General description

Below is the procedure for performing a single-host installation.

Instructions for deploying NAICE in a high-availability configuration are provided in v1.1_3.3 High-availability installation (using VRRP) and v1.1_3.4 High-availability installation (without using VRRP).

For successful installation on Astra Linux 1.7.5 / 1.7.6, Ansible version 2.17.12 or earlier is required.

sudo apt install ansible sshpass -y

wget https://cloud.eltex-co.ru/index.php/s/9Hv6p4yz611fDXb/download -O community-docker-4.7.0.tar.gz

ansible-galaxy collection install community-docker-4.7.0.tar.gz

ansible-galaxy collection list | grep community.docker
community.docker                         4.7.0  
community.docker                         X.X.X 

NAICE is a licensed product; activating its functionality requires a valid license. See v1.1_2. Licensing for details.

At the time of installation, the license is not required, the product can be installed without activation.

Until a license is activated, NAICE operates in demo mode, in which the maximum number of network devices, active endpoints, and active guest endpoints is limited to 15 each.

wget https://cloud.eltex-co.ru/index.php/s/vQdCi5UP1Abiv69/download -O ansibleNaice-v1.2-2026-06-26.tar.gz

tar xzvf ansibleNaice-v1.2-2026-06-26.tar.gz

cd ansibleNaice-v1.2-2026-06-26

---
common:
  hosts:
    # Host for performing a stand-alone NAICE installation
    common_host:
      ansible_host: <IP address or domain name of the NAICE host> 
      ansible_user: <username>
      ansible_ssh_pass: <user password>
      ansible_become_pass: <sudo password>

The specified IP address or domain name will be added to the Subject Alternative Name (SAN) field when generating a self-signed certificate during NAICE service installation.

[defaults]
inventory = hosts.yml
host_key_checking = True
private_key_file = <path to the SSH key file>
deprecation_warnings = False

---
common:
  hosts:
    common_host:
      ansible_host: <IP address or domain name of the NAICE host>
      ansible_user: <username>
      ansible_become_pass: <sudo password>

ansible all --list-hosts  # check the list of hosts
ansible all -m ping       # check access to hosts

common_host | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": false,
    "ping": "pong"
}

time_zone: "Region/City"

Examples:
time_zone: "Europe/Moscow"

or:
time_zone: "Asia/Novosibirsk"

---
# Variables for Docker network configuration
docker_network_unmasked:
  subnet: "172.18.0.0/20"
  ip_range: "172.18.8.0/21"
  gateway: "172.18.0.1"
 
docker_network_external:
  subnet: "172.20.0.0/20"
  ip_range: "172.20.8.0/21"
  gateway: "172.20.0.1"
 
docker_network_internal:
  subnet: "172.21.0.0/20"
  ip_range: "172.21.8.0/21"
  gateway: "172.21.0.1"

Docker subnets cannot be changed after NAICE has been installed by simply modifying the variables and rerunning the playbook. If you need to change the Docker subnets after installation, follow the instructions in v1.2_3.15 Changing Docker networks.

ansible-playbook install-naice.yml

During the installation of NAICE services, a self-signed certificate is automatically generated for the user interfaces lemmus, gavia, and larus. If you have your own trusted certificate, it can be installed after the services are deployed, replacing the default self-signed certificate. Detailed information on using security certificates can be found in the v1.1_3.6 Using security certificates section.

Because NAICE uses healthcheck mechanisms to verify successful startup, initializing the containers may take several minutes. Wait until the playbook execution is fully completed.

$ sudo docker compose ps -a
NAME             IMAGE                                                               COMMAND                  SERVICE         CREATED              STATUS                        PORTS
epg-service      naice-build-hosted.registry.eltex.loc/naice/epg-service:1.3-2       "/bin/sh -e /usr/loc…"   epg-service     6 minutes ago        Up 5 minutes (healthy)        
naice-aquila     naice-release.registry.eltex.loc/naice-aquila:1.2                   "java -cp @/app/jib-…"   naice-aquila    About a minute ago   Up About a minute (healthy)   0.0.0.0:8091->8091/tcp, [::]:8091->8091/tcp, 0.0.0.0:49->1049/tcp, [::]:49->1049/tcp
naice-bubo       naice-release.registry.eltex.loc/naice-bubo:1.2                     "java -cp @/app/jib-…"   naice-bubo      5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8093->8093/tcp, [::]:8093->8093/tcp
naice-castor     naice-release.registry.eltex.loc/naice-castor:1.2                   "java -Djava.awt.hea…"   naice-castor    5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8095->8095/tcp, [::]:8095->8095/tcp
naice-cetus      naice-release.registry.eltex.loc/naice-cetus:1.2                    "java -cp @/app/jib-…"   naice-cetus     5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8099->8099/tcp, [::]:8099->8099/tcp
naice-gavia      naice-release.registry.eltex.loc/naice-gavia:1.2                    "java -cp @/app/jib-…"   naice-gavia     5 minutes ago        Up About a minute (healthy)   0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp
naice-gulo       naice-release.registry.eltex.loc/naice-gulo:1.2                     "java -cp @/app/jib-…"   naice-gulo      5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8089->8089/tcp, [::]:8089->8089/tcp
naice-lemmus     naice-release.registry.eltex.loc/naice-lemmus:1.2                   "java -cp @/app/jib-…"   naice-lemmus    5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8083->8083/tcp, [::]:8083->8083/tcp
naice-lepus      naice-release.registry.eltex.loc/naice-lepus:1.2                    "java -cp @/app/jib-…"   naice-lepus     5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8087->8087/tcp, [::]:8087->8087/tcp, 0.0.0.0:67->1024/udp, [::]:67->1024/udp
naice-mustela    naice-release.registry.eltex.loc/naice-mustela:1.2                  "java -cp @/app/jib-…"   naice-mustela   5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8070->8070/tcp, [::]:8070->8070/tcp
naice-nats       naice-build-hosted.registry.eltex.loc/naice/nats:1.2.2              "docker-entrypoint.s…"   nats            6 minutes ago        Up 5 minutes (healthy)        4222/tcp, 6222/tcp, 7777/tcp, 8222/tcp
naice-ovis       naice-release.registry.eltex.loc/naice-ovis:1.2                     "java -cp @/app/jib-…"   naice-ovis      5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8084->8084/tcp, [::]:8084->8084/tcp
naice-phoca      naice-release.registry.eltex.loc/naice-phoca:1.2                    "java -cp @/app/jib-…"   naice-phoca     6 minutes ago        Up 5 minutes (healthy)        0.0.0.0:8097->8097/tcp, [::]:8097->8097/tcp
naice-postgres   naice-build-hosted.registry.eltex.loc/naice/postgres-repmgr:1.2.2   "/opt/bitnami/script…"   postgres        7 minutes ago        Up 5 minutes (healthy)        127.0.0.1:5432->5432/tcp, 127.0.0.1:15432->22/tcp
naice-radius     naice-release.registry.eltex.loc/naice-radius:1.2                   "/docker-entrypoint.…"   naice-radius    4 minutes ago        Up 4 minutes (healthy)        0.0.0.0:1812-1813->1812-1813/udp, [::]:1812-1813->1812-1813/udp, 0.0.0.0:9812->9812/tcp, [::]:9812->9812/tcp
naice-sterna     naice-release.registry.eltex.loc/naice-sterna:1.2                   "/docker-entrypoint.…"   naice-sterna    About a minute ago   Up About a minute (healthy)   0.0.0.0:32888->80/tcp, [::]:32888->80/tcp, 0.0.0.0:8443->444/tcp, [::]:8443->444/tcp
naice-ursus      naice-release.registry.eltex.loc/naice-ursus:1.2                    "java -cp @/app/jib-…"   naice-ursus     5 minutes ago        Up 4 minutes (healthy)        0.0.0.0:8081->8081/tcp, [::]:8081->8081/tcp
naice-vulpus     naice-release.registry.eltex.loc/naice-vulpus:1.2                   "java -cp @/app/jib-…"   naice-vulpus    5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8086->8086/tcp, [::]:8086->8086/tcp
naice-web        naice-release.registry.eltex.loc/naice-web:1.2                      "/docker-entrypoint.…"   naice-web       About a minute ago   Up 59 seconds (healthy)       0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:32889->80/tcp, [::]:32889->80/tcp, 0.0.0.0:80->4200/tcp, [::]:80->4200/tcp

Legend:

• - not recommended for editing.
• - hint.

Environment variable (.env)	Ansible variable (group_vars/all.yml)	Default value	Description
Distribution variables
no	offline_install	false	Flag indicating installation in an isolated environment. When installing in an isolated environment, a separate archive must be downloaded. Do not change this value when using the online installation playbooks!
no	naice_address	ansible_host	Target IP address or DNS hostname. Taken from the ansible_host variable value. Only needs to be changed if the IP address for web GUI access differs from the installation address!
no	naice_docker_path	/etc/docker-naice	Target installation directory
no	naice_docker_images	not set	Used during installation in an isolated environment. When installing in an isolated environment, a separate archive must be downloaded. Do not change this value when using the online installation playbooks!
no	docker_compose_download_url	https://cloud.eltex-co.ru/index.php/s/yKlAcy83VVPEfzx/download	Download URL for the docker compose plugin when installing on Astra Linux 1.7.X.
no	ip_has_been_changed	false	Flag indicating that the host IP address has been changed after installation. Used to update the IP address when re-running the installation playbook.
no	skip_docker_installation	false	Skip Docker services installation. Used during installation in an isolated environment. When installing in an isolated environment, a separate archive must be downloaded. Do not change this value when using the online installation playbooks!
BACKEND_VERSION_TAG	version_tag	1.2	Backend services version (naice-gavia, naice-lemmus, naice-ovis, naice-ursus).
FRONTEND_VERSION_TAG	version_tag	1.2	Frontend service version (naice-web, known as larus).
POSTGRES_VERSION_TAG	postgres_version_tag	1.2.2	Containerized postgres DB image version.
RADIUS_VERSION_TAG	radius_version_tag	1.2	Containerized FreeRadius image version.
NATS_VERSION_TAG	nats_version_tag	1.2.2	Containerized NATS image version.
ELTEX_HUB	ELTEX_HUB	hub.eltex-co.ru/naice	External repository with stable software build versions.
BACKEND_HUB	ELTEX_HUB	ELTEX_HUB	Variable storing the currently selected repository for downloading backend services.
FRONTEND_HUB	ELTEX_HUB	ELTEX_HUB	Variable storing the currently selected repository for downloading the frontend service.
RADIUS_HUB	ELTEX_HUB	ELTEX_HUB	Variable storing the currently selected repository for downloading the FreeRADIUS container.
CI_HUB	CI_HUB	hub.eltex-co.ru	External repository for supporting product builds (PostgreSQL).
TZ	time_zone	Etc/UTC	Timezone value variable for the NAICE deployment. Affects system log timestamps.
NAICE_HOSTNAME	no	Taken from /etc/hostname during ansible playbook installation	Hostname of the system where NAICE is deployed. Required for licensing. Changing it after license activation is prohibited.
naice_node_ip	naice_node_ip	IP address, by default taken from theansible_hostvariable	Node IP address that corresponds to the {{ ansible_host }} variable value if it contains an IP, or obtained via DNS resolution of {{ ansible_host }} if a domain name is used.
Gavia variables
GAVIA_HOST_PORT	gavia_host_port	8080	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
LEMMUS_GAVIA_POSTGRES_USERNAME	lemmus_gavia_postgres_username	lemmus	Login for accessing the database. lemmus.
LEMMUS_GAVIA_POSTGRES_PASSWORD	lemmus_gavia_postgres_password	lemmus	Password for accessing the database. lemmus.
Ursus variables
URSUS_HOST_PORT	ursus_host_port	8081	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
URSUS_POSTGRES_USERNAME	ursus_postgres_username	ursus	User for service access to the PostgreSQL database.
URSUS_POSTGRES_PASSWORD	ursus_postgres_password	ursus	User password for service access to the PostgreSQL database.
URSUS_OUI_UPDATE_TIME_S	ursus_update_oui_time	86400	Frequency of updating the MAC OUI list, s.
URSUS_OUI_UPDATE	ursus_upload_oui_csv	True	Enable/disable MAC OUI list update.
URSUS_OUI_UPLOAD_FILE_URL	ursus_upload_csv_oui_url	https://standards-oui.ieee.org/oui/oui.csv	URL of the MAC OUI list used for updates.
URSUS_PORTAL_USER_PASSWORD_LENGTH	ursus_portal_user_password_length	4	Minimum password length that can be set for a portal user.
URSUS_IDENTITY_PASSWORD_LENGTH	ursus_identity_password_length	8	Minimum network user password length.
URSUS_NETLOGON_CHANGE_COMPUTER_PASS_CRON	ursus_netlogon_change_pass_cron	-	Domain computer password rotation interval setting (0 10 2 1-31/7 * * – every seventh day from 1st to 31st at 2:10).
no	ursus_netlogon_change_pass_cron_node1	-	Domain computer password rotation interval setting for high-availability deployment on node 1.
no	ursus_netlogon_change_pass_cron_node2	-	Domain computer password rotation interval setting for high-availability deployment on node 2.
URSUS_NETLOGON_CHANGE_COMPUTER_PASS_LENGTH	ursus_netlogon_change_pass_length	12	Generated domain computer password length during rotation: from 12 to 200 characters.
Lemmus variables
LEMMUS_HOST_PORT	lemmus_host_port	8083	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
LEMMUS_POSTGRES_USERNAME	lemmus_postgres_username	lemmus	User for service access to the PostgreSQL database.
LEMMUS_POSTGRES_PASSWORD	lemmus_postgres_password	lemmus	User password for service access to the PostgreSQL database.
LEMMUS_ACCESS_TTL_S	lemmus_access_ttl_s	3600	Token lifetime in seconds.
LEMMUS_REFRESH_TTL_S	lemmus_refresh_ttl_s	7200	Time in seconds during which the token can be refreshed.
LEMMUS_REDIRECTS_RULES		*:443,0.0.0.0/0:443	Web interface access rules on first NAICE startup. Later configured in System settings → Security and Login → Login → Management Addresses.
PostgreSQL variables
no	postgres_host	naice-postgres	PostgreSQL database container name.
no	postgres_port	5432	Port for connecting to the PostgreSQL database.
POSTGRES_USER	postgres_user	postgres	User created during database installation and configuration.
POSTGRES_PASSWORD	postgres_password	postgres	User password created during database installation and configuration.
no	postgres_db	postgres	Default database name used for managing the PostgreSQL database.
PostgreSQL variables for high-availability deployment
no	postgres_reserved_host	127.0.0.1	Backup PostgreSQL node address.
no	postgres_reserved_port	5432	Backup PostgreSQL node port.
Ovis variables
OVIS_HOST_PORT	ovis_host_port	8084	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
OVIS_CACHE_TTL_S	ovis_cache_ttl_s	86400	naice-ovis cache lifetime in seconds, during which it stores authentication and authorization settings. After this time, settings are re-read.
OVIS_SESSION_IDLE_S	ovis_session_idle_s	86400	Lifetime of inactive user sessions, s.
OVIS_URSUS_POSTGRES_USERNAME	ovis_ursus_postgres_username	ovis	Login for connecting to the ursus database.
OVIS_URSUS_POSTGRES_PASSWORD	ovis_ursus_postgres_password	ovis	Password for connecting to the ursus database.
OVIS_OVIS_POSTGRES_USERNAME	ovis_ovis_postgres_username	ovis	Login for connecting to the ovis database.
OVIS_OVIS_POSTGRES_PASSWORD	ovis_ovis_postgres_password	ovis	Password for connecting to the ovis database.
OVIS_NODE_INTERFACE	hazelcast_node_interface	{{ naice_address }}	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
OVIS_NODE_MEMBERS	hazelcast_node_members	127.0.0.1	IP addresses/DNS names of the instances participating in a high-availability deployment.
OVIS_SESSIONS_CLEAN_CRON	ovis_session_clean_cron	0 0 * * * *	Interval for running the radius session cleanup task from the database, by default every hour.
OVIS_SESSION_FLUSH_SEC	ovis_session_flush_sec	10	Interval for radius session persistence from cache to the database, s.
OVIS_DB_POOL_CONNECTION_LIFETIME	ovis_db_pool_connection_lifetime	1800000	Connection lifetime to the ursus database, s.
OVIS_DB_POOL_IDLE_TIMEOUT	ovis_db_pool_idle_timeout	60000	Response wait time when connecting to the ursus database, ms.
OVIS_DB_POOL_MIN_IDLE	ovis_db_pool_min_idle	5	Minimum number of connections for the ursus database in idle mode.
OVIS_DB_POOL_SIZE	ovis_db_pool_size	10	Number of connections for connecting to the ovis database.
OVIS_SESSIONS_DB_POOL_CONNECTION_LIFETIME	ovis_sessions_db_pool_connection_lifetime	1800000	Connection lifetime to the ovis database, s.
OVIS_SESSIONS_DB_POOL_IDLE_TIMEOUT	ovis_sessions_db_pool_idle_timeout	60000	Response wait time when connecting to the ovis database, ms.
OVIS_SESSIONS_DB_POOL_MIN_IDLE	ovis_sessions_db_pool_min_idle	2	Minimum number of connections for the ovis database in idle mode.
OVIS_SESSIONS_DB_POOL_SIZE	ovis_sessions_db_pool_size	5	Number of connections for connecting to the ovis database.
OVIS_SESSION_BATCH_SIZE	ovis_session_batch_size	100	Number of sessions in a single batch for saving to the ovis database.
OVIS_RADIUS_CLASS_ATTR_ENABLED	ovis_radius_class_attr_enabled	true	Enable/disable accounting processing for user active session limits: true – enable, false – disable.
Larus (web) variables
LARUS_PORT	larus_port	4200	Port on which the service runs inside the container.
LARUS_HOST_PORT	larus_host_port	80	HTTP port to which the service container port is forwarded on the host machine. Used for interacting with the service. Used only to redirect user connections to the secure port 443.
FRONTEND_STERNA_URL	frontend_sterna_url	https://{{ naice_address }}:{{ sterna_host_port }}	URL where the Captive Portal runs.
NATS variables
NATS_MONITORING_PORT	nats_monitoring_port	8222	Port used for service monitoring.
NATS_EXPORTER_PORT	nats_exporter_port	7777	Port used by the service to expose metrics in Prometheus format.
NATS_CLUSTER_PORT	nats_cluster_port	6222	Port for NATS cluster communication (high-availability deployment).
no	nats_slave_address	127.0.0.1	IP address used for NATS communication within the cluster.
NATS_REQUEST_REPLY_TIMEOUT	nats_request_reply_timeout	5	Maximum wait time for a response from the client service to a sent nats event, s.
NATS_RECONNECT_WAIT	nats_reconnect_wait	15	Pause time between attempts to reconnect the client service to nats, s.
NATS_MAX_RECONNECT	nats_max_reconnect	30	Maximum number of attempts to reconnect the client service to nats.
NATS_RECONNECT_BUFFER_SIZE	nats_reconnect_buffer_size	0	Buffer size for outgoing messages during connection loss, sent after reconnection, in bytes. 0 means this buffer is disabled. When the non-zero value is exceeded, the client will start dropping messages.
Vulpus variables
VULPUS_HOST_PORT	vulpus_host_port	8086	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
VULPUS_POSTGRES_USERNAME	vulpus_postgres_username	vulpus	Login for connecting to the database.
VULPUS_POSTGRES_PASSWORD	vulpus_postgres_password	vulpus	Password for connecting to the database.
VULPUS_NODE_INTERFACE	hazelcast_node_interface	{{ naice_address }}	Interface IP address for communication with a neighboring instance in a high-availability deployment.
VULPUS_NODE_MEMBERS	hazelcast_node_members	127.0.0.1	Interface IP address of the neighboring node for communication in a high-availability deployment.
Lepus variables
LEPUS_HOST_PORT	lepus_host_port	8087	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
LEPUS_REPOSITORY_BATCH_SIZE	lepus_repository_batch_size	500	Batch size for saving probes to the database (count).
LEPUS_POSTGRES_USERNAME	lepus_postgres_username	lepus	Login for connecting to the database.
LEPUS_POSTGRES_PASSWORD	lepus_postgres_password	lepus	Password for connecting to the database.
LEPUS_DHCP_PROBE_ENABLED	lepus_dhcp_probe_enabled	true	Enable/disable DHCP probe collection.
LEPUS_DHCP_PROBE_HOST_PORT	lepus_dhcp_probe_host_port	67	External service port for collecting DHCP probes.
LEPUS_DHCP_PROBE_SCHEDULE_CLEAR_PROBES_AFTER_DAYS	lepus_dhcp_probe_schedule_clear_probes_after_days	30	DHCP probe retention time in the database.
LEPUS_DHCP_PROBE_SCHEDULE_CLEAN_EXPIRED_CRON	lepus_dhcp_probe_schedule_clean_expired_cron	0 0 * * * *	Schedule for running the task to clean up expired DHCP probes from the database.
Gulo variables
GULO_HOST_PORT	gulo_host_port	8089	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
GULO_USER_LABEL	no	{{ naice_address }}/v{{ version_tag }}
Aquila variables
AQUILA_HOST_PORT	aquila_host_port	8091	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
AQUILA_CACHE_TTL_S	aquila_cache_ttl_s	300	naice-aquila cache lifetime in seconds, during which the service stores authentication and authorization settings. After this time, settings are re-read.
AQUILA_POSTGRES_USERNAME	aquila_postgres_username	aquila	Login for connecting to the database.
AQUILA_POSTGRES_PASSWORD	aquila_postgres_password	aquila	Password for connecting to the database.
AQUILA_DB_POOL_SIZE	aquila_db_pool_size	5	Number of connections for connecting to the database. aquila.
AQUILA_DB_POOL_MIN_IDLE	aquila_db_pool_min_idle	1	Minimum number of connections for the aquila database in idle mode.
AQUILA_DB_POOL_IDLE_TIMEOUT	aquila_db_pool_idle_timeout	60000	Response wait time when connecting to the database, ms.
AQUILA_DB_POOL_CONNECTION_LIFETIME	aquila_db_pool_connection_lifitime	1800000	Connection lifetime to the database, s.
AQUILA_URSUS_DB_POOL_MIN_IDLE	aquila_ursus_db_pool_min_idle	2	Minimum number of connections for the ursus database in idle mode.
AQUILA_URSUS_DB_POOL_SIZE	aquila_ursus_db_pool_size	10	Number of connections for connecting to the database. ursus.
AQUILA_FLUSH_SEC	aquila_flush_sec	60	Interval for persisting sessions and accounting to the database, s.
AQUILA_SESSIONS_CLEAN_CRON	aquila_session_clean_cron	0 0 * * * *	Interval for cleaning up sessions and accounting from the database, by default every hour.
AQUILA_NODE_INTERFACE	hazelcast_node_interface	{{ naice_address }}	Interface IP address for communication with a neighboring instance in a high-availability deployment.
AQUILA_NODE_MEMBERS	hazelcast_node_members	127.0.0.1	Interface IP address of the neighboring node for communication in a high-availability deployment.
AQUILA_USER_CACHE_ENABLE	aquila_user_cache_enable	True	Enable caching of the username when executing command authorization. Possible values: True / False. When set to False, each command authorization request will trigger a check for the username existence in the identity source.
AQUILA_USER_CACHE_TTL_S	aquila_user_cache_ttl_s	300	Username cache retention time when executing command authorization.
Bubo variables
BUBO_HOST_PORT	bubo_host_port	8093	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
BUBO_NODE_INTERFACE	hazelcast_node_interface	{{ naice_address }}	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
BUBO_NODE_MEMBERS	hazelcast_node_members	127.0.0.1	IP addresses/DNS names of instances participating in  high-availability deployment.
BUBO_POSTGRES_USERNAME	bubo_postgres_username	bubo	Login for connecting to the database.
BUBO_POSTGRES_PASSWORD	bubo_postgres_password	bubo	Password for connecting to the database.
BUBO_CACHE_TTL_S	bubo_cache_ttl_s	300
BUBO_SMS_SCHEDULE_CLEAN_EXPIRED_CRON	bubo_sms_schedule_clean_expired_cron	0 0 * * * *	Interval for cleaning up SMS records from the database, by default every hour.
BUBO_SMS_TO_DELETE_DAYS	bubo_sms_to_delete_days	31	Retention period for sent SMS information in the database.
Castor variables
CASTOR_HOST_PORT	castor_host_port	8095	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
CASTOR_POSTGRES_USERNAME	castor_postgres_username	castor	Login for connecting to the database.
CASTOR_POSTGRES_PASSWORD	castor_postgres_password	castor	Password for connecting to the database.
CASTOR_NODE_INTERFACE	hazelcast_node_interface	{{ naice_address }}	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
CASTOR_NODE_MEMBERS	hazelcast_node_members	127.0.0.1	IP addresses/DNS names of instances participating in a high-availability deployment.
CASTOR_DB_POOL_SIZE	castor_db_pool_size	10	Number of connections for connecting to the database.
CASTOR_DB_POOL_MIN_IDLE	castor_db_pool_min_idle	2	Minimum number of connections for the database in idle mode.
CASTOR_DB_POOL_IDLE_TIMEOUT	castor_db_pool_idle_timeout	60000	Response wait time when connecting to the database, ms.
CASTOR_DB_POOL_CONNECTION_LIFETIME	castor_db_pool_connection_lifetime	1800000	Connection lifetime to the database, s.
CASTOR_CACHE_TTL_S	castor_cache_ttl_s	300	User information cache retention time, s.
CASTOR_REQUESTS_RATE_LIMIT	castor_requests_rate_limit	1000	Maximum number of REST requests to the service within the time period specified by the CASTOR_SECONDS_RATE_LIMIT variable.
CASTOR_SECONDS_RATE_LIMIT	castor_seconds_rate_limit	10	Time period for counting REST requests to the service, s.
CASTOR_MAX_THREAD_COUNT	castor_max_thread_count	20	Maximum number of threads when processing REST requests to the service.
Sterna variables
STERNA_HTTPS_PORT	sterna_https_port	444	HTTPS port on which the service runs inside the container.
STERNA_HTTP_PORT	sterna_http_port	81	HTTP port on which the service runs inside the container.
STERNA_HTTPS_HOST_PORT	sterna_host_port	8443	HTTPS port to which the service container port is forwarded on the host machine. Used for interacting with the service.
STERNA_HTTP_HOST_PORT	sterna_host_port	8443	HTTP port to which the service container port is forwarded on the host machine. Used for interacting with the service. Not used by default, requires manual activation.
FRONTEND_STERNA_URL	frontend_sterna_url	https://{{ ansible_host }}:8443	Portal redirect URL that will be used for authenticating portal users.
Mustela variables
MUSTELA_HOST_PORT	mustela_host_port	8098	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
MUSTELA_POSTGRES_USERNAME	mustela_postgres_username	mustela	Login for connecting to the database.
MUSTELA_POSTGRES_PASSWORD	mustela_postgres_password	mustela	Password for connecting to the database.
MUSTELA_DB_POOL_SIZE	mustela_db_pool_size	25	Maximum number of connections for connecting to the database.
MUSTELA_DB_POOL_MIN_IDLE	mustela_db_pool_min_idle	5	Minimum number of connections for the database in idle mode.
MUSTELA_DB_POOL_IDLE_TIMEOUT	mustela_db_pool_idle_timeout	60000	Response wait time when connecting to the database, ms.
MUSTELA_DB_POOL_CONNECTION_LIFETIME	mustela_db_pool_connection_lifetime	1800000	Connection lifetime to the database, ms.
MUSTELA_NODE_INTERFACE	hazelcast_node_interface	{{ naice_address }}	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
MUSTELA_NODE_MEMBERS	hazelcast_node_members	127.0.0.1	IP addresses/DNS names of instances participating in a high-availability deployment.
MUSTELA_EVENTS_CLEAN_CRON	mustela_events_clean_cron	0 0 3 * * *	Interval for cleaning up events past their retention period from the database, by default every 3 hours.
Phoca variables
PHOCA_HOST_PORT	phoca_host_port	8097	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
PHOCA_POSTGRES_USERNAME	phoca_postgres_username	phoca	Login for connecting to the database.
PHOCA_POSTGRES_PASSWORD	phoca_postgres_password	phoca	Password for connecting to the database.
PHOCA_DB_POOL_SIZE	phoca_db_pool_size	5	Maximum number of connections for connecting to the database.
PHOCA_DB_POOL_MIN_IDLE	phoca_db_pool_min_idle	1	Minimum number of connections for the database in idle mode.
PHOCA_DB_POOL_IDLE_TIMEOUT	phoca_db_pool_idle_timeout	60000	Response wait time when connecting to the database, ms.
PHOCA_DB_POOL_CONNECTION_LIFETIME	phoca_db_pool_connection_lifetime	1800000	Connection lifetime to the database, ms.
PHOCA_HOST_DOCKER_SOCK	phoca_host_docker_sock	/var/run/docker.sock	Path to the UNIX socket for communicating with the Docker daemon. Required for managing containers to apply configurations to services.
Cetus variables
CETUS_HOST_PORT	cetus_host_port	8099	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
CETUS_POSTGRES_USERNAME	cetus_postgres_username	cetus	Login for connecting to the database.
CETUS_POSTGRES_PASSWORD	cetus_postgres_password	cetus	Password for connecting to the database.
CETUS_DB_POOL_SIZE	cetus_db_pool_size	10	Maximum number of connections for connecting to the database.
CETUS_DB_POOL_MIN_IDLE	cetus_db_pool_min_idle	3	Minimum number of connections for the database in idle mode.
CETUS_DB_POOL_IDLE_TIMEOUT	cetus_db_pool_idle_timeout	60000	Response wait time when connecting to the database, ms.
CETUS_DB_POOL_CONNECTION_LIFETIME	cetus_db_pool_connection_lifetime	1800000	Response wait time when connecting to the database, ms.
CETUS_CACHE_TTL_S	cetus_cache_ttl_s	300	Cache lifetime in seconds, during which the service stores authentication settings. After this time, settings are re-read.
CETUS_USERS_CACHE_TTL_S	cetus_users_cache_ttl_s	10	User cache lifetime in seconds.
CETUS_USERS_CACHE_ENABLED	cetus_users_cache_enabled	true	Enable user caching during authentication. Possible values: true / false.
CETUS_NODE_INTERFACE	hazelcast_node_interface	{{ naice_address }}	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
CETUS_NODE_MEMBERS	hazelcast_node_members	127.0.0.1	IP addresses/DNS names of instances participating in high-availability.
CETUS_LDAP_CONNECT_TIMEOUT_MS	cetus_ldap_connect_timeout_ms	3000	Timeout for connecting to an external source via LDAP protocol, ms.
CETUS_LDAP_READ_TIMEOUT_MS	cetus_ldap_read_timeout_ms	7000	Timeout for the data retrieval process from an external source via LDAP protocol, ms.
CETUS_LDAP_REFERRAL_VALUE	cetus_ldap_referral_value	ignore	Behavior when receiving a referral to another server in response to an LDAP request: * "ignore" (default) - ignore and do not follow the external referral; * "follow" - automatically redirect requests to another server upon receiving a referral.
CETUS_LDAP_POOL_SIZE	cetus_ldap_pool_size	10	Number of connections for connecting to the LDAP server at service startup.
CETUS_LDAP_POOL_MAX_SIZE	cetus_ldap_pool_max_size	10	Maximum number of connections for connecting to the LDAP server.
CETUS_NETLOGON_LIB_SOCKET_TIMEOUT_MS	cetus_netlogon_lib_socket_timeout_ms	5000	Timeout for data exchange with an external identity source (Active Directory) via netlogon protocol, ms.
CETUS_NETLOGON_LIB_CONNECT_TIMEOUT_MS	cetus_netlogon_lib_connect_timeout_ms	5000	Timeout for connecting to an external identity source (Active Directory) via netlogon protocol, ms.
CETUS_NETLOGON_LIB_CLIENT_CACHE_ENABLED	cetus_netlogon_lib_client_cache_enabled	true	Enable computer session caching when accessing an external identity source (Active Directory) via netlogon protocol.
CETUS_NETLOGON_LIB_CLIENT_CACHE_TTL_S	cetus_netlogon_lib_client_cache_ttl_s	1800	Computer session cache retention time, s.
CETUS_NETLOGON_LIB_CLIENT_CACHE_PERIOD_S	cetus_netlogon_lib_client_cache_period_s	180	Interval for checking computer session existence in cache, s.
CETUS_NETLOGON_LIB_DNS_CACHE_TTL_S	CETUS_NETLOGON_LIB_DNS_CACHE_TTL_S	3600	Cache retention time for domain controller information after DNS SRV query execution, s.
CETUS_NETLOGON_LIB_DNS_CACHE_PERIOD_S	cetus_netlogon_lib_dns_cache_period_s	360	Interval for checking domain controller information in cache after DNS SRV query execution, s.
EPG variables
EPG_TAG	epg_tag	1.1-3	EPG service version.
EPG_LOG_FILE_MAX_SIZE	epg_log_file_max_size	10	Maximum size of a single log file in MB.
EPG_LOG_FILE_MAX_COUNT	epg_log_file_max_count	4	Maximum number of log files in rotation.
EPG_KERNEL_LOG_LEVEL	epg_kernel_log_level	info	Log level for EPG service "kernel" logs.
EPG_DEBUG_LOG_LEVEL	epg_debug_log_level	off	Log level for EPG service "debug" logs.
EPG_NETWORKING_LOG_LEVEL	epg_networking_log_level	info	Log level for EPG service "networking" logs.
EPG_HOST_PORT	epg_host_port	8100	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
RADIUS variables
General variables
RADIUS_EXPORTER_PORT	radius_exporter_port	9812	Port used by the service to expose metrics in Prometheus format.
RADIUS_VERSION_TAG	radius_version_tag	{{ version_tag }}	Service version
RADIUS_LOG_PATH	radius_log_path	/var/log/radius	File on the host machine for storing service operation logs.
RADIUS variables for SQL module connection
RADIUS_POSTGRES_DB_HOST	radius_postgres_db_host	naice-postgres	IP address for connecting to the database.
RADIUS_POSTGRES_DB_PORT	radius_postgres_db_port	5432	Port for connecting to the database.
RADIUS_POSTGRES_DB_LOGIN	radius_postgres_db_login	radius	Login for connecting to the database.
RADIUS_POSTGRES_DB_PASSWORD	radius_postgres_db_password	radius	Password for connecting to the database.
RADIUS variables for backup SQL module (used only in a high-availability deployment)
RADIUS_POSTGRES_RESERVED_DB_HOST	radius_postgres_reserved_db_host	{{ postgres_reserved_host }}	Backup PostgreSQL node address.
RADIUS_POSTGRES_RESERVED_DB_PORT	radius_postgres_reserved_db_port	{{ postgres_reserved_port }}	Backup PostgreSQL node port.
RADIUS_POSTGRES_RESERVED_DB_LOGIN	radius_postgres_reserved_db_login	radius	Login for connecting to the database.
RADIUS_POSTGRES_RESERVED_DB_PASSWORD	radius_postgres_reserved_db_password	radius	Password for connecting to the database.
RADIUS_POSTGRES_RESERVED_ENABLED	radius_postgres_reserved_enabled	0	Use high-availability (0 - no, 1 - yes)
Service logging variables
no	docker_log_max_size	"\"10m\""	Maximum service log file size.
no	docker_log_max_file	"\"10\""	Maximum number of log files for a service.
Variables for high-availability deployment (located in group_vars/reservation.yml)
Variables defining PostgreSQL cluster addresses in a high-availability deployment
no	primary_db_host	{{ hostvars['node_primary'].ansible_host }}	Host address for installing the Primary PostgreSQL node.
no	standby_db_host	{{ hostvars['node_standby'].ansible_host }}	Host address for installing the Backup PostgreSQL node.
no	primary_db_port	{{ hostvars['node_primary'].forwarded_postgresql_port }}	Port for connecting to the PostgreSQL database on the Primary node.
no	standby_db_port	{{ hostvars['node_standby'].forwarded_postgresql_port }}	Port for connecting to the PostgreSQL database on the Backup node.
Parameters for configuring the keepalived service
no	check_vip_interface	true	Check that the IP address specified in the hosts-cluster.yml file variable keepalived_vip is within the subnet of IP addresses configured on the target VM interfaces specified in the hosts-cluster.yml file variable keepalived_interface (true – check, false – do not check)`.
no	vip_server_name	{{ keepalived_vip }}	VIP address used for high-availability or a domain name that resolves to this address via DNS.
no	vip_auth_type	PASS	VRRP announcement authentication type.
no	vip_auth_pass	testing123	Password used in VRRP announcements.
no	vrrp_garp_master_refresh	0	Period for sending GARP messages by a VRRP instance in Primary state, s. 0 = do not send.
no	vrrp_garp_master_refresh_repeat	1	Number of GARP messages sent by a VRRP instance in MASTER state during periodic sending.
no	vrrp_garp_master_delay	5	Delay during which GARP message sending will not be performed after VRRP instance transitions to MASTER state, s.
no	vrrp_garp_master_repeat	5	Number of GARP  messages to be sent after VRRP instance transitions to MASTER state.
no	virtual_router_id	1	Identifier for VRRP instances that provide high-availability for a single VIP address. Valid values: 1-255.
no	advert_int	1	Interval for sending VRRP announcements by an instance in MASTER state, s.
no	check_interval	20	Interval for executing the script that checks NAICE service health status, s.
no	keepailveed_logrotate_save_n_rotated_files	5	Number of VRRP operation log files retained during log rotation.
no	keepailveed_logrotate_maxage	30	Maximum lifetime of a VRRP log file before rotation is performed, days.
no	keepailveed_logrotate_size	10M	Maximum size of a VRRP log file before rotation is performed, MB.
no	keepailveed_logrotate_delay	weekly	Interval for performing log rotation, by default weekly.
Variables for PostgreSQL cluster interaction in a high-availability deployment (located in group_vars/postgres-cluster.yml) After installing the PostgreSQL cluster, these variables are stored in the repmgr.env file
REPMGR_CONNECT_TIMEOUT	repmgr_connect_timeout	5	Wait time when connecting a node, s.
REPMGR_RECONNECT_ATTEMPTS	repmgr_reconnect_attempts	3	Number of node cluster connection attempts before the cluster is considered unavailable.
REPMGR_RECONNECT_INTERVAL	repmgr_reconnect_interval	5	Interval between node cluster connection attempts, s.
REPMGR_MASTER_RESPONSE_TIMEOUT	repmgr_master_response_timeout	20	Wait time for a response from a node in "Primary" state, s.
REPMGR_UPGRADE_EXTENSION	repmgr_upgrade_extension	'yes'	Enable replication manager extension updates after installing a new version.
BITNAMI_DEBUG	bitnami_debug	false	Disable/Enable (false/true) additional replication manager logs.
REPMGR_LOG_LEVEL	repmgr_log_level	info	Replication manager event log level. Possible values: info, debug.
Variables for managing Docker subnet IP addressing (located in group_vars/networks.yml)
Variables for managing the docker_network_unmasked network
no	subnet	"172.18.0.0/20"	IP address range assigned to the subnet.
no	ip_range	"172.18.8.0/21"	IP address range within the assigned subnet from which addresses are allocated for running containers.
no	gateway	"172.18.0.1"	Gateway for container traffic to exit the Docker virtual network to the external network.
Variables for managing the docker_network_external network
no	subnet	"172.20.0.0/20"	IP address range assigned to the subnet.
no	ip_range	"172.20.8.0/21"	IP address range within the assigned subnet from which addresses are allocated for running containers.
no	gateway	"172.20.0.1"	Gateway for container traffic to exit the Docker virtual network to the external network.
Variables for managing the docker_network_internal network
no	subnet	"172.21.0.0/20"	IP address range assigned to the subnet.
no	ip_range	"172.21.8.0/21"	IP address range within the assigned subnet from which addresses are allocated for running containers.
no	gateway	"172.21.0.1"	Gateway for container traffic to exit the Docker virtual network to the external network.