Lab Deployment Plan - Enterprise IT Stack¶

Minimum Specs:
- CPU: 8 cores / 16 threads (Intel i7/i9 or AMD Ryzen 7/9)
- RAM: 32 GB (64 GB recommended)
- Storage: 500 GB SSD
- Network: 1 Gbps Ethernet

This can run all services on one machine using Docker or VMs.
Good for: Quick proof-of-concept, limited users

Server 1 - "Infrastructure" (Identity + Database):
- CPU: 4 cores
- RAM: 16 GB
- Storage: 100 GB SSD
- Services: FreeIPA, Keycloak, PostgreSQL, Redis

Server 2 - "Applications":
- CPU: 6 cores
- RAM: 16 GB
- Storage: 200 GB SSD
- Services: Nextcloud, Mattermost, Jitsi, Zammad

Server 3 - "Communications":
- CPU: 4 cores
- RAM: 8 GB
- Storage: 100 GB SSD
- Services: iRedMail, Reverse Proxy, Monitoring

Total: 14 cores, 40 GB RAM, 400 GB storage
Good for: Realistic testing, proper separation of concerns

Server 1 - Identity & Auth:
- FreeIPA, Keycloak
- 4 cores, 8 GB RAM, 100 GB

Server 2 - Database:
- PostgreSQL, Redis
- 4 cores, 12 GB RAM, 100 GB

Server 3 - Collaboration:
- Nextcloud, Mattermost
- 4 cores, 12 GB RAM, 150 GB

Server 4 - Communications:
- Jitsi, iRedMail, Zammad
- 4 cores, 8 GB RAM, 100 GB

Server 5 - Infrastructure:
- Reverse Proxy, Monitoring, Backup
- 2 cores, 4 GB RAM, 200 GB

Total: 18 cores, 44 GB RAM, 650 GB storage
Good for: Production-like testing, full architecture validation

                    School Network
                          │
                   ┌──────┴──────┐
                   │ Lab Switch  │
                   └──────┬──────┘
                          │
        ┌─────────────────┼─────────────────┐
        │                 │                 │
   ┌────▼────┐       ┌────▼────┐      ┌────▼────┐
   │ Lab-VM1 │       │ Lab-VM2 │      │ Lab-VM3 │
   │Identity │       │  Apps   │      │  Comm   │
   │10.0.X.11│       │10.0.X.12│      │10.0.X.13│
   └─────────┘       └─────────┘      └─────────┘

Use school network for connectivity, but isolated VLAN:
Lab Subnet: 10.0.50.0/24 (adjust to match school's scheme)

IP Assignments:
10.0.50.10 - Gateway (if needed)
10.0.50.11 - lab-id1 (FreeIPA, Keycloak)
10.0.50.12 - lab-db1 (PostgreSQL, Redis)
10.0.50.13 - lab-app1 (Nextcloud, Mattermost)
10.0.50.14 - lab-comm1 (Jitsi, Mail, Zammad)
10.0.50.15 - lab-infra1 (Proxy, Monitoring)
10.0.50.20-50 - DHCP range for test clients

# Add to /etc/hosts on all servers
10.0.50.11  id.lab.local ipa.lab.local sso.lab.local
10.0.50.12  db.lab.local
10.0.50.13  cloud.lab.local chat.lab.local
10.0.50.14  mail.lab.local meet.lab.local desk.lab.local
10.0.50.15  proxy.lab.local monitor.lab.local

ssh -L 8443:cloud.lab.local:443 username@lab-gateway
# Access: https://localhost:8443

┌─────────────────────────────────────────────────────────────┐
│                      Test Clients                           │
│  (Your Laptop, Phone, Other Lab Computers)                  │
└────────────────────────┬────────────────────────────────────┘
                         │
┌────────────────────────▼────────────────────────────────────┐
│              lab-infra1 (Proxy Server)                      │
│  Traefik Reverse Proxy - Routes all traffic                │
│  Ports: 80, 443                                             │
└────────────────────────┬────────────────────────────────────┘
                         │
        ┌────────────────┼────────────────┐
        │                │                │
┌───────▼──────┐  ┌──────▼──────┐  ┌─────▼──────┐
│  lab-id1     │  │  lab-app1   │  │ lab-comm1  │
│              │  │             │  │            │
│ FreeIPA      │  │ Nextcloud   │  │ Jitsi      │
│ Keycloak ────┼──┤ Mattermost  │  │ iRedMail   │
│              │  │             │  │ Zammad     │
└──────┬───────┘  └──────┬──────┘  └─────┬──────┘
       │                 │                │
       └─────────────────┼────────────────┘
                         │
                  ┌──────▼──────┐
                  │  lab-db1    │
                  │             │
                  │ PostgreSQL  │
                  │ Redis       │
                  └─────────────┘

Features:
├── Internal extensions (100-999)
├── Inbound/outbound calling via SIP trunk
├── Auto-attendant (IVR)
├── Call queues for departments
├── Voicemail to email
├── Call recording (compliance)
├── Conference bridges
├── Softphone support (desktop/mobile)
├── Integration with CRM for click-to-call
└── Real-time call monitoring

Hardware Requirements:
- CPU: 2-4 cores
- RAM: 4-8 GB
- Storage: 50-100 GB (call recordings can grow)
- Network: Dedicated VLAN recommended for QoS

# Server: lab-voip1 (10.0.50.15)
# Install FreePBX (includes Asterisk)
cd /opt
wget https://www.freepbx.org/downloads/freepbx-distro-latest.iso
# Boot from ISO or use Docker container

# Docker alternative:
docker run -d --name freepbx \
  --net=host \
  --cap-add=NET_ADMIN \
  -v /data/freepbx:/data \
  -e TIMEZONE=America/New_York \
  tiredofit/freepbx:latest

Extensions:
100-199: Executive team
200-299: Sales department
300-399: Support department
400-499: IT department
500-599: Operations

Ring Groups:
600: Sales (rings 200-299)
601: Support (rings 300-399)
602: IT (rings 400-499)

IVR Menu:
"Press 1 for Sales"
"Press 2 for Support"
"Press 3 for IT"
"Press 9 for Directory"

Features:
├── Contact management
├── Lead tracking and conversion
├── Sales pipeline management
├── Email integration (track all communications)
├── Calendar and task management
├── Reporting and dashboards
├── Mobile app
├── VoIP integration (click-to-call)
├── Workflow automation
└── Custom modules

Hardware Requirements:
- CPU: 2-4 cores
- RAM: 4-8 GB
- Storage: 50 GB

# Server: lab-app2 (10.0.50.16)
# Create database
sudo -u postgres psql
CREATE DATABASE suitecrm;
CREATE USER suitecrm WITH ENCRYPTED PASSWORD 'CrmPass2024!';
GRANT ALL PRIVILEGES ON DATABASE suitecrm TO suitecrm;
\q

# Install SuiteCRM
cd /var/www
sudo wget https://suitecrm.com/download/latest
sudo unzip SuiteCRM-*.zip
sudo chown -R www-data:www-data suitecrm
sudo chmod -R 755 suitecrm

# Configure nginx
sudo nano /etc/nginx/sites-available/crm.lab.local

server {
    listen 80;
    server_name crm.lab.local;
    root /var/www/suitecrm;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.1-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }
}

docker run -d --name espocrm \
  -p 8090:80 \
  -e ESPOCRM_DATABASE_HOST=10.0.50.11 \
  -e ESPOCRM_DATABASE_NAME=espocrm \
  -e ESPOCRM_DATABASE_USER=espocrm \
  -e ESPOCRM_DATABASE_PASSWORD=EspoPass2024! \
  -e ESPOCRM_ADMIN_USERNAME=admin \
  -e ESPOCRM_ADMIN_PASSWORD=AdminPass2024! \
  -e ESPOCRM_SITE_URL=http://crm.lab.local \
  espocrm/espocrm:latest

Core Modules:
├── Accounting & Finance
│   ├── General ledger
│   ├── Invoicing
│   ├── Accounts receivable/payable
│   ├── Bank reconciliation
│   └── Multi-currency support
├── Sales Management
│   ├── Quotations and sales orders
│   ├── eCommerce integration
│   └── Customer portal
├── Purchase Management
│   ├── Purchase orders
│   ├── Vendor management
│   └── Procurement automation
├── Inventory & Warehouse
│   ├── Stock management
│   ├── Barcode scanning
│   ├── Multi-warehouse
│   └── Logistics
├── Manufacturing
│   ├── Bill of Materials (BoM)
│   ├── Work orders
│   └── Quality control
├── Human Resources
│   ├── Employee management
│   ├── Attendance tracking
│   ├── Leave management
│   ├── Recruitment
│   └── Performance reviews
├── Project Management
│   ├── Tasks and projects
│   ├── Timesheets
│   ├── Resource allocation
│   └── Gantt charts
└── Point of Sale (POS)
    ├── Retail management
    ├── Multi-store support
    └── Offline mode

Hardware Requirements:
- CPU: 4-8 cores
- RAM: 8-16 GB
- Storage: 100-200 GB

# Server: lab-erp1 (10.0.50.17)
# Install Odoo
sudo wget -O - https://nightly.odoo.com/odoo.key | sudo gpg --dearmor -o /usr/share/keyrings/odoo.gpg
echo 'deb [signed-by=/usr/share/keyrings/odoo.gpg] https://nightly.odoo.com/17.0/nightly/deb/ ./' | sudo tee /etc/apt/sources.list.d/odoo.list
sudo apt update
sudo apt install odoo -y

# Configure Odoo
sudo nano /etc/odoo/odoo.conf

[options]
admin_passwd = OdooMaster2024!
db_host = 10.0.50.11
db_port = 5432
db_user = odoo
db_password = OdooDb2024!
xmlrpc_port = 8069
proxy_mode = True

sudo -u postgres psql
CREATE DATABASE odoo;
CREATE USER odoo WITH ENCRYPTED PASSWORD 'OdooDb2024!';
GRANT ALL PRIVILEGES ON DATABASE odoo TO odoo;
\q

sudo systemctl restart odoo

# More modern UI, Python-based
docker run -d --name erpnext \
  -p 8080:8000 \
  -e MARIADB_HOST=10.0.50.11 \
  frappe/erpnext:latest

Features:
├── Document versioning
├── Metadata tagging
├── Full-text search (OCR support)
├── Workflow automation
├── Records management (compliance)
├── Email archiving
├── Digital signatures
├── Audit trails
├── Document templates
└── Mobile access

Hardware Requirements:
- CPU: 2-4 cores
- RAM: 4-8 GB
- Storage: 100-500 GB

# Server: lab-app2 (10.0.50.16)
docker run -d --name openkm \
  -p 8090:8080 \
  -v /data/openkm:/opt/openkm \
  -e DB_HOST=10.0.50.11 \
  -e DB_NAME=openkm \
  -e DB_USER=openkm \
  -e DB_PASS=DmsPass2024! \
  openkm/openkm-ce:latest

Features:
├── Kanban boards
├── Scrum support (sprints, backlog)
├── Issue tracking
├── Wiki documentation
├── Time tracking
├── Gantt charts
├── Custom workflows
├── Multi-project support
└── Mobile apps

Hardware Requirements:
- CPU: 2 cores
- RAM: 4 GB
- Storage: 20 GB

# Server: lab-app3 (10.0.50.18)
git clone https://github.com/kaleidos-ventures/taiga-docker.git
cd taiga-docker
nano docker-compose.yml
# Update environment variables

docker-compose up -d

# More traditional PM tool, Gantt-focused
docker run -d -p 8080:80 \
  -e SECRET_KEY_BASE=secret \
  -e DATABASE_URL=postgres://openproject:pass@10.0.50.11/openproject \
  openproject/community:latest

Features:
├── Asset tracking (hardware, software)
├── Check-in/check-out to employees
├── License management
├── Maintenance schedules
├── Depreciation tracking
├── QR code/barcode support
├── Custom fields
├── Audit reports
└── Email notifications

Hardware Requirements:
- CPU: 2 cores
- RAM: 2-4 GB
- Storage: 20 GB

# Server: lab-app3 (10.0.50.18)
docker run -d --name snipeit \
  -p 8085:80 \
  -e MYSQL_PORT_3306_TCP_ADDR=10.0.50.11 \
  -e MYSQL_PORT_3306_TCP_PORT=3306 \
  -e MYSQL_DATABASE=snipeit \
  -e MYSQL_USER=snipeit \
  -e MYSQL_PASSWORD=SnipePass2024! \
  -e APP_URL=http://assets.lab.local \
  -v /data/snipeit:/var/lib/snipeit \
  snipe/snipe-it:latest

Features:
├── IT asset inventory (auto-discovery)
├── Ticket system
├── Change management
├── Problem management
├── Service catalog
├── Knowledge base
├── SLA management
└── Software license tracking

Hardware Requirements:
- CPU: 2 cores
- RAM: 4 GB
- Storage: 30 GB

docker run -d --name glpi \
  -p 8084:80 \
  -e TIMEZONE=America/New_York \
  diouxx/glpi:latest

┌──────────────────────────────────────────────────────────────────┐
│                       External World                             │
│  SIP Trunk Provider │ Email │ Web Clients │ Mobile Apps          │
└────────────────────────────────┬─────────────────────────────────┘
                                 │
┌────────────────────────────────▼─────────────────────────────────┐
│              lab-infra1 (Reverse Proxy + Edge)                   │
│  Traefik - Routes: *.lab.local                                   │
│  Ports: 80, 443, 5060 (SIP)                                      │
└────────────────────────────────┬─────────────────────────────────┘
                                 │
        ┌────────────────────────┼────────────────────┐
        │                        │                    │
┌───────▼───────┐     ┌──────────▼────────┐   ┌──────▼──────────┐
│  IDENTITY     │     │   COLLABORATION   │   │  COMMUNICATIONS │
│  lab-id1      │     │   lab-app1        │   │  lab-comm1      │
│  10.0.50.11   │     │   10.0.50.12      │   │  10.0.50.13     │
│               │     │                   │   │                 │
│ • FreeIPA     │◄────┤ • Nextcloud       │   │ • iRedMail      │
│ • Keycloak    │     │ • Mattermost      │   │ • Zammad        │
│ • PostgreSQL  │     │ • Jitsi Meet      │   │ • Monitoring    │
│ • Redis       │     └───────────────────┘   └─────────────────┘
└───────┬───────┘              │                      │
        │                      │                      │
        └──────────────────────┼──────────────────────┘
                               │
        ┌──────────────────────┼──────────────────────┐
        │                      │                      │
┌───────▼───────┐     ┌────────▼──────────┐   ┌──────▼──────────┐
│  VOIP/PBX     │     │   BUSINESS OPS    │   │  ERP/PROJECTS   │
│  lab-voip1    │     │   lab-app2        │   │  lab-erp1       │
│  10.0.50.15   │     │   10.0.50.16      │   │  10.0.50.17     │
│               │     │                   │   │                 │
│ • FreePBX     │◄────┤ • SuiteCRM        │   │ • Odoo ERP      │
│ • Asterisk    │     │ • OpenKM (DMS)    │   │ • Accounting    │
│ • SIP Trunk   │     │ • E-signing       │   │ • Inventory     │
└───────────────┘     └───────────────────┘   │ • HR/Payroll    │
                               │              │ • Manufacturing │
                      ┌────────▼──────────┐   └─────────────────┘
                      │  IT/PROJECT MGMT  │
                      │  lab-app3         │
                      │  10.0.50.18       │
                      │                   │
                      │ • Taiga (PM)      │
                      │ • Snipe-IT        │
                      │ • GLPI (ITSM)     │
                      └───────────────────┘

Hostname: lab-voip1.lab.local
IP: 10.0.50.15
OS: Ubuntu 24.04 or FreePBX Distro
CPU: 4 cores
RAM: 4-6 GB
Storage: 100 GB (call recordings)
Services: FreePBX, Asterisk

Hostname: lab-app2.lab.local
IP: 10.0.50.16
OS: Ubuntu 24.04 Server
CPU: 4-6 cores
RAM: 8-12 GB
Storage: 150 GB
Services: SuiteCRM, OpenKM

Hostname: lab-erp1.lab.local
IP: 10.0.50.17
OS: Ubuntu 24.04 Server
CPU: 6-8 cores
RAM: 12-16 GB
Storage: 200 GB
Services: Odoo

Hostname: lab-app3.lab.local
IP: 10.0.50.18
OS: Ubuntu 24.04 Server
CPU: 4 cores
RAM: 8 GB
Storage: 100 GB
Services: Taiga, Snipe-IT, GLPI

Hostname: lab-id1.lab.local
IP: 10.0.50.11
OS: Ubuntu 24.04 Server

Services:
├── FreeIPA (LDAP/Kerberos/DNS)
│   └── Ports: 389, 636, 88, 464, 53
├── Keycloak (SSO)
│   └── Port: 8080
└── PostgreSQL (Shared database)
    └── Port: 5432
    └── Redis (Cache)
        └── Port: 6379

Resources: 8 GB RAM, 4 cores, 100 GB disk

Hostname: lab-app1.lab.local
IP: 10.0.50.12
OS: Ubuntu 24.04 Server

Services:
├── Nextcloud (Files, Calendar, Collaboration)
│   └── Port: 80 (internal)
├── Mattermost (Chat)
│   └── Port: 8065
└── Jitsi Meet (Video)
    └── Ports: 80, 443, 10000/udp

Resources: 12 GB RAM, 6 cores, 200 GB disk

Hostname: lab-comm1.lab.local
IP: 10.0.50.13
OS: Ubuntu 24.04 Server

Services:
├── Traefik (Reverse Proxy - Entry Point)
│   └── Ports: 80, 443
├── iRedMail (Email Server)
│   └── Ports: 25, 587, 993
├── Zammad (Help Desk)
│   └── Port: 3000
└── Zabbix (Monitoring)
    └── Port: 8080

Resources: 12 GB RAM, 4 cores, 150 GB disk

ping google.com
ping 10.0.50.11  # From each server to others
ssh labadmin@10.0.50.11  # Test SSH

sudo apt update && sudo apt upgrade -y

sudo apt install -y vim curl wget git htop net-tools

sudo hostnamectl set-hostname lab-id1.lab.local
sudo apt install -y freeipa-server freeipa-server-dns

sudo ipa-server-install \
  --domain=lab.local \
  --realm=LAB.LOCAL \
  --ds-password='LabDS2024!' \
  --admin-password='LabAdmin2024!' \
  --hostname=lab-id1.lab.local \
  --ip-address=10.0.50.11 \
  --setup-dns \
  --forwarder=8.8.8.8 \
  --forwarder=1.1.1.1 \
  --no-ntp \
  --unattended

kinit admin
ipa user-find

sudo apt install -y postgresql-16 postgresql-contrib
sudo systemctl enable postgresql

# Configure to accept network connections
sudo nano /etc/postgresql/16/main/postgresql.conf
# Change: listen_addresses = '10.0.50.11'

sudo nano /etc/postgresql/16/main/pg_hba.conf
# Add: host all all 10.0.50.0/24 scram-sha-256

sudo systemctl restart postgresql

sudo apt install -y redis-server
sudo nano /etc/redis/redis.conf
# Change: bind 10.0.50.11
sudo systemctl restart redis-server

sudo apt install -y openjdk-17-jdk

sudo -u postgres psql
CREATE DATABASE keycloak;
CREATE USER keycloak WITH ENCRYPTED PASSWORD 'KeycloakLab2024!';
GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;
\q

cd /opt
sudo wget https://github.com/keycloak/keycloak/releases/download/24.0.0/keycloak-24.0.0.tar.gz
sudo tar -xzf keycloak-24.0.0.tar.gz
sudo mv keycloak-24.0.0 keycloak
sudo useradd -r -s /bin/false keycloak
sudo chown -R keycloak:keycloak /opt/keycloak

sudo nano /opt/keycloak/conf/keycloak.conf

db=postgres
db-url=jdbc:postgresql://10.0.50.11:5432/keycloak
db-username=keycloak
db-password=KeycloakLab2024!
hostname=sso.lab.local
http-enabled=true
http-port=8080
proxy=edge

cd /opt/keycloak
sudo -u keycloak ./bin/kc.sh build

# Create systemd service
sudo nano /etc/systemd/system/keycloak.service

[Unit]
Description=Keycloak
After=network.target postgresql.service

[Service]
Type=idle
User=keycloak
Group=keycloak
ExecStart=/opt/keycloak/bin/kc.sh start
Restart=on-failure

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable keycloak
sudo systemctl start keycloak

# Create admin user
cd /opt/keycloak
export KCADM=/opt/keycloak/bin/kcadm.sh
sudo -u keycloak $KCADM config credentials \
  --server http://localhost:8080 \
  --realm master \
  --user admin \
  --password LabAdmin2024!

Edit Mode: WRITABLE
Vendor: Red Hat Directory Server
Connection URL: ldap://10.0.50.11
Bind DN: uid=admin,cn=users,cn=accounts,dc=lab,dc=local
Bind Credential: LabAdmin2024!
Users DN: cn=users,cn=accounts,dc=lab,dc=local
Username LDAP Attribute: uid
RDN LDAP Attribute: uid
UUID LDAP Attribute: ipaUniqueID
User Object Classes: person,inetOrgPerson

# On lab-id1, create test user
kinit admin
ipa user-add testuser --first=Test --last=User --email=test@lab.local --password
# Set password when prompted: TestUser123!

# On lab-id1 (FreeIPA DNS)
kinit admin
ipa dnsrecord-add lab.local cloud --a-rec=10.0.50.12

sudo apt install -y nginx php8.3-fpm php8.3-cli php8.3-common \
  php8.3-pgsql php8.3-zip php8.3-gd php8.3-mbstring php8.3-curl \
  php8.3-xml php8.3-bcmath php8.3-intl php8.3-imagick \
  php8.3-apcu php8.3-redis php8.3-gmp unzip

# SSH to lab-id1
sudo -u postgres psql
CREATE DATABASE nextcloud;
CREATE USER nextcloud WITH ENCRYPTED PASSWORD 'NextcloudLab2024!';
GRANT ALL PRIVILEGES ON DATABASE nextcloud TO nextcloud;
\q

# On lab-app1
cd /tmp
wget https://download.nextcloud.com/server/releases/nextcloud-28.0.0.tar.bz2
sudo tar -xjf nextcloud-28.0.0.tar.bz2 -C /var/www/
sudo chown -R www-data:www-data /var/www/nextcloud

sudo nano /etc/php/8.3/fpm/php.ini
# Set: memory_limit = 512M
# Set: upload_max_filesize = 2G
# Set: post_max_size = 2G

sudo systemctl restart php8.3-fpm

sudo nano /etc/nginx/sites-available/nextcloud

server {
    listen 80;
    server_name cloud.lab.local;
    root /var/www/nextcloud;

    location / {
        try_files $uri $uri/ /index.php$request_uri;
    }

    location ~ \.php(?:$|/) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
    }
}

sudo ln -s /etc/nginx/sites-available/nextcloud /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx

cd /var/www/nextcloud
sudo -u www-data php occ maintenance:install \
  --database="pgsql" \
  --database-name="nextcloud" \
  --database-host="10.0.50.11:5432" \
  --database-user="nextcloud" \
  --database-pass="NextcloudLab2024!" \
  --admin-user="admin" \
  --admin-pass="LabAdmin2024!" \
  --data-dir="/var/www/nextcloud/data"

# Add trusted domains
sudo -u www-data php occ config:system:set trusted_domains 0 --value=cloud.lab.local
sudo -u www-data php occ config:system:set trusted_domains 1 --value=10.0.50.12

# Configure Redis
sudo -u www-data php occ config:system:set redis host --value=10.0.50.11
sudo -u www-data php occ config:system:set redis port --value=6379
sudo -u www-data php occ config:system:set memcache.local --value='\\OC\\Memcache\\APCu'
sudo -u www-data php occ config:system:set memcache.distributed --value='\\OC\\Memcache\\Redis'

# SSH to lab-id1
sudo -u postgres psql
CREATE DATABASE mattermost;
CREATE USER mattermost WITH ENCRYPTED PASSWORD 'MattermostLab2024!';
GRANT ALL PRIVILEGES ON DATABASE mattermost TO mattermost;
\q

# On lab-app1
cd /tmp
wget https://releases.mattermost.com/9.3.0/mattermost-9.3.0-linux-amd64.tar.gz
tar -xzf mattermost-9.3.0-linux-amd64.tar.gz
sudo mv mattermost /opt/
sudo mkdir /opt/mattermost/data
sudo useradd --system --user-group mattermost
sudo chown -R mattermost:mattermost /opt/mattermost

sudo nano /opt/mattermost/config/config.json

{
  "ServiceSettings": {
    "SiteURL": "http://chat.lab.local",
    "ListenAddress": ":8065"
  },
  "SqlSettings": {
    "DriverName": "postgres",
    "DataSource": "postgres://mattermost:MattermostLab2024!@10.0.50.11:5432/mattermost?sslmode=disable"
  }
}

sudo nano /etc/systemd/system/mattermost.service

[Unit]
Description=Mattermost
After=network.target

[Service]
Type=notify
ExecStart=/opt/mattermost/bin/mattermost
TimeoutStartSec=3600
Restart=always
User=mattermost
Group=mattermost
WorkingDirectory=/opt/mattermost

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable mattermost
sudo systemctl start mattermost

curl -sL https://download.jitsi.org/jitsi-key.gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/jitsi-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/jitsi-keyring.gpg] https://download.jitsi.org stable/" | sudo tee /etc/apt/sources.list.d/jitsi-stable.list
sudo apt update

sudo apt install -y jitsi-meet
# During install: hostname = meet.lab.local
# SSL: self-signed (we'll use proxy later)

sudo nano /etc/jitsi/meet/meet.lab.local-config.js
# Verify domain settings match

sudo hostnamectl set-hostname lab-comm1.lab.local

cd /tmp
wget https://github.com/iredmail/iRedMail/archive/1.6.8.tar.gz
tar -xzf 1.6.8.tar.gz
cd iRedMail-1.6.8

sudo bash iRedMail.sh

sudo apt install -y docker.io docker-compose
sudo systemctl enable docker

sudo mkdir -p /opt/traefik/{config,certs,logs}
cd /opt/traefik

sudo nano docker-compose.yml

version: '3.8'

services:
  traefik:
    image: traefik:v2.11
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./config:/config:ro
      - ./certs:/certs
      - ./logs:/logs
    networks:
      - proxy

networks:
  proxy:
    external: true

sudo nano traefik.yml

api:
  dashboard: true
  insecure: true

entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"

providers:
  file:
    directory: /config
    watch: true

log:
  level: INFO
  filePath: /logs/traefik.log

accessLog:
  filePath: /logs/access.log

sudo nano config/backends.yml

http:
  routers:
    nextcloud:
      rule: "Host(`cloud.lab.local`)"
      entryPoints:
        - http
      service: nextcloud

    mattermost:
      rule: "Host(`chat.lab.local`)"
      entryPoints:
        - http
      service: mattermost

    jitsi:
      rule: "Host(`meet.lab.local`)"
      entryPoints:
        - http
      service: jitsi

    keycloak:
      rule: "Host(`sso.lab.local`)"
      entryPoints:
        - http
      service: keycloak

  services:
    nextcloud:
      loadBalancer:
        servers:
          - url: "http://10.0.50.12:80"

    mattermost:
      loadBalancer:
        servers:
          - url: "http://10.0.50.12:8065"

    jitsi:
      loadBalancer:
        servers:
          - url: "http://10.0.50.12:80"

    keycloak:
      loadBalancer:
        servers:
          - url: "http://10.0.50.11:8080"

sudo docker network create proxy
sudo docker-compose up -d
sudo docker-compose logs -f

10.0.50.13   cloud.lab.local
10.0.50.13   chat.lab.local
10.0.50.13   meet.lab.local
10.0.50.13   sso.lab.local
10.0.50.13   mail.lab.local

# On lab-id1
sudo -u postgres psql
CREATE DATABASE zammad_production;
CREATE USER zammad WITH ENCRYPTED PASSWORD 'ZammadLab2024!';
GRANT ALL PRIVILEGES ON DATABASE zammad_production TO zammad;
\q

# On lab-comm1
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
sudo apt update
sudo apt install -y elasticsearch

# Configure
sudo nano /etc/elasticsearch/elasticsearch.yml
# Add: network.host: 127.0.0.1
# Add: xpack.security.enabled: false

sudo systemctl enable elasticsearch
sudo systemctl start elasticsearch

curl -fsSL https://dl.packager.io/srv/zammad/zammad/key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/pkgr-zammad.gpg> /dev/null
echo "deb [signed-by=/etc/apt/trusted.gpg.d/pkgr-zammad.gpg] https://dl.packager.io/srv/deb/zammad/zammad/stable/ubuntu 24.04 main"| sudo tee /etc/apt/sources.list.d/zammad.list > /dev/null
sudo apt update
sudo apt install -y zammad

# Configure
sudo zammad config:set DATABASE_URL="postgresql://zammad:ZammadLab2024!@10.0.50.11:5432/zammad_production"
sudo zammad run rails db:migrate
sudo zammad run rake searchindex:rebuild

sudo systemctl restart zammad

# On lab-comm1, edit /opt/traefik/config/backends.yml
# Add under routers:

    zammad:
      rule: "Host(`desk.lab.local`)"
      entryPoints:
        - http
      service: zammad

# Add under services:
    zammad:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:3000"

# Traefik auto-reloads

# On lab-app1
sudo -u www-data php occ app:install user_oidc
sudo -u www-data php occ user_oidc:provider add Keycloak \
  --clientid=nextcloud \
  --clientsecret=<get-from-keycloak> \
  --discoveryuri=http://sso.lab.local/realms/lab/.well-known/openid-configuration

# On lab-id1
kinit admin
ipa user-add guard1 --first=Guard --last=One --email=guard1@lab.local --password
ipa user-add guard2 --first=Guard --last=Two --email=guard2@lab.local --password
ipa user-add manager1 --first=Manager --last=One --email=manager1@lab.local --password
ipa user-add office1 --first=Office --last=Staff --email=office1@lab.local --password

# Create groups
ipa group-add guards --desc="Security Guards"
ipa group-add managers --desc="Managers"
ipa group-add office-staff --desc="Office Staff"

# Add users to groups
ipa group-add-member guards --users=guard1,guard2
ipa group-add-member managers --users=manager1
ipa group-add-member office-staff --users=office1

# On lab-comm1
sudo bash /var/vmail/bin/create_mail_user_SQL.sh guard1@lab.local 'Password123!'
sudo bash /var/vmail/bin/create_mail_user_SQL.sh guard2@lab.local 'Password123!'
sudo bash /var/vmail/bin/create_mail_user_SQL.sh manager1@lab.local 'Password123!'
sudo bash /var/vmail/bin/create_mail_user_SQL.sh office1@lab.local 'Password123!'

# Option 1: FreePBX Distro ISO (recommended)
# Download from https://www.freepbx.org/downloads/
# Boot and install, select all features

# Option 2: Manual Asterisk + FreePBX
sudo apt update && sudo apt upgrade -y
sudo apt install -y asterisk asterisk-modules

# Or Option 3: Docker
docker run -d --name freepbx \
  --net=host \
  --cap-add=NET_ADMIN \
  -v /data/freepbx:/data \
  -e TIMEZONE=America/New_York \
  tiredofit/freepbx:latest

Extensions → Add Extension → Chan SIP
Extension: 101
Display Name: Guard One
Secret: strong_password

Repeat for:
102 - Guard Two
103 - Manager One
201 - Sales Dept
301 - Support Dept
401 - IT Dept

Enable: Yes
Email: extension@lab.local
Email Attachment: Yes
Delete After Email: No

Extensions → Ring Groups
Group 600: Sales Team (rings 201, 202, 203)
Group 601: Support Team (rings 301, 302, 303)
Group 602: IT Team (rings 401, 402)

Ring Strategy: ringall

Applications → IVR
Name: Main Menu
Announcement: "Thank you for calling. Press 1 for Sales, 2 for Support, 3 for IT, 9 for directory"

IVR Entries:
1 → Ring Group 600 (Sales)
2 → Ring Group 601 (Support)
3 → Ring Group 602 (IT)
9 → Directory

Connectivity → Inbound Routes
DID: [leave blank for any]
Destination: IVR → Main Menu

Admin → System Recordings
Upload announcements or use TTS

For specific extensions:
Extensions → [select extension] → Record Options

Applications → Conferences
Conference Number: 9000
PIN: [optional]
Max users: 10

Connectivity → Trunks → Add Trunk → Chan SIP

Example for Twilio:
Trunk Name: Twilio
Outbound CallerID: +1XXXXXXXXXX

Peer Details:
host=yourdomain.pstn.twilio.com
username=your_username
secret=your_auth_token
type=peer
insecure=port,invite
context=from-trunk

Outbound Routes:
Route Pattern: NXXNXXXXXX (10-digit)
Trunk: Twilio

# In FreePBX User Management
Settings → User Management → Directories
Add LDAP Directory:
Host: 10.0.50.11
Base DN: cn=users,cn=accounts,dc=lab,dc=local
User DN: uid=admin,cn=users,cn=accounts,dc=lab,dc=local
Password: [FreeIPA admin password]

sudo ufw allow 5060/udp  # SIP signaling
sudo ufw allow 5061/tcp  # SIP TLS
sudo ufw allow 10000:20000/udp  # RTP media
sudo ufw allow 80/tcp    # HTTP
sudo ufw allow 443/tcp   # HTTPS

Options:
- Zoiper (Windows/Mac/Linux/Mobile)
- Linphone (Open source)
- MicroSIP (Windows)
- Bria (Commercial)

Configuration:
SIP Server: 10.0.50.15 or voip.lab.local
Username: 101
Password: [extension secret]

✓ Call from ext 101 to 102
✓ Test voicemail
✓ Call conference bridge (9000)
✓ Test IVR menu
✓ Check call recording

sudo -u postgres psql
CREATE DATABASE suitecrm;
CREATE USER suitecrm WITH ENCRYPTED PASSWORD 'CrmPass2024!';
GRANT ALL PRIVILEGES ON DATABASE suitecrm TO suitecrm;
GRANT ALL ON SCHEMA public TO suitecrm;
\q

sudo apt install -y nginx php8.1-fpm php8.1-mysql php8.1-pgsql \
  php8.1-curl php8.1-xml php8.1-mbstring php8.1-zip \
  php8.1-gd php8.1-imap php8.1-ldap

cd /var/www
sudo wget https://github.com/salesagility/SuiteCRM/releases/download/v8.6.1/SuiteCRM-8.6.1.zip
sudo unzip SuiteCRM-8.6.1.zip
sudo mv SuiteCRM-8.6.1 suitecrm
sudo chown -R www-data:www-data suitecrm
sudo chmod -R 755 suitecrm

server {
    listen 80;
    server_name crm.lab.local;
    root /var/www/suitecrm/public;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.1-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
}

Admin → Password Management → LDAP Settings
Server: 10.0.50.11
Port: 389
Base DN: cn=users,cn=accounts,dc=lab,dc=local
Bind DN: uid=admin,cn=users,cn=accounts,dc=lab,dc=local
Auto Create Users: Yes

Admin → Email Settings
Outbound:
SMTP Server: 10.0.50.13
Port: 587
Username: crm@lab.local
Security: TLS

Inbound:
Server: 10.0.50.13
Protocol: IMAP
Port: 993

Download Asterisk connector for SuiteCRM
Upload via Module Loader
Configure: Asterisk host: 10.0.50.15
AMI User/Password (create in FreePBX)
Test click-to-call functionality

# Add Odoo repository
sudo wget -O - https://nightly.odoo.com/odoo.key | sudo gpg --dearmor -o /usr/share/keyrings/odoo.gpg
echo 'deb [signed-by=/usr/share/keyrings/odoo.gpg] https://nightly.odoo.com/17.0/nightly/deb/ ./' | sudo tee /etc/apt/sources.list.d/odoo.list

sudo apt update
sudo apt install -y odoo

# Or use Docker:
docker run -d --name odoo17 \
  -p 8069:8069 \
  -e HOST=10.0.50.11 \
  -e USER=odoo \
  -e PASSWORD=OdooDb2024! \
  -v /data/odoo:/var/lib/odoo \
  odoo:17.0

sudo -u postgres psql
CREATE DATABASE odoo;
CREATE USER odoo WITH ENCRYPTED PASSWORD 'OdooDb2024!';
GRANT ALL PRIVILEGES ON DATABASE odoo TO odoo;
\q

sudo nano /etc/odoo/odoo.conf

[options]
admin_passwd = OdooMaster2024!
db_host = 10.0.50.11
db_port = 5432
db_user = odoo
db_password = OdooDb2024!
xmlrpc_port = 8069
proxy_mode = True
list_db = False

sudo systemctl restart odoo
# Navigate to http://erp.lab.local or http://10.0.50.17:8069
# Create database: production_lab
# Master password: OdooMaster2024!
# Admin email: admin@lab.local
# Choose: Start with Apps

Navigate to Apps (remove Apps filter)

Install:
✓ Sales Management
✓ Invoicing / Accounting
✓ Purchase Management
✓ Inventory
✓ CRM
✓ Project
✓ Employees
✓ Time Off
✓ Timesheets
✓ Expenses
✓ Contacts
✓ Calendar

Optional (if needed):
- Manufacturing
- Point of Sale
- eCommerce
- Email Marketing
- Help Desk

Settings → General Settings → Companies
Name: Your Company Name
Address, Phone, Email, Website
Currency: USD (or your currency)
Fiscal Year: January-December

# Create database
sudo -u postgres psql
CREATE DATABASE openkm;
CREATE USER openkm WITH ENCRYPTED PASSWORD 'DmsPass2024!';
GRANT ALL PRIVILEGES ON DATABASE openkm TO openkm;
\q

# Docker deployment
docker run -d --name openkm \
  -p 8090:8080 \
  -v /data/openkm:/opt/openkm/repository \
  -e DB_HOST=10.0.50.11 \
  -e DB_NAME=openkm \
  -e DB_USER=openkm \
  -e DB_PASS=DmsPass2024! \
  openkm/openkm-ce:latest

git clone https://github.com/kaleidos-ventures/taiga-docker.git /opt/taiga
cd /opt/taiga

# Edit docker-compose.yml
nano docker-compose.yml
# Update:
# - POSTGRES_HOST=10.0.50.11
# - TAIGA_SECRET_KEY=[generate random]
# - TAIGA_SITES_DOMAIN=projects.lab.local

docker-compose up -d

docker run -d --name snipeit \
  -p 8085:80 \
  -e MYSQL_PORT_3306_TCP_ADDR=10.0.50.11 \
  -e MYSQL_DATABASE=snipeit \
  -e MYSQL_USER=snipeit \
  -e MYSQL_PASSWORD=SnipePass2024! \
  -e APP_URL=http://assets.lab.local \
  -v /data/snipeit:/var/lib/snipeit \
  snipe/snipe-it:latest

docker run -d --name glpi \
  -p 8084:80 \
  -e TIMEZONE=America/New_York \
  -v /data/glpi:/var/www/html/glpi \
  diouxx/glpi:latest

# On Windows:
Download from: https://github.com/glpi-project/glpi-agent/releases
Install with server: http://10.0.50.18:8084/plugins/fusioninventory/

# On Linux:
sudo apt install glpi-agent
sudo nano /etc/glpi-agent/agent.cfg
# server = http://10.0.50.18:8084/plugins/fusioninventory/
sudo systemctl restart glpi-agent

# Add to traefik dynamic config
- "traefik.http.routers.crm.rule=Host(`crm.lab.local`)"
- "traefik.http.routers.erp.rule=Host(`erp.lab.local`)"
- "traefik.http.routers.voip.rule=Host(`voip.lab.local`)"
- "traefik.http.routers.docs.rule=Host(`docs.lab.local`)"
- "traefik.http.routers.projects.rule=Host(`projects.lab.local`)"
- "traefik.http.routers.assets.rule=Host(`assets.lab.local`)"
- "traefik.http.routers.itsm.rule=Host(`itsm.lab.local`)"

#!/bin/bash
# lab-deploy.sh - Automated lab deployment
# Run this on EACH server with appropriate SERVER_ROLE

set -e

# Configuration
SERVER_ROLE=$1  # id, app, or comm
BASE_IP="10.0.50"
LAB_DOMAIN="lab.local"
DB_PASSWORD="LabDB2024!"

if [ -z "$SERVER_ROLE" ]; then
    echo "Usage: $0 [id|app|comm]"
    exit 1
fi

# Common setup
echo "=== Common Setup ==="
sudo apt update
sudo apt upgrade -y
sudo apt install -y vim curl wget git htop net-tools

# Role-specific installation
case $SERVER_ROLE in
    id)
        echo "=== Installing Identity Server ==="
        sudo hostnamectl set-hostname lab-id1.lab.local

        # FreeIPA
        sudo apt install -y freeipa-server freeipa-server-dns
        sudo ipa-server-install \
            --domain=$LAB_DOMAIN \
            --realm=$(echo $LAB_DOMAIN | tr '[:lower:]' '[:upper:]') \
            --ds-password="$DB_PASSWORD" \
            --admin-password="$DB_PASSWORD" \
            --hostname=lab-id1.$LAB_DOMAIN \
            --ip-address=${BASE_IP}.11 \
            --setup-dns \
            --forwarder=8.8.8.8 \
            --no-ntp \
            --unattended

        # PostgreSQL
        sudo apt install -y postgresql-16 postgresql-contrib
        sudo systemctl enable postgresql
        # ... (configure for network access)

        # Redis
        sudo apt install -y redis-server

        echo "Identity server setup complete!"
        ;;

    app)
        echo "=== Installing Application Server ==="
        sudo hostnamectl set-hostname lab-app1.lab.local

        # Point DNS to FreeIPA
        echo "nameserver ${BASE_IP}.11" | sudo tee /etc/resolv.conf

        # Nextcloud dependencies
        sudo apt install -y nginx php8.3-fpm php8.3-pgsql \
            php8.3-gd php8.3-curl php8.3-zip php8.3-xml \
            php8.3-mbstring php8.3-intl

        # Download Nextcloud
        cd /tmp
        wget https://download.nextcloud.com/server/releases/nextcloud-28.0.0.tar.bz2
        sudo tar -xjf nextcloud-28.0.0.tar.bz2 -C /var/www/
        sudo chown -R www-data:www-data /var/www/nextcloud

        # Mattermost
        wget https://releases.mattermost.com/9.3.0/mattermost-9.3.0-linux-amd64.tar.gz
        tar -xzf mattermost-9.3.0-linux-amd64.tar.gz
        sudo mv mattermost /opt/

        # Jitsi
        curl -sL https://download.jitsi.org/jitsi-key.gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/jitsi-keyring.gpg
        echo "deb [signed-by=/usr/share/keyrings/jitsi-keyring.gpg] https://download.jitsi.org stable/" | sudo tee /etc/apt/sources.list.d/jitsi-stable.list
        sudo apt update
        sudo apt install -y jitsi-meet

        echo "Application server setup complete!"
        echo "Manual configuration required for each service."
        ;;

    comm)
        echo "=== Installing Communications Server ==="
        sudo hostnamectl set-hostname lab-comm1.lab.local

        # Docker for Traefik
        sudo apt install -y docker.io docker-compose
        sudo systemctl enable docker

        # iRedMail
        cd /tmp
        wget https://github.com/iredmail/iRedMail/archive/1.6.8.tar.gz
        tar -xzf 1.6.8.tar.gz

        echo "Communications server prerequisites installed!"
        echo "Run iRedMail installer manually: cd /tmp/iRedMail-1.6.8 && sudo bash iRedMail.sh"
        ;;

    *)
        echo "Invalid role. Use: id, app, or comm"
        exit 1
        ;;
esac

echo "=== Setup complete for $SERVER_ROLE ==="

# On lab-id1:
bash lab-deploy.sh id

# On lab-app1:
bash lab-deploy.sh app

# On lab-comm1:
bash lab-deploy.sh comm

# FreeIPA
ipa-replica-prepare lab-id1.lab.local

# Keycloak
cd /opt/keycloak
./bin/kc.sh export --dir /tmp/keycloak-export --realm lab

# Nextcloud
sudo -u www-data php occ config:list system > /tmp/nextcloud-config.json

# Mattermost
cd /opt/mattermost
sudo -u mattermost ./bin/mattermost export bulk /tmp/mattermost-export.json

# Database schemas
pg_dump -s nextcloud > /tmp/nextcloud-schema.sql
pg_dump -s mattermost > /tmp/mattermost-schema.sql

# All servers
sudo systemctl status postgresql
sudo systemctl status keycloak
sudo systemctl status nginx
sudo systemctl status mattermost
sudo systemctl status ipa

# View logs
sudo journalctl -u <service> -f

# From lab-id1
sudo -u postgres psql
\l  # List databases
\c <database>  # Connect to database

# From any server
ping 10.0.50.11  # Test network
curl http://10.0.50.12  # Test web service
telnet 10.0.50.11 5432  # Test PostgreSQL port