Variables

Most variables use the iris_* prefix. A few don't (root_pw, sshd_template, component) — these are called out individually below.

General

Variable	Type	Default	Description
`iris_install_source_dir`	string	`{{ shared_files_directory }}`	Where install/InstaServer/license files are fetched from — either a local path on the Ansible controller or an `http(s)://` URL. `shared_files_directory` itself is set in `group_vars/all/vars.yml`, not by this role.
`iris_install_files_path`	string	`/epic/tmp`	Directory on the target host install files are copied/downloaded to, and where InstaServer is invoked from.
`iris_admin_user`	string	`epicadm`	Owner applied to `iris_directories` below.
`iris_admin_group`	string	`epicuser`	Group applied to most `iris_directories` entries below.
`iris_config_backup`	bool	`false`	Passed as `backup:` to the `/etc/hosts` edit in `configure_hosts_file.yml`. Does not cover `iris.cpf` — that's `iris_cpf_backup` below.
`iris_cpf_backup`	bool	`true`	Passed as `backup:` to the `ini_file` task in `fix_cpf_ports.yml`. The module writes a backup only when it actually rewrites `iris.cpf`, so a run where the ports already match produces no file and reports no change. Backups land beside the original as `iris.cpf.<pid>.<YYYY-MM-DD@HH:MM:SS>~`.
`iris_answerfile_name`	string	`answer_file.txt`	Filename the InstaServer answer file is templated to, inside `iris_extracted_install_files_path`.
`iris_bin`	string	`/usr/bin/iris`	Path to the `iris` CLI, used to run `qlist` and detect already-installed instances before templating the answer file.
`iris_tuned_profile`	string	`epic`	tuned profile applied by `install_and_configure_tuned.yml`.
`iris_tmp_fs_size`	string	`4G`	Size of the dedicated `/tmp` tmpfs mount (Epic OS Setup Guide §3.M).
`iris_dependencies`	list	`[ksh, vim]`	Packages installed via `dnf` by the `dependencies`/`packages` tag.

Default iris_directories:

iris_directories:
  - path: "{{ iris_install_files_path }}"
    state: directory
    mode: "1777"
    owner: "{{ iris_admin_user }}"
    group: "{{ iris_admin_group }}"
  - path: "/epic/work"
    state: directory
    mode: "2775"
    owner: "{{ iris_admin_user }}"
    group: "{{ iris_admin_group }}"
  - path: "/usr/local/epic"
    state: directory
    mode: "0755"
    owner: "{{ iris_admin_user }}"
    group: "epicsys"
  - path: "/epic/pki"
    state: directory
    mode: "0755"
    owner: "{{ iris_admin_user }}"
    group: "epicsys"
  - path: "/epic/pki/certs"
    state: directory
    mode: "0755"
    owner: "{{ iris_admin_user }}"
    group: "epicsys"
  - path: "/epic/pki/client"
    state: directory
    mode: "0750"
    owner: "{{ iris_admin_user }}"
    group: "dmngrp"
  - path: "/epic/pki/crl"
    state: directory
    mode: "0755"
    owner: "{{ iris_admin_user }}"
    group: "epicsys"
  - path: "/epic/pki/keys"
    state: directory
    mode: "0755"
    owner: "{{ iris_admin_user }}"
    group: "epicsys"
  - path: "/epic/pki/esmp_trusted_client_certificates"
    state: directory
    mode: "0755"
    owner: "{{ iris_admin_user }}"
    group: "epicsys"
  - path: "/epic/pki/esmp_trusted_server_certificates"
    state: directory
    mode: "0755"
    owner: "{{ iris_admin_user }}"
    group: "epicsys"

Cloud Provider CLI

Installed by the cloud_cli tag (cloud_cli/main.yml) — the AWS CLI v2 on AWS instances, the Azure CLI on Azure VMs, chosen from the platform detected in prerequisites.yml. See the Tags table.

Variable	Type	Default	Description
`iris_install_cloud_cli`	bool	`true`	Whether the `cloud_cli` tag installs the matching CLI. Set `false` to skip both installs (equivalent to `--skip-tags cloud_cli`).
`iris_aws_cli_installer_url`	string	`https://awscli.amazonaws.com/awscli-exe-linux-{{ ansible_architecture }}.zip`	URL of the official AWS CLI v2 bundled installer. The architecture segment comes from `ansible_architecture`, so `x86_64` and `aarch64` both resolve. Override for an internal mirror.
`iris_is_aws`	bool	(derived)	Computed by `prerequisites.yml` from the instance metadata endpoint — `true` on an AWS EC2 instance. Don't set directly.
`iris_is_azure`	bool	(derived)	Computed by `prerequisites.yml` from the instance metadata endpoint — `true` on an Azure VM. Don't set directly.

The fixed install paths (/usr/local/bin/aws, the download/unpack locations) and the Microsoft package-repo/key URLs are plumbing a consumer never sets per host, so they live in roles/iris/vars/main.yml (role vars, non-overridable) rather than defaults/ — change them there if AWS or Microsoft ever move them.

Ubuntu support is present but not yet validated

The role includes an Ubuntu/Debian path for both CLIs (apt-based unzip, plus the Azure CLI via Microsoft's apt repo in cloud_cli/install_azure_cli_debian.yml), but it has only been exercised on RHEL so far. Ubuntu support and its testing are tracked for a follow-up change — treat the Ubuntu path as experimental until then.

Download Authentication

Only relevant when iris_install_source_dir is an http(s):// URL.

Variable	Type	Default	Description
`iris_url_username`	string	`{{ lookup('env', 'URL_USERNAME', default=url_username) }}`	Basic auth username for `get_url`.
`iris_url_password`	string	`{{ lookup('env', 'URL_PASSWORD', default=url_password) }}`	Basic auth password for `get_url`.
`iris_force_basic_auth`	bool	`{{ lookup('env', 'FORCE_BASIC_AUTH', default=force_basic_auth) }}`	Passed to `get_url` as `force_basic_auth`.

These three invert the secret precedence convention used elsewhere in this repo: the uppercase environment variable wins if set, and the plain (non-iris_-prefixed) url_username/url_password/force_basic_auth Ansible variables are only the fallback. This matches system_pulse's documented deviation, not the standard kuiper-style pattern — don't copy it into new roles.

Users, Groups & Sudoers

Variable	Type	Default	Description
`iris_groups`	list	(required)	Groups to create — `{name, gid}` per entry. No role default; supplied via `extra_vars/users.yml` in this repo's dev environment.
`iris_users`	list	(required)	Users to create — `{name, password, uid, group, groups, append, shell, generate_keys, distribute_keys}` per entry. `generate_keys: true` generates an SSH keypair for that user; `distribute_keys: true` additionally pushes the public key to every other host in the play (`keys` tag). No role default.
`root_pw`	string	(unset)	Not `iris_`-prefixed. When defined, sets the root password. Skipped entirely (not just left at a default) when undefined — `provision_users_and_groups.yml` guards it with `when: root_pw is defined`.
`iris_sudoers`	list	`[{user: epicadm, value: 'ALL=(ALL) NOPASSWD:ALL', file_name: 98_epicadm, state: present}]`	`/etc/sudoers.d` drop-ins, validated with `visudo -cf`. The default expression is actually `sudoers \\| default([...])` — set the plain `sudoers` variable (as `extra_vars/users.yml` does) to override without touching `iris_sudoers` directly. `state: absent` on an entry removes that drop-in instead of writing it.

SELinux

Variable	Type	Default	Description
`iris_selinux_state`	string	`disabled`	Passed to `ansible.posix.selinux`'s `state`. RHEL only (`selinux` tag) — see Usage Guide.
`iris_selinux_policy_type`	string	`targeted`	Policy type applied when `iris_selinux_state` is not `disabled`.

Transitions to/from disabled only fully apply at next boot — use an ad-hoc command to test this without bundling a reboot into an unrelated task, e.g. ansible all -m reboot --become --limit=<host>.

SSH

Variable	Type	Default	Description
`sshd_template`	string	`sshd_config.j2`	Not `iris_`-prefixed. Template used for `/etc/ssh/sshd_config`, validated with `sshd -t`. No `sshd_config.j2` ships in this role's `templates/` directory — a value must be supplied (or a template added) before the `sshd` tag will work.

Install Files

Most of these have no role default — they're specific to the IRIS release being installed and are set in host_vars per host (see host_vars/TSTODB.sapphire.dev.yml for a real example). iris_extra_install_files is the one exception, defaulting to an empty list.

Variable	Type	Default	Description
`iris_install_file`	string	(required)	IRIS install archive filename (`.tar.gz`), relative to `iris_install_source_dir`.
`iris_instaserver_file`	string	(required)	InstaServer installer filename (`.sh`), relative to `iris_install_source_dir`. Also determines `iris_extracted_install_files_path` (its basename with `.sh` stripped).
`iris_key_file`	string	(required)	IRIS license key filename, relative to `iris_install_source_dir`.
`iris_extra_install_files`	list of strings	`[]`	Extra filenames fetched from `iris_install_source_dir` alongside the three above — e.g. a supplemental license or a hotfix. Same HTTP(S)-vs-controller-copy rule applies to each one.
`iris_default_epic_path`	string	(required if used)	Fallback base path for an instance's directory (`{{ iris_default_epic_path }}{{ instance.Instance \\| lower }}`) when that instance's `Directory` isn't set under `iris_instaserver_variables.Instances`. Every instance in the current `host_vars` examples sets `Directory` explicitly, so this is rarely exercised.

InstaServer / Instances

Variable	Type	Default	Description
`iris_instaserver_variables`	map	(required)	Drives the templated InstaServer answer file (`templates/answer_file.j2`). See shape below.
`component`	string	`BuildCustom`	Not `iris_`-prefixed. Passed as InstaServer's `--component` flag for both `--validate` and the real install.
`iris_hugepages`	int	(unset)	Optional. Only written to `tuned.conf` (`hugepagesz`/`hugepages`) when defined — omit it entirely to leave hugepages unconfigured.

iris_instaserver_variables shape, from host_vars/TSTODB.sapphire.dev.yml:

iris_instaserver_variables:
  Instances:
    - Instance: TST
      Directory: /epic/tst
      InstanceType: NONPROD
      SuperServerPort: 1973
      WebServerPort: 6073
  # Password: leave undefined to randomly generate one (persisted across re-runs)
  SystemPulseServer: sp.tstdomain.org
  KuiperServer: kp.tstdomain.org
  SMTPServer: smtp.tstdomain.org
  EmailFrom: admin_tstodb@tstdomain.org
  EmailTo: odb_alerts@tstdomain.org
  Organization: TST Health
  PRDESMPRemoteHost: prdodb
  DRESMPRemoteHost: drodb
  OtherRemoteServer:               # note: singular, not "OtherRemoteServers"
    - Hostname: localhost
      CheckSystemConfig: 0
      HostType: Epic database
      Port: 10443
      Queued: 0

Two gotchas worth knowing before setting this up:

LicenseKey is a dead field. answer_file.j2 builds the answer file's LicenseKey= line itself from iris_install_files_path/iris_key_file, so a LicenseKey key under iris_instaserver_variables (as seen in some existing host_vars files) is silently ignored. Slated for removal from those host_vars files.
The list key is OtherRemoteServer, singular — answer_file.j2 checks iris_instaserver_variables.OtherRemoteServer. A commented-out example in host_vars/TSTODB.sapphire.dev.yml uses the plural OtherRemoteServers, which the template never reads — that entry would silently produce no OtherRemoteServer= lines at all.

certmgr / ESMP

Used by configure_certmgr_ca.yml (certmgr tag) to initialize the Epic ESMP certificate authority on exactly one designated host. See the Usage Guide for how the host is selected, what the task file does, and why every epicadm command sits behind the CA check.

These are not role defaults

Unlike the rest of this page, the iris_certmgr_* values do not live in roles/iris/defaults/main.yml. The baseline is set in group_vars/_Red_Hat_Enterprise_Linux/vars.yml, and the per-host override naming the CA is in that host's host_vars (currently host_vars/TSTODB.sapphire.dev.yml). The "Default" column below records the baseline that group_vars sets, not a value the role supplies on its own.

Two consequences. A host outside _Red_Hat_Enterprise_Linux has none of these defined — tasks/main.yml uses iris_certmgr_initialize_ca | default(false) so the step is skipped rather than failing the play. And consuming this role from outside ansible-epic means supplying all of these yourself.

Variable	Type	Default	Description
`iris_certmgr_initialize_ca`	bool	`false`	On/off switch for the whole feature. `tasks/main.yml` skips the entire `configure_certmgr_ca.yml` include unless this is true. It does not select which host is the CA — that's `iris_certmgr_ca_host`. Set both together in `group_vars`.
`iris_certmgr_ca_host`	string	`""`	Inventory hostname of the one primary certificate authority. Only the host whose `inventory_hostname` matches initializes a CA; every other host prints a skip notice. Accepts the FQDN or the short name, in any case (`TSTODB.sapphire.dev` or `tstodb`). Because it holds a single name, two CAs cannot be expressed — that, rather than a runtime check, is what makes the single-CA guarantee hold under any `--limit`. Empty while `iris_certmgr_initialize_ca` is true is a hard error.
`iris_certmgr_is_ca_host`	bool	(derived)	Computed per host from the two above — don't set it directly. Exposed so it can be overridden for an edge case, and so the gate is inspectable with `-e` or a `debug` task.
`iris_certmgr_bin`	string	`/epic/redalert/bin/certmgr`	Path to the certmgr binary. Ships with RedAlert, so this step must run after the IRIS install.
`iris_certmgr_ca_location`	string	`/epic/pki/ca`	Passed as `--location`. Created by the role as `{{ iris_admin_user }}:{{ iris_certmgr_ca_group }}` mode `0755` before certmgr runs. CA servers only — deliberately not in `iris_directories`.
`iris_certmgr_ca_group`	string	`epicsys`	Group applied to `iris_certmgr_ca_location`.
`iris_certmgr_esmp_cert_path`	string	`/epic/pki/certs/esmp.crt`	Idempotency marker for `certmgr --auto_config_local` and one half of the end-state assertion. `/epic/pki/certs` itself comes from `iris_directories`.
`iris_certmgr_ca_marker`	string	`This server is a certificate authority`	Substring searched for (case-insensitively) in `certmgr --show` output to decide whether the host is already a CA. Change this only if Epic changes certmgr's wording.
`iris_certmgr_common_name`	string	`{{ inventory_hostname.split('.')[0] \\| lower }}`	Passed as `--common_name`. Derives the short hostname so the CA identifies the host it actually runs on.
`iris_certmgr_country`	string	`US`	Passed as `--country`.
`iris_certmgr_state`	string	(site-specific)	Passed as `--state`.
`iris_certmgr_city`	string	(site-specific)	Passed as `--city`. Multi-word values are safe — every metadata value is run through the `quote` filter before reaching the `command` module.
`iris_certmgr_organization`	string	(site-specific)	Passed as `--organization`.
`iris_certmgr_organizational_unit`	string	`IT`	Passed as `--ou`.
`iris_certmgr_email`	string	(site-specific)	Passed as `--email`.
`iris_certmgr_expiration`	int	`10950`	Passed as `--expiration`, in days (30 years).
`iris_certmgr_esmp_trust`	bool	`true`	Adds `--esmp_trust` to `--initialize_ca`, putting the CA certificate in the ESMP trusted certificate store.

The organization metadata defaults in defaults/main.yml are the deploying site's values — override them in group_vars when standing up a different customer.