General description

The NAICE system is distributed as container images intended for deployment using the Docker containerization and application management platform. All system components are managed using the Docker Compose plugin, which is designed for orchestrating multi-container applications.

Ansible playbooks are used to automate the installation process.

Installation

Below is the procedure for performing a single-host installation.

Instructions for deploying NAICE in a high-availability configuration are provided in v1.1_3.3 High-availability installation (using VRRP) and v1.1_3.4 High-availability installation (without using VRRP).

Both online and offline installation are available.

Online installation is supported on all supported operating systems and is described below.

Offline installation (isolated network) is described in section v1.1_3.2.1 Installation in an isolated network (stand-alone).

Installing Ansible

To run the playbooks, install Ansible on a host that has SSH access to the target host.

The recommended operating system for the playbook execution host is Ubuntu 24.04.

The minimum Ansible version required for the installation playbooks to work correctly is 2.16.3.

For successful installation on Astra Linux 1.7.5 / 1.7.6, Ansible version 2.17.12 or earlier is required.

Official Ansible installation documentation is available online.

Install Ansible and the sshpass utility (required for the playbooks to function correctly) on the host from which the Ansible playbooks will be executed using the apt package manager:

sudo apt install ansible sshpass -y

Install community.docker Ansible collection version 4.7.0. To do this, download and place the file community-docker-4.7.0.tar.gz.

Example download using wget

wget https://cloud.eltex-co.ru/index.php/s/9Hv6p4yz611fDXb/download -O community-docker-4.7.0.tar.gz

Install the collection using the following command (without sudo):

ansible-galaxy collection install community-docker-4.7.0.tar.gz

Verify the installed collection version:

ansible-galaxy collection list | grep community.docker
community.docker                         4.7.0  
community.docker                         X.X.X

Obtaining files for running the playbook

NAICE is a licensed product; activating its functionality requires a valid license. See v1.1_2. Licensing for details.

At the time of installation, the license is not required, the product can be installed without activation.

Until a license is activated, NAICE operates in demo mode, in which the maximum number of network devices, active endpoints, and active guest endpoints is limited to 15 each.

To deploy the system in online mode, download the latest version archive from the v1.2_1.5 Stable versions page and place it on the host from which the playbook will be executed.

wget https://cloud.eltex-co.ru/index.php/s/vQdCi5UP1Abiv69/download -O ansibleNaice-v1.2-2026-06-26.tar.gz

Extract the archive:

tar xzvf ansibleNaice-v1.2-2026-06-26.tar.gz

Go to the playbook directory:

cd ansibleNaice-v1.2-2026-06-26

Configuring access to target hosts for installation

Using login/password authentication

To configure the host on which NAICE will be deployed, edit the file: inventory/hosts.yml. In the variable ansible_host, specify the IP address or domain name of the target host, as well as the username, password, and sudo password:

---
common:
  hosts:
    # Host for performing a stand-alone NAICE installation
    common_host:
      ansible_host: <IP address or domain name of the NAICE host> 
      ansible_user: <username>
      ansible_ssh_pass: <user password>
      ansible_become_pass: <sudo password>

The specified IP address or domain name will be added to the Subject Alternative Name (SAN) field when generating a self-signed certificate during NAICE service installation.

Using SSH key authentication

By default, login/password authentication is assumed. If SSH key authentication is used (the key must be generated and placed on the target host beforehand), update ansible.cfg:

[defaults]
inventory = hosts.yml
host_key_checking = True
private_key_file = <path to the SSH key file>
deprecation_warnings = False

Then specify access parameters in hosts.yml:

---
common:
  hosts:
    common_host:
      ansible_host: <IP address or domain name of the NAICE host>
      ansible_user: <username>
      ansible_become_pass: <sudo password>

Verifying access configuration

To verify the correctness of the configured access parameters and check connectivity to the remote host, run:

ansible all --list-hosts  # check the list of hosts
ansible all -m ping       # check access to hosts

Example output when access is configured correctly:

common_host | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": false,
    "ping": "pong"
}

Configuring variables in the file group_vars/all.yml

Variable settings are defined in the file group_vars/all.yml and are used for configuring system services. The system will operate correctly when using the default variable values. Below are the most commonly used configuration variables.

Configuring the time zone (TZ)

To ensure correct time display in NAICE, the following parameter must be set in the group_vars/all.yml configuration file.

Variable format:

time_zone: "Region/City"

Examples:
time_zone: "Europe/Moscow"

or:
time_zone: "Asia/Novosibirsk"

Other variables (optional)

If necessary, modify additional environment variables in group_vars/all.yml. For example, you can change the NAICE service installation directory or specify an external NAICE address different from the management address.

Configuring Docker networks

NAICE services use three Docker networks:

External
Internal
Unmasked

The variables used to configure the Docker networks are located in the group_vars/networks.yml file. This file defines the subnet, IP address range, and gateway for each network.

Example contents of the group_vars/networks.yml file:

---
# Variables for Docker network configuration
docker_network_unmasked:
  subnet: "172.18.0.0/20"
  ip_range: "172.18.8.0/21"
  gateway: "172.18.0.1"
 
docker_network_external:
  subnet: "172.20.0.0/20"
  ip_range: "172.20.8.0/21"
  gateway: "172.20.0.1"
 
docker_network_internal:
  subnet: "172.21.0.0/20"
  ip_range: "172.21.8.0/21"
  gateway: "172.21.0.1"

The example above shows the default values. If these networks overlap with existing networks in your infrastructure, update the network settings in the group_vars/networks.yml file before installing NAICE.

Docker subnets cannot be changed after NAICE has been installed by simply modifying the variables and rerunning the playbook. If you need to change the Docker subnets after installation, follow the instructions in v1.2_3.15 Changing Docker networks.

NAICE installation

For deploying NAICE services in a single-host installation, use the playbook install-naice.yml.

Run the install-naice.yml playbook to install the Docker containerization service, the Docker Compose plugin, and to start NAICE services via this plugin:

ansible-playbook install-naice.yml

During the installation of NAICE services, a self-signed certificate is automatically generated for the user interfaces lemmus, gavia, and larus. If you have your own trusted certificate, it can be installed after the services are deployed, replacing the default self-signed certificate. Detailed information on using security certificates can be found in the v1.1_3.6 Using security certificates section.

Because NAICE uses healthcheck mechanisms to verify successful startup, initializing the containers may take several minutes. Wait until the playbook execution is fully completed.

Checking service status after installation

To check whether the containers have started successfully, navigate to the NAICE installation directory (default: /etc/docker-naice/) and run the following command to view the list and status of containers: docker compose ps -a.

The example is shown for Ubuntu 24.04 LTS and may differ on other operating systems depending on the installed version of docker compose:

$ sudo docker compose ps -a
NAME             IMAGE                                                               COMMAND                  SERVICE         CREATED              STATUS                        PORTS
epg-service      naice-build-hosted.registry.eltex.loc/naice/epg-service:1.3-2       "/bin/sh -e /usr/loc…"   epg-service     6 minutes ago        Up 5 minutes (healthy)        
naice-aquila     naice-release.registry.eltex.loc/naice-aquila:1.2                   "java -cp @/app/jib-…"   naice-aquila    About a minute ago   Up About a minute (healthy)   0.0.0.0:8091->8091/tcp, [::]:8091->8091/tcp, 0.0.0.0:49->1049/tcp, [::]:49->1049/tcp
naice-bubo       naice-release.registry.eltex.loc/naice-bubo:1.2                     "java -cp @/app/jib-…"   naice-bubo      5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8093->8093/tcp, [::]:8093->8093/tcp
naice-castor     naice-release.registry.eltex.loc/naice-castor:1.2                   "java -Djava.awt.hea…"   naice-castor    5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8095->8095/tcp, [::]:8095->8095/tcp
naice-cetus      naice-release.registry.eltex.loc/naice-cetus:1.2                    "java -cp @/app/jib-…"   naice-cetus     5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8099->8099/tcp, [::]:8099->8099/tcp
naice-gavia      naice-release.registry.eltex.loc/naice-gavia:1.2                    "java -cp @/app/jib-…"   naice-gavia     5 minutes ago        Up About a minute (healthy)   0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp
naice-gulo       naice-release.registry.eltex.loc/naice-gulo:1.2                     "java -cp @/app/jib-…"   naice-gulo      5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8089->8089/tcp, [::]:8089->8089/tcp
naice-lemmus     naice-release.registry.eltex.loc/naice-lemmus:1.2                   "java -cp @/app/jib-…"   naice-lemmus    5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8083->8083/tcp, [::]:8083->8083/tcp
naice-lepus      naice-release.registry.eltex.loc/naice-lepus:1.2                    "java -cp @/app/jib-…"   naice-lepus     5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8087->8087/tcp, [::]:8087->8087/tcp, 0.0.0.0:67->1024/udp, [::]:67->1024/udp
naice-mustela    naice-release.registry.eltex.loc/naice-mustela:1.2                  "java -cp @/app/jib-…"   naice-mustela   5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8070->8070/tcp, [::]:8070->8070/tcp
naice-nats       naice-build-hosted.registry.eltex.loc/naice/nats:1.2.2              "docker-entrypoint.s…"   nats            6 minutes ago        Up 5 minutes (healthy)        4222/tcp, 6222/tcp, 7777/tcp, 8222/tcp
naice-ovis       naice-release.registry.eltex.loc/naice-ovis:1.2                     "java -cp @/app/jib-…"   naice-ovis      5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8084->8084/tcp, [::]:8084->8084/tcp
naice-phoca      naice-release.registry.eltex.loc/naice-phoca:1.2                    "java -cp @/app/jib-…"   naice-phoca     6 minutes ago        Up 5 minutes (healthy)        0.0.0.0:8097->8097/tcp, [::]:8097->8097/tcp
naice-postgres   naice-build-hosted.registry.eltex.loc/naice/postgres-repmgr:1.2.2   "/opt/bitnami/script…"   postgres        7 minutes ago        Up 5 minutes (healthy)        127.0.0.1:5432->5432/tcp, 127.0.0.1:15432->22/tcp
naice-radius     naice-release.registry.eltex.loc/naice-radius:1.2                   "/docker-entrypoint.…"   naice-radius    4 minutes ago        Up 4 minutes (healthy)        0.0.0.0:1812-1813->1812-1813/udp, [::]:1812-1813->1812-1813/udp, 0.0.0.0:9812->9812/tcp, [::]:9812->9812/tcp
naice-sterna     naice-release.registry.eltex.loc/naice-sterna:1.2                   "/docker-entrypoint.…"   naice-sterna    About a minute ago   Up About a minute (healthy)   0.0.0.0:32888->80/tcp, [::]:32888->80/tcp, 0.0.0.0:8443->444/tcp, [::]:8443->444/tcp
naice-ursus      naice-release.registry.eltex.loc/naice-ursus:1.2                    "java -cp @/app/jib-…"   naice-ursus     5 minutes ago        Up 4 minutes (healthy)        0.0.0.0:8081->8081/tcp, [::]:8081->8081/tcp
naice-vulpus     naice-release.registry.eltex.loc/naice-vulpus:1.2                   "java -cp @/app/jib-…"   naice-vulpus    5 minutes ago        Up 3 minutes (healthy)        0.0.0.0:8086->8086/tcp, [::]:8086->8086/tcp
naice-web        naice-release.registry.eltex.loc/naice-web:1.2                      "/docker-entrypoint.…"   naice-web       About a minute ago   Up 59 seconds (healthy)       0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:32889->80/tcp, [::]:32889->80/tcp, 0.0.0.0:80->4200/tcp, [::]:80->4200/tcp

Appendices

Appendix A. Environment variable in the .env file and Ansible playbook variables

Legend:

- not recommended for editing.
- hint.

Environment variable (.env)	Ansible variable (group_vars/all.yml)	Default value	Description
Distribution variables
no	`offline_install`	`false`	Flag indicating installation in an isolated environment. When installing in an isolated environment, a separate archive must be downloaded. Do not change this value when using the online installation playbooks!
no	`naice_address`	`ansible_host`	Target IP address or DNS hostname. Taken from the `ansible_host` variable value. Only needs to be changed if the IP address for web GUI access differs from the installation address!
no	`naice_docker_path`	`/etc/docker-naice`	Target installation directory
no	`naice_docker_images`	`not set`	Used during installation in an isolated environment. When installing in an isolated environment, a separate archive must be downloaded. Do not change this value when using the online installation playbooks!
no	`docker_compose_download_url`	`https://cloud.eltex-co.ru/index.php/s/yKlAcy83VVPEfzx/download`	Download URL for the `docker compose` plugin when installing on Astra Linux 1.7.X.
no	`ip_has_been_changed`	`false`	Flag indicating that the host IP address has been changed after installation. Used to update the IP address when re-running the installation playbook.
no	`skip_docker_installation`	`false`	Skip Docker services installation. Used during installation in an isolated environment. When installing in an isolated environment, a separate archive must be downloaded. Do not change this value when using the online installation playbooks!
`BACKEND_VERSION_TAG`	`version_tag`	`1.2`	Backend services version (naice-gavia, naice-lemmus, naice-ovis, naice-ursus).
`FRONTEND_VERSION_TAG`	`version_tag`	`1.2`	Frontend service version (naice-web, known as larus).
`POSTGRES_VERSION_TAG`	`postgres_version_tag`	`1.2.2`	Containerized postgres DB image version.
`RADIUS_VERSION_TAG`	`radius_version_tag`	`1.2`	Containerized FreeRadius image version.
`NATS_VERSION_TAG`	`nats_version_tag`	`1.2.2`	Containerized NATS image version.
`ELTEX_HUB`	`ELTEX_HUB`	`hub.eltex-co.ru/naice`	External repository with stable software build versions.
`BACKEND_HUB`	`ELTEX_HUB`	`ELTEX_HUB`	Variable storing the currently selected repository for downloading backend services.
`FRONTEND_HUB`	`ELTEX_HUB`	`ELTEX_HUB`	Variable storing the currently selected repository for downloading the frontend service.
`RADIUS_HUB`	`ELTEX_HUB`	`ELTEX_HUB`	Variable storing the currently selected repository for downloading the FreeRADIUS container.
`CI_HUB`	`CI_HUB`	`hub.eltex-co.ru`	External repository for supporting product builds (PostgreSQL).
`TZ`	`time_zone`	`Etc/UTC`	Timezone value variable for the NAICE deployment. Affects system log timestamps.
`NAICE_HOSTNAME`	`no`	`Taken from /etc/hostname during ansible playbook installation`	Hostname of the system where NAICE is deployed. Required for licensing. Changing it after license activation is prohibited.
`naice_node_ip`	`naice_node_ip`	`IP address, by default taken from theansible_hostvariable`	Node IP address that corresponds to the `{{ ansible_host }}` variable value if it contains an IP, or obtained via DNS resolution of `{{ ansible_host }}` if a domain name is used.
Gavia variables
`GAVIA_HOST_PORT`	`gavia_host_port`	`8080`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`LEMMUS_GAVIA_POSTGRES_USERNAME`	`lemmus_gavia_postgres_username`	`lemmus`	Login for accessing the database. lemmus.
`LEMMUS_GAVIA_POSTGRES_PASSWORD`	`lemmus_gavia_postgres_password`	`lemmus`	Password for accessing the database. lemmus.
Ursus variables
`URSUS_HOST_PORT`	`ursus_host_port`	`8081`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`URSUS_POSTGRES_USERNAME`	`ursus_postgres_username`	`ursus`	User for service access to the PostgreSQL database.
`URSUS_POSTGRES_PASSWORD`	`ursus_postgres_password`	`ursus`	User password for service access to the PostgreSQL database.
`URSUS_OUI_UPDATE_TIME_S`	`ursus_update_oui_time`	`86400`	Frequency of updating the MAC OUI list, s.
`URSUS_OUI_UPDATE`	`ursus_upload_oui_csv`	`True`	Enable/disable MAC OUI list update.
`URSUS_OUI_UPLOAD_FILE_URL`	`ursus_upload_csv_oui_url`	`https://standards-oui.ieee.org/oui/oui.csv`	URL of the MAC OUI list used for updates.
`URSUS_PORTAL_USER_PASSWORD_LENGTH`	`ursus_portal_user_password_length`	`4`	Minimum password length that can be set for a portal user.
`URSUS_IDENTITY_PASSWORD_LENGTH`	ursus_identity_password_length	8	Minimum network user password length.
`URSUS_NETLOGON_CHANGE_COMPUTER_PASS_CRON`	ursus_netlogon_change_pass_cron	-	Domain computer password rotation interval setting (0 10 2 1-31/7 * * – every seventh day from 1st to 31st at 2:10).
no	ursus_netlogon_change_pass_cron_node1	-	Domain computer password rotation interval setting for high-availability deployment on node 1.
no	ursus_netlogon_change_pass_cron_node2	-	Domain computer password rotation interval setting for high-availability deployment on node 2.
`URSUS_NETLOGON_CHANGE_COMPUTER_PASS_LENGTH`	ursus_netlogon_change_pass_length	12	Generated domain computer password length during rotation: from 12 to 200 characters.
Lemmus variables
`LEMMUS_HOST_PORT`	`lemmus_host_port`	`8083`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`LEMMUS_POSTGRES_USERNAME`	`lemmus_postgres_username`	`lemmus`	User for service access to the PostgreSQL database.
`LEMMUS_POSTGRES_PASSWORD`	`lemmus_postgres_password`	`lemmus`	User password for service access to the PostgreSQL database.
`LEMMUS_ACCESS_TTL_S`	`lemmus_access_ttl_s`	`3600`	Token lifetime in seconds.
`LEMMUS_REFRESH_TTL_S`	`lemmus_refresh_ttl_s`	`7200`	Time in seconds during which the token can be refreshed.
`LEMMUS_REDIRECTS_RULES`		`*:443,0.0.0.0/0:443`	Web interface access rules on first NAICE startup. Later configured in System settings → Security and Login → Login → Management Addresses.
PostgreSQL variables
`no`	`postgres_host`	`naice-postgres`	PostgreSQL database container name.
`no`	`postgres_port`	`5432`	Port for connecting to the PostgreSQL database.
`POSTGRES_USER`	`postgres_user`	`postgres`	User created during database installation and configuration.
`POSTGRES_PASSWORD`	`postgres_password`	`postgres`	User password created during database installation and configuration.
`no`	`postgres_db`	`postgres`	Default database name used for managing the PostgreSQL database.
PostgreSQL variables for high-availability deployment
`no`	`postgres_reserved_host`	`127.0.0.1`	Backup PostgreSQL node address.
`no`	`postgres_reserved_port`	`5432`	Backup PostgreSQL node port.
Ovis variables
`OVIS_HOST_PORT`	`ovis_host_port`	`8084`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`OVIS_CACHE_TTL_S`	`ovis_cache_ttl_s`	`86400`	naice-ovis cache lifetime in seconds, during which it stores authentication and authorization settings. After this time, settings are re-read.
`OVIS_SESSION_IDLE_S`	`ovis_session_idle_s`	`86400`	Lifetime of inactive user sessions, s.
`OVIS_URSUS_POSTGRES_USERNAME`	`ovis_ursus_postgres_username`	`ovis`	Login for connecting to the ursus database.
`OVIS_URSUS_POSTGRES_PASSWORD`	`ovis_ursus_postgres_password`	`ovis`	Password for connecting to the ursus database.
`OVIS_OVIS_POSTGRES_USERNAME`	`ovis_ovis_postgres_username`	`ovis`	Login for connecting to the ovis database.
`OVIS_OVIS_POSTGRES_PASSWORD`	`ovis_ovis_postgres_password`	`ovis`	Password for connecting to the ovis database.
`OVIS_NODE_INTERFACE`	`hazelcast_node_interface`	`{{ naice_address }}`	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
`OVIS_NODE_MEMBERS`	`hazelcast_node_members`	`127.0.0.1`	IP addresses/DNS names of the instances participating in a high-availability deployment.
`OVIS_SESSIONS_CLEAN_CRON`	`ovis_session_clean_cron`	0 0 * * * *	Interval for running the radius session cleanup task from the database, by default every hour.
`OVIS_SESSION_FLUSH_SEC`	`ovis_session_flush_sec`	10	Interval for radius session persistence from cache to the database, s.
`OVIS_DB_POOL_CONNECTION_LIFETIME`	`ovis_db_pool_connection_lifetime`	1800000	Connection lifetime to the ursus database, s.
`OVIS_DB_POOL_IDLE_TIMEOUT`	`ovis_db_pool_idle_timeout`	60000	Response wait time when connecting to the ursus database, ms.
`OVIS_DB_POOL_MIN_IDLE`	`ovis_db_pool_min_idle`	5	Minimum number of connections for the ursus database in idle mode.
`OVIS_DB_POOL_SIZE`	`ovis_db_pool_size`	10	Number of connections for connecting to the ovis database.
`OVIS_SESSIONS_DB_POOL_CONNECTION_LIFETIME`	`ovis_sessions_db_pool_connection_lifetime`	1800000	Connection lifetime to the ovis database, s.
`OVIS_SESSIONS_DB_POOL_IDLE_TIMEOUT`	`ovis_sessions_db_pool_idle_timeout`	60000	Response wait time when connecting to the ovis database, ms.
`OVIS_SESSIONS_DB_POOL_MIN_IDLE`	`ovis_sessions_db_pool_min_idle`	2	Minimum number of connections for the ovis database in idle mode.
`OVIS_SESSIONS_DB_POOL_SIZE`	`ovis_sessions_db_pool_size`	5	Number of connections for connecting to the ovis database.
`OVIS_SESSION_BATCH_SIZE`	`ovis_session_batch_size`	100	Number of sessions in a single batch for saving to the ovis database.
OVIS_RADIUS_CLASS_ATTR_ENABLED	`ovis_radius_class_attr_enabled`	true	Enable/disable accounting processing for user active session limits: true – enable, false – disable.
Larus (web) variables
`LARUS_PORT`	`larus_port`	`4200`	Port on which the service runs inside the container.
`LARUS_HOST_PORT`	`larus_host_port`	`80`	HTTP port to which the service container port is forwarded on the host machine. Used for interacting with the service. Used only to redirect user connections to the secure port 443.
`FRONTEND_STERNA_URL`	`frontend_sterna_url`	`https://{{ naice_address }}:{{ sterna_host_port }}`	URL where the Captive Portal runs.
NATS variables
`NATS_MONITORING_PORT`	`nats_monitoring_port`	`8222`	Port used for service monitoring.
`NATS_EXPORTER_PORT`	`nats_exporter_port`	`7777`	Port used by the service to expose metrics in Prometheus format.
`NATS_CLUSTER_PORT`	`nats_cluster_port`	`6222`	Port for NATS cluster communication (high-availability deployment).
`no`	`nats_slave_address`	`127.0.0.1`	IP address used for NATS communication within the cluster.
`NATS_REQUEST_REPLY_TIMEOUT`	`nats_request_reply_timeout`	5	Maximum wait time for a response from the client service to a sent nats event, s.
`NATS_RECONNECT_WAIT`	`nats_reconnect_wait`	15	Pause time between attempts to reconnect the client service to nats, s.
`NATS_MAX_RECONNECT`	`nats_max_reconnect`	30	Maximum number of attempts to reconnect the client service to nats.
`NATS_RECONNECT_BUFFER_SIZE`	`nats_reconnect_buffer_size`	0	Buffer size for outgoing messages during connection loss, sent after reconnection, in bytes. 0 means this buffer is disabled. When the non-zero value is exceeded, the client will start dropping messages.
Vulpus variables
`VULPUS_HOST_PORT`	`vulpus_host_port`	`8086`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`VULPUS_POSTGRES_USERNAME`	`vulpus_postgres_username`	`vulpus`	Login for connecting to the database.
`VULPUS_POSTGRES_PASSWORD`	`vulpus_postgres_password`	`vulpus`	Password for connecting to the database.
`VULPUS_NODE_INTERFACE`	`hazelcast_node_interface`	`{{ naice_address }}`	Interface IP address for communication with a neighboring instance in a high-availability deployment.
`VULPUS_NODE_MEMBERS`	`hazelcast_node_members`	`127.0.0.1`	Interface IP address of the neighboring node for communication in a high-availability deployment.
Lepus variables
`LEPUS_HOST_PORT`	`lepus_host_port`	`8087`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`LEPUS_REPOSITORY_BATCH_SIZE`	`lepus_repository_batch_size`	`500`	Batch size for saving probes to the database (count).
`LEPUS_POSTGRES_USERNAME`	`lepus_postgres_username`	`lepus`	Login for connecting to the database.
`LEPUS_POSTGRES_PASSWORD`	`lepus_postgres_password`	`lepus`	Password for connecting to the database.
`LEPUS_DHCP_PROBE_ENABLED`	`lepus_dhcp_probe_enabled`	`true`	Enable/disable DHCP probe collection.
`LEPUS_DHCP_PROBE_HOST_PORT`	`lepus_dhcp_probe_host_port`	`67`	External service port for collecting DHCP probes.
`LEPUS_DHCP_PROBE_SCHEDULE_CLEAR_PROBES_AFTER_DAYS`	`lepus_dhcp_probe_schedule_clear_probes_after_days`	`30`	DHCP probe retention time in the database.
`LEPUS_DHCP_PROBE_SCHEDULE_CLEAN_EXPIRED_CRON`	`lepus_dhcp_probe_schedule_clean_expired_cron`	`0 0 * * * *`	Schedule for running the task to clean up expired DHCP probes from the database.
Gulo variables
`GULO_HOST_PORT`	`gulo_host_port`	`8089`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`GULO_USER_LABEL`	no	`{{ naice_address }}/v{{ version_tag }}`
Aquila variables
`AQUILA_HOST_PORT`	`aquila_host_port`	`8091`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`AQUILA_CACHE_TTL_S`	`aquila_cache_ttl_s`	`300`	naice-aquila cache lifetime in seconds, during which the service stores authentication and authorization settings. After this time, settings are re-read.
`AQUILA_POSTGRES_USERNAME`	`aquila_postgres_username`	`aquila`	Login for connecting to the database.
`AQUILA_POSTGRES_PASSWORD`	`aquila_postgres_password`	`aquila`	Password for connecting to the database.
`AQUILA_DB_POOL_SIZE`	`aquila_db_pool_size`	`5`	Number of connections for connecting to the database. aquila.
`AQUILA_DB_POOL_MIN_IDLE`	`aquila_db_pool_min_idle`	`1`	Minimum number of connections for the aquila database in idle mode.
`AQUILA_DB_POOL_IDLE_TIMEOUT`	`aquila_db_pool_idle_timeout`	`60000`	Response wait time when connecting to the database, ms.
`AQUILA_DB_POOL_CONNECTION_LIFETIME`	`aquila_db_pool_connection_lifitime`	`1800000`	Connection lifetime to the database, s.
`AQUILA_URSUS_DB_POOL_MIN_IDLE`	`aquila_ursus_db_pool_min_idle`	`2`	Minimum number of connections for the ursus database in idle mode.
`AQUILA_URSUS_DB_POOL_SIZE`	`aquila_ursus_db_pool_size`	`10`	Number of connections for connecting to the database. ursus.
`AQUILA_FLUSH_SEC`	`aquila_flush_sec`	`60`	Interval for persisting sessions and accounting to the database, s.
`AQUILA_SESSIONS_CLEAN_CRON`	`aquila_session_clean_cron`	`0 0 * * * *`	Interval for cleaning up sessions and accounting from the database, by default every hour.
`AQUILA_NODE_INTERFACE`	`hazelcast_node_interface`	`{{ naice_address }}`	Interface IP address for communication with a neighboring instance in a high-availability deployment.
`AQUILA_NODE_MEMBERS`	`hazelcast_node_members`	`127.0.0.1`	Interface IP address of the neighboring node for communication in a high-availability deployment.
`AQUILA_USER_CACHE_ENABLE`	`aquila_user_cache_enable`	`True`	Enable caching of the username when executing command authorization. Possible values: True / False. When set to False, each command authorization request will trigger a check for the username existence in the identity source.
`AQUILA_USER_CACHE_TTL_S`	`aquila_user_cache_ttl_s`	`300`	Username cache retention time when executing command authorization.
Bubo variables
`BUBO_HOST_PORT`	`bubo_host_port`	`8093`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`BUBO_NODE_INTERFACE`	`hazelcast_node_interface`	`{{ naice_address }}`	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
`BUBO_NODE_MEMBERS`	`hazelcast_node_members`	`127.0.0.1`	IP addresses/DNS names of instances participating in high-availability deployment.
`BUBO_POSTGRES_USERNAME`	`bubo_postgres_username`	`bubo`	Login for connecting to the database.
`BUBO_POSTGRES_PASSWORD`	`bubo_postgres_password`	`bubo`	Password for connecting to the database.
`BUBO_CACHE_TTL_S`	`bubo_cache_ttl_s`	`300`
`BUBO_SMS_SCHEDULE_CLEAN_EXPIRED_CRON`	`bubo_sms_schedule_clean_expired_cron`	`0 0 * * * *`	Interval for cleaning up SMS records from the database, by default every hour.
`BUBO_SMS_TO_DELETE_DAYS`	`bubo_sms_to_delete_days`	`31`	Retention period for sent SMS information in the database.
Castor variables
`CASTOR_HOST_PORT`	`castor_host_port`	`8095`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`CASTOR_POSTGRES_USERNAME`	`castor_postgres_username`	`castor`	Login for connecting to the database.
`CASTOR_POSTGRES_PASSWORD`	`castor_postgres_password`	`castor`	Password for connecting to the database.
`CASTOR_NODE_INTERFACE`	`hazelcast_node_interface`	`{{ naice_address }}`	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
`CASTOR_NODE_MEMBERS`	`hazelcast_node_members`	`127.0.0.1`	IP addresses/DNS names of instances participating in a high-availability deployment.
`CASTOR_DB_POOL_SIZE`	`castor_db_pool_size`	`10`	Number of connections for connecting to the database.
`CASTOR_DB_POOL_MIN_IDLE`	`castor_db_pool_min_idle`	`2`	Minimum number of connections for the database in idle mode.
`CASTOR_DB_POOL_IDLE_TIMEOUT`	`castor_db_pool_idle_timeout`	`60000`	Response wait time when connecting to the database, ms.
`CASTOR_DB_POOL_CONNECTION_LIFETIME`	`castor_db_pool_connection_lifetime`	`1800000`	Connection lifetime to the database, s.
`CASTOR_CACHE_TTL_S`	`castor_cache_ttl_s`	`300`	User information cache retention time, s.
`CASTOR_REQUESTS_RATE_LIMIT`	`castor_requests_rate_limit`	`1000`	Maximum number of REST requests to the service within the time period specified by the CASTOR_SECONDS_RATE_LIMIT variable.
`CASTOR_SECONDS_RATE_LIMIT`	`castor_seconds_rate_limit`	`10`	Time period for counting REST requests to the service, s.
`CASTOR_MAX_THREAD_COUNT`	`castor_max_thread_count`	`20`	Maximum number of threads when processing REST requests to the service.
Sterna variables
`STERNA_HTTPS_PORT`	`sterna_https_port`	`444`	HTTPS port on which the service runs inside the container.
`STERNA_HTTP_PORT`	`sterna_http_port`	`81`	HTTP port on which the service runs inside the container.
`STERNA_HTTPS_HOST_PORT`	`sterna_host_port`	`8443`	HTTPS port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`STERNA_HTTP_HOST_PORT`	`sterna_host_port`	`8443`	HTTP port to which the service container port is forwarded on the host machine. Used for interacting with the service. Not used by default, requires manual activation.
`FRONTEND_STERNA_URL`	`frontend_sterna_url`	`https://{{ ansible_host }}:8443`	Portal redirect URL that will be used for authenticating portal users.
Mustela variables
`MUSTELA_HOST_PORT`	`mustela_host_port`	`8098`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`MUSTELA_POSTGRES_USERNAME`	`mustela_postgres_username`	`mustela`	Login for connecting to the database.
`MUSTELA_POSTGRES_PASSWORD`	`mustela_postgres_password`	`mustela`	Password for connecting to the database.
`MUSTELA_DB_POOL_SIZE`	`mustela_db_pool_size`	`25`	Maximum number of connections for connecting to the database.
`MUSTELA_DB_POOL_MIN_IDLE`	`mustela_db_pool_min_idle`	`5`	Minimum number of connections for the database in idle mode.
`MUSTELA_DB_POOL_IDLE_TIMEOUT`	`mustela_db_pool_idle_timeout`	`60000`	Response wait time when connecting to the database, ms.
`MUSTELA_DB_POOL_CONNECTION_LIFETIME`	`mustela_db_pool_connection_lifetime`	`1800000`	Connection lifetime to the database, ms.
`MUSTELA_NODE_INTERFACE`	`hazelcast_node_interface`	`{{ naice_address }}`	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
`MUSTELA_NODE_MEMBERS`	`hazelcast_node_members`	`127.0.0.1`	IP addresses/DNS names of instances participating in a high-availability deployment.
`MUSTELA_EVENTS_CLEAN_CRON`	`mustela_events_clean_cron`	`0 0 3 * * *`	Interval for cleaning up events past their retention period from the database, by default every 3 hours.
Phoca variables
`PHOCA_HOST_PORT`	`phoca_host_port`	`8097`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`PHOCA_POSTGRES_USERNAME`	`phoca_postgres_username`	`phoca`	Login for connecting to the database.
`PHOCA_POSTGRES_PASSWORD`	`phoca_postgres_password`	`phoca`	Password for connecting to the database.
`PHOCA_DB_POOL_SIZE`	`phoca_db_pool_size`	5	Maximum number of connections for connecting to the database.
`PHOCA_DB_POOL_MIN_IDLE`	`phoca_db_pool_min_idle`	1	Minimum number of connections for the database in idle mode.
`PHOCA_DB_POOL_IDLE_TIMEOUT`	`phoca_db_pool_idle_timeout`	60000	Response wait time when connecting to the database, ms.
`PHOCA_DB_POOL_CONNECTION_LIFETIME`	`phoca_db_pool_connection_lifetime`	1800000	Connection lifetime to the database, ms.
`PHOCA_HOST_DOCKER_SOCK`	`phoca_host_docker_sock`	`/var/run/docker.sock`	Path to the UNIX socket for communicating with the Docker daemon. Required for managing containers to apply configurations to services.
Cetus variables
`CETUS_HOST_PORT`	`cetus_host_port`	`8099`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
`CETUS_POSTGRES_USERNAME`	`cetus_postgres_username`	`cetus`	Login for connecting to the database.
`CETUS_POSTGRES_PASSWORD`	`cetus_postgres_password`	`cetus`	Password for connecting to the database.
`CETUS_DB_POOL_SIZE`	`cetus_db_pool_size`	`10`	Maximum number of connections for connecting to the database.
`CETUS_DB_POOL_MIN_IDLE`	`cetus_db_pool_min_idle`	`3`	Minimum number of connections for the database in idle mode.
`CETUS_DB_POOL_IDLE_TIMEOUT`	`cetus_db_pool_idle_timeout`	`60000`	Response wait time when connecting to the database, ms.
`CETUS_DB_POOL_CONNECTION_LIFETIME`	`cetus_db_pool_connection_lifetime`	`1800000`	Response wait time when connecting to the database, ms.
`CETUS_CACHE_TTL_S`	`cetus_cache_ttl_s`	`300`	Cache lifetime in seconds, during which the service stores authentication settings. After this time, settings are re-read.
CETUS_USERS_CACHE_TTL_S	cetus_users_cache_ttl_s	10	User cache lifetime in seconds.
CETUS_USERS_CACHE_ENABLED	cetus_users_cache_enabled	true	Enable user caching during authentication. Possible values: true / false.
`CETUS_NODE_INTERFACE`	`hazelcast_node_interface`	`{{ naice_address }}`	IP address/DNS name of the interface for communication with a neighboring instance in a high-availability deployment.
`CETUS_NODE_MEMBERS`	`hazelcast_node_members`	`127.0.0.1`	IP addresses/DNS names of instances participating in high-availability.
`CETUS_LDAP_CONNECT_TIMEOUT_MS`	`cetus_ldap_connect_timeout_ms`	`3000`	Timeout for connecting to an external source via LDAP protocol, ms.
`CETUS_LDAP_READ_TIMEOUT_MS`	`cetus_ldap_read_timeout_ms`	`7000`	Timeout for the data retrieval process from an external source via LDAP protocol, ms.
`CETUS_LDAP_REFERRAL_VALUE`	`cetus_ldap_referral_value`	`ignore`	Behavior when receiving a referral to another server in response to an LDAP request: * "ignore" (default) - ignore and do not follow the external referral; * "follow" - automatically redirect requests to another server upon receiving a referral.
`CETUS_LDAP_POOL_SIZE`	`cetus_ldap_pool_size`	`10`	Number of connections for connecting to the LDAP server at service startup.
`CETUS_LDAP_POOL_MAX_SIZE`	`cetus_ldap_pool_max_size`	`10`	Maximum number of connections for connecting to the LDAP server.
`CETUS_NETLOGON_LIB_SOCKET_TIMEOUT_MS`	`cetus_netlogon_lib_socket_timeout_ms`	`5000`	Timeout for data exchange with an external identity source (Active Directory) via netlogon protocol, ms.
`CETUS_NETLOGON_LIB_CONNECT_TIMEOUT_MS`	`cetus_netlogon_lib_connect_timeout_ms`	`5000`	Timeout for connecting to an external identity source (Active Directory) via netlogon protocol, ms.
`CETUS_NETLOGON_LIB_CLIENT_CACHE_ENABLED`	`cetus_netlogon_lib_client_cache_enabled`	`true`	Enable computer session caching when accessing an external identity source (Active Directory) via netlogon protocol.
`CETUS_NETLOGON_LIB_CLIENT_CACHE_TTL_S`	`cetus_netlogon_lib_client_cache_ttl_s`	`1800`	Computer session cache retention time, s.
`CETUS_NETLOGON_LIB_CLIENT_CACHE_PERIOD_S`	`cetus_netlogon_lib_client_cache_period_s`	`180`	Interval for checking computer session existence in cache, s.
`CETUS_NETLOGON_LIB_DNS_CACHE_TTL_S`	`CETUS_NETLOGON_LIB_DNS_CACHE_TTL_S`	`3600`	Cache retention time for domain controller information after DNS SRV query execution, s.
`CETUS_NETLOGON_LIB_DNS_CACHE_PERIOD_S`	`cetus_netlogon_lib_dns_cache_period_s`	`360`	Interval for checking domain controller information in cache after DNS SRV query execution, s.
EPG variables
`EPG_TAG`	`epg_tag`	`1.1-3`	EPG service version.
`EPG_LOG_FILE_MAX_SIZE`	`epg_log_file_max_size`	`10`	Maximum size of a single log file in MB.
`EPG_LOG_FILE_MAX_COUNT`	`epg_log_file_max_count`	`4`	Maximum number of log files in rotation.
`EPG_KERNEL_LOG_LEVEL`	`epg_kernel_log_level`	`info`	Log level for EPG service "kernel" logs.
`EPG_DEBUG_LOG_LEVEL`	`epg_debug_log_level`	`off`	Log level for EPG service "debug" logs.
`EPG_NETWORKING_LOG_LEVEL`	`epg_networking_log_level`	`info`	Log level for EPG service "networking" logs.
`EPG_HOST_PORT`	`epg_host_port`	`8100`	Port to which the service container port is forwarded on the host machine. Used for interacting with the service.
RADIUS variables
General variables
`RADIUS_EXPORTER_PORT`	`radius_exporter_port`	`9812`	Port used by the service to expose metrics in Prometheus format.
RADIUS_VERSION_TAG	`radius_version_tag`	`{{ version_tag }}`	Service version
`RADIUS_LOG_PATH`	`radius_log_path`	`/var/log/radius`	File on the host machine for storing service operation logs.
RADIUS variables for SQL module connection
`RADIUS_POSTGRES_DB_HOST`	`radius_postgres_db_host`	`naice-postgres`	IP address for connecting to the database.
`RADIUS_POSTGRES_DB_PORT`	`radius_postgres_db_port`	`5432`	Port for connecting to the database.
`RADIUS_POSTGRES_DB_LOGIN`	`radius_postgres_db_login`	`radius`	Login for connecting to the database.
`RADIUS_POSTGRES_DB_PASSWORD`	`radius_postgres_db_password`	`radius`	Password for connecting to the database.
RADIUS variables for backup SQL module (used only in a high-availability deployment)
`RADIUS_POSTGRES_RESERVED_DB_HOST`	`radius_postgres_reserved_db_host`	`{{ postgres_reserved_host }}`	Backup PostgreSQL node address.
`RADIUS_POSTGRES_RESERVED_DB_PORT`	`radius_postgres_reserved_db_port`	`{{ postgres_reserved_port }}`	Backup PostgreSQL node port.
`RADIUS_POSTGRES_RESERVED_DB_LOGIN`	`radius_postgres_reserved_db_login`	`radius`	Login for connecting to the database.
`RADIUS_POSTGRES_RESERVED_DB_PASSWORD`	`radius_postgres_reserved_db_password`	`radius`	Password for connecting to the database.
`RADIUS_POSTGRES_RESERVED_ENABLED`	`radius_postgres_reserved_enabled`	`0`	Use high-availability (0 - no, 1 - yes)
Service logging variables
`no`	`docker_log_max_size`	`"\"10m\""`	Maximum service log file size.
`no`	`docker_log_max_file`	`"\"10\""`	Maximum number of log files for a service.
Variables for high-availability deployment (located in `group_vars/reservation.yml`)
Variables defining PostgreSQL cluster addresses in a high-availability deployment
`no`	`primary_db_host`	`{{ hostvars['node_primary'].ansible_host }}`	Host address for installing the Primary PostgreSQL node.
`no`	`standby_db_host`	`{{ hostvars['node_standby'].ansible_host }}`	Host address for installing the Backup PostgreSQL node.
`no`	`primary_db_port`	`{{ hostvars['node_primary'].forwarded_postgresql_port }}`	Port for connecting to the PostgreSQL database on the Primary node.
`no`	`standby_db_port`	`{{ hostvars['node_standby'].forwarded_postgresql_port }}`	Port for connecting to the PostgreSQL database on the Backup node.
Parameters for configuring the `keepalived` service
`no`	`check_vip_interface`	`true`	Check that the IP address specified in the `hosts-cluster.yml` file variable `keepalived_vip` is within the subnet of IP addresses configured on the target VM interfaces specified in the `hosts-cluster.yml` file variable `keepalived_interface` (true – check, false – do not check)`.
`no`	`vip_server_name`	`{{ keepalived_vip }}`	VIP address used for high-availability or a domain name that resolves to this address via DNS.
`no`	`vip_auth_type`	`PASS`	VRRP announcement authentication type.
`no`	`vip_auth_pass`	`testing123`	Password used in VRRP announcements.
`no`	`vrrp_garp_master_refresh`	`0`	Period for sending GARP messages by a VRRP instance in Primary state, s. 0 = do not send.
`no`	`vrrp_garp_master_refresh_repeat`	`1`	Number of GARP messages sent by a VRRP instance in MASTER state during periodic sending.
`no`	`vrrp_garp_master_delay`	`5`	Delay during which GARP message sending will not be performed after VRRP instance transitions to MASTER state, s.
`no`	`vrrp_garp_master_repeat`	`5`	Number of GARP messages to be sent after VRRP instance transitions to MASTER state.
`no`	`virtual_router_id`	`1`	Identifier for VRRP instances that provide high-availability for a single VIP address. Valid values: 1-255.
`no`	`advert_int`	`1`	Interval for sending VRRP announcements by an instance in MASTER state, s.
`no`	`check_interval`	`20`	Interval for executing the script that checks NAICE service health status, s.
`no`	`keepailveed_logrotate_save_n_rotated_files`	`5`	Number of VRRP operation log files retained during log rotation.
`no`	`keepailveed_logrotate_maxage`	`30`	Maximum lifetime of a VRRP log file before rotation is performed, days.
`no`	`keepailveed_logrotate_size`	`10M`	Maximum size of a VRRP log file before rotation is performed, MB.
`no`	`keepailveed_logrotate_delay`	`weekly`	Interval for performing log rotation, by default weekly.
Variables for PostgreSQL cluster interaction in a high-availability deployment (located in `group_vars/postgres-cluster.yml`) After installing the PostgreSQL cluster, these variables are stored in the repmgr.env file
`REPMGR_CONNECT_TIMEOUT`	`repmgr_connect_timeout`	`5`	Wait time when connecting a node, s.
`REPMGR_RECONNECT_ATTEMPTS`	`repmgr_reconnect_attempts`	`3`	Number of node cluster connection attempts before the cluster is considered unavailable.
`REPMGR_RECONNECT_INTERVAL`	`repmgr_reconnect_interval`	`5`	Interval between node cluster connection attempts, s.
`REPMGR_MASTER_RESPONSE_TIMEOUT`	`repmgr_master_response_timeout`	`20`	Wait time for a response from a node in "Primary" state, s.
`REPMGR_UPGRADE_EXTENSION`	`repmgr_upgrade_extension`	`'yes'`	Enable replication manager extension updates after installing a new version.
`BITNAMI_DEBUG`	`bitnami_debug`	`false`	Disable/Enable (false/true) additional replication manager logs.
`REPMGR_LOG_LEVEL`	`repmgr_log_level`	`info`	Replication manager event log level. Possible values: `info`, `debug`.
Variables for managing Docker subnet IP addressing (located in `group_vars/networks.yml`)
Variables for managing the `docker_network_unmasked` network
no	`subnet`	`"172.18.0.0/20"`	IP address range assigned to the subnet.
no	`ip_range`	`"172.18.8.0/21"`	IP address range within the assigned subnet from which addresses are allocated for running containers.
no	`gateway`	`"172.18.0.1"`	Gateway for container traffic to exit the Docker virtual network to the external network.
Variables for managing the `docker_network_external` network
no	`subnet`	`"172.20.0.0/20"`	IP address range assigned to the subnet.
no	`ip_range`	`"172.20.8.0/21"`	IP address range within the assigned subnet from which addresses are allocated for running containers.
no	`gateway`	`"172.20.0.1"`	Gateway for container traffic to exit the Docker virtual network to the external network.
Variables for managing the `docker_network_internal` network
no	`subnet`	`"172.21.0.0/20"`	IP address range assigned to the subnet.
no	`ip_range`	`"172.21.8.0/21"`	IP address range within the assigned subnet from which addresses are allocated for running containers.
no	`gateway`	`"172.21.0.1"`	Gateway for container traffic to exit the Docker virtual network to the external network.

Быстрые ссылки

Дерево страниц

General description

Installation

Installing Ansible

Obtaining files for running the playbook

Configuring access to target hosts for installation

Using login/password authentication

Using SSH key authentication

Verifying access configuration

Configuring variables in the file group_vars/all.yml

Configuring the time zone (TZ)

Other variables (optional)

Configuring Docker networks

NAICE installation

Checking service status after installation

Appendices

Appendix A. Environment variable in the .env file and Ansible playbook variables

Быстрые ссылки

Дерево страниц

v1.2_2.2 Installation using Ansible playbooks (stand-alone)

General description

Installation

Installing Ansible

Obtaining files for running the playbook

Configuring access to target hosts for installation

Using login/password authentication

Using SSH key authentication

Verifying access configuration

Configuring variables in the file group_vars/all.yml

Configuring the time zone (TZ)

Other variables (optional)

Configuring Docker networks

NAICE installation

Checking service status after installation

Appendices

Appendix A. Environment variable in the .env file and Ansible playbook variables