Configuration
customer.env, variable by variable. Model A's .env and Model B's customer.env share one variable set; only the connection method and a few container settings differ.
One file is filled in before install: deploy/customer.env for Model B (copied from customer.env.example), or the appliance .env for Model A (copied from appliance.env.example). render-inventory.sh renders it into an ansible inventory and names any missing required field.
The file holds clear-text passwords. chmod 600, keep it on the control node after install, never send it back, commit it or hand it to the customer.
Connection
| Variable | Meaning | Model A | Model B |
|---|---|---|---|
ANSIBLE_CONNECTION | How the installer reaches the target | local | ssh, or local for all-in-one |
IPA_HOST_ALIAS | Target label in the inventory | Anything; ignored with local | Target FQDN |
Identity
Changed for every customer. Fixed after install.
| Variable | Meaning | Constraint | Example |
|---|---|---|---|
IPA_HOSTNAME | IPA server FQDN | Equals hostname -f, resolves both ways, not loopback | idm.corp.example |
IPA_REALM | Kerberos realm | Upper case, normally the domain in upper case | CORP.EXAMPLE |
IPA_DOMAIN | IPA domain | Lower case | corp.example |
IPA_NETBIOS | NetBIOS name for AD trust | Upper case, at most 15 characters, different from the AD domain's | CORP |
Passwords
| Variable | Used for |
|---|---|
IPA_ADMIN_PASSWORD | The admin account: console login, kinit admin, day-to-day administration |
IPA_DM_PASSWORD | Directory Manager: backup and restore, replication topology maintenance, cn=config operations. Not replicated; each IPA server has its own |
Use two different strong passwords. Store them in a password manager after install; they belong on the handover checklist. A lost Directory Manager password can be reset locally as root over LDAPI (dsconf slapd-<REALM> config replace nsslapd-rootpw=...) without downtime, once per IPA server.
POSIX ID ranges
Defaults suit small and medium sites. AD users get uids and gids outside this range: the trust creates a separate <AD domain>_id_range mapped from SIDs, nothing to configure.
| Variable | Default | Meaning |
|---|---|---|
IPA_IDSTART | 60000 | First local user / group id |
IPA_IDMAX | 62000 | Upper bound. 2000 local accounts; raise it before install, or later with ipa idrange-mod |
IPA_RID_BASE | 63000 | RID base for adtrust |
IPA_SECONDARY_RID_BASE | 70000 | Secondary RID base |
DNS
| Variable | Default | Meaning |
|---|---|---|
IPA_SETUP_DNS | true | Built-in DNS maintaining A / PTR / SRV. With false, add records to the customer DNS by hand; the other DNS variables are ignored |
IPA_AUTO_FORWARDERS | true | Take upstream forwarders from the target's /etc/resolv.conf. Set false in production and use IPA_FORWARDERS |
IPA_FORWARDERS | empty | Upstream DNS; quote and space-separate several. The installer contacts each one and fails if unreachable |
IPA_FORWARD_POLICY | first | first: ask forwarders, recurse on failure; only: forwarders only |
IPA_NO_DNSSEC | true | Disable DNSSEC validation. Most internal upstreams do not sign; leaving it on floods the log with warnings |
IPA_AUTO_REVERSE | true | Create the reverse zone automatically |
The three layouts and their settings: quick start.
AD trust
| Variable | Default | Meaning |
|---|---|---|
IPA_SETUP_ADTRUST | true | Install adtrust (smb, winbind), a prerequisite for any trust. The trust itself is created afterwards with ipa trust-add; see AD trust prerequisites |
Leaving it true without AD costs two extra services and changes nothing else.
Host, firewall, time
| Variable | Model A | Model B | Meaning |
|---|---|---|---|
IPA_SETUP_FIREWALLD | false | true | No firewalld inside a container; on bare metal let the installer open the IPA ports |
IPA_NO_NTP | true | false | Containers do not run NTP; on bare metal IPA installs chrony and manages time |
IPA_NO_HOST_DNS | true | as needed | Skip the pre-install host DNS check. Keep false on bare metal so it checks for you |
Model B only
Used only with ANSIBLE_CONNECTION=ssh. The console and licence layer are pushed from the control node; paths point into the bundle.
| Variable | Meaning |
|---|---|
SSH_USER | Login user on the target, NOPASSWD sudo required |
SSH_HOST | Target IP or hostname |
SSH_PRIVATE_KEY | Private key path. Empty means ssh-agent or password |
SSH_COMMON_ARGS | Extra ssh options such as -o StrictHostKeyChecking=no; quote if it contains spaces |
IDM_LIC_SRC | Licence layer source on the control node, <bundle>/license |
IDM_LIC_REMOTE_SRC | false. true is the Model A container-mount semantics |
IDM_WEBUI_DIST_SRC | Console source on the control node, <bundle>/dist |
IDM_WEBUI_DIST_DST | Console directory on the target, default /opt/idmatrix/dist |
For all-in-one leave every SSH_* empty and set IDM_*_SRC to the local unpack path.
Model A only
The appliance .env has a few extra entries driving the compose network:
| Variable | Default | Meaning |
|---|---|---|
IDM_IP | 192.168.58.100 | Container IP on the bridge; must match what IPA_HOSTNAME resolves to |
IDM_SUBNET | 192.168.58.0/24 | Bridge subnet |
IDM_HTTPS_PORT | 8443 | Host port mapped to container 443 |
The container's /etc/machine-id must persist (compose already binds it); otherwise every recreate changes the fingerprint and invalidates the licence.
Deploy (Model B)
What the playbook does on the target, where things land, how to verify, how to clean up a failed run, and the handover checklist.
AD trust prerequisites and setup
Five things to check before creating a one-way "AD users log in to Linux" trust, the commands, and how to verify lookups. Any one missing makes trust-add fail or user resolution silent.