3. Installing Ansible Tower¶

Tower can be installed in various ways by choosing the best mode for your environment and making any necessary modifications to the inventory file. For OpenShift-based deployments, refer to OpenShift Deployment and Configuration.

3.1. Tower Installation Scenarios¶

Tower can be installed using one of the following scenarios:

Single Machine:

As an integrated installation:
- This is a single machine install of Tower - the web frontend, REST API backend, and database are all on a single machine. This is the standard installation of Tower. It also installs PostgreSQL from your OS vendor repository, and configures the Tower service to use that as its database.
With an external database (2 options available):
- Tower with remote DB configuration: This installs the Tower server on a single machine and configures it to talk to a remote instance of PostgreSQL 10 as its database. This remote PostgreSQL can be a server you manage, or can be provided by a cloud service such as Amazon RDS.
- Tower with a playbook install of a remote PostgreSQL system: This installs the Tower server on a single machine and installs a remote PostgreSQL database via the playbook installer (managed by Tower).

Note

1). Tower will not configure replication or failover for the database that it uses, although Tower should work with any replication that you have. 2). The database server should be on the same network or in the same datacenter as the Tower server for performance reasons.

Settings available for a traditional Tower install:

pg_sslmode controls the SSL functions of the PostgreSQL client, i.e., how the Tower server connects to the database. It defaults to prefer, which means if the database server offers SSL, the client will use it. You can also set it to verify-full to enforce SSL with full verification of certificate trust.
web_server_ssl_cert and web_server_ssl_key allow the user to provide a certificate and key to be installed in the web server for the Tower UI and API. These must either both be provided or both be absent. If they are absent, a self-signed (untrusted) certificate will be generated at install time.
postgres_use_ssl (true/false) - controls whether the PostgreSQL server will be configured to require SSL. This only has any effect with an internal/embedded database (i.e. when the Tower install script is doing the deployment of the database server). It has no effect on an external database.
postgres_ssl_cert and postgres_ssl_key - must be supplied when postgres_use_ssl is true. These certificates should have a CN (or wildcard, subject alternate name, and so forth) that matches the hostname the Tower nodes will use to connect to the database server.

For OpenShift-based deployments, refer to OpenShift Deployment and Configuration.

High Availability Multi-Machine Cluster:

Tower can be installed in a high availability cluster mode. In this mode, multiple Tower nodes are installed and active. Any node can receive HTTP requests and all nodes can execute jobs.

A Clustered Tower setup must be installed with an external database (2 options available):
- Tower with remote DB configuration: This installs the Tower server on a single machine and configures it to talk to a remote instance of PostgreSQL as its database. This remote PostgreSQL can be a server you manage, or can be provided by a cloud service such as Amazon RDS.
- Tower with a playbook install of a remote PostgreSQL system: This installs the Tower server on a single machine and installs a remote PostgreSQL database via the playbook installer (managed by Tower).
For more information on configuring a clustered setup, refer to Clustering.

Note

Running in a cluster setup requires any database that Tower uses to be external–PostgreSQL must be installed on a machine that is not one of the primary or secondary tower nodes. When in a redundant setup, the remote PostgreSQL version requirements is PostgreSQL 10.

3.2. Setting up the Inventory File¶

As you edit your inventory file, there are a few things you must keep in mind:

The contents of the inventory file should be defined in ./inventory, next to the ./setup.sh installer playbook.
For installations and upgrades: If you need to make use of external databases, you must ensure the database sections of your inventory file are properly setup. Edit this file and add your external database information before running the setup script.
For upgrading an existing cluster: When upgrading a cluster, you may decide that you want to also reconfigure your cluster to omit existing instances or instance groups. Omitting the instance or the instance group from the inventory file will not be enough to remove them from the cluster. In addition to omitting instances or instance groups from the inventory file, you must also deprovision instances or instance groups before starting the upgrade. Otherwise, omitted instances or instance groups will continue to communicate with the cluster, which can cause issues with tower services during the upgrade.
For clustered installations: If you are creating a clustered setup, you must replace localhost with the hostname or IP address of all instances. All nodes/instances must be able to reach any others using this hostname or address. In other words, you cannot use the localhost ansible_connection=local on one of the nodes AND all of the nodes should use the same format for the host names.

Therefore, this will not work:
```
[tower]
localhost ansible_connection=local
hostA
hostB.example.com
172.27.0.4
```
Instead, use these formats:
```
[tower]
hostA
hostB
hostC
```
OR
```
hostA.example.com
hostB.example.com
hostC.example.com
```
OR
```
[tower]
172.27.0.2
172.27.0.3
172.27.0.4
```
For all standard installations: When performing an installation, you must supply any necessary passwords in the inventory file.

Note

Changes made to the installation process now require that you fill out all of the password fields in the inventory file. If you need to know where to find the values for these they should be:

admin_password='' <— Tower local admin password

pg_password='' <—- Found in /etc/tower/conf.d/postgres.py

Warning