Editing Tornedo.tetrain.com Runbook (section)

== Phase 3 — Build the final target (<code><nowiki>ipa.tetrain.com</nowiki></code>, AlmaLinux 9) from the bridge ==

Confirmed live 2026-07-25: this box is AlmaLinux 9.7, <code><nowiki>ipa-server-4.13.1-3.el9_8.2</nowiki></code>, <code><nowiki>389-ds-base-2.8.0-8.el9_8</nowiki></code>, <code><nowiki>krb5-server-1.21.1-10.el9_8</nowiki></code>.

Networking between <code><nowiki>ipa8</nowiki></code> and this box was already fully open both directions on ports 389/636/88/464/80/443/8080/8443 — check this per-pair, don't assume it's always already open.

=== 3.1 Same <code><nowiki>/etc/hosts</nowiki></code> loopback fix as Phase 2.2 ===

Same class of bug, same fix, on this box too.

=== 3.2 Critical: add swap before attempting <code><nowiki>--setup-ca</nowiki></code> ===

This box has 1.6G RAM and (originally) zero swap. The CA database init step spawns a JVM (<code><nowiki>ca-db-init</nowiki></code>) that OOMs *silently* — no debug log, no catalina output, exit code 255, no kernel OOM-killer entry (the JVM fails to reserve heap before its own logging initializes). '''Add swap before attempting the CA setup, not after failing once''':

<pre>
<nowiki>
fallocate -l 4G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile swap swap defaults 0 0' >> /etc/fstab
free -h   # confirm swap is present
</nowiki>
</pre>

(Confirmed live 2026-07-25: this exact <code><nowiki>/swapfile</nowiki></code> + <code><nowiki>/etc/fstab</nowiki></code> entry is still in place and in active use — 295MB in use at time of check.)

=== 3.3 Run the replica install ===

<pre>
<nowiki>
kinit admin   # client-run, same rule as Phase 2.4
ipa-replica-install --setup-ca --skip-mem-check --unattended
</nowiki>
</pre>

<code><nowiki>--skip-mem-check</nowiki></code> is required here specifically because of the low-RAM box above — without it the installer refuses to proceed even with swap present.

If retrying after a failed attempt, clean up in this order (all recurring issues on this hop):

<pre>
<nowiki>
# 1. stale topology/master entry left by any attempt that got past "adding master entry"
#    before failing later — host-disable/host-mod CANNOT touch a master entry, must force-delete:
ipa server-del ipa.tetrain.com --force

# 2. kill orphaned processes from a failed uninstall (ipa-server-install --uninstall often
#    reports success without actually stopping these) — prefer stop+pkill over `disable` for
#    ad-hoc cleanup, since `disable` can remove the systemd .wants/ symlink directory as a side
#    effect and break the NEXT install attempt's symlink creation:
systemctl stop pki-tomcatd@pki-tomcat.service
pkill -9 ns-slapd
pkill -9 -f pki-tomcatd
ps aux | grep -E 'ns-slapd|pki-tomcatd'   # confirm actually gone before retrying
mkdir -p /etc/systemd/system/pki-tomcatd.target.wants/   # recreate if a `disable` removed it

ipa-server-install --uninstall -U
</nowiki>
</pre>

Immediately after a successful install:

<pre>
<nowiki>
ipa-server-upgrade
</nowiki>
</pre>

=== 3.4 Validate ===

<pre>
<nowiki>
ipactl status
kinit -kt /etc/krb5.keytab host/ipa.tetrain.com   # issues a valid krbtgt/TORNEDO.TETRAIN.COM ticket
ipa user-show admin                                # full LDAP+API roundtrip
curl -sI https://ipa.tetrain.com/ipa/ui/            # expect HTTP/1.1 200
free -h                                             # confirm swap actually got used during install
</nowiki>
</pre>

Also worth checking from a real existing production client (not the box itself) — proves actual external reachability without touching that client's persistent config:

<pre>
<nowiki>
# from any already-enrolled client:
nc -zv ipa.tetrain.com 389 636 88 464 80 443
ldapsearch -x -H ldap://ipa.tetrain.com -b '' -s base namingcontexts
# expect: dc=tornedo,dc=tetrain,dc=com  and  o=ipaca
</nowiki>
</pre>

----