listens on 0.0.0.0 (TCP). Port used for rabbitmq cluster inter-node and CLI tool communication
rabbitmq_erlang_distr_client_ports:     '35672-35682' # Listen on 0.0.0.0 (TCP). Inter-node Communication Port Range for rabbitmq cluster
rabbitmq_erlang_empd_port:              '4369'  # Listens on 0.0.0.0 (TCP). The port where Erlang Port Mapper Daemonepmd (or "epmd") is listening. This daemon acts as a name server on all hosts of rabbitmq cluster. When rabbitmq node starts, the node has a name and it obtains an address from the host OS kernel
zookeeper_port:                         '2181'  # Listens on 0.0.0.0 (ZK). Zookeeper port. Used by mesos and marathon as they don't support SSL communication with ZK.
zookeeper_secure_port:                  '2281'  # Listens on 0.0.0.0 (ZK/SSL). Zookeeper SSL port. Used by WorkFusion Work.AI product components.
zookeeper_cluster_port:                 '2888'  # Listens on 0.0.0.0 (TCP). Zookeeper peers use this port to connect to other peers. More specifically, ZooKeeper server uses this port to connect followers to the leader. When a new leader arises, a follower opens a TCP connection to the leader using this port
zookeeper_leader_election_port:         '3888'  # Listens on 0.0.0.0 (TCP). Zookeeper port used for leader election. Because the default leader election also uses TCP, Zookeeper cannot use the same "zookeeper_cluster_port" for this. Thus it is required to have another port for leader election
workfusion_port:                        '7080'  # Listens on 127.0.0.1 (HTTP). Tomcat port where Control Tower is listening.
workfusion_tomcat_cluster_port:         '7088'  # Listens on 127.0.0.1 (HTTP). Tomcat port for Control Tower clustering.
ct_hazelcast_port:                      '5702'  # Don't change it. Listens on 0.0.0.0 (HTTPS). Hazelcast port for Control Tower. If you change it installation will fail on Control Tower startup (RCM-4175)
workspace_port:                         '5080'  # Listens on 127.0.0.1 (HTTP). Workspace port.
bot_manager_port:                       '5555'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where bot-manager service is listening.
kibana_port:                            '5601'  # Listens on 127.0.0.1 (HTTP). Kibana port.
wms_mtls_client_port:                   '9095'  # Don't change it. Listens on 127.0.0.1 (HTTP). Nginx port. Used by CT to proxy requests to WMS service mtls endpoint.
ags_mtls_client_port:                   '9077'  # Don't change it. Listens on 127.0.0.1 (HTTP). Nginx port. Used by CT to proxy requests to AGS service mtls endpoint.
workspace_mtls_client_port:             '5082'  # Listens on 127.0.0.1 (HTTP). Nginx port. Used by Workers to proxy requests to Workspace mtls endpoint (/workspace/api/internal).
workfusion_mtls_client_port:            '7081'  # Listens on 127.0.0.1 (HTTP). Nginx port. Used by Workers to proxy requests to Control Tower mtls endpoint (internal-api).
vault_proxy_port:                       '8202'  # Listens on 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for Vault.
zoonavigator_port:                      '8090'  # Listens on 127.0.0.1 (HTTP). Not used by default. Zoonavigator port.  Used only if you install product with "install_zoonavigator: true" option (not secure).
keycloak_port:                          '9099'  # Listens on 127.0.0.1 (HTTPS). Used in product versions 10.2+. Jboss Keycloak port.
keycloak_tcpping_port:                  '7600'  # Listens on 0.0.0.0 (HTTPS). Used in product versions 10.2+. Used for Keycloak in tcpping protocol for HA installation.
keycloak_ajp_port:                      '8009'  # Listens on 127.0.0.1. Used in product versions 10.2+. AJP Keycloak port.
keycloak_management_http_port:          '9990'  # Listens on 127.0.0.1 (HTTP). Used in product versions 10.2+. Defines the HTTP connection used by Wildfly CLI and web console.
keycloak_modcluster_port:               '23364' # Listens on 224.0.1.105 multicast address. Used in product versions 10.2+. Used in modcluster module.
keycloak_mail_smtp_port:                '25'    # Listens on 127.0.0.1. Used in product versions 10.2+. Mail smtp port.
wms_port:                               '9091'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where worker-management-service is listening.
wms_mtls_port:                          '9093'  # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'wms_port'.
ags_port:                               '9070'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where automl-gateway-service is listening.
ags_mtls_port:                          '9073'  # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'ags_port'.
ams_port:                               '9071'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where automl-model-service is listening.
ams_mtls_port:                          '9075'  # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'ams_port'.
amms_port:                              '9072'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where automl-model-management-service is listening.
amms_mtls_port:                         '9076'  # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'amms_port'.
abs_port:                               '9080'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where automl-billing-service is listening.
abs_mtls_port:                          '9094'  # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'abs_port'
apm_port:                               '8203'  # Listens on 127.0.0.1 (HTTP). Elastic APM port where APM server is listening.
ocr_port:                               '9002'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where OCR Rest API is listening.
marathon_port:                          '8480'  # Don't change it. Listens on 0.0.0.0 (HTTPS). Marathon Port.
marathon_communication_port:            '15000' # Listens on 0.0.0.0 (HTTPS). The port used by Marathon for libprocess communication between clustered nodes.
mesos_master_port:                      '5050'  # Listens on 0.0.0.0 (HTTPS). Mesos master port.
hazelcast_server_app_port:              '9061'  # Listens on 127.0.0.1 (HTTP). Spring-boot port where hazelcast-server is listening.
hazelcast_server_app_mtls_port:         '9063'  # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'hazelcast_server_app_port'.
hazelcast_server_communication_port:    '9702'  # Don't change it. Listens on 0.0.0.0 (HTTPS). Hazelcast server port.
tds_mtls_client_port:                   '9097'  # Don't change it. Listens on 127.0.0.1 (HTTP). Nginx port. Used by WMS to proxy requests to TDS mtls endpoint.
ams_mtls_client_port:                   '9085'  # Listens on 127.0.0.1 (HTTP). Nginx port. Used by AGS to proxy requests to AMS mtls endpoint.
amms_mtls_client_port:                  '9087'  # Listens on 127.0.0.1 (HTTP). Nginx port. Used by AGS to proxy requests to AMMS mtls endpoint.
nfs_lockd_tcp_port:                     '32800' # NFS lockd TCP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
nfs_lockd_udp_port:                     '32700' # NFS lockd UDP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
nfs_mountd_port:                        '20048' # Don't change it. NFS mountd TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
nfs_portmap_port:                       '111'   # Don't change it. NFS portmap TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
nfsd_port:                              '2049'  # Don't change it. NFS daemon TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
dataset_management_port:                '9074'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where Dataset Management is listening.
dataset_management_mtls_port:           '9079'  # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'dataset_management_port'.
dataset_management_mtls_client_port:    '9081'  # Don't change it. Listens on 127.0.0.1 (HTTP). Nginx port. Used by AutoML to proxy requests to Dataset Management Service mtls endpoint.
labeling_service_port:                  '9078'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where Labeling Service is listening.
manual_task_renderer_app_port:          '8990'  # Listens on 127.0.0.1 (HTTP). Spring Boot port where manual task renderer is listening.
jmx_monitoring_tds_port:                '10600' # Listens on 127.0.0.1 (HTTP). Not used by default. Task-dispatcher-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ct_port:                 '10602' # Listens on 127.0.0.1 (HTTP). Not used by default. Control Tower JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ws_port:                 '10604' # Listens on 127.0.0.1 (HTTP). Not used by default. Workspace JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_bm_port:                 '10605' # Listens on 127.0.0.1 (HTTP). Not used by default. Bot-manager JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_sqc_port:                '10601' # Listens on 127.0.0.1 (HTTP). Not used by default. SQC JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_wms_port:                '10606' # Listens on 127.0.0.1 (HTTP). Not used by default. Worker-management-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ags_port:                '10607' # Listens on 127.0.0.1 (HTTP). Not used by default. Automl-gateway-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ams_port:                '10608' # Listens on 127.0.0.1 (HTTP). Not used by default. Automl-model-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_amms_port:               '10609' # Listens on 127.0.0.1 (HTTP). Not used by default. Automl-model-management-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_hs_port:                 '10610' # Listens on 127.0.0.1 (HTTP). Not used by default. Hazelcast-server JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ocr_rest_port:           '10612' # Listens on 127.0.0.1 (HTTP). Not used by default. OCR Rest JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_dataset_management_port: '10613' # Listens on 127.0.0.1 (HTTP). Not used by default. Dataset Management JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_labeling_service_port:   '10614' # Listens on 127.0.0.1 (HTTP). Not used by default. Labeling Service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_abs_port:                '10615' # Listens on 127.0.0.1 (HTTP). Not used by default. Automl-billing-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).

# AGENT server ports
mesos_slave_port:              '5051'        # Listens on 0.0.0.0 (HTTPS). Mesos Agent port.
mesos_slave_port_range:        '40000-44000' # Listens on 0.0.0.0 (HTTPS). Ports range on mesos Agent(s) used for communication with Mesos Master (ports from this range are opened randomly during tasks execution).
input_connector_rest_port:     '8081'        # Listens on 0.0.0.0 (HTTP) input-connector-rest port.
# Additional ports listening on AGENT server(s): ags_mtls_client_port, workfusion_mtls_client_port, workspace_mtls_client_port

# RPA Windows Server ports
bot_manager_mtls_client_port: '5555' # Listens on 127.0.0.1 (HTTP). Nginx port. Used by workers to proxy requests to bot-manager from RPA server.
rdp_port:                     '3389' # Listens on 0.0.0.0 (RDP). Remote Desktop port. Used by bot manager to log in into RPA server.
# Additional ports listening on RPA servers: {nginx_port}, {nginx_port_ssl}, {workfusion_mtls_client_port}, {ags_mtls_client_port}

Specify RPA users​

To configure RPA servers, on the Master server, in the PACKAGE_DIR directory, edit the rpa.yml file and add the credentials of the RPA users for all RPA servers.

$ vi rpa.yml
See sample RPA.yml file
rpa_ad_domain: ''
rpa_machines:
    rpa1.example.com:
        -
        unit: 'master'
        username: 'USERNAME'
        password: 'PASSWORD'
        -
        unit: 'unit_1'
        username: 'USERNAME'
        password: 'PASSWORD'
        -
        unit: 'unit_2'
        username: 'USERNAME'
        password: 'PASSWORD'
    rpa2.example.com:
        -
        unit: 'master'
        username: 'USERNAME'
        password: 'PASSWORD'
        -
        unit: 'unit_1'
        username: 'USERNAME'
        password: 'PASSWORD'
        -
        unit: 'unit_2'
        username: 'USERNAME'
        password: 'PASSWORD'

The file contains the following configurable parameters:

  • rpa_ad_domain: if Active Directory Domain users are used for unit, specify the Active Directory domain name for the rpa_ad_domain setting. Example: rpa_ad_domain: 'EXAMPLE.COM'.

  • rpa[X].example.com: the RPA host. Specify the same host in hosts.yml. If you have several hosts, add them to the rpa.yml and hosts.yml files. Each host must include at least one of the following user configuration blocks.

  • unit: type of the user. Possible values:

    • master: Bot Master user.

    • unit_[X]: Bot Unit user.

      If you use Windows Server 2016 on your RPA server (the RPD-to-RDP RPA installation), specify one unit: 'master' and all the Bot Unit users (unit: 'unit_1', unit: 'unit_2', and so on) on this host. Each host can have a different number of users.

    • vdi: a non-RDP user. If you have Windows 10 or 8 as your RPA server OS (VDI installation), specify only one unit:'vdi' on this host.

  • username: name of the unit user.

    For Active Directory, specify users in the format: DOMAIN\username or LOCALHOST\username if they belong to different types. For example, BotMaster is a domain account, while BotUnits are local.

  • password: password of the unit user.

Specify installation parameters​

By default, the config.yml file doesn't contain passwords. You must generate them with the following script or set manually.

To specify the installation parameters, follow the steps below:

  1. On the Master server, in the PACKAGE_DIR directory, change the permissions for the config.yml file:

    $ sudo chmod 644 config.yml

  2. Open the config.yml file. In the parameter ansible_vault_password, change the Ansible vault password:

    $ vi config.yml

    The password is used to encrypt config.yml at the subsequent step and is requested several times during the installation. Ensure to secure and memorize it.

  3. Complete the step for the high availability setup only. In config.yml, in the HA mode section, set the following mandatory parameter to enable the high availability mode: ha_mode: true.

    Note: skip this step if you plan to set up Work.AI in the Basic mode.

  4. On the Master server, run the following command to automatically generate passwords for the WorkFusion internal services according to product policies.

    $ ./install.sh passwords generate

    As a result, in config.yml, passwords for most services are created, except for the following end-user ones:

    rpa_pass:
    bi_pass:

    Alternatively, you can set the passwords manually. In that case, remember to use only Latin letters and allowed symbols. If needed, change other secrets and parameters. After that, save and close the file.

    When creating passwords, make sure they are strong enough and meet the following requirements:

    • At least one space should be present between each 'key: value'.
    • It is strongly advised to enclose values with special symbols into single quotes.
    • Standard English symbols must be used.
    • Passwords must be not shorter that 6 symbols and not longer than 20 symbols.
    • Passwords must contain at least one uppercase character [A-Z].
    • Passwords must contain at least one lowercase character [a-z].
    • Passwords must contain at least one numeric character [0-9].
    • Passwords must contain at least one of the following special symbols unless limitations are explicitly described in comments: @#^*():,.}[]></.
    • Passwords must NOT contain spaces or the following symbols: ;\"!?&'{$|`%.

    Note: in the #MSSQL section, specify the corresponding MS SQL login names and passwords you created earlier.

Configure services​

Request credentials and URL for Solution Catalog​

Request credentials and URL for Solution Catalog from the WorkFusion team and specify them in the config.yaml file:

solution_catalog_enabled: true
solution_catalog_url: 'https://solution-catalog.workfusion.com'
solution_catalog_username: ''
solution_catalog_password: ''

Alternatively, if the environment is deployed without Internet access and there is no possibility to use the Solution Catalog, set the solution_catalog_enabled variable to false, leaving other three variables as is.

Integrate services with APM​

To integrate WorkFusion services with APM, enable the corresponding parameter:

...
apm_enabled: true
...

Specify parameters for Pendo setup identification​

For the successful Pendo setup identification, specify the customer and environment ID parameters in config.yml:

billing_environment_id: ''
billing_customer_id: ''

Mind that these parameters have nothing to do with billing procedures and are responsible for the identification only.

Encrypt configuration​

Run the following command to encrypt both the config.yml and rpa.yml files:

$ ./install.sh encrypt config

Note that the installer doesn't allow you to start the installation until config.yml is encrypted.

If needed, you can edit the encrypted files later with the following commands:

$ cd /opt/workfusion/wf_installer
$ ./install.sh edit_config master      #edit config.yml
$ ./install.sh edit_rpa_config master  #edit rpa.yml

Prepare certificates​

To prepare certificates, follow the steps below:

  1. Log in via SSH to the Master server and add the prepared ca.crt, server.crt, and server.key to the PACKAGE_DIR/certificates/ directory. Skip the step if you do not have them.

    $ ls -la PACKAGE_DIR/certificates/
    total 24
    drwxr-xr-x.  3 ec2-user ec2-user   78 Sep 24 14:47 .
    drwxr-xr-x. 12 ec2-user ec2-user 4096 Sep 27 17:20 ..
    -rw-r--r--.  1 ec2-user ec2-user 2984 Sep 24 14:42 ca.crt
    -rw-r--r--.  1 ec2-user ec2-user 4835 Sep 24 14:42 server.crt
    -rw-r--r--.  1 ec2-user ec2-user 1674 Sep 24 14:42 server.key

  2. Generate the additional client certificates used internally by the Workfusion services for communication and authentication among each other. Execute the following command on the Master server:

    $ ./install.sh certs generate

    The command creates the _auth_internal/ sub-directory inside the certificates/ directory and generates all required internal certs. If you didn't add your ca.crt, server.crt, and server.key files to the /certificates directory, they are also generated automatically (self-signed).

    See certificates and directory content
    $ cd PACKAGE_DIR/
    $ tree certificates/

    certificates/
    ├── _auth_internal
    │   ├── elasticsearch.crt
    │   ├── elasticsearch.key
    │   ├── elk-ca.crt
    │   ├── elk-ca.key
    │   ├── kibana.crt
    │   ├── kibana.key
    │   ├── logstash.crt
    │   ├── logstash.key
    │   ├── logstash.p12
    │   ├── mtls-ca.crt
    │   ├── mtls-ca.key
    │   ├── mtls-client.crt
    │   ├── mtls-client.key
    │   ├── vault_admin.crt
    │   ├── vault_admin.p12
    │   ├── vault_workfusion.crt
    │   └── vault_workfusion.p12
    ├── ca.crt
    ├── server.crt
    └── server.key

Install Workfusion license​

To install the WorkFusion license, copy the provided license.properties file to the PACKAGE_DIR directory, for example, /opt/workfusion/wf_installer/license.properties.

If you install the Product on your own, request the license file from your WorkFusion Account Manager or via the Service Desk. For more information, see Activate Workfusion license.

Prepare MS SQL server​

  1. On the Master server, check that MS SQL meets the requirements:

    $ ./install.sh precheck mssql
    # Checks that MSSQL credentials are set correctly in config.yml,
    # database exists, wf_dba_user exists and has db_owner role

  2. If all checks have passed successfully, run the following command to grant necessary permissions for database schemas.

    $ ./install.sh configure mssql
    # Creates all required schemas in Workfusion DB,
    # creates and maps DB users to provided MSSQL logins,
    # and assigns correct user permissions per schemas

Run additional root steps​

Additionally, run the steps that require root privileges. Depending on your company's policy, sudo permissions can be temporarily granted to the application user, or another user with the root privileges can execute this set of tasks.

If you decide to grant these privileges to the application user, it is recommended to revoke them after the installation for security reasons.

Select the tab with the user that matches your case:

If your application user has sudo permissions:

Prepare system libraries to execute Ansible installer​

note

This step is only required if you run on RHEL/Rocky Linux 9.x.

Run the following commands on each server where Ansible installer will be executed:

ln -s /usr/lib64/libffi.so.8 /usr/lib64/libffi.so.6 || true

Prepare master server​

$ ./install.sh preinstall full

Perform additional setup for Superset server​

Run this command on the Superset server:

sudo yum install nfs-utils policycoreutils-python-utils iptables fuse-overlayfs slirp4netns

If you have an external NFS server, mount the vds-data directory on the Superset server and make sure it persists after the server reboot.

Apply configuration to all servers​

If you are installing the Product in the multipoint way, copy the PACKAGE_DIR directory to all other Linux servers. Otherwise, skip this step.