tiCrypt 2.17.9

Pre-Installation Checklist

TL;DR

• Complete every item here before running the installer
• The network section needs your network team, so start it early
• Request the RPM token and the counter-signing from Tera Insights now; neither is instant
• When everything is checked, continue to the Backend Installation Guide

Most failed installations are not installer problems. They are a missing DNS record, a VLAN that was never trunked, or a certificate that does not cover all four subdomains. Each of those surfaces partway through the Ansible run, after the installer has already changed the system. Checking beforehand costs far less than unwinding afterward.

Work through every item below. The network preparation involves other people and lead times, so it is the one to raise first.

Hardware

Minimum Requirements

Single server with 32+ CPU cores (virtualization extensions enabled in BIOS)

128 GB+ RAM

1 TB+ disk space

A distributed file system reachable by every host, once you run more than one. VM images, drives, and shared storage live on it. A single-node deployment can use local storageOptional

If you intend to run Slurm: one or more dedicated Slurm hosts, separate from the backendOptional

note

These are minimum specifications for a combined backend and VM host node, suitable for a demo or a small production deployment. Larger deployments need more. See the Infrastructure Guide for architecture-specific sizing.

Slurm needs dedicated hosts

A single combined machine is enough for a demo, but not for running real work through Slurm.

Slurm splits across two roles. The controller runs on the backend, and jobs execute on the Slurm hosts declared in the [slurm_hosts] group. The installer will configure a single-machine Slurm, in which the backend is both controller and its own compute node, but that arrangement is for demonstration only and is not supported for production batch processing.

Size the Slurm hosts for the jobs you expect to run, not against the backend minimums above. If Slurm is out of scope for now, omit [slurm_hosts] during installation and add the hosts later.

Operating System

Supported distributions

RHEL, Rocky Linux, or AlmaLinux 8, 9, or 10 (or a compatible RPM-based distribution)

Access to RPM package repositories (internet or local mirror)

Python 3 installed on all target nodes

Ansible installed on the control node

yq installed on the control node (required by ticrypt-setup.sh --setup)

Key-based SSH access from the control node to every target node, with passwordless sudo

Keep every node on the same major version

The installer derives the tiCrypt package repository from each host's major version (el8, el9, el10), so one package set works across all three. Mixing major versions within a deployment is not supported.

Network

VLANs and ports

tiCrypt uses an Open vSwitch network architecture with three virtual networks: secure, service, and data-in. VLAN 1081 backs br-secure for VM-to-VM traffic, VLAN 1082 backs br-service for VM-to-backend traffic, and VLAN 1083 backs br-datain for SFTP ingress. The trunk switch carries them over a bonded interface such as bond0. Coordinate the following with your network team before installation.

VLANs

Three VLAN IDs reserved for tiCrypt private networks (e.g., 1081 secure, 1082 service, 1083 data-in). These VLANs must not be forwarded outside the switches connecting the tiCrypt nodes.

Physical switch ports connecting the backend and all VM hosts configured as trunk ports carrying the assigned VLANs

A bonded or dedicated physical interface (e.g., bond0) available on the backend and every VM host for VLAN traffic

Three private, non-overlapping IP ranges assigned (one per network, must not overlap with the host or backend management networks)

Ports

Port 443 open on all tiCrypt servers (TLS/HTTPS)

Ports 6000-6100 open on ticrypt.* (VM connection tunnels)

Port 2022 open on the SFTP host, if your deployment exposes SFTP ingress on that port rather than behind NGINX on 443Optional

Port 22 open for management access (SSH)

If you are not using an external firewall, the installer configures firewalld on the backend, which blocks all other inbound traffic. This is set by network.firewall, which also accepts iptables and none.

Reserve the secure network range now

The secure network must be a private range of at least /17. Every secure VM and Slurm node takes an address on it, and it must not overlap your host or backend management networks. This is set as network.secure in ticrypt.yml during installation, but the range itself has to be reserved now.

DNS

Required A records

A record for ticrypt.example.com (main backend and web interface)

A record for the tiCrypt Audit interface. The shipped configuration expects tiaudit.; whatever label you choose must match tiaudit.hostname in ticrypt.yml

A record for sftp.example.com (SFTP data ingress)

A record for mailbox.example.com (URL-based data ingress)

Replace example.com with your domain. All four resolve to the backend unless you run the SFTP or mailbox ingress on separate hosts.

TLS Certificates

Certificate coverage

TLS certificate obtained covering all four subdomains (SAN or wildcard)

Certificate and private key files present on the server

Consider separate certificates in production

Rather than sharing one wildcard or SAN certificate across all four subdomains, issue a separate certificate for the main backend (ticrypt.example.com). The sftp and mailbox services are exposed to external parties, which makes their certificates a higher compromise risk. Isolating the backend onto its own certificate means a compromised ingress certificate cannot be used to impersonate it.

What You Need From Tera Insights

You will also need two things from Tera Insights, and neither is instant:

• An RPM token for the package repository, which you set as global.rpmToken. Without it the installer cannot fetch anything.
• Counter-signing of config.toml and deployment.json, which --setup generates from your configuration. The frontend will not accept them unsigned, and the install stops partway through waiting for them, so request the token now and plan for the round trip.

When every box above is checked, continue to the Backend Installation Guide.