Important

For the production environment, a separate X-Road Security Server must be deployed on separate infrastructure (physical or virtual), with its own IP address and DNS name, different from those of the test environment.

Please do not use the test environment's Security Server, or its IP address or DNS name, for production. The Security Servers of the test and production environments, and their corresponding network identifiers, must be kept separate.

Alongside the transition to the production environment, the test infrastructure must be maintained and continue to operate for testing purposes.

Virtual Machine deployment using Ansible

Video Guide

A video walkthrough covering the steps in this guide is available at the bottom of this page.

To deploy the Security Server using Ansible, first clone the X-Road Git repository, checkout to 7.8.2 tag and go to the ansible folder 

cd path/to/working/directory

git clone https://github.com/nordic-institute/X-Road.git
git checkout 7.8.2

cd ./ansible

In that folder, we need to create the following hosts file:

../ansible/hosts/hosts.txt 

[ss_servers]
${VM-IP-ADDRESS} ansible_ssh_user=${VM-USER}

[example:children]
ss_servers

[ss_servers:vars]
variant=vanilla

Where:

  • VM-IP-ADDRESS - the virtual machine’s IP address and SSH port if it’s not the default.
  • VM-USER - the user on the virtual machine with sudo access, or root.

Production instance only

Before running the playbook, edit the following file to point to the ADEL production repository:

../ansible/vars_files/remote_repo.yml

xroad_repo_baseurl: "https://registry.del.am/repository"
xroad_repo_key: "https://registry.del.am/repository/am-keys/am-xroad-archive-keyring.asc"

This is only required for production deployments. For the test instance, the default repository settings should be left as-is.

X-Road distributions support a setup where the database is installed on the same machine as the server, which we do not recommend, even for testing environments. Instead, specify a remote database instance in the Security Server variable file. Here is an example configuration:

Please make sure that PostgreSQL listens on the interface connected to the network (the default is localhost), and that pg_hba.conf is configured to accept requests from your network for all users.

../ansible/vars_files/ss_database.yaml 

database_host: "127.0.0.1:5432"
database_admin_password: "superuser-password" ## password of postgres user

The database_admin_password should always be the password of the postgres user. The superuser is only used when setting up the database for the server and is not used by the server afterward.

After that, enable operational monitoring if it’s not already enabled:

../ansible/vars_files/base.yaml 

xroad_install_opmonitoring: true

Lastly, deploy the Security Server using the following command:

ansible-playbook -i hosts/hosts.txt xroad_init.yml

Once deployed, follow the instructions in the X-Road Security Server Configuration Guide to continue the installation.

Video Guide

Below is a video walkthrough covering the steps described in this guide for a test environment.