--- url: /on-premises/install/quickstart/config.md --- # Configuration This lists all variables you can use to configure our playbook. ## applications.yml ### DNS configuration ::: v-pre | Variables | Default value | Description | |-----------------------------|----------------------------------------|--------------------------------------------------------| | app\_dns\_domain | "domain.tld" | DNS (sub)domain use to build the app URLs. | | api\_dns\_name | "api.{{ app\_dns\_domain }}" | DNS name use for the API URL. | | connect\_dns\_name | "connect.{{ app\_dns\_domain }}" | DNS name use for the Connect URL. | | platform\_back\_dns\_name | "platform-back.{{ app\_dns\_domain }}" | DNS name use for the Platform back URL. | | platform\_front\_dns\_name | "platform.{{ app\_dns\_domain }}" | DNS name use for the Platform URL. | | iam\_dns\_name | "iam.{{ app\_dns\_domain }}" | DNS name use for the Keycloak (identity provider) URL. | | documentation\_dns\_name |"doc.{{ app\_dns\_domain }}" | DNS name use for the documentation URL. | | archive\_dns\_name |"archive.{{ app\_dns\_domain }}" | DNS name use for the archive URL. | | marketplace\_back\_dns\_name |"marketplace-back.{{ app\_dns\_domain }}" | DNS name use for the marketplace back URL. | | marketplace\_front\_dns\_name |"marketplace.{{ app\_dns\_domain }}" | DNS name use for fhe marketplace URL. | ::: For example if: ``` app_dns_domain: bimdata.company.tld api_dns_name: `"api.{{ app_dns_domain }}"` ``` The DNS name for the API will be: `api.bimdata.company.tld`. Each name needs to be defined in the corresponding authoritative DNS server. This playbook does not manage this. ### SMTP Configuration ::: v-pre | Variables | Default value | Description | |--------------------|-------------------------|----------------------------------------------------------| | smtp\_host | "" | SMTP server address. | | smtp\_port | 587 | SMTP server port. | | smtp\_user | "" | User used for the authentication on the SMTP server. | | smtp\_pass | "{{ vault\_smtp\_pass }}" | Password used for the authentication on the SMTP server. | | smtp\_use\_tls | true | If the SMTP connection should use TLS or not. | | smtp\_default\_email | "" | Email address use as default sender. | ::: ### Web configuration | Variables | Default value | Description | |---------------------|---------------|---------------------------------------------------| | external\_port\_http | 80 | TCP port for HTTP connections on the web server. | | external\_port\_https | 443 | TCP port for HTTPS connections on the web server. | | max\_upload\_size | "1g" | Maximum upload file size (ifc… etc). | ### Data storage ::: v-pre | Variables | Default value | Description | |----------------------------|----------------------------------|-------------------------------------------------------------| | bimdata\_path | "/opt/bimdata" | Where we will install our needed files on the servers. | | bimdata\_docker\_volume\_path | "{{ bimdata\_path }}/datas" | Where will your datas will be store on the servers. | | bimdata\_dockerfiles\_path | "{{ bimdata\_path }}/dockerfiles" | Where we store the dockerfiles use to start the containers. | ::: Object storage (Swift): ::: v-pre | Variables | Default value | Description | |------------------------------|----------------------------------|-----------------------------------------------------| | swift\_enabled | false | Enable the swift storage or not. | | swift\_auth\_url | "" | The URL of the auth server. | | swift\_tenant\_id | "" | The tenant/project id to use when authenticating. | | swift\_tenant\_name | "" | The tenant/project name to use when authenticating. | | swift\_username | "" | The username to use to authenticate. | | swift\_password | "{{ vault\_swift\_password }}" | The password/key to use to authenticate. | | swift\_temp\_url\_key | "{{ vault\_swift\_temp\_url\_key }}" | The temporary URL key ([see openstack documentation](https://docs.openstack.org/kilo/config-reference/content/object-storage-tempurl.html)) | | swift\_api\_container\_name | "" | The container in which to store the API files. | | swift\_connect\_container\_name | "" | The container in which to store the Connect files. | ::: ### Applications configuration ::: v-pre | Variables | Default value | Description | |--------------------------------------------|--------------------------------------------------------------------------|------------------------------------------------------------------| | api\_secret\_key | "{{ vault\_api\_secret\_key }}" | You should not change this. | |||| | connect\_secret\_key | "{{ vault\_connect\_secret\_key }}" | You should not change this. | | connect\_invitation\_secret | "{{ vault\_connect\_invitation\_secret }}" | You should not change this. | | connect\_invitation\_client\_secret | "{{ vault\_connect\_invitation\_client\_secret }}" | You should not change this. | |||| | platform\_back\_secret\_key | "{{ vault\_platform\_back\_secret\_key }}" | You should not change this. | | platform\_back\_webhook\_secret | "{{ vault\_platform\_back\_webhook\_secret }}" | You should not change this. | |||| | platform\_front\_project\_status\_limit\_new | "5" | Number of days during which the project is considered new. | | platform\_front\_project\_status\_limit\_active | "15" | Number of days during before the project is considered inactive. | |||| | iam\_user | "admin" | Keycloak administrator user. | | iam\_password | "{{ vault\_iam\_password }}" | Keycloak administrator password. | |||| | marketplace\_enabled | false | Enable / disable marketplace. | | marketplace\_back\_secret\_key | "{{ vault\_marketplace\_back\_secret\_key }}" | You should not change this. | |||| | marketplace\_front\_workers | 2 | Number of node workers. | |||| | workers\_export\_instance | 1 | Number of replicas deployed on *each* server. | | workers\_export\_cpu | 1 | Number of CPUs allocated for each replicas. | | workers\_gltf\_instance | 1 | Number of replicas deployed on *each* server. | | workers\_gltf\_cpu | 1 | Number of CPUs allocated for each replicas. | | workers\_extract\_instance | 1 | Number of replicas deployed on *each* server. | | workers\_extract\_cpu | 1 | Number of CPUs allocated for each replicas. | | workers\_extract\_quantities\_instance | 1 | Number of replicas deployed on *each* server. | | workers\_extract\_quantities\_cpu | 1 | Number of CPUs allocated for each replicas. | | workers\_svg\_instance | 1 | Number of replicas deployed on *each* server. | | workers\_svg\_cpu | 1 | Number of CPUs allocated for each replicas. | | workers\_merge\_instance | 1 | Number of replicas deployed on *each* server. | | workers\_merge\_cpu | 1 | Number of CPUs allocated for each replicas. | | workers\_xkt\_instance | 1 | Number of replicas deployed on *each* server. | | workers\_xkt\_cpu | 1 | Number of CPUs allocated for each replicas. | | workers\_preview\_instance | 1 | Number of replicas deployed on *each* server. | | workers\_preview\_cpu | 1 | Number of CPUs allocated for each replicas. | |||| | master\_token | "{{ vault\_master\_token }}" | Master token use for authentication between workers and API. | | app\_env | "staging" | Environnement definition for some app. Must not be changed. | | mapbox\_token | "{{ vault\_mapbox\_token }}" | Token for authentication on the Mapbox API. | ::: ## connectivity.yml ### Ansible connectivity | Variables | Default value | Description | |----------------------------|--------------------|-------------------------------| | ansible\_python\_interpreter | "/usr/bin/python3" | Force the use of python3. | | ansible\_ssh\_pipelining | true | Improve ansible performances. | ### SSH Bastion If you can't use SSH directly from this computer to the servers where you want to install our applications, you can use a *bastion* that will proxy the ssh connections. ::: v-pre | Variables | Default value | Description | |---------------------------|-------------------------------|------------------------------------------------| | use\_bastion | false | Configure if you want to use a bastion or not. | | bastion\_ssh\_addr | "" | Bastion adresse use for the ssh connection. | | bastion\_ssh\_port | 22 | Bastion TCP port use for the ssh connection. | | bastion\_ssh\_user | "{{ lookup('env', 'USER') }}" | SSH user for authentication on the Bastion. | | bastion\_ssh\_extra\_options | *undefined* | String to add other SSH options. | ::: ### Proxy If your servers can't access the web directly, you may need to configure a proxy to access our docker registry for example. | Variables | Default value | Description | |-------------|---------------|--------------------------------------------------------| | http\_proxy | "" | HTTP proxy address. | | https\_proxy | "" | HTTPS proxy address. | | no\_proxy | \[] | List of domains / IP where the proxy must not be used. | ## databases.yml ### External postgres cluster | Variables | Default value | Description | |------------------|---------------|----------------------------------------------------------------------------------| | use\_external\_db | false | Configure if you want to use a postgres instance manage by this playbook or not. | | external\_db\_host | "" | Postgres cluster address use for connection if use\_external\_db: true. | | external\_db\_port | 5432 | Postgres cluster TCP port use for connection if use\_external\_db: true. | ### Databases ::: v-pre | Variables | Default value | Description | |-------------------------|---------------------------------------|----------------------------------------| | db\_api\_name | "api" | Database name for the API. | | db\_api\_user | "api" | Postgres user for the API. | | db\_api\_password | "{{ vault\_db\_api\_password }}" | Postgres password for the API. | |||| | db\_connect\_name | "connect" | Database name for Connect. | | db\_connect\_user | "connect" | Postgres user for Connect. | | db\_connect\_password | "{{ vault\_db\_connect\_password }}" | Postgres password for Connect. | |||| | db\_platform\_name | "platform" | Database name for the Platform. | | db\_platform\_user | "platform" | Postgres user for the Platform. | | db\_platform\_password | "{{ vault\_db\_platform\_password }}" | Postgres password for the Platform. | |||| | db\_iam\_name | "iam" | Database name for Keycloak. | | db\_iam\_user | "iam" | Postgres user for Keycloak. | | db\_iam\_password | "{{ vault\_db\_iam\_password }}" | Postgres password for Keycloak. | |||| | db\_marketplace\_name | "marketplace" | Database name for the Marketplace. | | db\_marketplace\_user | "marketplace" | Postgres user for the Marketplace. | | db\_marketplace\_password | "{{ vault\_db\_marketplace\_password }}" | Postgres password for the Marketplace. | ::: If `use_external_db: false` AND if the \[db] server is different from the \[app] server (in the inventory) each Postgres instance will need to use its own TCP port. There are defined with these variables. You will need to configure your firewall: the \[app] server will need to be able to communication with the \[db] server on these ports. ::: v-pre | Variables | Default value | Description | |------------------------------|----------------------------------------------------------------------|------------------------------------------------------------------------------------------| | db\_api\_external\_port | 5432 | Postgres external port for the API. | | db\_connect\_external\_port | 5433 | Postgres external port for Connect. | | db\_platform\_external\_port | 5434 | Postgres external port for the Platform. | | db\_iam\_external\_port | 5435 | Postgres external port for Keycloak. | | db\_marketplace\_external\_port | 5436 | Postgres external port for Keycloak. | | db\_server\_addr | "{{ hostvars\[groups\['db']\[0]]\['ansible\_default\_ipv4']\['address'] }}" | Use to determine the IP that will be use for Postgres connection between \[app] and \[db]. | ::: ## docker\_images.yml ::: v-pre | Variables | Default value | Description | |-----------------------------------------|-------------------------------------------------------------|---------------------------------------------------------------------------| | docker\_private\_registry | "docker-registry.bimdata.io" | Define the registry address from which most of the images will come from. | | docker\_registries | | List of registries informations use to configure docker authentication. | | docker\_rabbitmq\_image | "rabbitmq" | RabbitMQ docker image (use Dockerhub by default). | | docker\_rabbitmq\_tag | "3.8-management-alpine" | RabbitMQ docker tag. | | docker\_postgres\_image | "postgres" | Postgres docker image (use Dockerhub by default). | | docker\_postgres\_tag | "10-alpine" | Postgres docker tag. | | docker\_api\_image | "{{ docker\_private\_registry }}/on-prem/api" | API docker image. | | docker\_api\_tag | latest | API docker tag. | | docker\_connect\_image | "{{ docker\_private\_registry }}/on-prem/connect" | Connect docker image. | | docker\_connect\_tag | latest | Connect docker tag. | | docker\_platform\_back\_image | "{{ docker\_private\_registry }}/on-prem/platform\_back" | Platform back docker image. | | docker\_platform\_back\_tag | latest | Platform back docker tag. | | docker\_platform\_front\_image | "{{ docker\_private\_registry }}/on-prem/platform" | Platform front docker image. | | docker\_platform\_front\_tag | latest | Platform front docker tag. | | docker\_iam\_image | "{{ docker\_private\_registry }}/on-prem/iam" | Keycloak docker image. | | docker\_iam\_tag | latest | Keycloak docker tag. | | docker\_documentation\_image | "{{ docker\_private\_registry }}/on-prem/documentation" | Documentation docker image. | | docker\_documentation\_tag | latest | Documentation docker tag. | | docker\_archive\_image | "{{ docker\_private\_registry }}/on-prem/archive" | Archive docker image. | | docker\_archive\_tag | latest | Archive docker tag. | | docker\_marketplace\_back\_image | "{{ docker\_private\_registry }}/on-premise/marketplace\_back" | Marketplace back images. | | docker\_marketplace\_back\_tag | latest | Marketplace back docker tag. | | docker\_marketplace\_front\_image | "{{ docker\_private\_registry }}/on-premise/marketplace" | Marketplace front docker image. | | docker\_marketplace\_front\_tag | latest | Marketplace front docker tag. | | docker\_workers\_export\_image | "{{ docker\_private\_registry }}/on-prem/workers" | Worker export docker image. | | docker\_workers\_export\_tag | latest | Worker export docker tag. | | docker\_workers\_gltf\_image | "{{ docker\_private\_registry }}/on-prem/workers" | Worker GLTF docker image. | | docker\_workers\_gltf\_tag | latest | Worker GLTF docker tag. | | docker\_workers\_extract\_image | "{{ docker\_private\_registry }}/on-prem/workers" | Worker extract docker image. | | docker\_workers\_extract\_tag | latest | Worker extract docker tag. | | docker\_workers\_extract\_quantities\_image | "{{ docker\_private\_registry }}/on-prem/workers" | Worker extract quantities docker image. | | docker\_workers\_extract\_quantities\_tag | latest | Worker extract quantities docker tag. | | docker\_workers\_svg\_image | "{{ docker\_private\_registry }}/on-prem/workers" | Worker SVG docker image. | | docker\_workers\_svg\_tag | latest | Worker SVG docker tag. | | docker\_workers\_merge\_image | "{{ docker\_private\_registry }}/on-prem/workers" | Worker merge docker image. | | docker\_workers\_merge\_tag | latest | Worker merge docker tag. | | docker\_workers\_xkt\_image | "{{ docker\_private\_registry }}/on-prem/xkt\_worker" | Worker XKT docker image. | | docker\_workers\_xkt\_tag | latest | Worker XKT docker tag. | | docker\_workers\_preview\_image | "{{ docker\_private\_registry }}/on-prem/viewer\_360" | Worker preview docker image. | | docker\_workers\_preview\_tag | latest | Worker preview docker tag. | ::: ## docker.yml ::: v-pre | Variables | Default value | Description | |----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------| | install\_docker | true | Install Docker or not (if not, docker need to be already installed). | | docker\_apt\_dependencies | \["python3-docker", "gnupg", "apt-transport-https", "ca-certificates"] | List of APT packages to install before Docker. | | docker\_apt\_release\_channel | "stable" | Docker version that will be installed. | | docker\_repo\_base\_url | "https://download.docker.com/linux" | Docker APT repository. | | docker\_apt\_key\_url | "{{ docker\_repo\_base\_url }}/{{ ansible\_distribution | lower }}/gpg" | URL of APT GPG key needed for Docker installation. | | docker\_apt\_repo\_url | "{{ docker\_repo\_base\_url }}/{{ ansible\_distribution | lower }}" | URL of APT repository for Docker installation. | |||| | docker\_edition | ce | Docker edition that will be installed ('ee' for 'Enterprise Edition' or 'ce' for 'Community Edition') | | docker\_pkg\_name | "docker-{{ docker\_edition }}" | Docker APT package name that will be installed. | | docker\_pkg\_version | "" | Docker APT package version that will be installed. | | docker\_pkg\_version\_hold | "{{ docker\_pkg\_version | default(false) | ternary(true, false) }}" | Should APT be configure to hold the Docker version (false by default, true if docker\_pkg\_version is defined) | |||| | docker\_svc\_name | "docker" | Docker service name. | | docker\_install\_compose | true | Install Docker compose or not (if noot, need to be already installed.) | | docker\_compose\_version | "1.29.2" | Docker compose version to install. | | docker\_compose\_url | "https://github.com/docker/compose/releases/download/{{ docker\_compose\_version }}/docker-compose-{{ ansible\_system }}-{{ ansible\_architecture }}" | URL to download docker compose. | | docker\_compose\_path | "/usr/local/bin/docker-compose" | Path of where Docker compose will be installed. | |||| | docker\_use\_extra\_hosts | false | Add /etc/hosts value in containers if needed. | | docker\_extra\_hosts | \[] | list of hosts that will be added to /etc/hosts of containers. | ::: ## nginx.yml You should not have to modify these variables in most cases. | Variables | Default value | Description | |----------------------|---------------|-----------------------------| | nginx\_custom\_conf | | Nginx custom configuration. | | nginx\_vhost\_override | | Nginx vhost configuration. | ## rabbitmq.yml ::: v-pre | Variables | Default value | Description | |-------------------------|---------------------------------|------------------------------------------------------------| | use\_external\_rabbitmq | false | Set to true if you want to use your own RabbitMQ instance. | | external\_rabbitmq\_host | "" | RabbitMQ cluster address if use\_external\_rabbitmq: true. | | external\_rabbitmq\_port | 5672 | RabbitMQ cluster TCP port if use\_external\_rabbitmq: true. | | rabbitmq\_user | "bimdata" | RabbitMQ user use for authentication. | | rabbitmq\_password | "{{ vault\_rabbitmq\_password }}" | RabbitMQ password use for authentication. | | rabbitmq\_admin\_dns\_name | "rabbitmq.{{ app\_dns\_domain }}" | RabbitMQ dns name. | | rabbitmq\_external\_port | 5672 | RabbitMQ external port. | | rabbitmq\_server\_addr | "{{ rabbitmq\_admin\_dns\_name }}" | RabbitMQ server address. | ::: ## tls.yml ::: v-pre | Variables | Default value | Description | |----------------------------|-----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------| | tls\_enabled | false | Enable external TLS or not. | | nginx\_use\_pregen\_dh | true | Use pre-defined diffie hellman parameters. If false it'll generate new one. This take a lot of time. | | tls\_ca\_certificate | "" | CA certificate of the CA used to sign the certificates for the applications. (PEM format.) | | tls\_subca\_certificates | \[] | If a complexe CA architecture is used, tls\_ca\_certificate should contain the main CA, and this list all the intermediate ones. | | tls\_api\_key | "{{ vault\_tls\_api\_key }}" | API TLS key (PEM format). | | tls\_api\_cert | "" | API TLS Certificate (PEM format). | | tls\_connect\_key | "{{ vault\_tls\_connect\_key }}" | Connect TLS key (PEM format). | | tls\_connect\_cert | "" | Connect TLS Certificate (PEM format). | | tls\_platform\_back\_key | "{{ vault\_tls\_platform\_back\_key }}" | Platform back TLS key (PEM format). | | tls\_platform\_back\_cert | "" | Platform back TLS Certificate (PEM format). | | tls\_platform\_front\_key | "{{ vault\_tls\_platform\_front\_key }}" | Platform front TLS key (PEM format). | | tls\_platform\_front\_cert | "" | Platform front TLS Certificate (PEM format). | | tls\_iam\_key | "{{ vault\_tls\_iam\_key }}" | Keycloak TLS key (PEM format). | | tls\_iam\_cert | "" | Keycloak TLS Certificate (PEM format). | | tls\_rabbitmq\_admin\_key | "{{ vault\_tls\_rabbitmq\_admin\_key }}" | RabbitMQ TLS key (PEM format). (Only needed if use\_external\_rabbitmq: false.) | | tls\_rabbitmq\_admin\_cert | "" | RabbitMQ TLS Certificate (PEM format). (Only needed if use\_external\_rabbitmq: false.) | | tls\_documentation\_key | "{{ vault\_tls\_documentation\_key }}" | Documentation TLS key (PEM format). | | tls\_documentation\_cert | "" | Documentation TLS Certificate (PEM format). | | tls\_archive\_key | "{{ vault\_tls\_archive\_key }}" | Archive TLS key (PEM format). | | tls\_archive\_cert | "" | Archive TLS Certificate (PEM format). | | tls\_marketplace\_back\_key | "{{ vault\_tls\_marketplace\_back\_key }}" | Marketplace back TLS key (PEM format). | | tls\_marketplace\_back\_cert | "" | Marketplace back TLS Certificate (PEM format). | | tls\_marketplace\_front\_key | "{{ vault\_tls\_marketplace\_front\_key }}" | Marketplace front TLS key (PEM format). | | tls\_marketplace\_front\_cert | "" | Marketplace front TLS Certificate (PEM format). | ::: ## vault.yml In this file, all private pieces of information are defined. Like passwords, TLS keys, or other security stuff. You should replace all the values and encrypt the file with [`ansible-vault`](https://docs.ansible.com/ansible/latest/user_guide/vault.html).