Editing Tornedo.tetrain.com Runbook (section)

== Phase 2 — Build the intermediate bridge replica (<code><nowiki>ipa8.tetrain.com</nowiki></code>, Rocky Linux 8.10) ==

Needed because a direct IPA-4.6-to-IPA-4.13 replica failed at CA-cloning with <code><nowiki>403 Forbidden</nowiki></code> — too many major versions apart. This bridge server is temporary — built, used once to carry data forward, then decommissioned (Phase 4).

=== 2.1 Base OS + firewall ===

<pre>
<nowiki>
# this box has firewalld active (the eventual final-target box, ipa.tetrain.com, does not —
# check per-box, don't assume)
firewall-cmd --permanent --add-service=freeipa-ldap
firewall-cmd --permanent --add-service=freeipa-ldaps
firewall-cmd --permanent --add-service=dns
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-service=kerberos
firewall-cmd --permanent --add-port=464/tcp --add-port=464/udp
firewall-cmd --permanent --add-port=8080/tcp --add-port=8443/tcp
firewall-cmd --reload
</nowiki>
</pre>

=== 2.2 Fix <code><nowiki>/etc/hosts</nowiki></code> before attempting install ===

Cloud-init's default template mapped this box's own hostname to '''both''' <code><nowiki>127.0.0.1</nowiki></code> and <code><nowiki>::1</nowiki></code> — IPA's installer explicitly refuses a hostname that resolves to loopback.

<pre>
<nowiki>
# edit /etc/hosts: remove the loopback mapping for this box's own hostname, add a real line:
#   <real-ip>  ipa8.tetrain.com  ipa8

# stop cloud-init from reverting it on next boot:
echo 'manage_etc_hosts: false' >> /etc/cloud/cloud.cfg
</nowiki>
</pre>

Also add an entry for the '''old''' server here too — it has the same AWS-default-PTR reverse-DNS mismatch as Phase 0.1, and this box needs to resolve it correctly to talk to it:

<pre>
<nowiki>
echo '<tornedo-real-ip>  tornedo.tetrain.com' >> /etc/hosts
</nowiki>
</pre>

=== 2.3 Install IPA (EL8 packages it via a DNF module, not a plain package) ===

<pre>
<nowiki>
dnf module enable idm:DL1 -y
dnf install -y @idm:DL1/server @idm:DL1/dns   # dns component per your actual topology needs
</nowiki>
</pre>

=== 2.4 Run the replica install ===

Needs real <code><nowiki>admin</nowiki></code> Kerberos credentials for <code><nowiki>check_creds</nowiki></code>, not just the host keytab — '''run <code><nowiki>kinit</nowiki></code> and the install command together in one session that never leaves your hands''' (this migration's rule throughout: admin/Directory Manager passwords are never typed into or passed through the assisting session):

<pre>
<nowiki>
kinit admin
ipa-replica-install --setup-ca --unattended
</nowiki>
</pre>

If a prior attempt failed and needs retrying:

<pre>
<nowiki>
ipa-server-install --uninstall -U
# this also wipes client enrollment — get a fresh OTP before retrying:
#   on the SOURCE server: ipa host-disable ipa8.tetrain.com ; ipa host-mod --random ipa8.tetrain.com
</nowiki>
</pre>

Two non-fatal warnings are expected and fine (<code><nowiki>acmeIPAServerCert</nowiki></code> profile import failure, <code><nowiki>dnaHostname</nowiki></code> lookup timeout — both known transient issues during replica install). Immediately after a successful install, run:

<pre>
<nowiki>
ipa-server-upgrade
</nowiki>
</pre>

(re-migrates certificate profiles, clears the two warnings above).

=== 2.5 Validate before moving on ===

<pre>
<nowiki>
ipactl status                              # all 7 services RUNNING
getcert list                               # all certs MONITORING, no errors
ldapsearch -Y EXTERNAL -H ldapi:/// -b "" -s base   # LDAPI search succeeds
kinit -kt /etc/krb5.keytab host/ipa8.tetrain.com    # ticket issuance works
</nowiki>
</pre>

----