main.yml

# SPDX-License-Identifier: Apache-2.0
---

################
# Main role parameters:
################
# Set which Ansible Collection to use for the Linux System Roles.
# For community/upstream, use 'fedora.linux_system_roles'
# For the RHEL System Roles for SAP, or for Red Hat Automation Hub, use 'redhat.rhel_system_roles'
sap_hana_install_system_roles_collection: 'fedora.linux_system_roles'

# Directory containing the IMDB SAR files and all components
sap_hana_install_software_directory: '/software/hana'

# Directory into which the SAR files will be extracted. Defaults is {{ sap_hana_install_software_directory }}/extracted .
# Note: In case the directory SAP_HANA_DATABASE does not exist in this directory, the directory will be removed and
# created again before the extraction starts.
sap_hana_install_software_extract_directory: "{{ sap_hana_install_software_directory }}/extracted"

# If there is a requirement to cleanup "sap_hana_install_software_extract_directory" after SAP HANA Installation, then
# set the value to true. By default, this directory will not be removed
sap_hana_install_cleanup_extract_directory: false

# Set this variable to `true` if you want to copy the SAR files from `sap_hana_install_software_directory`
# to `sap_hana_install_software_extract_directory/sarfiles` before extracting.
# This might be useful if the SAR files are on a slow fileshare.
sap_hana_install_copy_sarfiles: false

# Set the following variable to `true` if you want to keep the copied SAR files. By default, the SAR files will be
# removed after extraction.
sap_hana_install_keep_copied_sarfiles: false

# (RedHat specific) fapolicyd package is present on RedHat systems
# For installing SAP HANA with fapolicyd support, set the following variable to `true`:
sap_hana_install_configure_fapolicyd: false

# (RedHat specific) desired fapolicyd service status (only if 'sap_hana_install_configure_fapolicyd' is set to 'true').
# For enabling and starting the fapolicyd service after the installation has finished, set the following variable to 'true'.
sap_hana_install_enable_fapolicyd: false

# (RedHat specific) fapolicyd integrity level
# When using fapolicyd, you can set the following variable to one of `none`, `size`, `sha256`, or `ima`. Note that before setting
# to `ima`, it is essential to prepare the system accordingly (e.g. boot with a different kernel parameter). See the
# RHEL 9 Managing, monitoring, and updating the kernel guide for more information on this topic.
sap_hana_install_fapolicyd_integrity: 'sha256'

# (RedHat specific) name of fapolicyd rule file for protecting shell scripts
# When using fapolicyd, the following variable is used to define the fapolicyd rule file in which the rules for
# protecting shell scripts are stored. The rule file will be created in the directory '/etc/fapolicyd/rules.d'.
# Note: The mandatory file ending '.rules' will be added in the corresponding task of this role.
sap_hana_install_fapolicyd_rule_file: '71-sap-shellscripts'

# Directories which are used for the SAP HANA installation (relevant for SELinux relabeling and for fapolicyd protection)
sap_hana_install_directories:
  - "{{ sap_hana_install_root_path }}"
  - '/lss/shared'
  - '/usr/sap'

# File name of SAPCAR*EXE in the software directory. If the variable is not set and there is more than one SAPCAR executable
# in the software directory, the latest SAPCAR executable for the CPU architecture will be selected automatically.
# sap_hana_install_sapcar_filename: SAPCAR_1115-70006178.EXE

# List of file names of SAR files to extract. Can be set in case there are more SAR files in the software directory
# than needed or desired for the HANA installation.
# sap_hana_install_sarfiles:
#  - SAPHOSTAGENT54_54-80004822.SAR
#  - IMDB_SERVER20_060_0-80002031.SAR

# Set the following variable to `true` to let the role abort if checksum verification fails for any SAPCAR or SAR file
# called or used by the role.
sap_hana_install_verify_checksums: false

# Checksum algorithm for checksum verification. Default is sha256, for which a checksum is available in the SAP software
# download pages.
sap_hana_install_checksum_algorithm: sha256

# In case a global checksum file is present, use the following variable to specify the full path to this file:
# sap_hana_install_global_checksum_file: "{{ sap_hana_install_software_directory }}/SHA256"

# Set the following variable to `true` to let hdbclm verify SAR file signatures. This corresponds to the hdblcm command line
# argument `--verify_signature`.
sap_hana_install_verify_signature: false

# hdblcm configfile related variables:
# Directory where to store the hdblcm configfile template and the Jinja2 template:
sap_hana_install_configfile_directory: "{{ sap_hana_install_software_extract_directory }}/configfiles"

# If a custom path for sap_hana_install_configfile_directory was defined and if there is a requirement to cleanup this directory,
# then set "sap_hana_install_cleanup_configfile_directory" as true. In case if a custom path was not defined and
# "sap_hana_install_cleanup_extract_directory" was set as true, then the configfiles will be removed.
sap_hana_install_cleanup_configfile_directory: false

# File name prefix for the hdblcm configfile template and the Jinja2 template:
sap_hana_install_configfile_template_prefix: "hdblcm_configfile_template"

# Directory where to download the Jinja2 template:
sap_hana_install_local_configfile_directory: '/tmp'

# If you would like to perform an installation check after the installation, set the following variable to 'true'.
# Note: This only works if there is no static configfile available in sap_hana_install_configfile_directory.
sap_hana_install_check_installation: false

# Only if sap_hana_install_check_installation (above) is set to 'true', you can select which command to use by setting the
# following variable to `true` or `false`.
# true: use the command 'hdbcheck', with parameters `--remote_execution=ssh` and `--scope=system`
# false: use the command `hdblcm --action=check_installation`
sap_hana_install_use_hdbcheck: true

# If the following variable is set to 'true', the HANA installation check will be skipped
sap_hana_install_force: false

# If the following variable is set to `false`, the role will attempt to install SAP HANA even if there is already a sidadm user.
sap_hana_install_check_sidadm_user: true

# If the following variable is undefined or set to `true`, the role will perform a fresh SAP HANA installation.
# If set to `false`, additional hosts as specified by variable sap_hana_install_addhosts will be added to
# an existing HANA system.
sap_hana_install_new_system: true

# The first tenant database is using a port range not within the range of the ports of additional tenant databases.
# In case this is not desired, you can set the following parameter to `true` to recreate the initial tenant database.
sap_hana_install_recreate_tenant_database: false

# For compatibility of SAP HANA with SELinux in enforcing mode, the role will set the SELinux boolean 'selinuxuser_execmod' to 'on'.
# It will also recursively relabel directories and files in `/hana` before the installation starts and in all other directories
# specified in 'sap_hana_install_directories' after the installation has finished.
# If this not desired, set the following variable to `false`.
sap_hana_install_configure_selinux: true

################
# Parameters for hdblcm:
################
# List of components to be installed, default 'all'
# Components should be comma separated
sap_hana_install_components: 'all'

# Pass some extra arguments to hdblcm, see some examples below.
# sap_hana_install_hdblcm_extraargs: '--verify_signature'
# sap_hana_install_hdblcm_extraargs: '--ignore=check_diskspace,check_min_mem'

# Instance details
sap_hana_install_sid: ''
sap_hana_install_number: ''
sap_hana_install_root_path: "{{ '/' + sap_hana_install_install_path.split('/')[1] if sap_hana_install_install_path is defined else '/hana' }}"
sap_hana_install_shared_path: "{{ sap_hana_install_install_path | d(sap_hana_install_root_path + '/shared') }}"

# Adjust these accordingly for your installation type
sap_hana_install_system_usage: 'custom'
sap_hana_install_restrict_max_mem: 'n'
# sap_hana_install_max_mem: ''

# Starting with SAP HANA 2.0 SPS08, the component LSS (Local Secure Store) will be installed by default
# when installing SAP HANA. This requires the installation execution mode to be set to 'optimized'.
# You can change the following variable to the default of 'standard' in your playbook or inventory,
# for example when installing an older version of SAP HANA or when not installing the 'lss' component.
sap_hana_install_install_execution_mode: 'optimized'

# hdblcm will use default ids if blank
# sap_hana_install_userid: ''
# sap_hana_install_groupid: ''

# Passwords
# Setting master password to 'y' will use that master password for all passwords - recommended
sap_hana_install_use_master_password: 'y'
# Set one or more of the following password variables in your playbook or inventory.
# sap_hana_install_master_password:
# sap_hana_install_sidadm_password:
# sap_hana_install_db_system_password:
# sap_hana_install_lss_user_password:
# sap_hana_install_lss_backup_password:
# sap_hana_install_ase_user_password:
# sap_hana_install_root_password:
# sap_hana_install_sapadm_password:  # This password is required when adding hosts with `sap_hana_install_new_system: false`
# sap_hana_install_xs_org_password:

################
# Optional parameters:
################

# Set this variable to `true` to configure the required firewall ports for SAP HANA (default is `false`).
# This configuration includes installing the `firewalld` package and starting the service.
# Configuration can be customized by variable `sap_hana_install_firewall_ports`:
# - If not defined, a Firewalld service definition is created with the recommended ports.
# - If defined, the specified ports are opened directly and no service definition is created.
# Note: Setting this variable to `false` does not remove any existing firewall configuration.
# For ongoing firewall management after installation,
# consider using the `community.sap_operations.sap_firewall` role or the `firewall` Linux System Role.
sap_hana_install_configure_firewall: false

# List of firewall ports for SAP HANA.
# Commented out example shows same ports that are defined in service file.
# sap_hana_install_firewall_ports:
#   # SAP Host Agent ports for status and metrics communication.
#   - "1128-1129/tcp"
#   # SAP HANA Web Dispatcher HTTPS port.
#   - "43{{ sap_hana_install_number }}/tcp"
#   # SAP HANA Data Provisioning Agent (DP Agent) port for SDA/SDI connectivity.
#   - "5050/tcp"
#   # Main SAP HANA SQL and internal communication range for the IndexServer and distributed nodes.
#   - "3{{ sap_hana_install_number }}00-3{{ sap_hana_install_number }}90/tcp"
#   # The 4NNXX range supports SAP HANA Extended Application Services (XS) and other key internal services.
#   - "4{{ sap_hana_install_number }}01/tcp"
#   - "4{{ sap_hana_install_number }}02/tcp"
#   - "4{{ sap_hana_install_number }}06/tcp"
#   - "4{{ sap_hana_install_number }}12/tcp"
#   - "4{{ sap_hana_install_number }}14/tcp"
#   - "4{{ sap_hana_install_number }}40/tcp"
#   # Ports for SAP Service Layer or SAP Start Service for AS-Java/B1 components.
#   - "5{{ sap_hana_install_number }}00/tcp"
#   - "5{{ sap_hana_install_number }}13/tcp"
#   - "5{{ sap_hana_install_number }}14/tcp"
#   # SAP HANA XSA runtime port range for the xscontroller-managed Web Dispatcher connection.
#   - "51000-51500/tcp"
#   # Internal administration port for the SAP Web Dispatcher, used for local communication only.
#   - "64997/tcp"

# Name of firewall zone, where service or ports will be configured.
# Default zone is used if not set.
# sap_hana_install_firewall_zone: ''

# The following variable is no longer used. Setting /etc/hosts entries is done in role sap_general_preconfigure.
# sap_hana_install_update_etchosts: true

# Post install parameters
sap_hana_install_hdbuserstore_key: 'HDB_SYSTEMDB'
sap_hana_install_nw_input_location: '/tmp'

# Overwrite existing hdbuserstore configuration.
sap_hana_install_hdbuserstore_force: false

# License
sap_hana_install_apply_license: false
# sap_hana_install_license_path:
# sap_hana_install_license_file_name:

# Misc

# The following variable can be used to specify the hostname used for generation of self-signed SSL certificates
# for the SAP Host Agent. If empty, the current host will be used.
sap_hana_install_certificates_hostmap:

# If the following variable is set to `y`, the role will start SAP HANA after each system boot.
sap_hana_install_system_restart: 'n'

# Set to `true` to ensure the SAP system user '{{ sid | lower }}adm' is non-expiring.
# Set to `false` to skip this step — typically used when the user is domain-managed.
sap_hana_install_set_sidadm_noexpire: true

# If the following variable is undefined or set to `y`, the role will create an initial tenant database.
# corresponding entry in the hdblcm configfile:
# create_initial_tenant, default: 'y'
sap_hana_install_create_initial_tenant: 'y'

# The following variable can be used to modify the log_mode to 'overwrite' after the installation has finished.
# If unset or set to 'normal', the role will leave the log_mode to 'normal', which is required for SAP HANA
# System Replication. The log_mode 'overwrite' is useful for limiting cost or capacity if System Replication
# is not used.
# sap_hana_install_log_mode: 'overwrite'

# If the following variable is specified, the role will perform a scaleout installation or it will add additional
# hosts to an existing HANA system.
# Corresponding hdblcm parameter: addhosts
# Example:
# sap_hana_install_addhosts: 'host2:role=worker,host3:role=worker:group=g02,host4:role=standby:group=g02'

# Define hostname of master server where addhosts operation will be executed.
# If undefined, master specific steps will be executed on first host in the play.
# sap_hana_install_scaleout_master: ''

# The hostname is set by 'hdblcm --dump_configfile_template' during the preinstall phase but can also
# be set to a different value in your playbook or hostvars:
# sap_hana_install_hostname:

# Display SAP HANA hdblcm unattended mode output (hdblcm stdout)
sap_hana_install_display_unattended_output: false

# (Optional) Set to `true` to skip the filesystem check during SAP HANA installation.
# This is not recommended, but can be used in case of a non-Production environment.
sap_hana_install_skip_filesystem_check: false