Requirements

Audience: Technical administration

Overview

This chapter lists everything that must be in place before the installation: a Docker host, free ports, a network connection to the opsi configserver and a technical opsi user. Check the items in order before you start the Installation .

Host

oPBWeb runs on any Linux host with Docker. You can run the stack directly on the opsi configserver or on a separate host that reaches the configserver via HTTPS.

• Operating system: Linux with a current Docker Engine.
• Docker Compose: the Compose plugin (version 2, invoked as docker compose). The old standalone docker-compose (version 1) is not sufficient, because the Compose file uses features such as file secrets and service_completed_successfully.
• Bash and OpenSSL: The scripts setup-opbweb.sh, start.sh, stop.sh and scripts/init-secrets.sh are Bash scripts; the secrets are generated with openssl.
• Git: to get the sources.
• Disk space: The object storage grows with the package files. Plan enough space for the Docker volumes (database, object storage). There are no fixed minimum values for CPU, memory or disk space; the containers run without resource limits.

Ports

The stack exposes only the frontend container to the outside. All other services communicate on internal Docker networks.

The interface is served via HTTPS only; the HTTP port redirects there. If a web server is already running on the host (for example on the configserver), choose different ports.

Network to the opsi configserver

The worker container talks directly to opsiconfd on the configserver:

• HTTPS on port 4447 for JSON-RPC.
• WebDAV over the same port for the shares /repository, /workbench and /depot.

The connection originates from the worker via the Docker network opsi-net. Firewalls between the Docker host and the configserver must allow port 4447.

opsi-side requirements

oPBWeb is designed for opsi 4.3. On the configserver you need:

• A technical user with opsi admin rights: The worker signs in with this user (default in the interface: opsiadm). Without admin rights, the connection test fails with “… has no opsi admin rights”; in addition, /repository and /workbench require admin rights.
• admin-networks in opsiconfd: If this setting is set, it must include the worker’s Docker network. Otherwise opsiconfd rejects the admin calls with HTTP 403. After the first start, determine the subnet with docker network inspect opbweb_opsi-net (entry Subnet).
• FQDN of the configserver: Later, enter the configserver with its fully qualified host name, not with its IP address. The opsiconfd server certificate is issued for the name; with an IP address the TLS check fails. The name must be resolvable from the worker container.

Certificates

• TLS certificate for the web interface (recommended): For HTTPS you need a certificate with the full chain (fullchain.pem) and the matching private key (key.pem) for the host name under which users open oPBWeb. Put both files next to setup-opbweb.sh before the setup. Without your own certificate the setup creates a self-signed one; the browser then shows a warning.
• CA of the opsi server: It is fetched directly from the configserver during the initial setup. Have shell access to the configserver ready to compare the fingerprint.
• LDAPS CA (optional): For LDAP sign-in with your own CA, place the CA file as ldap-ca.pem next to the script or in certs/ldap/, see LDAP Sign-in .

Images and internet access

You can provide the oPBWeb images (backend, frontend, garage-init) in two ways:

• Build them locally with ./start.sh --build. For this the host needs access to:
  • Docker Hub for the base images (Python, Node.js, nginx, Alpine),
  • GitHub for python-opsi and the Hugo modules of the manual,
  • PyPI for the Python packages,
  • npm registry for the frontend dependencies,
  • the Go module proxy proxy.golang.org for the manual theme.
• Pull them prebuilt from a registry, for example from the registry of the project’s GitLab CI or an internal mirror. The host then only needs access to this registry; an account (docker login) is only needed if it requires a sign-in. The project’s registry is public. Only the machine on which the images are built needs internet access for building.

In both cases the third-party images for MariaDB, Redis and Garage come from Docker Hub unless you use a mirror. You choose the way during the Installation with setup-opbweb.sh.

During operation the stack does not need internet access.

Versions

This manual describes the following versions:

Technical basis:

You can see the installed frontend and backend versions at any time in the status bar at the bottom of the interface.