Editing Tornedo.tetrain.com Runbook (section)

=== 2.4 Run the replica install ===

Needs real <code><nowiki>admin</nowiki></code> Kerberos credentials for <code><nowiki>check_creds</nowiki></code>, not just the host keytab — '''run <code><nowiki>kinit</nowiki></code> and the install command together in one session that never leaves your hands''' (this migration's rule throughout: admin/Directory Manager passwords are never typed into or passed through the assisting session):

<pre>
<nowiki>
kinit admin
ipa-replica-install --setup-ca --unattended
</nowiki>
</pre>

If a prior attempt failed and needs retrying:

<pre>
<nowiki>
ipa-server-install --uninstall -U
# this also wipes client enrollment — get a fresh OTP before retrying:
#   on the SOURCE server: ipa host-disable ipa8.tetrain.com ; ipa host-mod --random ipa8.tetrain.com
</nowiki>
</pre>

Two non-fatal warnings are expected and fine (<code><nowiki>acmeIPAServerCert</nowiki></code> profile import failure, <code><nowiki>dnaHostname</nowiki></code> lookup timeout — both known transient issues during replica install). Immediately after a successful install, run:

<pre>
<nowiki>
ipa-server-upgrade
</nowiki>
</pre>

(re-migrates certificate profiles, clears the two warnings above).