Ansible Deployment
1. Overview
This guide provides step-by-step instructions for deploying Syndeia Cloud 3.7 and its required dependencies using the provided Ansible playbook and the Syndeia Cloud 3.7 deployment package.
The playbook automates the entire process, including:
Installing dependencies (OpenJDK 11, Python 3.10, Cassandra 4.1, Kafka 3.7, JanusGraph 1.0).
Setting up system users and groups for process isolation.
Deploying and configuring all Syndeia Cloud microservices.
Initializing the database schemas and license.
Configuring and enabling
systemdservices to manage all components.
This automation is designed for a fresh installation on a single-node server.
2. Prerequisites
2.1 General Requirements
Software: Syndeia Cloud (SC) Components
Syndeia Cloud (SC) packages: Download the following packages from the password-protected link provided in the Intercax Helpdesk request where you originally received your Syndeia Cloud license. To request a copy of these, visit https://intercax.com/help and enter an Evaluation Request - or find the existing request that your colleagues or organization may have sent to Intercax in the past. These packages are provided using Intercax’s secure, access-controlled file share service.
syndeia-cloud-3.7*-ansible.zipsyndeia-cloud-3.7*.zip
Software: Intercax License Server
RLM-based Intercax License Server 15.1 must be up and running if using a floating license. See this document for installation instructions if one has not been set up: Linux - Intercax License Server Installation and Setup. RLM license server is NOT included in the docker-compose files and there is not currently a docker image for this.
A valid license file must be present in the home directory of the user/admin that will be running the installation scripts.
If the Intercax License Server is serving floating licenses, then you must create a License Pointer File as described here: License Pointer File Creation.
If you are using node-locked license, then you must have downloaded the node-locked license available with your Syndeia downloads.
The License Pointer File (for floating licenses) or the node-locked license file will be used when deploying Syndeia Cloud later in this process.
Please see Syndeia Licensing for details regarding license types. If you need help acquiring a license, you can open a ticket at intercax.com/help.
2.2 Target Server Requirements
The Target Server is the server on which you will be installing Syndeia Cloud
Target Server must meet all requirements specified in Software and Hardware Requirements .
User Account with Sudo Access: A user account with
sudoprivileges is required. The playbook will prompt for thesudopassword during execution.unzip: Tool must be installed.
tar: Tool must be installed.
2.3 Control Node Requirements
The Control Node is the machine from which you will execute the Ansible commands. This can be your local workstation, a dedicated management server, or the Target Server itself.
Ansible: Ansible must be installed.
We recommend that organizations become familiar with Ansible before using it for Syndeia deployments
To install Ansible on RHEL-related systems, use
sudo yum install ansible
unzip: Tool must be installed.
tar: Tool must be installed.
SSH Access (for Remote Execution): If your Control Node is not the Target Server, it must have passwordless SSH access (using an SSH key) to the Target Server. See this RedHat blog entry for instructions on how to enable passwordless SSH access.
Syndeia Software:
The Syndeia Cloud application package (e.g.,
syndeia-cloud-3.7*.zip) must be downloaded and placed in a known directory on the control node.You must have either a Syndeia license file (e.g.,
Company-hostname-Syndeia-3.7*-ClientNodeLocked-date-x1.lic) or the connection details for your organization's floating license server.
3. Deployment
Stage 1: Initial Setup
Step 1: Prepare Installation Files
In this step, we will prepare the files that we will need to transfer to the Control Node for the deployment. Locate the files and place them in your user’s home folder on your workstation or server.
Step 1.1: Place package files in your home folder (Required for everyone):
syndeia-cloud-3.7*.zip(The Syndeia Cloud 3.7 Package)syndeia-cloud-3.7*-ansible.zip(The Ansible Package)
To request a copy of these packages, visit Intercax.com/Help and enter an Evaluation Request - or find the existing request that your colleagues or organization may have sent to Intercax in the past. Both packages are provided using Intercax’s secure, access-controlled file share service.
Step 1.2: Place your license file in your home folder (Required ONLY if using a node-locked license) :
If you are using a node-locked license, you should have received it via our helpdesk. If you need a node-locked license, please visit Intercax.com/Help to request one. If you are using a floating license, you will not need a license file for this installation.
Company-hostname-Syndeia-3.7*-ClientNodeLocked-date-x1.lic
Step 1.3: Generate and Place Offline Dependencies in your home folder (Required ONLY for air-gapped/offline servers):
If your environment cannot access the internet, you must pre-download an additional package containing Syndeia Cloud dependencies (Java, Cassandra, Kafka, etc.).
1. On a machine with internet access, from your user’s home folder, extract syndeia-cloud-3.7*-ansible.zip.
unzip syndeia-cloud-3.7*-ansible.zip -d syndeia-cloud-3.7*-ansible2. Navigate to the extracted directory and run the downloader script:
#This will create a file named syndeia-offline-dependencies.zip. You will transfer this file in the next step
cd syndeia-cloud-3.7*-ansible
python3 offline_dependency_downloader.py3. Move the generated syndeia-offline-dependencies.zip package to your users home folder
mv syndeia-offline-dependencies.zip ~/Step 2: Transfer Packages to the Control Node
From the machine containing the packages gathered in Step 1, transfer the standard packages to your home folder on the Control Node using your desired method (scp, ftp, etc.).
Step 2.1: Transfer Standard Files (Required):
# Replace 'user' and 'controlnode.server.com' with your username and the fqdn or ip of the Control Node.
scp syndeia-cloud-3.7*.zip syndeia-cloud-3.7*-ansible.zip user@controlnode.server.com:~Step 2.2: Transfer License File (Required ONLY if using a node-locked license):
# Replace 'Company-hostname-Syndeia-3.7*-ClientNodeLocked-date-x1.lic', 'user', and 'controlnode.server.com'
# with your license file name, username, and the fqdn or ip of the Control Code.
scp Company-hostname-Syndeia-3.7*-ClientNodeLocked-date-x1.lic user@controlnode.server.com:~/syndeia-license/Step 2.3: Transfer Offline Dependency Package (Required ONLY for air-gapped/offline servers):
# Replace 'user' and 'controlnode.server.com' with your username and the fqdn or ip of the Control Node.
scp syndeia-offline-dependencies.zip user@controlnode.server.com:~Step 3: Stage Syndeia Cloud 3.7 Package on the Control Node
We must move the syndeia-cloud-3.7*.zip package to a folder where ansible can access it. By default this is ~/syndeia-software.
Step 3.1: Log into the Control Node and navigate to your users home folder:
# On the Control Node, navigate to your users home folder
cd ~Step 3.2: Create the syndeia-software directory:
mkdir -p ~/syndeia-softwareStep 3.3: Move the syndeia-cloud-3.7*.zip package to the syndeia-software directory:
mv syndeia-cloud-3.7*.zip ~/syndeia-softwareStep 4: Unzip the Ansible Package
Unzip the syndeia-cloud-3.7*-ansible.zip file into a working directory on the Control Node.
# Unzip the package and cd
unzip syndeia-cloud-3.7*-ansible.zip -d syndeia-cloud-3.7*-ansible
cd syndeia-cloud-3.7*-ansibleStep 5: Review the Directory Structure
After extraction, the package contains the following key components:
syndeia-cloud-3.7*-ansible/
+-- ansible.cfg # Configuration settings for ansible
+-- customer_config.yml.template # Template for your environment-specific settings
+-- group_vars/ # A directory containing the core variables for the playbook
+-- install_syndeia.ansible.yml # The syndeia install playbook
+-- inventory.ini.template # The server inventory template
+-- offline_dependency_downloader.py # Python script for offline installation downloads
+-- README.md # The ansible package's README containing a link to this documentation
+-- requirements.yml # A text list of the required ansible collections
+-- roles/ # A directory containing all of the roles used by install_syndeia playbookStep 6: Stage License File (Required ONLY if using a Node-Locked License)
Note: If you are using a Floating License, you will skip this step, proceeding to Step 7.
If you are using a Node-Locked license, you must place your .lic file your home folder under a directory called syndeia-license so Ansible can locate it. The license file should have already been transferred to the home folder of the Control Node in Step 2.2.
Step 6.1: Create a directory called “syndeia-license” in your user’s home directory on the Control Node:
mkdir -p ~/syndeia-licenseStep 6.2: Move the node-locked license to the newly created ~/syndeia-license directory on the Control Node:
# Replace Company-hostname-Syndeia-3.7*-ClientNodeLocked-date-x1.lic with your license file name.
mv ~/Company-hostname-Syndeia-3.7*-ClientNodeLocked-date-x1.lic ~/syndeia-license/Step 7: Stage Offline Dependencies (Required ONLY for air-gapped/offline servers)
Note: If your Target Server has internet access, skip this step and proceed to Stage 2: Configuration.
If you transferred the syndeia-offline-dependencies.zip file in Step 2.3, you must now extract it to the specific temporary location where the Ansible playbook expects to find them.
Step 7.1: Unzip the package on the Control Node:
# Ensure you have the 'unzip' utility installed (e.g., sudo yum install unzip)
unzip ~/syndeia-offline-dependencies.zip -d /tmp/syndeia_downloadsExpected Output:
Step 7.2: Verify the files are in place
ls -l /tmp/syndeia_downloadsWarning: The /tmp directory is temporary and is often cleared when a server reboots. Do not restart the Control Node between this step and the execution of the playbook.
Stage 2: Configuration
Important: All steps in this section should be performed on the Control Node.
Step 1: Configure the Ansible Inventory
The inventory file acts as an address book, telling Ansible which server to connect to and how to authenticate.
Step 1.1: Navigate to the package directory:
cd ~/syndeia-cloud-3.7*-ansibleStep 1.2: Create the inventory file from the template:
cp inventory.ini.template inventory.iniStep 1.3: Open the file for editing:
vim inventory.iniStep 1.4: Configure your connection scenario:
Choose Scenario A or Scenario B below.
Step 1.4 - Scenario A: Remote Execution (Standard)
Use this if your Control Node is a separate machine (e.g., a laptop or management server) connecting to the Target Server over SSH.
Under
[syndeia_cloud_servers], replace the placeholder with the FQDN or IP address of your Target Server.Set
ansible_userto the username on the Target Server. This user must have sudo access on the Target server.Set
ansible_private_key_fileto the path of your SSH private key on the Control Node.If your remote server runs ssh on a port other than 22, set
ansible_portto the correct ssh port.
Example Remote Execution inventory.ini contents:
[syndeia_cloud_servers]
192.168.1.100
[syndeia_cloud_servers:vars]
ansible_user=remote_admin
ansible_private_key_file=~/.ssh/id_ed25519
# ansible_port=22Step 1.4 - Scenario B: Local Execution
Use this if you are running Ansible directly on the Target Server itself.
Under
[syndeia_cloud_servers], set the host tolocalhost.Add the variable
ansible_connection=local.Remove or comment out the [syndeia_cloud_servers:vars] section.
Example Local Execution inventory.ini contents:
[syndeia_cloud_servers]
localhost ansible_connection=local
#[syndeia_cloud_servers:vars]
#ansible_user=user
#ansible_private_key_file=~/.ssh/id_rsaStep 2: Create and Edit the Customer Configuration File
Ansible uses a variable file to customize the installation for your specific environment. You will create this file from the provided template.
Step 2.1: Create and edit customer configuration file
Create the configuration file:
cp customer_config.yml.template customer_config.ymlOpen the file for editing:
vim customer_config.ymlConfigure the variables:
Scroll through the file and update the sections below.
Step 2.2: Essential Configuration
customer_cassandra_syndeia_admin_password: Set a secure password for the
syndeia_admindatabase user. This password is used internally by the application to talk to the database.Example:
"AnotherSecur3P@ss!"
Step 2.3: Production Secrets
Syndeia Cloud requires two secret keys to secure user sessions and authentication tokens.
customer_syndeia_play_secret: A long, random string used to sign session cookies.
customer_syndeia_jwt_secret: A different long, random string used to sign JSON Web Tokens (JWTs).
Important: If these are left commented out, Ansible will generate new random secrets every time the playbook runs. This will invalidate existing user sessions (logging everyone out) during upgrades or re-configurations. It is strongly recommended to generate fixed strings for production environments.
You can generate a strong secret using OpenSSL on the Control Node:
openssl rand -base64 48Copy the output and paste it into your config file:
customer_syndeia_play_secret: "2Aoja9kUXU9QzFeS11fdX2UlbIcgNXxYxutoUT+8cV4Qpsl6KaRfEws+A+SuCcXo"
customer_syndeia_jwt_secret: "H++iHo3gdtdFobetBm7jgZksif+7aRvFNlS1GWf+DB6HMtqg2QxFpsOzKOSGBhuY"Step 2.4: License Configuration
You must configure one of the following two scenarios (2.4 - Scenario A or 2.4 - Scenario B). The Ansible playbook detects which method to use based on which variables you populate.
Step 2.4 - Scenario A: Floating License (Standard)
Use this method if you have an Intercax License Server (ILS) running on your network. Ansible will automatically generate the required pointer file on the Target Server.
Locate the License Configuration section in
customer_config.yml.Important: Ensure
customer_syndeia_license_file_pathis commented out or empty.Uncomment
customer_syndeia_license_server_hostand enter the FQDN or IP address of your License Server.(Optional) If your License Server uses non-standard ports, uncomment and update
customer_syndeia_license_server_rlm_port(Default: 5053) and/orcustomer_syndeia_license_server_isv_port(Default: 5055).
Example Configuration for Floating License:
# Leave the file path EMPTY or commented out
# customer_syndeia_license_file_path: ""
# Uncomment and set the License Server Hostname
customer_syndeia_license_server_host: "rlm-server.mycompany.com"Step 2.5 - Scenario B: Node-Locked License
Use this method if you are using a node-locked license file and have staged it in the ~/syndeia-license directory on the Control Node (as described in Section 3, Step 6).
Locate the License Configuration section in
customer_config.yml.Uncomment
customer_syndeia_license_file_path.Set the value to the full path of the directory created in Section 3 (e.g.,
/home/<your-user>/syndeia-license/Company-hostname-Syndeia-3.7*-ClientNodeLocked-date-x1.lic).Important: Ensure
customer_syndeia_license_server_hostis commented out.
Example Configuration for Node-Locked License:
# Point to the staged license file on the Control Node
# Replace 'user' with your username
customer_syndeia_license_file_path: "/home/user/syndeia-license/Company-hostname-Syndeia-3.7*-ClientNodeLocked-date-x1.lic"
# Ensure the Server Host is commented out
# customer_syndeia_license_server_host: "rlm.mycompany.com"
# customer_syndeia_license_server_rlm_port: 5053
# customer_syndeia_license_server_isv_port: 5055Note: The
customer_config.ymlfile contains an "Advanced & Optional Configuration" section at the bottom. This includes settings for tuning Cassandra, Kafka, and other components. For a standard installation, the default values in that section are sufficient and do not need to be changed.
Stage 3: Execution
With all required files staged and ansible configured, we can now run the playbook from the Control Node.
Step 1: Navigate to the extracted ansible package on your Control Node
cd ~/syndeia-cloud-3.7*-ansibleStep 2: Run the playbook
Note: Immediately after running the command below, you will be prompted with
BECOME password:. You must enter the appropriate sudo password and press Enter to proceed:
Remote Execution: Use the password for the user on the remote Target Server as defined in Stage 2, Step 1.4.
Local Execution: Use the password for the user currently running this playbook.
ansible-playbook install_syndeia.ansible.yml --extra-vars "@customer_config.yml"The playbook will now run, which may take 10-20 minutes. A final success message will be shown upon completion.
Stage 4: Post-Installation Verification
After the playbook completes, verify that Syndeia Cloud is running correctly. All verification should be done on the Target Server.
Step 1: Log into the Target Server
# Replace 'user' and 'target.server.com' with your username and the fqdn or ip of the Target Server
ssh user@target.server.comStep 2: Check Service Status
All services are managed by a single systemd target. Check their status with:
systemctl list-units cassandra.service janusgraph.service kafka.service sc-*.serviceStep 3: Verify Services are Enabled on Boot
The playbook automatically enables services to start on boot. You can verify this with:
systemctl list-unit-files 'sc-*.service' cassandra.service janusgraph.service kafka.service --no-pagerStep 4: Login to Syndeia Cloud:
You can now access the Syndeia Cloud web interface (e.g., http://<your-server-ip>:9000) and log in using the username super.user and the default password (syn45ia). You should be greeted with a dashboard displaying three pie graphs.
Note: The graphs may not load immediately after first boot. If you do not see them, try refreshing your browser.
5. Troubleshooting
This section outlines how to address common issues that may arise during deployment.
5.1 The "Idempotent" Design
The Ansible playbook provided with this package is designed to be idempotent.
What this means for you:
If the installation fails with an error, you do not need to uninstall, delete files, or perform manual cleanup.
Read the error message provided by Ansible.
Fix the specific issue (e.g., correct a typo in
customer_config.yml, add more RAM to the server, or fix a network rule).Re-run the exact same Ansible command.
The playbook recognizes which steps have already completed successfully and will skip them, resuming work only on the parts that changed or failed.
5.2 Common Errors and Resolutions
Error Type | Symptoms / Ansible Output | Likely Cause & Resolution |
SSH / Connection |
| Cause: The Control Node cannot SSH to the Target Server, or the |
Sudo Password |
| Cause: The playbook requires root privileges but the password was not provided or was wrong. |
Missing Files |
| Cause: The |
Download Failures |
| Cause: The Target Server does not have internet access, or the repository is temporarily unavailable. |
Service Timeout |
| Cause: Cassandra, Kafka, or JanusGraph is taking too long to start, often due to insufficient RAM or CPU. |
5.3 Diagnosing Service Failures
If the playbook finishes but a specific service is not running (see Stage 4, Step 2), you can inspect the system logs on the Target Server to determine why.
To view the logs for a specific service:
# Syntax: journalctl -u <service-name> -f
# Example: Check the logs for the Web Gateway
journalctl -u sc-web-gateway -f
# Example: Check the logs for Cassandra
journalctl -u cassandra -fTo check the status of a service:
systemctl status sc-store5.4 Re-running the Playbook
Once you have corrected the issue (modified the configuration file, moved a missing file, or fixed a network issue), navigate back to the ansible directory on the Control Node and execute the run command again:
cd ~/syndeia-cloud-3.7*-ansible
ansible-playbook install_syndeia.ansible.yml --extra-vars "@customer_config.yml"