---
title: Installation worksheet
description: Collect every value an OpenLM Platform installation asks for in one file before you start, then paste it into your shell.
product: OpenLM Platform
---

Before you start, collect every value the installation asks for in one file, so you never have to stop halfway. The installation needs about 15 values: names, addresses, and passwords.

## How to use this worksheet

Set up the file once, then load it before each step:

1. Copy the block in [The worksheet](#the-worksheet) into a text file on your workstation, for example `openlm-install.env`.
2. Replace every value marked `CHANGE-ME`. Keep the quotes.
3. Before each step of the installation, load the file into your shell:

   ```bash
   source ./openlm-install.env
   ```

Every command in this guide uses these variable names, so you can copy and paste the commands as they are.

:::danger[This file contains passwords]
Store `openlm-install.env` like any other password file: not in a shared folder, not in Git. Delete it, or move it to your password vault, when the installation is complete.
:::

## The worksheet

Copy this block:

```bash
# ── openlm-install.env ─────────────────────────────────────────────────────────

# The platform release you are installing. Take it from the release notes.
export OPENLM_VERSION="1.0.0-rc.4"

# Your cluster
export NS="openlm"                         # keep this: the platform is built for "openlm"
export STORAGE_CLASS="CHANGE-ME"           # kubectl get storageclass   (for example gp3, managed-csi, local-path)
export INGRESS_CLASS="CHANGE-ME"           # kubectl get ingressclass   (for example traefik, nginx). OpenShift: leave as is
export ON_OPENSHIFT="false"                # true on OpenShift, ROSA and ARO

# Your web address (no https://, no trailing slash)
export DOMAIN="CHANGE-ME"                  # for example openlm.example.com

# The TLS certificate for $DOMAIN (files on this workstation)
export TLS_CERT_FILE="./fullchain.pem"     # certificate + intermediates (+ root for a private CA)
export TLS_KEY_FILE="./privkey.pem"        # private key, not password-protected

# SQL Server
export SQL_HOST="CHANGE-ME"                # host name or IP that pods can reach
export SQL_PORT="1433"
export SQL_USER="CHANGE-ME"
export SQL_PASSWORD="CHANGE-ME"
export SQL_ENCRYPT="True"                  # True for Azure SQL / RDS / any SQL with TLS; False only for a plain lab SQL
export DB_PREFIX="openlm"                  # databases become openlm_identity, openlm_reporting, ...

# MongoDB: a full connection string. It must NOT end with "/"
export MONGO_URI="mongodb://CHANGE-ME-user:CHANGE-ME-password@CHANGE-ME-host:27017"

# Kafka: bootstrap servers, comma-separated host:port
export KAFKA_BOOTSTRAP="CHANGE-ME:9092"

# Redis
export REDIS_HOST="CHANGE-ME"              # host name, no port
export REDIS_PORT="6379"
export REDIS_PASSWORD="CHANGE-ME"
export REDIS_TLS="false"                   # true for ElastiCache with in-transit encryption, Azure Redis, etc.

# Generated once, kept for upgrades. Leave these lines as they are.
export HANGFIRE_PASSWORD="${HANGFIRE_PASSWORD:-$(openssl rand -hex 16)}"
export GATEWAY_SECRET="${GATEWAY_SECRET:-$(openssl rand -hex 24)}"
```

:::warning[Keep the generated values]
The last two lines create random passwords the first time you load the file. Write them into the file after the first `source`, so every later step and every upgrade uses the same ones:

```bash
echo "export HANGFIRE_PASSWORD=\"$HANGFIRE_PASSWORD\"" >> ./openlm-install.env
echo "export GATEWAY_SECRET=\"$GATEWAY_SECRET\""       >> ./openlm-install.env
```
:::

## What each value means

The following table says where to get each value:

| Variable | Where to get it | Example |
|---|---|---|
| `OPENLM_VERSION` | The newest entry in the [release notes](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/release-notes/index), or the version OpenLM gave you | `1.0.0` |
| `STORAGE_CLASS` | `kubectl get storageclass`. Choose the one marked `(default)` unless your team says otherwise. | `gp3` |
| `INGRESS_CLASS` | `kubectl get ingressclass` | `traefik` |
| `ON_OPENSHIFT` | `true` on OpenShift, ROSA and ARO, `false` everywhere else | `false` |
| `DOMAIN` | The DNS name your users open. Your network team creates it in [step 1](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/install/step-1-prepare-cluster). | `openlm.example.com` |
| `SQL_HOST`, `SQL_PORT` | Your database team. Use the name **pods** use to reach SQL Server, which isn't always the name you use from your laptop. | `sql01.corp.example.com` |
| `SQL_USER`, `SQL_PASSWORD` | A SQL login (not a Windows account) that owns the four databases | `openlm_app` |
| `SQL_ENCRYPT` | `True` if SQL Server accepts encrypted connections, which all managed cloud SQL services do | `True` |
| `DB_PREFIX` | Your choice. Letters, digits, and `_` only. | `openlm` |
| `MONGO_URI` | Your MongoDB team. Include user and password. Add `?tls=true` (or the options your provider gives you) after the port if MongoDB uses TLS. | `mongodb://openlm:…@mongo.example.com:27017` |
| `KAFKA_BOOTSTRAP` | Your Kafka team. Pods must be able to reach the address. | `kafka-0.kafka:9092` |
| `REDIS_*` | Your Redis team | `redis.example.com`, `6379` |

:::tip[Check]
After you fill in the file, run this command. It prints nothing if every value is set:

```bash
source ./openlm-install.env && grep -n "CHANGE-ME" ./openlm-install.env
```

If it prints lines, fill in those values.
:::