Yes, so I managed to successfully install IPA server and replica using the two roles. They're both master? I know the replicas configuration is based on the Master, but one of my problem is that: - I use Idstart 6000 on my IPA server (master) and my replica does not follow this configuration, meaning when I try to create a user of both servers they start with different ID. On IPA server it'll have 6001 and on the replica it'll be 50001.

I tried to login into both IPA servers through web ui just to "test", and noticed this diff. Seems like "idstart" isn't replicated to the replica server?

Also... It's required to have IPA client installed on the replica?.. Would it still be considered a "master"? I had to manually join as I get the following error running ipareplica role: FAILED! => {"changed": false, "msg": "Unable to find IPA Server to join"} MANUALLY JOIN: $ sudo ipa-client-install --domain=EXAMPLE.COM--realm=EXAMPLE.COM--server=master.example.com This program will set up IPA client. Version 4.10.0 Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: yes Do you want to configure chrony with NTP server or pool address? [no]: .... The ipa-client-install command was successful

So... We're using dynamic-inventory... And when I tried creating a static inventory dividing my hosts into the groups [ipaserver] and [ipareplicas] this worked... Without using these groups specifically my vars got ignored..?

Maybe I'm mistaken, however: Playbook: - hosts: - master2.example.com roles: - role: freeipa.ansible_freeipa.ipaserver vars: ipaserver: "{{ inventory_hostname }}" ipaserver_hostname: "{{ inventory_hostname }}" ipadm_password: SuperSecret123 ipaadmin_password: SuperSecret123 ipaserver_ip_addresses: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}" ipaserver_domain: "example.com" ipaserver_realm: "EXAMPLE.COM" ipaserver_no_host_dns: true ipaserver_mem_check: true ipaserver_idstart: 6000 ipaserver_setup_dns: false ipaserver_no_pkinit: true - hosts: - master2.example.com become: true roles: - role: freeipa.ansible_freeipa.ipareplica vars: ipaservers: master1.example.com ipaserver_hostname: master1.example.com ipareplicas: master2.example.com ipareplica_domain: example.com ipaclient_force_join: true ipaadmin_principal: admin ipareplica_setup_dns: false As mentioned when running using a cloud dynamic inventory this playbook does not work, however, as preivously mentioned, when creating a static inventory, it works: [ipaservers] master1.example.com [ipareplicas] master2.example.com

TYPO!

On Mon, Apr 17, 2023 at 2:08 PM Finn Fysj via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt; wrote: I don't think setting /etc/hosts will scale later, as you will need DNS for usage. It is possible to use a cloud DNS server, but you must handle it as any other external DNS. Take a look at the documentation links I provided earlier. Rafael -- Rafael Guterres Jeffman Senior Software Engineer FreeIPA - Red Hat

Error when using dynamic inventory: fatal: [master2.example.com]: FAILED! => { "changed": false, "invocation": { "module_args": { "all_ip_addresses": false, "ca_cert_files": null, "configure_firefox": false, "domain": "example.com", "enable_dns_updates": false, "firefox_dir": null, "force_ntpd": false, "hostname": "master2.example.com", "ip_addresses": null, "kinit_attempts": 5, "nisdomain": null, "no_nisdomain": false, "no_ntp": false, "ntp_pool": null, "ntp_servers": null, "on_master": false, "realm": "EXAMPLE.COM", "servers": null } }, "msg": "Unable to find IPA Server to join" }