Ronald Wimmer via FreeIPA-users wrote:
On 19.10.18 14:15, Rob Crittenden via FreeIPA-users wrote:
> Ronald Wimmer via FreeIPA-users wrote:
>> Hi,
>>
>> we have been evaluating FreeIPA for quite a while now on our test setup
>> (1 IPA server, 1 Replica) and are planning to move towards production.
>> Can the whole setup be migrated from an ipa test to an ipa production
>> server? (the ipa 'linux.ourdomain.at' domain should stay the same) Or
>> would it be easier to use both test servers for production (and just
>> adding additional replicas)?
>
> There is no real migration mechanism between environments like you're
> looking for (e.g. test -> integration -> production).
>
> IMHO you are best off putting these systems into production and perhaps
> adding additional masters.
How do I add new production servers? Simply issue the
"ipa-replica-install" on the new systems? (The documentation states:
"Replicas are created as clones of the initial master servers. Once a
replica is created, it is functionally identical to the master server")
See the docs for instructions on creating a replica.
Yes, masters are all more or less equal, the difference being whether
they run optional services and there are a few roles that only one
master has (CRL manager, renewal manager).
What about AD trust? Does it have to be set up for each of the new
servers?
https://www.freeipa.org/page/Active_Directory_trust_setup does
say so: "When planning access of AD users to IPA clients, make sure to
run ipa-adtrust-install on every IPA master these IPA clients will be
connecting to."
Then I guess it does.
Does it make sense to install CA services on each of the servers?
Probably not, you just want > 1, ideally in separate locations in case
of catastrophic failure. There is no reason you can't run a CA on all
masters it just slightly increases replication traffic, adds some
additional RAM and disk requirements and is another service to administer.
rob