> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Standard environment preparation

export const Danger = ({children}) => {
  return <div class="callout my-4 px-5 py-4 overflow-hidden rounded-2xl flex gap-3 border danger-admonition dark:danger-admonition" data-callout-type="danger">
      <div class="mt-0.5 w-4">
        <svg width="14" height="14" viewBox="0 0 14 14" fill="rgb(239, 68, 68)" xmlns="http://www.w3.org/2000/svg" class="w-4 h-4 text-sky-500" aria-label="Danger">
          <path fill-rule="evenodd" clip-rule="evenodd" d="M7 1.3C10.14 1.3 12.7 3.86 12.7 7C12.7 10.14 10.14 12.7 7 12.7C5.48908 12.6974 4.0408 12.096 2.97241 11.0276C1.90403 9.9592 1.30264 8.51092 1.3 7C1.3 3.86 3.86 1.3 7 1.3ZM7 0C3.14 0 0 3.14 0 7C0 10.86 3.14 14 7 14C10.86 14 14 10.86 14 7C14 3.14 10.86 0 7 0ZM8 3H6V8H8V3ZM8 9H6V11H8V9Z"></path>
        </svg>
      </div>
      <div class="text-sm prose min-w-0 w-full">
        {children}
      </div>
    </div>;
};

This topic provides guidance for preparing your environment before [Standard installation](/docs/psm-on-prem/6.6.3/install/instructions).

## Install requirements

### Hardware requirements

* CPU - 4 cores
* 16GB RAM
* 1TB storage space

When partitioning space, allocate 20GB for `/var/lib` and the remaining 1TB for `/opt/anaconda`.

<Danger>
  Our recommended storage space only accounts for Anaconda’s default channels; if you want to mirror additional channels or upload additional packages, please allocate more storage accordingly.
</Danger>

<Note>
  The installer provides a single-node installation process.
</Note>

### Software requirements

The installer is a self-extracting binary that contains all of the necessary components to run Package Security Manager services. The basic requirements prior to installation are:

* Any Linux variant capable of supporting Docker
* Use a fully qualified domain name (FQDN) or Hostname
* DNS record and TLS/SSL certs (optional)
* Make sure that SELinux is not in enforcing mode, either by disabling it or putting it in `permissive` mode in the `/etc/selinux/config` file. If it is in enforcing mode, you will need to reboot your instance after updating. After rebooting, run the following command to verify that SELinux is not being enforced:

  ```sh theme={null}
  getenforce
  # The result should be either Disabled or Permissive
  ```

<Tabs>
  <Tab title="Docker requirements">
    - [Docker Engine](https://docs.docker.com/engine/install/) 23.x+ (Supports Compose format 3.8)
    - [Docker Compose](https://docs.docker.com/compose/install/) 2.1+ (Supports Compose format 3.8)
  </Tab>

  <Tab title="Podman requirements">
    * RHEL8+
    * Package Security Manager version 6.3.0+
    * [Podman version 4.0.2+](https://podman.io/getting-started/installation)
    * [Netavark network plugin](https://github.com/containers/netavark)
    * [Docker Compose](https://docs.docker.com/compose/install/) 2.1+ (Supports Compose format 3.8)
    * [podman-docker](https://linuxsoft.cern.ch/cern/centos/7/extras/x86_64/repoview/podman-docker.html)

    <Accordion title="Complete the Podman setup">
      Podman setup requires you to download and configure the [podman-docker](https://linuxsoft.cern.ch/cern/centos/7/extras/x86_64/repoview/podman-docker.html) package. This package converts docker commands into their corresponding podman commands.

      <Note>
        You might need to work with your IT department to secure the `podman-docker` package.
      </Note>

      1. Install the required software by running the following commands:

         ```sh theme={null}
         sudo yum install -y podman-docker
         sudo yum install netavark
         curl -SL https://github.com/docker/compose/releases/download/v2.23.0/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
         ```
      2. Using your preferred file editor, open the `usr/share/containers/containers.conf` file and verify the `network_backend=` value is set to `"netavark"`. If it is not, set the value now, and save your changes.
      3. If necessary, make your `docker-compose` volume executable by running the following command:

         ```sh theme={null}
         sudo chmod +x /usr/local/bin/docker-compose
         ```
      4. Create a symbolic link by running the following command:

         ```sh theme={null}
         sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
         ```
      5. Enable the `podman.socket` by running the following commands:

         ```sh theme={null}
         sudo systemctl enable --now podman.socket
         sudo systemctl status podman.socket
         ```
      6. Verify that the podman socket works by running the following command:

         ```sh theme={null}
         sudo curl -w "\n" -H "Content-Type: application/json" --unix-socket /var/run/docker.sock http://localhost/_ping
         ```
    </Accordion>
  </Tab>

  <Tab title="External Postgres requirements">
    If you are using an external Postgres server, you must complete these steps to create the `keycloak` and `anaconda` users and assign them a role with appropriate permissions prior to installation.

    <Warning>
      You must be using a Postgres version between 9.6 and 14.9.
    </Warning>

    1. Log in to your Postgres server.

    2. Create the `keycloak` and `anaconda` users, and set passwords for them by running the following commands:

       ```sh theme={null}
       # Replace <PSM_PASSWORD> with a password for your anaconda user
       # Replace <KEYCLOAK_PASSWORD> with a password for your keycloak user
       CREATE USER "anaconda" WITH PASSWORD '<PSM_PASSWORD>';
       CREATE USER "keycloak" WITH PASSWORD '<KEYCLOAK_PASSWORD>';
       ```

           <Tip>
             You’ll need your `keycloak` and `anaconda` user passwords to complete installation. Save them in a secure location.
           </Tip>

    3. Create the databases needed for your users by running the following commands:

       ```sh theme={null}
       CREATE DATABASE anaconda OWNER "anaconda";
       CREATE DATABASE keycloak OWNER "keycloak";
       ```

    4. Create the role needed to configure permissions for the `keycloak` and `anaconda` users, then assign them the role by running the following commands:

       ```sh theme={null}
       CREATE ROLE anaconda_role;
       GRANT ALL PRIVILEGES ON DATABASE anaconda TO anaconda_role;
       GRANT ALL PRIVILEGES ON DATABASE keycloak TO anaconda_role;

       ALTER ROLE anaconda_role WITH CREATEDB;
       ALTER ROLE anaconda_role WITH LOGIN;

       GRANT CONNECT ON DATABASE postgres TO anaconda_role;
       GRANT USAGE ON SCHEMA public TO anaconda_role;
       GRANT SELECT ON ALL TABLES IN SCHEMA public TO anaconda_role;
       ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO anaconda_role;

       GRANT anaconda_role TO "anaconda";
       GRANT anaconda_role TO "keycloak";        
       ```
  </Tab>
</Tabs>

### Additional recommendations

* RHEL7/CentOS7: The most popular choice for most Package Security Manager users, and what Anaconda has the most experience supporting. The versions of Docker and Docker Compose available through the default yum package repository are sufficient.
* Ubuntu 20.04 LTS: This has proven to be a reliable choice for customers as well, using the versions of Docker and Docker Compose available in the default `apt-get` package repository.
* Other Linux variants that provide full support for Docker and Docker Compose are likely to work as well, but we invite you to inquire with the Anaconda implementation team for our most up-to-date experience.

For Docker, the default log driver must be [configured to the json-file](https://docs.docker.com/config/containers/logging/configure/).

For Red Hat systems, please refer to the [Default options for modifying docker daemon options](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux_atomic_host/7/html/getting_started_with_containers/using_the_docker_command_and_service#default_options). To verify that you’re running the json-file, run the following command:

```sh theme={null}
docker info --format '{{.LoggingDriver}}'
```

### DNS and TLS/SSL certificate requirements

Package Security Manager can use TLS/SSL certificates to provide transport layer security for the cluster. If you do not have these certs prior to installation, self-signed certificates can be generated during the initial installation. You can configure the platform to use organizational TLS/SSL certificates after completing the installation.

You may purchase certificates commercially, use Let’s Encrypt, or generate them using your organization’s internal public key infrastructure (PKI) system. When using an internal PKI-signed setup, the CA certificate is stored on the file system. You will need to make sure that the root certificate of your certificate authority is trusted by the server running the application and the workstations used by users of the application.

In either case, the configuration will include the following:

* A certificate for the root certificate authority (CA)
* An intermediate certificate chain
* A server certificate
* A private server key

**DNS requirements**

Web browsers use domain names and web origins to separate sites, so they cannot tamper with each other. If you want to use DNS, you must have it ready prior to installation. This DNS name is what users will use to access the application.

**You must provide the SSL cert for the hostname your Package Security Manager instance is running on.**

## Security requirements

**External — accessible outside of server**

It is important to protect all services running on the node from outside access. The exceptions are as shown below:

* `:443` nginx - only if you are using HTTPS
* `:22` ssh - optional; only if you need SSH

**Internal — accessible only within server**

Package Security Manager uses several ports for internal communication between components. These ports do not need to be open to the end user.

* `:5000` repo - Package Security Manager API
* `:5002` repo-proxy - Package Security Manager file serving API proxy
* `:5000` repo-dispatcher - Package Security Manager event dispatcher/handler (exposed only for prometheus metrics)
* `:5000` repo-worker - Package Security Manager scheduled jobs worker (exposed only for prometheus metrics)
* `:8080` keycloak - keycloak’s `/auth/*` endpoints are proxied in Nginx
* `:5432` postgres - Postgresql database used by Package Security Manager and Keycloak
* `:6379` redis - Redis instance used by Package Security Manager services
* `:9090` prometheus - Prometheus is proxied in Nginx at `/Prometheus`

To change the `postgres` user password, run `\password postgres` when in the shell of the postgres container.

To change the `redis` user password, follow the instructions under [Troubleshooting](../reference/troubleshooting#using-redis).

## Enable IP address forwarding

Forwarding IP addresses allows containers to communicate with one another on your host. You’ll need to configure these settings to allow non-root users to perform installations of Package Security Manager.

```sh theme={null}
sysctl net.ipv4.conf.all.forwarding=1
sysctl net.ipv6.conf.all.forwarding=1
iptables -P FORWARD ACCEPT
```

## System validation checks

Once your environment is prepared, run the following commands to verify it is ready for installation of Package Security Manager.

<Accordion title="System validation">
  To verify what type of processor your system is running and the number of CPUs present, run the command:

  ```sh theme={null}
  cat /proc/cpuinfo
  ```

  To verify the amount of system memory is sufficient, run the command:

  ```sh theme={null}
  cat /proc/meminfo
  ```

  To verify there is a sufficient amount of disk space for the installation, run the command:

  ```sh theme={null}
  df -h
  ```

  To verify the kernel release version and processor type, run the command:

  ```sh theme={null}
  uname -a
  ```

  To verify your operating system release version, run the command:

  ```sh theme={null}
  cat /etc/os-release
  ```

  To verify your version of Docker, run the command:

  ```sh theme={null}
  docker version
  ```

  To verify your version of `docker-compose`, run the command:

  ```sh theme={null}
  docker compose --version
  ```
</Accordion>

After ensuring all requirements have been met, proceed to [Standard installation](../install/instructions) to install Package Security Manager.