### Switch to root user

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallUbuntu.html

Run this command to become root before starting the installation process.

```bash
sudo su -
```

--------------------------------

### ADMIN node setup commands

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallUbuntu.html

Commands to install Docker, Postfix, and other dependencies on the ADMIN node, create a dummy network interface, initialize Docker Swarm, pull images, deploy the ferda stack, run migrations, and create a superuser.

```bash
# OS is up to you, docker apps only

apt update
apt install -y ca-certificates curl gnupg lsb-release python3-pip

# Postfix non-interactive installation
debconf-set-selections <<< "postfix postfix/mailname string $(hostname)"
debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Internet Site'"
apt --assume-yes install postfix

sudo mkdir -m 0755 -p /etc/apt/keyrings

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/docker.gpg

echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Create dummy network interface for docker
cat << EOT >> /etc/netplan/01-dock.yaml
network:
version: 2
renderer: networkd
bridges:
   dock:
      dhcp4: false
      dhcp6: false
      accept-ra: false
      interfaces: [ ]
      addresses:
      - 192.168.1.1/32
EOT

netplan apply

# Create ferda configuration in this folder (example conf can be found on https://gitlab.nic.cz/fred/ferda/-/tree/master/docs/demo-deploy, full list of configurable options is here https://gitlab.nic.cz/fred/ferda/-/blob/master/README.rst?ref_type=heads)
mkdir -p /etc/fred/ferda/

# It depends if you plan to have more admin nodes or just one (if one, keep the 127.0.0.1)
docker swarm init --advertise-addr 127.0.0.1

# Pull docker images
docker pull registry.nic.cz/fred/ferda/ferda-uwsgi
docker pull registry.nic.cz/fred/ferda/ferda-nginx

cd /etc/fred/ferda

# Deploy docker stacks
docker stack deploy --compose-file docker-compose.yml ferda

# Check that ferda container is running - docker ps | grep ferda_uwsgi, should be up for about 20+ seconds

# Run DB migrations - DB needs to be correctly configured in .env
docker exec  $(docker ps | grep ferda_uwsgi.1 | cut -d ' ' -f 1) django-admin migrate

# Change superuser credentials as needed
docker exec -e DJANGO_SUPERUSER_USERNAME=admin -e DJANGO_SUPERUSER_EMAIL=admin@admin.example -e DJANGO_SUPERUSER_PASSWORD=password $(docker ps | grep ferda_uwsgi.1 | cut -d ' ' -f 1) django-admin createsuperuser --noinput

```

--------------------------------

### WEB node setup commands

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallUbuntu.html

Commands to install Apache, Docker, and FRED packages on the WEB node, configure the dummy network interface, enable required Apache modules, and deploy the rdap and webwhois Docker stacks.

```bash
# Ubuntu 20.04 LTS
# Accesible from the internet, public services on this node

apt update
apt install -y ca-certificates curl gnupg lsb-release python3-pip apache2

# Add cznic keyring for fred packages
mkdir -p /usr/share/keyrings/
wget https://archive.nic.cz/dists/cznic-archive-keyring.gpg --output-document=/usr/share/keyrings/cznic-archive-keyring.gpg

# Add source list for FRED
cat << EOT >> /etc/apt/sources.list.d/fred.list
deb [signed-by=/usr/share/keyrings/cznic-archive-keyring.gpg] http://archive.nic.cz/public $(lsb_release -sc) main
EOT

# Postfix non-interactive installation
debconf-set-selections <<< "postfix postfix/mailname string $(hostname)"
debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Internet Site'"
apt --assume-yes install postfix

sudo mkdir -m 0755 -p /etc/apt/keyrings

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/docker.gpg

echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Create dummy network interface for docker
cat << EOT >> /etc/netplan/01-dock.yaml
network:
version: 2
renderer: networkd
bridges:
   dock:
      dhcp4: false
      dhcp6: false
      accept-ra: false
      interfaces: [ ]
      addresses:
      - 192.168.1.1/32
EOT

netplan apply

apt -y install libapache2-mod-corba libapache2-mod-whoisd

# Enable apache2 modules required by WHOIS
a2enmod corba whoisd ssl

# Enable whois site in apache
a2ensite 02-fred-mod-whoisd-apache

systemctl restart apache2

# Create webwhois and rdap configuration in these folders(example confs can be found on https://gitlab.nic.cz/fred/rdap/-/tree/master/docs/demo-deploy?ref_type=heads and https://gitlab.nic.cz/fred/webwhois/-/tree/master/docs/demo-deploy)
mkdir -p /etc/fred/rdap/
mkdir -p /etc/fred/webwhois/

# It depends if you plan to have more admin nodes or just one (if one, keep the 127.0.0.1)
docker swarm init --advertise-addr 127.0.0.1

# Pull docker images
docker pull registry.nic.cz/fred/rdap/rdap-uwsgi
docker pull registry.nic.cz/fred/rdap/rdap-nginx

docker pull registry.nic.cz/fred/webwhois/webwhois-uwsgi
docker pull registry.nic.cz/fred/webwhois/webwhois-nginx

# Deploy docker stacks
cd /etc/fred/rdap
docker stack deploy --compose-file docker-compose.yml rdap

cd /etc/fred/webwhois
docker stack deploy --compose-file docker-compose.yml webwhois

```

--------------------------------

### Install FRED on Debian 12

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallDebian.html

This script installs the necessary dependencies, adds the CZ.NIC repository, installs FRED packages, applies example configurations, and initializes the registry system.

```bash
# OS: Debian 12

apt update
apt install -y ca-certificates curl gnupg lsb-release git sudo

# Clone repo with configurations(.sql structures of databases)
cd /tmp/
git clone https://gitlab.nic.cz/fred/demo-install.git

# Move conf files to /tmp
mv demo-install/files /tmp/

# Add cznic keyring for fred packages
mkdir -p /usr/share/keyrings/
curl https://archive.nic.cz/dists/cznic-archive-keyring.gpg >/usr/share/keyrings/cznic-archive-keyring.gpg

# Add source list for FRED
if [ ! -f /etc/apt/sources.list.d/fred.list ]; then
cat << EOT >> /etc/apt/sources.list.d/fred.list
deb [signed-by=/usr/share/keyrings/cznic-archive-keyring.gpg] http://archive.nic.cz/public $(lsb_release -sc) main
EOT
fi

# Copy FRED pin list to /etc/apt/preferences.d/fred
cp files/fred /etc/apt/preferences.d/fred

apt update

# Installation of FRED
apt -y install fred-backend-logger fred-backend-logger-corba fred-backend-registry fred-backend-notify fred-backend-public-request fred-backend-zone fred-zone-generator fred-backend-dbreport fred-rifd fred-pifd fred-adifd fred-akm-ng fred-accifd libapache2-mod-eppd python3-fred-epplib fred-eppic

# Remove installation files created by packages, and use example confs from demo repository - it is expected that you will change these configurations according to your needs
rm -rf /etc/fred/*
cp -r files/configs/* /etc/fred/
cp files/configs/eppic.conf /etc/eppic/eppic.conf
rm /etc/fred/eppic.conf

# Initial FRED registry setup - create system registrar, your initial registrar, add EPP access, create zone etc..
# More usage can be found in manual page of fred-admin

# You can name the system registrar as you want - but then dont forget to change it in FRED configurations in /etc/fred/
# REG-SYSTEM is the default one
/usr/sbin/fred-admin --registrar_add --handle=REG-SYSTEM --reg_name=REG-SYSTEM --organization=SYSTEM --street1=SYSTEM --city=SYSTEM --email=SYSTEM --url=SYSTEM --country=CZ --dic=12345 --no_vat --system

# Create your registrar that will be used to register domains, contacts, nssets etc..
fred-admin --registrar_add --handle "REG-YOUR_HANDLE" --country "EXAMPLE COUNTRY CODE(2)" --ico "123456789" --reg_name "REG-NAME" --organization "Your org" --street1 "Your street" --city "Your city" --postalcode "00000" --telephone "+000.123456789" --email "someemail@something.com" --url "https://webpage.com" --dic "DEMO12345678" --system

# Add EPP access to your registrar
# Please change the certificate used to your own generated certificate(authority used to generate the certificate needs to be configured on EPP node - as shown below)
# Also the password should be something strong - max. 16 chars
# Fingerprint of certificate can be obtained via `openssl x509 -noout -fingerprint -md5 -in /path/to/cert.crt`
fred-admin --registrar_acl_add --handle REG-YOUR_HANDLE --certificate "Certificate MD5 fingerprint" --password <strong-password>

# Create zone you want to manage using FRED
fred-admin --zone_add --zone_fqdn=<zone> --hostmaster hostmaster@domain.something \
        --ns_fqdn some.ns.test.something
fred-admin --zone_ns_add --zone_fqdn=<zone> --ns_fqdn=other.ns.test.something

# Ensure the log files are created
touch /var/log/fred-zone-services.log
chown fred /var/log/fred-zone-services.log

# Restart all of the Fred daemons
systemctl restart 'fred-*'

# Mask services not included in public release(they are not usable)
systemctl mask fred-auction-warehouse
systemctl mask fred-dbreport-services
rm /lib/systemd/system/fred-auction-warehouse.service
systemctl reset-failed

# If any of the services are failing to start, you can debug them using manual run, for example if you want to debug why `fred-backend-logger.service` is not starting use: `sudo -u fred fred-logger-services --config /etc/fred/fred-logger-services.conf` - it will show you what's wrong
```

--------------------------------

### Install and configure FRED APP node on Ubuntu 20.04

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallUbuntu.html

Complete installation and configuration script for the FRED APP node on Ubuntu 20.04 LTS. It installs dependencies, adds the CZ.NIC keyring and FRED APT source, installs all required FRED packages, registers the system registrar, enables/starts services, disables unused services, and restarts them. Includes commented troubleshooting commands for a failing fred-backend-registry service.

```bash
# Ubuntu 20.04 LTS

# Install dependencies
apt update
apt install -y ca-certificates curl gnupg lsb-release python3-dnspython python3-pip uwsgi-plugin-python3

# Add cznic keyring for fred packages
mkdir -p /usr/share/keyrings/
wget https://archive.nic.cz/dists/cznic-archive-keyring.gpg --output-document=/usr/share/keyrings/cznic-archive-keyring.gpg

# Add source list for FRED
cat << EOT >> /etc/apt/sources.list.d/fred.list
deb [signed-by=/usr/share/keyrings/cznic-archive-keyring.gpg] http://archive.nic.cz/public $(lsb_release -sc) main
EOT

# Postfix non-interactive installation
debconf-set-selections <<< "postfix postfix/mailname string $(hostname)"
debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Internet Site'"
apt --assume-yes install postfix

# Create preferences.d/ pin list to install correct fred packages (current APT preferences file is available at https://fred.nic.cz/en/get-fred/)
wget https://fred.nic.cz/media/filer_public/71/ce/71ce3145-a4bb-4583-9ff2-218627d71d5f/20241fredpreferencesd.txt -O /etc/apt/preferences.d/fred

apt update

apt -y install fred-idl fred-typist python3-pydantic fred-api-logger fred-api-fileman fred-backend-logger fred-backend-logger-corba fred-backend-registry fred-backend-fileman fred-backend-notify fred-backend-public-request fred-backend-zone  fred-backend-dbreport fred-rifd fred-pifd fred-adifd fred-akmd fred-accifd fred-akm cdnskey-scanner python3-fred-epplib

# Now you can configure installed fred components. Some packages create their own config automatically in /etc/fred, in some cases you may need to create the config file yourself. Most config file examples are available in https://gitlab.nic.cz/fred/demo-install/-/tree/master/files/configs or in the project repository itself (such as https://gitlab.nic.cz/fred/server/-/blob/master/config/server.conf.in)

/usr/sbin/fred-admin --registrar_add --handle=REG-SYSTEM --reg_name=REG-SYSTEM --organization=SYSTEM --street1=SYSTEM --city=SYSTEM --email=SYSTEM --url=SYSTEM --country=CZ --dic=12345 --no_vat --system

# You can change the location of logs to any path using fred configuration
chown 666 /var/log/fred.log

# Enable and start FRED services
systemctl daemon-reload
systemctl enable --now omniorb4-nameserver fred-accifd fred-adifd fred-akmd fred-backend-logger fred-logger-corba fred-backend-registry fred-pifd fred-rifd fred-fileman-server fred-zone-services fred-dbreport-services@messenger.service fred-dbreport-services@registry.service fred-dbreport-services@fredlog.service

# Disable unused FRED services
systemctl disable fred-auctions-warehouse
systemctl mask fred-auction-warehouse.service
systemctl disable fred-dbreport-services.service
systemctl mask fred-dbreport-services.service

# Restart the services to be sure, that the config is correctly loaded
systemctl restart 'fred-*'
systemctl restart omniorb4-nameserver

# If services fail to start check journalctl and systemd. Service file contains information on how the daemon is run, so you might want to try running it manually to get more specific error messages if logs don't help.
# dpkg -L fred-backend-registry | grep ".service"
# /lib/systemd/system/fred-backend-registry.service
# grep -i exec /lib/systemd/system/fred-backend-registry.service
# ExecStart=/usr/sbin/fred-registry-services --config /etc/fred/fred-registry-services.conf
# sudo -u fred /usr/sbin/fred-registry-services --config /etc/fred/fred-registry-services.conf
```

--------------------------------

### Install and Configure EPP Node

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallDebian.html

Installs necessary packages, configures the FRED repository, and sets up Apache modules for the EPP node.

```bash
# OS: Debian 12

apt update
apt install -y ca-certificates curl gnupg lsb-release git sudo

# Clone repo with configurations(.sql structures of databases)
cd /tmp/
git clone https://gitlab.nic.cz/fred/demo-install.git

# Move conf files to /tmp
mv demo-install/files /tmp/

# Add cznic keyring for fred packages
mkdir -p /usr/share/keyrings/
curl https://archive.nic.cz/dists/cznic-archive-keyring.gpg >/usr/share/keyrings/cznic-archive-keyring.gpg

# Add source list for FRED
if [ ! -f /etc/apt/sources.list.d/fred.list ]; then
cat << EOT >> /etc/apt/sources.list.d/fred.list
deb [signed-by=/usr/share/keyrings/cznic-archive-keyring.gpg] http://archive.nic.cz/public $(lsb_release -sc) main
EOT
fi

# Copy FRED pin list to /etc/apt/preferences.d/fred
cp files/fred /etc/apt/preferences.d/fred

apt update

# Installation of FRED packages
apt -y install apache2 libapache2-mod-corba libapache2-mod-eppd python3-fred-epplib

# Enable apache2 modules required by EPP
a2enmod corba eppd ssl

# Enable eppd site in apache
a2ensite 02-fred-mod-eppd-apache

# Change logger configuration to point to correct name
sed -i 's/\(CorbaObject[[:space:]]*\)"Logger"\([[:space:]]*"Logger_alias"\)/\1"LoggerNew"\2/' /etc/apache2/sites-enabled/02-fred-mod-eppd-apache.conf

# Do not forget to edit configuration to suit your needs (/etc/apache2/sites-enabled/), then you can restart
# In this configuration you can specify certification authority that is used to authenticate registrars via EPP
systemctl restart apache2

# After installation you should be able to see apache2 listening on port 700, and you should be able to connect via fred-eppic to this node
```

--------------------------------

### Install and Configure PostgreSQL 17

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallDebian.html

This script installs PostgreSQL 17, configures the timezone and listen addresses, initializes the required databases, and imports the necessary SQL structures.

```bash
# OS is up to you, postgresql 17 is required

apt update
apt install -y ca-certificates curl gnupg lsb-release git sudo

# Clone repo with configurations(.sql structures of databases)
cd /tmp/
git clone https://gitlab.nic.cz/fred/demo-install.git

# Move conf files to /tmp
mv demo-install/files /tmp/

# Install postgresql 17
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
echo "deb http://apt.postgresql.org/pub/repos/apt/ `lsb_release -cs`-pgdg main" |sudo tee  /etc/apt/sources.list.d/pgdg.list
apt update
apt -y install postgresql-17 postgresql-client-17

# Set psql timezone to UTC, set correct listen addresses and setup pg_hba correctly
sed -i~ -e "s/^#\?\s*timezone\s*=.*/timezone = 'UTC'/" /etc/postgresql/17/main/postgresql.conf
sed -i "s/#listen_addresses = 'localhost'/listen_addresses = '*' /" /etc/postgresql/17/main/postgresql.conf
systemctl restart postgresql

# Initialize fred and fredlog database
mkdir -p /var/lib/postgresql/17/fred
cp -r files/db-config/* /var/lib/postgresql/17/fred/
sudo -u postgres psql -c "CREATE USER fred WITH ENCRYPTED PASSWORD '<strong-password>';"
sudo -u postgres psql -c "CREATE USER logd WITH ENCRYPTED PASSWORD '<strong-password>';"
sudo -u postgres psql -c 'CREATE DATABASE fred;'
sudo -u postgres psql -c 'CREATE DATABASE fredlog;'
sudo -u postgres psql -c 'ALTER DATABASE fred OWNER TO fred;'
sudo -u postgres psql -c 'ALTER DATABASE fredlog OWNER TO logd;'
sudo -u postgres psql -c 'GRANT ALL PRIVILEGES ON DATABASE fred TO fred;'
sudo -u postgres psql -c 'GRANT ALL PRIVILEGES ON DATABASE fredlog TO logd;'

su - postgres -c "PGPASSWORD='<strong-password>' psql -h 127.0.0.1 -U fred -d fred -f 17/fred/structure.sql"
su - postgres -c "PGPASSWORD='<strong-password>' psql -h 127.0.0.1 -U fred -d fred -f 17/fred/fred_db.sql"
su - postgres -c "PGPASSWORD='<strong-password>' psql -h 127.0.0.1 -U logd -d fredlog -f 17/fred/structure.sql"
su - postgres -c "PGPASSWORD='<strong-password>' psql -h 127.0.0.1 -U logd -d fredlog -f 17/fred/logdb_db.sql"
su - postgres -c "PGPASSWORD='<strong-password>' psql -h 127.0.0.1 -U logd -d fredlog -f 17/fred/fix-seq.sql"

# Initialize cdnskey_processor database
sudo -u postgres psql -c "CREATE USER cdnskey_processor WITH ENCRYPTED PASSWORD '<strong-password>';"
sudo -u postgres psql -c "CREATE USER cdnskey_processor_ro WITH ENCRYPTED PASSWORD '<strong-password>';"
sudo -u postgres psql -c 'CREATE DATABASE cdnskey_processor;'
sudo -u postgres psql -c 'ALTER DATABASE cdnskey_processor OWNER TO cdnskey_processor;'
sudo -u postgres psql -c 'GRANT ALL PRIVILEGES ON DATABASE cdnskey_processor TO cdnskey_processor;'

su - postgres -c "PGPASSWORD='<strong-password>' psql -h 127.0.0.1 -U cdnskey_processor -d cdnskey_processor -f 17/fred/cdnskey/0001_schema.sql"

# Add akm-worker into the cdnskey_processor database
su - postgres -c "PGPASSWORD='<strong-password>' psql -h 127.0.0.1 -U cdnskey_processor -d cdnskey_processor -c \"INSERT INTO worker (name) VALUES ('worker-1');\""

# Dont forget to configure /etc/postgresql/17/main/pg_hba.conf with correct ip addresses
```

--------------------------------

### Backend Node Installation and Configuration

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallDebian.html

This script installs required system dependencies, sets up Docker, configures Nginx, prepares application directories, sets up user permissions, and initializes the application containers.

```bash
# OS: Up to you - this is a docker server

apt update
apt install -y ca-certificates curl gnupg lsb-release git sudo nginx-full

# Clone repo with configurations(.sql structures of databases)
cd /tmp/
git clone https://gitlab.nic.cz/fred/demo-install.git

# Move conf files to /tmp
mv demo-install/files /tmp/

# Docker installation
sudo mkdir -m 0755 -p /etc/apt/keyrings

# Add docker gpg key
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add docker repository
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install required docker packages
apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Install and configure nginx
# Also consider using LE certificate or your own self-signed TLS cert to secure the webpage
apt install -y nginx-full
rm /etc/nginx/sites-enabled/default
# In this file `secretary` change the server name and certificates used
cp -r /tmp/files/docker-apps/nginx-demo/secretary /etc/nginx/sites-available/
ln -sf /etc/nginx/sites-available/secretary /etc/nginx/sites-enabled/secretary

systemctl restart nginx

# Create directory, where docker apps will store its configurations
mkdir -p /var/docker-apps

# Prepare docker app directories
cp -r /tmp/files/docker-apps/secretary /var/docker-apps/
cp -r /tmp/files/docker-apps/messenger /var/docker-apps/
cp -r /tmp/files/docker-apps/fileman /var/docker-apps/

# Move into secretary directory
# There you should edit .env file with your configuration - DB connection, secret token..
# And the same goes for the other docker apps - configure them to match your FRED installation
vim /var/docker-apps/secretary/.env
vim /var/docker-apps/messenger/.env
vim /var/docker-apps/fileman/.env

# Create volume for secretary files
docker volume create secretary_media

# Create also volume for fileman
mkdir -p /var/lib/fileman
docker volume create --driver local --opt type=none --opt device=/var/lib/fileman --opt o=bind fileman_files

# Create fileman user - needed to correctly mount fileman_files volume - GID and UID can be changed - but dont forget to change it in fileman docker compose too
sudo groupadd -g 30002 fileman
sudo useradd  -u 30002 -g 30002 -M -s /usr/sbin/nologin fileman
chown -R 30002:30002 /var/lib/fileman

# Create secretary user - needed to correctly mount secretary_media volume - GID and UID can be changed - but dont forget to change it in secretary docker compose too
sudo groupadd -g 30001 secretary
sudo useradd  -u 30001 -g 30001 -M -s /usr/sbin/nologin secretary
chown -R 30001:30001 /var/lib/docker/volumes/secretary_media/

# After you configure these options you can run all of the docker apps
cd /var/docker-apps/secretary/ && docker compose up -d
cd /var/docker-apps/messenger/ && docker compose up -d
cd /var/docker-apps/fileman/ && docker compose up -d

# You should be able to see secretary, messenger and fileman containers in the output of `docker ps`

# If you see secretary running - create superuser and load templates
mv /tmp/files/secretary-templates /tmp/

cd /var/docker-apps/secretary

docker compose run --rm -v /tmp/secretary-templates:/app/secretary-templates:ro -w /app/secretary-templates secretary_uwsgi python3 load_templates.py fred-migration.yml
docker compose run --rm -v /tmp/secretary-templates:/app/secretary-templates:ro -w /app/secretary-templates secretary_uwsgi python3 load_templates.py fred-templates.yml
docker compose run --rm -v /tmp/secretary-templates:/app/secretary-templates:ro -w /app/secretary-templates secretary_uwsgi python3 load_templates.py pdf-templates.yml

docker compose run -e DJANGO_SUPERUSER_USERNAME=<admin-user> -e DJANGO_SUPERUSER_EMAIL=<your-email> -e DJANGO_SUPERUSER_PASSWORD=<strong-password> --rm secretary_uwsgi django-admin createsuperuser --noinput

# For messenger - create master trigger file
mkdir -p /etc/master
touch /etc/master/messenger-sender

# After that you can browse secretary in your browser - templates or /admin for admin interface
# Also messenger and fileman container should be visible as up and running in the output of `docker ps`
```

--------------------------------

### Install FRED HM node on Ubuntu

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallUbuntu.html

Commands to install and configure the FRED HM node on Ubuntu. Includes adding the CZ.NIC keyring, setting up the FRED repository, installing postfix non-interactively, and installing fred-zone-generator. After installation, you need to create your own configuration (example linked) and restart the service.

```bash
apt update
apt install -y ca-certificates curl gnupg lsb-release python3-pip apache2

# Add cznic keyring for fred packages
mkdir -p /usr/share/keyrings/
wget https://archive.nic.cz/dists/cznic-archive-keyring.gpg --output-document=/usr/share/keyrings/cznic-archive-keyring.gpg

# Add source list for FRED
cat << EOT >> /etc/apt/sources.list.d/fred.list
deb [signed-by=/usr/share/keyrings/cznic-archive-keyring.gpg] http://archive.nic.cz/public $(lsb_release -sc) main
EOT

# Postfix non-interactive installation
debconf-set-selections <<< "postfix postfix/mailname string $(hostname)"
debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Internet Site'"
apt --assume-yes install postfix

# Create preferences.d/ pin list to install correct fred packages (current APT preferences file is available at https://fred.nic.cz/en/get-fred/)
wget https://fred.nic.cz/media/filer_public/71/ce/71ce3145-a4bb-4583-9ff2-218627d71d5f/20241fredpreferencesd.txt -O /etc/apt/preferences.d/fred

apt update

apt -y install fred-zone-generator

# You will need to create your own configuration, example is here https://gitlab.nic.cz/fred/backend/zone/-/blob/master/server-example.conf?ref_type=heads), restart service after change
```

--------------------------------

### Install AKM node on Debian 12

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallDebian.html

This script performs the full installation of the AKM node, including repository setup, package installation, and RabbitMQ configuration. Ensure you have root privileges before executing these commands.

```bash
# OS: Debian 12

apt update
apt install -y ca-certificates curl gnupg lsb-release git sudo

# Clone repo with configurations(.sql structures of databases)
cd /tmp/
git clone https://gitlab.nic.cz/fred/demo-install.git

# Move conf files to /tmp
mv demo-install/files /tmp/

# Add cznic keyring for fred packages
mkdir -p /usr/share/keyrings/
curl https://archive.nic.cz/dists/cznic-archive-keyring.gpg >/usr/share/keyrings/cznic-archive-keyring.gpg

# Add keyring for rabbitmq
curl -1sLf "https://keys.openpgp.org/vks/v1/by-fingerprint/0A9AF2115F4687BD29803A206B73A36E6026DFCA" | sudo gpg --dearmor | sudo tee /usr/share/keyrings/com.rabbitmq.team.gpg > /dev/null

# Add source list for rabbitmq
if [ ! -f /etc/apt/sources.list.d/rabbitmq.list ]; then
sudo tee /etc/apt/sources.list.d/rabbitmq.list <<EOF
deb [arch=amd64 signed-by=/usr/share/keyrings/com.rabbitmq.team.gpg] https://deb1.rabbitmq.com/rabbitmq-erlang/debian/bookworm bookworm main
deb [arch=amd64 signed-by=/usr/share/keyrings/com.rabbitmq.team.gpg] https://deb2.rabbitmq.com/rabbitmq-erlang/debian/bookworm bookworm main
deb [arch=amd64 signed-by=/usr/share/keyrings/com.rabbitmq.team.gpg] https://deb1.rabbitmq.com/rabbitmq-server/debian/bookworm bookworm main
deb [arch=amd64 signed-by=/usr/share/keyrings/com.rabbitmq.team.gpg] https://deb2.rabbitmq.com/rabbitmq-server/debian/bookworm bookworm main
EOF
fi

# Add source list for FRED
if [ ! -f /etc/apt/sources.list.d/fred.list ]; then
cat << EOT >> /etc/apt/sources.list.d/fred.list
deb [signed-by=/usr/share/keyrings/cznic-archive-keyring.gpg] http://archive.nic.cz/public $(lsb_release -sc) main
EOT
fi

# Copy FRED pin list to /etc/apt/preferences.d/fred
cp files/fred /etc/apt/preferences.d/fred

apt update

# Installation of FRED
apt -y install cdnskey-scanner cdnskey-processor-common cdnskey-processor-master cdnskey-processor-api cdnskey-processor-worker

## Install Erlang packages
sudo apt-get install -y erlang-base \
                        erlang-asn1 erlang-crypto erlang-eldap erlang-ftp erlang-inets \
                        erlang-mnesia erlang-os-mon erlang-parsetools erlang-public-key \
                        erlang-runtime-tools erlang-snmp erlang-ssl \
                        erlang-syntax-tools erlang-tftp erlang-tools erlang-xmerl

## Install rabbitmq-server and its dependencies
sudo apt-get install rabbitmq-server -y --fix-missing

# Create vhost in rabbitmq for cdnskey-processor
# vhost
rabbitmqctl add_vhost cdnskey-processor

# api
rabbitmqctl add_user api 'password'
rabbitmqctl set_permissions -p cdnskey-processor api "^queue_results$" "^(exchange_response|queue_results)$" "^queue_results$"

# worker
rabbitmqctl add_user worker 'password'
rabbitmqctl set_permissions -p cdnskey-processor worker "^(queue_(insecure|diag)_[-\w]+)$" "^(queue_diag|queue_secure|queue_insecure_[-\w]+|exchange_insecure_fanout)$" "^(exchange_diag|exchange_response|exchange_insecure_fanout|queue_secure|queue_(insecure|diag)_[-\w]+)$"

# admin
rabbitmqctl add_user admin 'password'
rabbitmqctl set_permissions -p / admin ".*" ".*" ".*"
rabbitmqctl set_user_tags admin administrator

# Copy rabbitmq configs
cp -r files/rabbitmq-config/* /etc/rabbitmq/

# Restart rabbitmq
systemctl restart rabbitmq-server

# Configure these services to match your FRED configuration, then restart them
# Restart cdnskey_processor services
systemctl restart cdnskey-processor-api.service
systemctl restart cdnskey-processor-worker.service
systemctl restart cdnskey-processor-producer.service
systemctl restart cdnskey-processor-consumer.service
```

--------------------------------

### Install and Configure ADMIN Node

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallDebian.html

Sets up Docker, Nginx, and the Ferda application for the ADMIN node.

```bash
# OS: Up to you - this is a docker server

apt update
apt install -y ca-certificates curl gnupg lsb-release git sudo nginx-full

# Clone repo with configurations(.sql structures of databases)
cd /tmp/
git clone https://gitlab.nic.cz/fred/demo-install.git

# Move conf files to /tmp
mv demo-install/files /tmp/

# Docker installation
sudo mkdir -m 0755 -p /etc/apt/keyrings

# Add docker gpg key
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add docker repository
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install required docker packages
apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Install and configure nginx
# Also consider using LE certificate or your own self-signed TLS cert to secure the webpage
apt install -y nginx-full
rm /etc/nginx/sites-enabled/default
# In this file `ferda` change the server name and certificates used
cp -r /tmp/files/docker-apps/nginx-demo/ferda /etc/nginx/sites-available/
ln -sf /etc/nginx/sites-available/ferda /etc/nginx/sites-enabled/ferda

systemctl restart nginx

# Create directory, where docker apps will store its configurations
mkdir -p /var/docker-apps

# Prepare Ferda app directory
cp -r /tmp/files/docker-apps/ferda /var/docker-apps/

# Move into Ferda directory
cd /var/docker-apps/ferda/

# There you should edit .env file without your configuration - that means correct addresses of registry services, address of database node for ferda etc...
# After you configure these options you can run ferda containers
docker compose up -d

# You should be able to see ferda containers in the output of `docker ps`, if so run migrations, and create superuser

docker compose run --rm ferda_uwsgi django-admin migrate

docker compose run -e DJANGO_SUPERUSER_USERNAME=<admin_username> -e DJANGO_SUPERUSER_EMAIL=<your-email-address> -e DJANGO_SUPERUSER_PASSWORD=<strong-password> --rm ferda_uwsgi django-admin createsuperuser --noinput

# After that you can login at your Ferda domain as a created superuser
```

--------------------------------

### Start eppic client (FRED EPP client)

Source: https://fred.nic.cz/documentation/html/QuickStart/RegistryOperations.html

Launch the `eppic` client for interactive testing with the registration demo registry using REG-DEMO credentials. Default configuration can be changed by editing `/etc/eppic/eppic.conf` or via command-line arguments.

```bash
fred@localhost:~$ eppic

```

--------------------------------

### Install FRED SECRETARY node on Ubuntu 20.04

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallUbuntu.html

Commands to install and configure the FRED SECRETARY node on Ubuntu 20.04. Includes installing dependencies, setting up the FRED repository, installing python3-django-secretary, enabling it in UWSGI, configuring nginx, creating necessary folders, running Django migrations, collecting static files, creating a superuser, loading templates, and starting services.

```bash
# Ubuntu 20.04 LTS

apt update
apt install -y ca-certificates curl gnupg lsb-release python3-pip uwsgi uwsgi-plugin-python3 nginx

# Add cznic keyring for fred packages
mkdir -p /usr/share/keyrings/
wget https://archive.nic.cz/dists/cznic-archive-keyring.gpg --output-document=/usr/share/keyrings/cznic-archive-keyring.gpg

# Add source list for FRED
cat << EOT >> /etc/apt/sources.list.d/fred.list
deb [signed-by=/usr/share/keyrings/cznic-archive-keyring.gpg] http://archive.nic.cz/public $(lsb_release -sc) main
EOT

# Create preferences.d/ pin list to install correct fred packages (current APT preferences file is available at https://fred.nic.cz/en/get-fred/)
wget https://fred.nic.cz/media/filer_public/71/ce/71ce3145-a4bb-4583-9ff2-218627d71d5f/20241fredpreferencesd.txt -O /etc/apt/preferences.d/fred

# Postfix non-interactive installation
debconf-set-selections <<< "postfix postfix/mailname string $(hostname)"
debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Internet Site'"
apt --assume-yes install postfix

apt update

apt -y install python3-django-secretary

# Enable secretary in UWSGI
cp /usr/share/doc/python3-django-secretary/examples/fred-secretary.ini /etc/uwsgi/apps-available/
ln -s /etc/uwsgi/apps-available/fred-secretary.ini /etc/uwsgi/apps-enabled/fred-secretary.ini
sed -i '/\/run\/uwsgi\/fred-secretary\/socket/c\socket = \/run\/uwsgi\/app\/fred-secretary\/socket' /etc/uwsgi/apps-available/fred-secretary.ini
cp /usr/share/doc/python3-django-secretary/examples/uwsgi_secretary.py /etc/uwsgi/

# Setup nginx and copy secretary configuration
cp /usr/share/doc/python3-django-secretary/examples/secretary-nginx.conf /etc/nginx/sites-available/secretary.conf
cp /usr/share/doc/python3-django-secretary/examples/fred-secretary.service /etc/systemd/system
ln -s /etc/nginx/sites-available/secretary.conf /etc/nginx/sites-enabled/secretary.conf
rm /etc/nginx/sites-enabled/default

# Create a folder for the UWSGI socket
mkdir -p /run/uwsgi/app/fred-secretary/
chown www-data:www-data /run/uwsgi/app/fred-secretary
# Create static files folder for secretary
mkdir -p /var/www/fred/
chown www-data:www-data /var/www/fred

# Before you run any secretary command, configuration must exist – example conf can be found here https://gitlab.nic.cz/fred/demo-install/-/tree/master/files/configs/secretary_cfg

sudo -u www-data PYTHONPATH=/etc/fred DJANGO_SETTINGS_MODULE=secretary_cfg.settings django-admin migrate

# Collect secretary static files
sudo -u www-data PYTHONPATH=/etc/fred DJANGO_SETTINGS_MODULE=secretary_cfg.settings django-admin collectstatic

# Create secretary super user
sudo -u www-data DJANGO_SUPERUSER_USERNAME=admin DJANGO_SUPERUSER_PASSWORD=password DJANGO_SUPERUSER_EMAIL=admin@admin.example PYTHONPATH=/etc/fred DJANGO_SETTINGS_MODULE=secretary_cfg.settings django-admin createsuperuser --noinput

# Load secretary templates
apt install python3-docopt
cd /usr/share/doc/python3-django-secretary/examples/secretary-templates/
sudo -u www-data PYTHONPATH=/etc/fred DJANGO_SETTINGS_MODULE=secretary_cfg.settings python3 load_templates.py pdf-templates.yml
sudo -u www-data PYTHONPATH=/etc/fred DJANGO_SETTINGS_MODULE=secretary_cfg.settings python3 load_templates.py fred-migration.yml
sudo -u www-data PYTHONPATH=/etc/fred DJANGO_SETTINGS_MODULE=secretary_cfg.settings python3 load_templates.py fred-templates.yml

systemctl daemon-reload
systemctl enable --now fred-secretary
systemctl restart nginx
```

--------------------------------

### Create domain via EPPic (create-domain)

Source: https://fred.nic.cz/documentation/html/QuickStart/RegistryOperations.html

Create a domain name example-domain.demo with registrant CID-DEMO1 using the eppic client.

```bash
create-domain --name=example-domain.demo --registrant=CID-DEMO1

```

--------------------------------

### XML example for domain create command

Source: https://fred.nic.cz/documentation/html/EPPReference/CommandStructure/Create/CreateDomain.html

Shows the EPP XML structure for creating a domain with name, nsset, registrant, and admin contact. The command must be contained in the <create> command type and declare the domain namespace.

```xml
<?xml version="1.0" encoding="utf-8" standalone="no"?>
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0 epp-1.0.xsd">
   <command>
      <create>
         <domain:create xmlns:domain="http://www.nic.cz/xml/epp/domain-1.4"
          xsi:schemaLocation="http://www.nic.cz/xml/epp/domain-1.4 domain-1.4.5.xsd">
            <domain:name>example.cz</domain:name>
            <domain:nsset>NSSET-MYNSSET</domain:nsset>
            <domain:registrant>MYOWN</domain:registrant>
            <domain:admin>ADMIN1</domain:admin>
         </domain:create>
      </create>
      <clTRID>zbdm002#17-08-09at12:31:47</clTRID>
   </command>
</epp>
```

--------------------------------

### Install and configure FRED HM node on Debian 12

Source: https://fred.nic.cz/documentation/html/AdminManual/Installation/InstallDebian.html

This script installs dependencies, adds the CZ.NIC repository, installs the fred-zone-generator package, and sets up initial configuration files from the demo repository.

```bash
# OS: Debian 12

apt update
apt install -y ca-certificates curl gnupg lsb-release git sudo

# Clone repo with configurations(.sql structures of databases)
cd /tmp/
git clone https://gitlab.nic.cz/fred/demo-install.git

# Move conf files to /tmp
mv demo-install/files /tmp/

# Add cznic keyring for fred packages
mkdir -p /usr/share/keyrings/
curl https://archive.nic.cz/dists/cznic-archive-keyring.gpg >/usr/share/keyrings/cznic-archive-keyring.gpg

# Add source list for FRED
if [ ! -f /etc/apt/sources.list.d/fred.list ]; then
cat << EOT >> /etc/apt/sources.list.d/fred.list
deb [signed-by=/usr/share/keyrings/cznic-archive-keyring.gpg] http://archive.nic.cz/public $(lsb_release -sc) main
EOT
fi

# Copy FRED pin list to /etc/apt/preferences.d/fred
cp files/fred /etc/apt/preferences.d/fred

apt update

# Installation of FRED packages
apt -y install fred-zone-generator

# Remove installation files created by packages, and use example confs from demo repository - it is expected that you will change these configurations according to your needs
rm -rf /etc/fred/*
cp -r files/configs/fred-zone-generator.conf /etc/fred/

# Configure zone-generator to match your FRED configuration
vim /etc/fred/fred-zone-generator.conf

# After the installation and configuration you should be able to generate zone via fred-zone-generator command
```