Appendix A. Inventory file variables The following tables contain information about the variables used in Ansible Automation Platform's installation inventory files. The tables include the variables that you can use for RPM-based installation and container-based installation. A.1. Ansible variables The following variables control how Ansible Automation Platform interacts with remote hosts. For more information about variables specific to certain plugins, see the documentation for Ansible.Builtin . For a list of global configuration options, see Ansible Configuration Settings . Variable Description ansible_connection The connection plugin used for the task on the target host. This can be the name of any of Ansible connection plugins. SSH protocol types are smart , ssh , or paramiko . Default = smart ansible_host The IP address or name of the target host to use instead of inventory_hostname . ansible_password The password to authenticate to the host. Do not store this variable in plain text. Always use a vault. For more information, see Keep vaulted variables safely visible . ansible_port The connection port number. The default for SSH is 22 . ansible_scp_extra_args This setting is always appended to the default scp command line. ansible_sftp_extra_args This setting is always appended to the default sftp command line. ansible_shell_executable This sets the shell that the Ansible controller uses on the target machine and overrides the executable in ansible.cfg which defaults to /bin/sh . ansible_shell_type The shell type of the target system. Do not use this setting unless you have set the ansible_shell_executable to a non-Bourne (sh) compatible shell. By default commands are formatted using sh-style syntax. Setting this to csh or fish causes commands executed on target systems to follow the syntax of those shells instead. ansible_ssh_common_args This setting is always appended to the default command line for sftp , scp , and ssh . Useful to configure a ProxyCommand for a certain host or group. ansible_ssh_executable This setting overrides the default behavior to use the system ssh . This can override the ssh_executable setting in ansible.cfg . ansible_ssh_extra_args This setting is always appended to the default ssh command line. ansible_ssh_pipelining Determines if SSH pipelining is used. This can override the pipelining setting in ansible.cfg . If using SSH key-based authentication, the key must be managed by an SSH agent. ansible_ssh_private_key_file Private key file used by SSH. Useful if using multiple keys and you do not want to use an SSH agent. ansible_user The user name to use when connecting to the host. Do not change this variable unless /bin/sh is not installed on the target machine or cannot be run from sudo. inventory_hostname This variable takes the hostname of the machine from the inventory script or the Ansible configuration file. You cannot set the value of this variable. Because the value is taken from the configuration file, the actual runtime hostname value can vary from what is returned by this variable. A.2. Automation hub variables RPM variable name Container variable name Description Required or optional Default automationhub_admin_password hub_admin_password Automation hub administrator password. Use of special characters for this variable is limited. The password can include any printable ASCII character except / , " , or @ . Required automationhub_api_token Set the existing token for the installation program. For example, a regenerated token in the automation hub UI will invalidate an existing token. Use this variable to set that token in the installation program the time you run the installation program. Optional automationhub_auto_sign_collections hub_collection_auto_sign If a collection signing service is enabled, collections are not signed automatically by default. Set this variable to true to sign collections by default. Optional false automationhub_backup_collections Ansible automation hub provides artifacts in /var/lib/pulp . These artifacts are automatically backed up by default. Set this variable to false to prevent backup or restore of /var/lib/pulp . Optional true automationhub_client_max_body_size hub_nginx_client_max_body_size Maximum allowed size for data sent to automation hub through NGINX. Optional 20m automationhub_collection_download_count Denote whether or not the collection download count should be displayed in the UI. Optional false automationhub_collection_seed_repository Controls the type of content to upload when hub_seed_collections is set to true . Valid options include: certified , validated Optional Both certified and validated are enabled by default. automationhub_collection_signing_service_key hub_collection_signing_key Path to the collection signing key file. Required if a collection signing service is enabled. automationhub_container_repair_media_type Denote whether or not to run the command pulpcore-manager container-repair-media-type . Valid options include: true , false , auto Optional auto automationhub_container_signing_service_key hub_container_signing_key Path to the container signing key file. Required if a container signing service is enabled. automationhub_create_default_collection_signing_service hub_collection_signing Set this variable to true to enable a collection signing service. Optional false automationhub_create_default_container_signing_service hub_container_signing Set this variable to true to enable a container signing service. Optional false automationhub_disable_hsts hub_nginx_disable_hsts Controls whether HTTP Strict Transport Security (HSTS) is enabled or disabled for automation hub. Set this variable to true to disable HSTS. Optional false automationhub_disable_https hub_nginx_disable_https Controls whether HTTPS is enabled or disabled for automation hub. Set this variable to true to disable HTTPS. Optional false automationhub_enable_api_access_log Controls whether logging is enabled or disabled at /var/log/galaxy_api_access.log . The file logs all user actions made to the platform, including username and IP address. Set this variable to true to enable this logging. Optional false automationhub_enable_unauthenticated_collection_access Controls whether read-only access is enabled or disabled for unauthorized users viewing collections or namespaces for automation hub. Set this variable to true to enable read-only access. Optional false automationhub_enable_unauthenticated_collection_download Controls whether or not unauthorized users can download read-only collections from automation hub. Set this variable to true to enable download of read-only collections. Optional false automationhub_firewalld_zone hub_firewall_zone The firewall zone where automation hub related firewall rules are applied. This controls which networks can access automation hub based on the zone's trust level. Optional public automationhub_force_change_admin_password Denote whether or not to require the change of the default administrator password for automation hub during installation. Set to true to require the user to change the default administrator password during installation. Optional false automationhub_importer_settings hub_galaxy_importer Dictionary of settings to pass to the galaxy-importer.cfg configuration file. These settings control how the galaxy-importer service processes and validates Ansible content. Example values include: ansible-doc , ansible-lint , and flake8 . Optional automationhub_nginx_tls_files_remote Denote whether the web certificate sources are local to the installation program ( false ) or on the remote component server ( true ). Optional The value defined in automationhub_tls_files_remote . automationhub_pg_cert_auth hub_pg_cert_auth Controls whether client certificate authentication is enabled or disabled on the automation hub PostgreSQL database. Set this variable to true to enable client certificate authentication. Optional false automationhub_pg_database hub_pg_database Name of the PostgreSQL database used by automation hub. Optional RPM = automationhub Container = pulp automationhub_pg_host hub_pg_host Hostname of the PostgreSQL database used by automation hub. Required RPM = 127.0.0.1 Container = automationhub_pg_password hub_pg_password Password for the automation hub PostgreSQL database user. Use of special characters for this variable is limited. The ! , # , 0 and @ characters are supported. Use of other special characters can cause the setup to fail. Optional automationhub_pg_port hub_pg_port Port number for the PostgreSQL database used by automation hub. Optional 5432 automationhub_pg_sslmode hub_pg_sslmode Controls the SSL/TLS mode to use when automation hub connects to the PostgreSQL database. Valid options include verify-full , verify-ca , require , prefer , allow , disable . Optional prefer automationhub_pg_username hub_pg_username Username for the automation hub PostgreSQL database user. Optional RPM = automationhub Container = pulp automationhub_pgclient_sslcert hub_pg_tls_cert Path to the PostgreSQL SSL/TLS certificate file for automation hub. Required if using client certificate authentication. automationhub_pgclient_sslkey hub_pg_tls_key Path to the PostgreSQL SSL/TLS key file for automation hub. Required if using client certificate authentication. automationhub_pgclient_tls_files_remote Denote whether the PostgreSQL client certificate sources are local to the installation program ( false ) or on the remote component server ( true ). Optional The value defined in automationhub_tls_files_remote . automationhub_require_content_approval Controls whether content signing is enabled or disabled for automation hub. By default when you upload collections to automation hub, an administrator must approve it before they are made available to users. To disable the content approval flow, set the variable to false . Optional true automationhub_restore_signing_keys Controls whether or not existing signing keys should be restored from a backup. Set to false to disable restoration of existing signing keys. Optional true automationhub_seed_collections hub_seed_collections Controls whether or not pre-loading of collections is enabled. When you run the bundle installer, validated content is uploaded to the validated repository, and certified content is uploaded to the rh-certified repository. By default, certified content and validated content are both uploaded. If you do not want to pre-load content, set this variable to false . For the RPM-based installer, if you only want one type of content, set this variable to true and set the automationhub_collection_seed_repository variable to the type of content you want to include. Optional true automationhub_ssl_cert hub_tls_cert Path to the SSL/TLS certificate file for automation hub. Optional automationhub_ssl_key hub_tls_key Path to the SSL/TLS key file for automation hub. Optional automationhub_tls_files_remote hub_tls_remote Denote whether the automation hub provided certificate files are local to the installation program ( false ) or on the remote component server ( true ). Optional false automationhub_user_headers hub_nginx_user_headers List of additional NGINX headers to add to automation hub's NGINX configuration. Optional [] generate_automationhub_token Controls whether or not a token is generated for automation hub during installation. By default, a token is automatically generated during a fresh installation. If set to true , a token is regenerated during installation. Optional false nginx_hsts_max_age hub_nginx_hsts_max_age Maximum duration (in seconds) that HTTP Strict Transport Security (HSTS) is enforced for automation hub. Optional 63072000 pulp_secret hub_secret_key Secret key value used by automation hub to sign and encrypt data. Optional hub_azure_account_key Azure blob storage account key. Required if using an Azure blob storage backend. hub_azure_account_name Account name associated with the Azure blob storage. Required when using an Azure blob storage backend. hub_azure_container Name of the Azure blob storage container. Optional pulp hub_azure_extra_settings Defines extra parameters for the Azure blob storage backend. For more information about the list of parameters, see django-storages documentation - Azure Storage . Optional {} hub_collection_signing_pass Password for the automation content collection signing service. Required if the collection signing service is protected by a passphrase. hub_collection_signing_service Service for signing collections. Optional ansible-default hub_container_signing_pass Password for the automation content container signing service. Required if the container signing service is protected by a passphrase. hub_container_signing_service Service for signing containers. Optional container-default hub_nginx_http_port Port number that automation hub listens on for HTTP requests. Optional 8081 hub_nginx_https_port Port number that automation hub listens on for HTTPS requests. Optional 8444 hub_nginx_https_protocols Protocols that automation hub will support when handling HTTPS traffic. Optional [TLSv1.2, TLSv1.3] hub_pg_socket UNIX socket used by automation hub to connect to the PostgreSQL database. Optional hub_s3_access_key AWS S3 access key. Required if using an AWS S3 storage backend. hub_s3_bucket_name Name of the AWS S3 storage bucket. Optional pulp hub_s3_extra_settings Used to define extra parameters for the AWS S3 storage backend. For more information about the list of parameters, see django-storages documentation - Amazon S3 . Optional {} hub_s3_secret_key AWS S3 secret key. Required if using an AWS S3 storage backend. hub_shared_data_mount_opts Mount options for the Network File System (NFS) share. Optional rw,sync,hard hub_shared_data_path Path to the Network File System (NFS) share with read, write, and execute (RWX) access. Required if installing more than one instance of automation hub with a file storage backend. When installing a single instance of automation hub, it is optional. hub_storage_backend Automation hub storage backend type. Possible values include: azure , file , s3 . Optional file hub_workers Number of automation hub workers. Optional 2 A.3. Automation controller variables RPM variable name Container variable name Description Required or optional Default admin_email controller_admin_email Email address used by Django for the admin user for automation controller. Optional admin@example.com admin_password controller_admin_password Automation controller administrator password. Use of special characters for this variable is limited. The password can include any printable ASCII character except / , " , or @ . Required admin_username controller_admin_user Username used to identify and create the administrator user in automation controller. Optional admin automationcontroller_client_max_body_size controller_nginx_client_max_body_size Maximum allowed size for data sent to automation controller through NGINX. Optional 5m awx_pg_cert_auth controller_pg_cert_auth Controls whether client certificate authentication is enabled or disabled on the automation controller PostgreSQL database. Set this variable to true to enable client certificate authentication. Optional false controller_firewalld_zone controller_firewall_zone The firewall zone where automation controller related firewall rules are applied. This controls which networks can access automation controller based on the zone's trust level. Optional public controller_nginx_tls_files_remote Denote whether the web certificate sources are local to the installation program ( false ) or on the remote component server ( true ). Optional The value defined in controller_tls_files_remote . controller_pgclient_tls_files_remote Denote whether the PostgreSQL client certificate sources are local to the installation program ( false ) or on the remote component server ( true ). Optional The value defined in controller_tls_files_remote . controller_tls_files_remote controller_tls_remote Denote whether the automation controller provided certificate files are local to the installation program ( false ) or on the remote component server ( true ). Optional false nginx_disable_hsts controller_nginx_disable_hsts Controls whether HTTP Strict Transport Security (HSTS) is enabled or disabled for automation controller. Set this variable to true to disable HSTS. Optional false nginx_disable_https controller_nginx_disable_https Controls whether HTTPS is enabled or disabled for automation controller. Set this variable to true to disable HTTPS. Optional false nginx_hsts_max_age controller_nginx_hsts_max_age Maximum duration (in seconds) that HTTP Strict Transport Security (HSTS) is enforced for automation controller. Optional 63072000 nginx_http_port controller_nginx_http_port Port number that automation controller listens on for HTTP requests. Optional RPM = 80 Container = 8080 nginx_https_port controller_nginx_https_port Port number that automation controller listens on for HTTPS requests. Optional RPM = 443 Container = 8443 nginx_tls_protocols controller_nginx_https_protocols Protocols that automation controller supports when handling HTTPS traffic. Optional RPM = [TLSv1.2] Container = [TLSv1.2, TLSv1.3] nginx_user_headers controller_nginx_user_headers List of additional NGINX headers to add to automation controller's NGINX configuration. Optional [] node_state The status of a node or group of nodes. Valid options include active , deprovision to remove a node from a cluster, or iso_migrate to migrate a legacy isolated node to an execution node. Optional active node_type See receptor_type for the container equivalent variable. For the [automationcontroller] group the two options are: node_type=control - The node only runs project and inventory updates, but not regular jobs. node_type=hybrid - The node runs everything. For the [execution_nodes] group the two options are: node_type=hop - The node forwards jobs to an execution node. node_type=execution - The node can run jobs. Optional For [automationcontroller] = hybrid For [execution_nodes] = execution peers See receptor_peers for the container equivalent variable. Used to indicate which nodes a specific host or group connects to. Wherever this variable is defined, an outbound connection to the specific host or group is established. This variable can be a comma-separated list of hosts and groups from the inventory. This is resolved into a set of hosts that is used to construct the receptor.conf file. Optional pg_database controller_pg_database Name of the PostgreSQL database used by automation controller. Optional awx pg_host controller_pg_host Hostname of the PostgreSQL database used by automation controller. Required pg_password controller_pg_password Password for the automation controller PostgreSQL database user. Use of special characters for this variable is limited. The ! , # , 0 and @ characters are supported. Use of other special characters can cause the setup to fail. Required if not using client certificate authentication. pg_port controller_pg_port Port number for the PostgreSQL database used by automation controller. Optional 5432 pg_sslmode controller_pg_sslmode Controls the SSL/TLS mode to use when automation controller connects to the PostgreSQL database. Valid options include verify-full , verify-ca , require , prefer , allow , disable . Optional prefer pg_username controller_pg_username Username for the automation controller PostgreSQL database user. Optional awx pgclient_sslcert controller_pg_tls_cert Path to the PostgreSQL SSL/TLS certificate file for automation controller. Required if using client certificate authentication. pgclient_sslkey controller_pg_tls_key Path to the PostgreSQL SSL/TLS key file for automation controller. Required if using client certificate authentication. uwsgi_listen_queue_size controller_uwsgi_listen_queue_size Number of requests uwsgi allows in the queue on automation controller until uwsgi_processes can serve them. Optional 2048 web_server_ssl_cert controller_tls_cert Path to the SSL/TLS certificate file for automation controller. Optional web_server_ssl_key controller_tls_key Path to the SSL/TLS key file for automation controller. Optional controller_event_workers Number of event workers that handle job-related events inside automation controller. Optional 4 controller_license_file Path to the automation controller license file. controller_percent_memory_capacity Memory allocation for automation controller. Optional 1.0 (allocates 100% of the total system memory to automation controller) controller_pg_socket UNIX socket used by automation controller to connect to the PostgreSQL database. Optional controller_secret_key Secret key value used by automation controller to sign and encrypt data. Optional A.4. Database variables RPM variable name Container variable name Description pg_ssl_mode Choose one of the two available modes: prefer and verify-full . Set to verify-full for client-side enforced SSL/TLS. Default = prefer postgres_firewalld_zone postgresql_firewall_zone The firewall zone where PostgreSQL related firewall rules are applied. This controls which networks can access PostgreSQL based on the zone's trust level. Default = public postgres_max_connections postgresql_max_connections Maximum database connections setting to apply if you are using an installer-managed database. See PostgreSQL database configuration and maintenance for automation controller for help selecting a value. Default = 1024 postgres_ssl_cert postgresql_tls_cert Path to the PostgreSQL SSL/TLS certificate file. postgres_ssl_key postgresql_tls_key Path to the PostgreSQL SSL/TLS key file. postgres_use_cert Location of the PostgreSQL user certificate file. /path/to/pgsql.crt postgres_use_ssl postgresql_disable_tls Determines if the connection between Ansible Automation Platform and the PostgreSQL database should use SSL/TLS. The default for this variable is false which means SSL/TLS is not used for PostgreSQL connections. When set to true , the platform connects to PostgreSQL by using SSL/TLS. postgresql_admin_username The username for the PostgreSQL admin user. When used, the installation program creates each component's database and credentials. The PostgreSQL admin user must have SUPERUSER privileges. Default = postgres postgresql_admin_password Required when using postgresql_admin_username . The password for the PostgreSQL admin user. When used, the installation program creates each component's database and credentials. The PostgreSQL admin user must have SUPERUSER privileges. postgresql_admin_database The name of the PostgreSQL admin database. Default = postgres postgresql_effective_cache_size This defines the total memory available for caching data. The format should be <int>MB. postgresql_keep_databases Determines whether or not to keep databases during uninstall. When set to true databases will be kept during uninstall. This variable applies to databases managed by the installation program only, and not external customer-created databases. Default = false postgresql_log_destination The location of the PostgreSQL log file. Default = /dev/stderr postgresql_password_encryption The type of PostgreSQL password encryption to use. Default = scram-sha-256 postgresql_shared_buffers The amount of memory allocated for caching data within the database. The format should be <int>MB. postgresql_tls_remote PostgreSQL TLS remote files. Default = false postgresql_port PostgreSQL port number. Default = 5432 A.5. Event-Driven Ansible controller variables RPM variable name Container variable name Description automationedacontroller_activation_workers eda_activation_workers Optional Number of workers for ansible-rulebook activation pods in Event-Driven Ansible. Default = (# of cores or threads) * 2 + 1 automationedacontroller_admin_email eda_admin_email Optional Email address used by Django for the admin user for Event-Driven Ansible controller. Default = admin@example.com automationedacontroller_admin_password eda_admin_password Required The admin password used by the Event-Driven Ansible controller instance. Passwords must be enclosed in quotes when they are provided in plain text in the inventory file. Use of special characters for this variable is limited. The password can include any printable ASCII character except / , " , or @ . automationedacontroller_admin_username eda_admin_user Username used by Django to identify and create the admin superuser in Event-Driven Ansible controller. Default = admin automationedacontroller_allowed_hostnames List of additional addresses to enable for user access to Event-Driven Ansible controller. Default = empty list automationedacontroller_controller_verify_ssl Boolean flag used to verify automation controller's web certificates when making calls from Event-Driven Ansible controller. Verified is true and not verified is false . Default = false automationedacontroller_disable_hsts eda_nginx_disable_hsts Optional Boolean flag to disable HSTS for Event-Driven Ansible controller. Default = false automationedacontroller_disable_https eda_nginx_disable_https Optional Boolean flag to disable HTTPS for Event-Driven Ansible controller. Default = false automationedacontroller_event_stream_path eda_event_stream_prefix_path API prefix path used for Event-Driven Ansible event-stream through platform gateway. Default = /eda-event-streams automationedacontroller_firewalld_zone eda_firewall_zone The firewall zone where Event-Driven Ansible related firewall rules are applied. This controls which networks can access Event-Driven Ansible based on the zone's trust level. Default = public automationedacontroller_gunicorn_workers eda_gunicorn_workers Number of workers for the API served through Gunicorn. Default = (# of cores or threads) * 2 + 1 automationedacontroller_max_running_activations eda_max_running_activations Optional The number of maximum activations running concurrently per node. This is an integer that must be greater than 0. Default = 12 automationedacontroller_nginx_tls_files_remote eda_tls_remote Boolean flag to specify whether cert sources are on the remote host (true) or local (false). Default = false automationedacontroller_pg_cert_auth eda_pg_cert_auth Set this variable to true to enable client certificate authentication. Default = false automationedacontroller_pg_database eda_pg_database The name of the PostgreSQL database used by Event-Driven Ansible. RPM default = automationedacontroller Container default = eda automationedacontroller_pg_host eda_pg_host Required The hostname of the PostgreSQL database used by Event-Driven Ansible. Default = 127.0.0.1 automationedacontroller_pg_password eda_pg_password Required if not using client certificate authentication. The password for the Event-Driven Ansible PostgreSQL database. Use of special characters for this variable is limited. The ! , # , 0 and @ characters are supported. Use of other special characters can cause the setup to fail. automationedacontroller_pg_port eda_pg_port Required if not using an internal database. The port number of the PostgreSQL database used by Event-Driven Ansible. Default = 5432 automationedacontroller_pg_sslmode eda_pg_sslmode Determines the level of encryption and authentication for client server connections. Valid options include verify-full , verify-ca , require , prefer , allow , disable . Default = prefer automationedacontroller_pg_username eda_pg_username The username for the Event-Driven Ansible PostgreSQL database. RPM default = automationedacontroller Container default = eda automationedacontroller_pgclient_sslcert eda_pg_tls_cert Required if using client certificate authentication. Path to the PostgreSQL SSL/TLS certificate file for Event-Driven Ansible. automationedacontroller_pgclient_sslkey eda_pg_tls_key Required if using client certificate authentication. Path to the PostgreSQL SSL/TLS key file for Event-Driven Ansible. automationedacontroller_redis_host eda_redis_host The Redis hostname used by Event-Driven Ansible controller. automationedacontroller_redis_port eda_redis_port The port used for the Redis host defined by automationedacontroller_redis_host for Event-Driven Ansible controller. automationedacontroller_rq_workers Number of Redis Queue (RQ) workers used by Event-Driven Ansible controller. RQ workers are Python processes that run in the background. Default = (# of cores or threads) * 2 + 1 automationedacontroller_ssl_cert eda_tls_cert Optional Path to the SSL/TLS certificate file for Event-Driven Ansible. automationedacontroller_ssl_key eda_tls_key Optional Path to the SSL/TLS key file for Event-Driven Ansible. automationedacontroller_user_headers eda_nginx_user_headers List of additional NGINX headers to add to Event-Driven Ansible controller's NGINX configuration. Default = empty list eda_node_type eda_type Optional Event-Driven Ansible controller node type. Default = hybrid eda_debug Event-Driven Ansible controller debug. Default = false eda_event_stream_url Event-Driven Ansible controller event stream URL. eda_main_url Event-Driven Ansible controller main URL. eda_nginx_client_max_body_size NGINX maximum body size. Default = 1m eda_nginx_hsts_max_age NGINX HSTS maximum age. Default = 63072000 eda_nginx_http_port NGINX HTTP port. Default = 8082 eda_nginx_https_port NGINX HTTPS port. Default = 8445 eda_nginx_https_protocols NGINX HTTPS protocols. Default = [TLSv1.2, TLSv1.3] eda_pg_socket PostgreSQL Event-Driven Ansible UNIX socket. eda_redis_disable_tls Disable TLS Redis (for many nodes). Default = false eda_redis_password Redis Event-Driven Ansible controller password (for many nodes). eda_redis_tls_cert Optional Path to the Event-Driven Ansible Redis certificate file. eda_redis_tls_key Optional Path to the Event-Driven Ansible Redis key file. eda_redis_username Redis Event-Driven Ansible controller username (for many nodes). eda_safe_plugins Event-Driven Ansible controller safe plugins. eda_secret_key The secret key value used by Event-Driven Ansible controller to sign and encrypt data, ensuring secure communication and data integrity between services. eda_workers Event-Driven Ansible controller workers count. Default = 2 A.6. General variables RPM variable name Container variable name Description aap_ca_cert_file ca_tls_cert Define a Certification Authority certificate along with a matching key when you want the installation program to create leaf certificates for each product for you. aap_ca_cert_files_remote ca_tls_remote Denote whether the CA provided certificate files are local to the installation program ( false ) or on the remote component server ( true ). Default = false aap_ca_key_file ca_tls_key Define the key for the matching certificate when you want the installation program to create leaf certificates for each product for you. bundle_install bundle_install Set to true to enable a bundled installation. Default = false bundle_install_folder bundle_dir Specify the path to the bundle directory when performing a bundle install. Container default = false RPM Default = /var/lib/ansible-automation-platform-bundle custom_ca_cert custom_ca_cert The path to the custom CA certificate file. If set, this installs a custom CA certificate to the system truststore. enable_insights_collection The default install registers the node to the Red Hat Insights for Red Hat Ansible Automation Platform for the Red Hat Ansible Automation Platform Service if the node is registered with Subscription Manager. Set to false to disable. Default = true nginx_tls_protocols Defines support for ssl_protocols in NGINX. Values available TLSv1 , TLSv1.1 , TLSv1.2 , TLSv1.3 . The TLSv1.1 and TLSv1.2 parameters only work when OpenSSL 1.0.1 or higher is used. The TLSv1.3 parameter only works when OpenSSL 1.1.1 or higher is used. If nginx_tls-protocols = ['TLSv1.3'] only TLSv1.3 is enabled. To set more than one protocol use nginx_tls_protocols = ['TLSv1.2', 'TLSv.1.3'] . Default = TLSv1.2 nginx_user_http_config List of NGINX configurations for /etc/nginx/nginx.conf under the http section. Each element in the list is provided into http nginx config as a separate line. Default = {} pcp_firewall_zone The firewall zone where Performance Co-Pilot related firewall rules are applied. This controls which networks can access Performance Co-Pilot based on the zone's trust level. Default = public redis_cluster_ip redis_cluster_ip The IPv4 address used by the Redis cluster to identify each host in the cluster. Redis clusters cannot use hostnames or IPv6 addresses. When defining hosts in the [redis] group, use this variable to identify the IPv4 address if the default is not what you want. redis_firewalld_zone redis_firewall_zone The firewall zone where Redis related firewall rules are applied. This controls which networks can access Redis based on the zone's trust level. Default = public redis_mode redis_mode The Redis mode to use for your Ansible Automation Platform installation. Possible values are: standalone and cluster . For more information about Redis, see Caching and queueing system in Planning your installation . Default = cluster registry_password registry_password Required if performing an online non-bundled installation. The password credential for access to the registry source defined in registry_url . For more information, see Setting registry_username and registry_password . registry_url registry_url URL for the registry source. Default = registry.redhat.io registry_username registry_username Required if performing an online non-bundled installation. The username credential for access to the registry source defined in registry_url . For more information, see Setting registry_username and registry_password . registry_verify_ssl registry_tls_verify Controls whether SSL/TLS certificate verification should be enabled or disabled when making HTTPS requests. Default = true routable_hostname routable_hostname This variable is used if the machine running the installation program can only route to the target host through a specific URL. For example, if you use short names in your inventory, but the node running the installation program can only resolve that host by using a FQDN. If routable_hostname is not set, it should default to ansible_host . If you do not set ansible_host , inventory_hostname is used as a last resort. This variable is used as a host variable for particular hosts and not under the [all:vars] section. For further information, see Assigning a variable to one machine: host variables . backup_dir The location of the backup directory on the Ansible host. Used when performing backup and restore. Default = ~/backups container_compress Container compression software. Default = gzip container_keep_images Keep container images. Default = false container_pull_images Pull newer container images. Default = true registry_auth Use registry authentication. Default = true registry_ns_aap Ansible Automation Platform registry namespace. Default = ansible-automation-platform-25 registry_ns_rhel RHEL registry namespace. Default = rhel8 use_archive_compression Controls at the global level whether the filesystem-related backup files will be compressed before being sent to the host to run the backup operation. If set to true, a tar.gz file is generated on each Ansible Automation Platform host, and then the gzip compression is used. If set to false, a simple tar file is generated. Default = true This functionality can be controlled at the component level using the <componentName>_use_archive_compression variable. <componentName>_use_archive_compression Enables or disables archive compression on a component level by specifying the component in <componentName> . For example: automationgateway_use_archive_compression=true automationcontroller_use_archive_compression=true automationhub_use_archive_compression=true automationedacontroller_use_archive_compression=true Default = true This functionality can be controlled at the global level using the use_archive_compression variable. use_db_compression Controls at the global level whether the database-related backup files will be compressed before being sent to the host to run the backup operation. Default = true This functionality can be controlled at the component level using the <componentName>_use_db_compression variable. <componentName>_use_db_compression Enables or disables archive compression on a database level by specifying the component in <componentName> . For example: automationgateway_use_db_compression=true automationcontroller_use_db_compression=true automationhub_use_db_compression=true automationedacontroller_use_db_compression=true Default = true This functionality can be controlled at the global level using the use_db_compression variable. A.7. Image variables RPM variable name Container variable name Description controller_image Automation controller image. Default = controller-rhel8:latest de_extra_images Decision environment extra images. de_supported_image Decision environment supported image. Default = de-supported-rhel8:latest eda_image Event-Driven Ansible image. Default = eda-controller-rhel8:latest eda_web_image Event-Driven Ansible web image. Default = eda-controller-ui-rhel8:latest ee_29_enabled Enable execution environment 29. Default = false ee_29_image Execution environment 29 image. Default = ee-29-rhel8:latest ee_extra_images Execution environment extra images. ee_minimal_image Execution environment minimal image. Default = ee-minimal-rhel8:latest ee_supported_image Execution environment supported image. Default = ee-supported-rhel8:latest hub_image Automation hub image. Default = hub-rhel8:latest hub_web_image Automation hub web image. Default = hub-web-rhel8:latest postgresql_image PostgreSQL image. Default = postgresql-15:latest receptor_image Receptor image. Default = receptor-rhel8:latest redis_image Redis image. Default = redis-6:latest pcp_image Performance Co-Pilot image. Default = rhel8-pcp:latest A.8. Platform gateway variables RPM variable name Container variable name Description automationgateway_admin_email gateway_admin_email The email address used for the admin user for platform gateway. automationgateway_admin_password gateway_admin_password Required The admin password used to connect to the platform gateway instance. Passwords must be enclosed in quotes when they are provided in plain text in the inventory file. Use of special characters for this variable is limited. The password can include any printable ASCII character except / , " , or @ . automationgateway_admin_username gateway_admin_user Optional The username used to identify and create the admin superuser in platform gateway. Default = admin automationgateway_disable_hsts gateway_nginx_disable_hsts Optional Disable NGINX HSTS. Default = false automationgateway_disable_https gateway_nginx_disable_https Optional Disable NGINX HTTPS. Default = false automationgateway_firewalld_zone gateway_proxy_firewall_zone The firewall zone where platform gateway related firewall rules are applied. This controls which networks can access platform gateway based on the zone's trust level. Default = public automationgateway_grpc_auth_service_timeout gateway_grpc_auth_service_timeout Platform gateway auth server timeout. Default = 30s automationgateway_grpc_server_max_threads_per_process gateway_grpc_server_max_threads_per_process Platform gateway auth server threads per process. Default = 10 automationgateway_grpc_server_processes gateway_grpc_server_processes Platform gateway auth server processes Default = 5 automationgateway_main_url gateway_main_url Optional The main platform gateway URL that clients will connect to (e.g. https://<gateway_node> ). If not specified, the first the first node in the [automationgateway] group will be used when needed. automationgateway_pg_cert_auth gateway_pg_cert_auth Set this variable to true to enable client certificate authentication. Default = false automationgateway_pg_database gateway_pg_database The name of the PostgreSQL database used by platform gateway. RPM default = automationgateway Container default = gateway automationgateway_pg_host gateway_pg_host Required The hostname of the PostgreSQL database used by platform gateway. Default = 127.0.0.1 automationgateway_pg_password gateway_pg_password Required if not using client certificate authentication. The password for the platform gateway PostgreSQL database. Use of special characters for this variable is limited. The ! , # , 0 and @ characters are supported. Use of other special characters can cause the setup to fail. automationgateway_pg_port gateway_pg_port Required if not using an internal database. The port number of the PostgreSQL database used by platform gateway. Default = 5432 automationgateway_pg_sslmode gateway_pg_sslmode Determines the level of encryption and authentication for client server connections. Valid options include verify-full , verify-ca , require , prefer , allow , disable . Default = prefer automationgateway_pg_username gateway_pg_username The username for the platform gateway PostgreSQL database. RPM default = automationgateway Container default = gateway automationgateway_pgclient_sslcert gateway_pg_tls_cert Required if using client certificate authentication. Path to the PostgreSQL SSL/TLS certificate file for platform gateway. automationgateway_pgclient_sslkey gateway_pg_tls_key Required if using client certificate authentication. Path to the PostgreSQL SSL/TLS key file for platform gateway. automationgateway_redis_host gateway_redis_host The Redis hostname used by platform gateway. automationgateway_redis_port gateway_redis_port The Redis platform gateway port. Default = 6379 automationgateway_ssl_cert gateway_tls_cert Optional Path to the SSL/TLS certificate file for platform gateway. automationgateway_ssl_key gateway_tls_key Optional Path to the SSL/TLS key file for platform gateway. envoy_disable_https Controls whether or not HTTPS is disabled when accessing the platform UI. Set to true to disable HTTPS for the platform UI (HTTP is used instead). envoy_http_port Port number on which the Envoy proxy listens for incoming HTTP connections. envoy_https_port Port number on which the Envoy proxy listens for incoming HTTPS connections. gateway_nginx_client_max_body_size NGINX maximum body size. Default = 5m gateway_nginx_hsts_max_age NGINX HSTS maximum age. Default = 63072000 gateway_nginx_http_port NGINX HTTP port. gateway_nginx_https_port NGINX HTTPS port. gateway_nginx_https_protocols NGINX HTTPS protocols. Default = [TLSv1.2, TLSv1.3] gateway_nginx_user_headers Custom NGINX headers. gateway_redis_disable_tls Disable TLS Redis. Default = false gateway_redis_password Redis platform gateway password. gateway_redis_tls_cert Optional Path to the platform gateway Redis certificate file. gateway_redis_tls_key Optional Path to the platform gateway Redis key file. gateway_redis_username Redis platform gateway username. Default = gateway gateway_secret_key The secret key value used by platform gateway to sign and encrypt data, ensuring secure communication and data integrity between services. gateway_tls_remote Platform gateway TLS remote files. Default = false gateway_uwsgi_listen_queue_size Platform gateway uWSGI listen queue size. Default = 4096 A.9. Receptor variables RPM variable name Container variable name Description receptor_disable_signing Disable receptor signing. Default = false receptor_disable_tls Disable receptor TLS. Default = false receptor_firewall_zone The firewall zone where receptor related firewall rules are applied. This controls which networks can access receptor based on the zone's trust level. Default = public receptor_log_level Receptor logging level. Default = info receptor_mintls13 Receptor TLS 1.3 minimal. Default = false See peers for the RPM equivalent variable receptor_peers Used to indicate which nodes a specific host connects to. Wherever this variable is defined, an outbound connection to the specific host is established. This variable can be a comma-separated list of hosts only and not groups from the inventory. This is resolved into a set of hosts that is used to construct the receptor.conf file. For example usage, see Adding execution nodes . Default = [] receptor_datadir This variable configures the receptor data directory. By default, it is set to /tmp/receptor . To change the default location, run the installation script with "-e receptor_datadir=" and specify the target directory that you want. NOTES * The target directory must be accessible to awx users. * If the target directory is a temporary file system tmpfs , ensure it is remounted correctly after a reboot. Failure to do so results in the receptor no longer having a working directory. receptor_listener_port receptor_port Receptor port number. Default = 27199 receptor_listener_protocol receptor_protocol Receptor protocol. Default = tcp receptor_signing_private_key Receptor signing private key. receptor_signing_public_key Receptor signing public key. receptor_signing_remote Receptor signing remote files. Default = false receptor_tls_cert Path to the SSL/TLS certificate file for receptor. receptor_tls_key Path to the SSL/TLS key file for receptor. receptor_tls_remote Receptor TLS remote files. Default = false See node_type for the RPM equivalent variable. receptor_type For the [automationcontroller] group the two options are: receptor_type=control - The node only runs project and inventory updates, but not regular jobs. receptor_type=hybrid - The node runs everything. Default for this group = hybrid . For the [execution_nodes] group the two options are: receptor_type=hop - The node forwards jobs to an execution node. receptor_type=execution - The node can run jobs. Default for this group = execution

Commands: