Introduction
------------
This software configures a reverse-proxy and redirects the http(s) requests to the active MnC HA. So clients connecting to reverse-proxy need not change the IP Address/FQDN post MnC HA switchover.

Modes of installation
---------------------
There are two modes of installation
1. From MnC HA bench, by referring to MnC installation guide
2. Manual installation

Below sections cover manual installation
========================================
Pre-requisites
--------------
1. A server installed with minimal RHEL/CentOS 8.3 (or higher) installation with Ansible 2.4.2 (or higher) and logrotate 3.8.6 (or higher). Minimal Hardware requirement - 4 virtual CPU, 16 GB RAM, 50 GB of available space allocated to / and 4G swap space. It can have one or more network interfaces. The connection bandwidth between machine on which this software will be installed and MnC HA benches is expected to be 200Mbs.
2. Ansible dependencies - PyYAML, libtomcrypt, libtommath, libyaml, python-babel, python3-httplib2, python3-jinja2, python3-markupsafe, python3-crypto, python3-cryptography, python3-ecdsa, python3-paramiko, python3-pyasn1 or equivalent ones for python 3.
3. Configure networking for access to external clients and to MnC HA benches. The ports as defined in NFM-T firewall document needs to be enabled.
4. Ensure that the date and time is in sync with MnC HA benches.
 
Installation and configuration procedure
----------------------------------------
1. Chose a user who has sudo permission to install. Copy the package to the <DOWNLOAD PATH> and extract.
2. cd <DOWNLOAD PATH>/rpm and install all the rpms with sudo.
3. Setup shared SSH key access to NOC and DRC. The users on NOC and DRC can be non-root users. It is also recommended to set the log level to ERROR in /etc/ssh/sshd_config on NOC and DRC to avoid login status messages for each ssh login.
4. It is necessary to whitelist the IP Address/FQDN of this machine to both NOC and DRC server. In order to whitelist, please follow the below steps
    a. Login to NOC and DRC using the NFM-T REST API authentication.
    b. Execute the POST call to whitelist this machine IP Address/FQDN.
       Ex - curl -kv -X POST https://<NOC|DRC IP>/session-manager/api/v1/whitelist/allowedHosts -H 'Authorization: Bearer <auth token>' -H 'Content-Type: application/json' -H 'cache-control: no-cache' -d '{ "host": "<this machine IP>" }'
5. Change dir to <DOWNLOAD PATH>/VirtualAccessToHAEnabledSystem/ and trigger the configure.sh with sudo with below parameters of HA benches -
    a. IP Address or FQDN of machine on which this software is planned to be installed
    b. IP Address or FQDN of MnC NOC Server main VM
    c. IP Address or FQDN of MnC DRC Server main VM
    d. User on MnC bench having shared ssh key access configured.
6. Post successful installation, the configured server acts as reverse-proxy and is ready to accept requests.
7. The installation log can be found at 
<DOWNLOAD PATH>/VirtualAccessToHAEnabledSystem/lib/playbooks/nfmt_ha_setup_secure.log


Note: Ensure that the NOC and DRC machines have log rotation and size limit configured in /etc/logrotate.conf (or equivalent) to manage the growth of /var/log/secure log due to reverse-proxy verification of HA state.


Upgrade
-------
1. Chose a user who has sudo permission to install. Copy the package to the <DOWNLOAD PATH> and extract. 
2. Change dir to <DOWNLOAD PATH>/VirtualAccessToHAEnabledSystem/ and trigger the upgrade.sh with sudo


Uninstallation
--------------
1. Chose a user who has sudo permission to install.
2. Change dir to <DOWNLOAD PATH>/VirtualAccessToHAEnabledSystem/ and trigger the uninstall.sh with sudo

Redundancy configuration options
--------------------------------
To avoid the machine hosting this software to be the single point of failure, following configurations are suggested.
1. Hot Standby configuration - 
	a. Two benches need to be installed with this software following the Installation procedure explained above.
	b. Both the benches will be active and can accept requests.
	c. When one of the application/machines go down, the client need detect and switch to the other.
2. Cold Standby configuration -
	a. Install Cold Standby bench with this software and shut it down.
	b. Install Active bench with this software and with the same IP as the Cold Standby. Active bench will be used to accept client requests.
	c. In case Active bench goes down, the Cold Standby bench need to be powered ON and used.
