Installation worksheet

Before you start, collect every value the installation asks for in one file, so you never have to stop halfway. The installation needs about 15 values: names, addresses, and passwords.

How to use this worksheet

Set up the file once, then load it before each step:

1. Copy the block in The worksheet into a text file on your workstation, for example openlm-install.env.

2. Replace every value marked CHANGE-ME. Keep the quotes.

3. Before each step of the installation, load the file into your shell:

   source ./openlm-install.env

Every command in this guide uses these variable names, so you can copy and paste the commands as they are.

This file contains passwords

Store openlm-install.env like any other password file: not in a shared folder, not in Git. Delete it, or move it to your password vault, when the installation is complete.

The worksheet

Copy this block:

# ── openlm-install.env ─────────────────────────────────────────────────────────

# The platform release you are installing. Take it from the release notes.
export OPENLM_VERSION="1.0.0-rc.4"

# Your cluster
export NS="openlm"                         # keep this: the platform is built for "openlm"
export STORAGE_CLASS="CHANGE-ME"           # kubectl get storageclass   (for example gp3, managed-csi, local-path)
export INGRESS_CLASS="CHANGE-ME"           # kubectl get ingressclass   (for example traefik, nginx). OpenShift: leave as is
export ON_OPENSHIFT="false"                # true on OpenShift, ROSA and ARO

# Your web address (no https://, no trailing slash)
export DOMAIN="CHANGE-ME"                  # for example openlm.example.com

# The TLS certificate for $DOMAIN (files on this workstation)
export TLS_CERT_FILE="./fullchain.pem"     # certificate + intermediates (+ root for a private CA)
export TLS_KEY_FILE="./privkey.pem"        # private key, not password-protected

# SQL Server
export SQL_HOST="CHANGE-ME"                # host name or IP that pods can reach
export SQL_PORT="1433"
export SQL_USER="CHANGE-ME"
export SQL_PASSWORD="CHANGE-ME"
export SQL_ENCRYPT="True"                  # True for Azure SQL / RDS / any SQL with TLS; False only for a plain lab SQL
export DB_PREFIX="openlm"                  # databases become openlm_identity, openlm_reporting, ...

# MongoDB: a full connection string. It must NOT end with "/"
export MONGO_URI="mongodb://CHANGE-ME-user:CHANGE-ME-password@CHANGE-ME-host:27017"

# Kafka: bootstrap servers, comma-separated host:port
export KAFKA_BOOTSTRAP="CHANGE-ME:9092"

# Redis
export REDIS_HOST="CHANGE-ME"              # host name, no port
export REDIS_PORT="6379"
export REDIS_PASSWORD="CHANGE-ME"
export REDIS_TLS="false"                   # true for ElastiCache with in-transit encryption, Azure Redis, etc.

# Generated once, kept for upgrades. Leave these lines as they are.
export HANGFIRE_PASSWORD="${HANGFIRE_PASSWORD:-$(openssl rand -hex 16)}"
export GATEWAY_SECRET="${GATEWAY_SECRET:-$(openssl rand -hex 24)}"

Keep the generated values

The last two lines create random passwords the first time you load the file. Write them into the file after the first source, so every later step and every upgrade uses the same ones:

echo "export HANGFIRE_PASSWORD=\"$HANGFIRE_PASSWORD\"" >> ./openlm-install.env
echo "export GATEWAY_SECRET=\"$GATEWAY_SECRET\""       >> ./openlm-install.env

What each value means

The following table says where to get each value:

Variable	Where to get it	Example
OPENLM_VERSION	The newest entry in the release notes, or the version OpenLM gave you	1.0.0
STORAGE_CLASS	kubectl get storageclass. Choose the one marked (default) unless your team says otherwise.	gp3
INGRESS_CLASS	kubectl get ingressclass	traefik
ON_OPENSHIFT	true on OpenShift, ROSA and ARO, false everywhere else	false
DOMAIN	The DNS name your users open. Your network team creates it in step 1.	openlm.example.com
SQL_HOST, SQL_PORT	Your database team. Use the name pods use to reach SQL Server, which isn't always the name you use from your laptop.	sql01.corp.example.com
SQL_USER, SQL_PASSWORD	A SQL login (not a Windows account) that owns the four databases	openlm_app
SQL_ENCRYPT	True if SQL Server accepts encrypted connections, which all managed cloud SQL services do	True
DB_PREFIX	Your choice. Letters, digits, and _ only.	openlm
MONGO_URI	Your MongoDB team. Include user and password. Add ?tls=true (or the options your provider gives you) after the port if MongoDB uses TLS.	mongodb://openlm:…@mongo.example.com:27017
KAFKA_BOOTSTRAP	Your Kafka team. Pods must be able to reach the address.	kafka-0.kafka:9092
REDIS_*	Your Redis team	redis.example.com, 6379

Check

After you fill in the file, run this command. It prints nothing if every value is set:

source ./openlm-install.env && grep -n "CHANGE-ME" ./openlm-install.env

If it prints lines, fill in those values.