Server installer

FAQ › EUZOS Server › Server installer · Nederlands

What is it?

The server installer puts EUZOS Server from a USB stick onto the internal disk (SATA/AHCI, NVMe, or virtio-blk in a virtual machine) of a server. It is graphical, in the same style as the desktop installer (choice screen, cards, light or dark, mouse, keyboard and the on-screen keyboard), and falls back to a text installer in the console when there is no framebuffer. Besides the disk it sets up the network (DHCP or a static/public address), the packages (server roles, first Workplace management) and, after a successful installation, registers the workplace server with the admin's organisation on the profile server. The firewall of the installed server is closed by default.

How do I…?

How do I start the installer?

Boot the server from an EUZOS Server stick. Because it booted from USB, the choice screen appears ("Welcome to EUZOS Server"): Console (from the stick, nothing changes on the server) or Install on this server (on the internal disk; everything on it is erased). Without a choice it goes to the console after 10 seconds. From the console, installer shows the choice screen again and installer text starts the text installer. With choice=no (legacy keuze=nee, still read) in \EOS\FW\INSTALL.TXT the choice screen does not appear. automatic=yes (the desktop's installation stick) has no effect on the server: there crate::setup_choice::must_choose alone decides (booted from a USB stick, on x86-64, not choice=no).

What are the steps?

Graphical installer (euzos_ui::installation_server):

1. Environment (test build only): SBX or PROD; written to the new disk as PROFILE.TXT.
2. Network: the network adapter (by default the one with a link) and DHCP or a fixed address: IP address, netmask or prefix (/24 or 255.255.255.0), gateway, one or two DNS servers, and optionally the external address behind NAT (public IP or DNS name). IPv4 only. The address applies immediately (for the Account step) and is written to the new disk.
3. Account: the admin signs in or creates an account (e-mail and password, with the code from the mail); no Microsoft login. With this account the server is registered with the organisation.
4. Packages: the list of server packages, Workplace management first (on by default). Packages that are not finished are shown greyed out as Coming soon.
5. Name of the server (if Workplace management is chosen): its name in Server Admin and for the admin (1 to 64 characters; default EUZOS Server).
6. Ports (optional): the network adapters, USB ports and USB storage found in this machine, all on; switch off what the server does not use (see below). Next without changes skips it.
7. Disk, 8. Wipe (quick or thorough erase, or Test install, no erase: only repartitioned, never the default, with a warning and a second Next to confirm; see Desktop installer), 9. Confirm (type the last 4 characters of the serial number), 10. Progress, 11. Done (shut down, remove the stick, switch on again: the server starts in the console).

How do I switch off unused network adapters or USB ports while installing?

On the step Network adapters and USB ports every adapter (PCI address, MAC address, link), every USB port (a USB 2 + USB 3 connector is one switch) and USB storage (usb-class storage) has a switch; everything is on. Tap a switch (or arrows and Space) to switch it off. The same safety rules as on a running server apply: the adapter chosen on the Network step stays on, the port of the installation stick stays on, and switching off the last adapter or the port with the only keyboard needs a second tap. What is off is written to the new disk as \EOS\FW\PORTS.TXT; with everything on no file is written. Change it later with Server Admin › Ports (see Ports).

How do I set a static or public IP address?

In the Network step choose Fixed address and fill in the fields. An invalid address, an IPv6 address, a network/broadcast address or a gateway outside the subnet gives a message at the field. A public address is allowed: then the note "this server can be reached directly from the internet. The firewall is closed; open ports with Server Admin." appears. After installation you change it with network on the console or with Server Admin (see Network and firewall).

Why is the firewall closed after installing?

The owner's decision: an EUZOS Server is completely closed inbound by default, with or without a public address. Only the admin protocol of Server Admin (TCP 8446) from the own subnet is open (in a test build also SSH from the own subnet). The Done screen reminds you: "The firewall is closed: open the cache (port 8445) with Server Admin." See Network and firewall.

What if the registration fails?

The Done screen says "The server is not registered (reason); you can do that later". Reasons from the profile server: the account is not an admin of an organisation (geen_beheerder), the account manages several organisations (kies_organisatie), the key is already registered (al_geregistreerd), or too many registrations (te_vaak). It can then be registered later on the profile server (see Organisations).

Is the admin's password stored on the server?

No. The password is only in the kernel during the request; the PC token of the Account step stays in RAM and is logged out after the installation.

How do I use the text installer?

installer text in the console. Each step is shown as text; you type a line and press Enter. stop returns to the console (except on the Done screen), back goes one step back. Network step: Enter = next, r = look again. Packages: type a package number to toggle it, Enter = next. For Workplace management it then asks the name and the link: the name of the organisation or a registration code; both only go into WORKPLC.TXT as a hint for the admin. Disk: type the number (or r to search again). Wipe: 1 fast (SSD only; the default on an SSD), 2 thorough (the default on a hard disk) or 3 "Quick install for testing: don't wipe, only repartition (old data can still be recovered; minutes instead of an hour or more)"; Enter keeps the choice shown. Choosing 3 shows a warning (the old data can be recovered with simple tools; only if the disk holds nothing confidential). Confirm: type the code exactly, which is WIPE-<serial> (the serial number, letters, digits and -; the legacy WIS-<serial> is still accepted); without wiping type the code and NO-WIPE, e.g. WIPE-S0EXAMPLE1234 NO-WIPE. The text installer has no Account step and does not register the server; register it afterwards on the profile server (see Organisations).

Details

• Installation goes from the stick itself (install::install_internal with Source::Stick): the signed manifest \EOS\MANIFEST.TXT and all files are checked before anything is wiped; everything is read back afterwards. It refuses the boot disk and disks without a usable serial number or that are too small. Only on x86-64.
• No Wi-Fi files and no apps (Chromium) are copied: that is EUZOS Desktop.
• Files written to the new disk (\EOS\FW\):
  • the role file of each chosen package (Workplace management: WORKPLC.TXT with the name; see Packages);
  • for Workplace management the keys WPKEY.TXT (Ed25519) and WPTLS.TXT (P-256 for TLS), created on this machine and written only to the new disk;
  • the network file NETWORK.TXT (static address by MAC address, external address), only when an adapter has a static address or an external address is set;
  • the language file LANG.TXT (language=<code>, if a language was chosen);
  • PORTS.TXT with what was switched off on the Ports step (only when something is off; see Ports);
  • PROFILE.TXT with the environment (test build; environment=, key=, key-id=, …);
  • in a test build dev-ssh=yes in the role file (development SSH).
• Registration: after a successful installation crate::server_setup_choice::register posts the public workplace key, the name and the external address to the profile server with the PC token of the Account step. The workplace server then appears in Server Admin for that admin with name, account, installation date and external address.
• The text installer's steps and logic live in euzos_install::server (Installer, Step), tested on the development machine.

Reference

Console commands

Inputs of the text installer (euzos_install::server::Installer::line):

Functions and modules

Config files

API endpoints

Called by the installer on the profile server (details in API):

The kernel currently calls the legacy path.

Protocol messages and formats

Registration request body (lines key=value, wire format, stays Dutch): sleutel=<public key, 64 hex>, naam=<name>, optional extern=<external address>. Reply: ok with werkplek=<id> and organisatie_naam= / organisatie=, or a failure with reden=<code> (geen_beheerder, kies_organisatie, al_geregistreerd, te_vaak, …).

See also

• docs/EDITIONS.md ("The server installer")
• docs/INSTALLING.md
• Packages, Network and firewall, Organisations