> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the inventory file

> Configure the hosts.inv inventory file with required properties for Zettaset installation.

The inventory file, `hosts.inv`, sets the configuration properties for the installation. The Zettaset software includes an annotated sample file, `hosts.inv.example`. Additional information is provided here for the file sections:

## ALL NODES

ALL NODES is a section of the inventory file.

```none expandable lines wrap title="None" theme={null}
# ALL NODES
target01 encrypted_blockdev=/dev/sdb1 encrypted_mountpoint=/data1
encrypted_mountnames=crypt1 encrypted_preserve=n fstype=ext4 newfsargs=none
mountargs=none

target02 encrypted_blockdev=/dev/sdb1 encrypted_mountpoint=/data1
encrypted_mountnames=crypt1 encrypted_preserve=n fstype=ext4 newfsargs=none
mountargs=none

target03 encrypted_blockdev=/dev/sdb1 encrypted_mountpoint=/data1
encrypted_mountnames=crypt1 encrypted_preserve=n fstype=ext4 newfsargs=none
mountargs=none
```

In this section, list each node in your deployment by using hostnames or IP addresses. When encrypting multiple partitions on a node, use commas to separate values. For each node, include the following variables:

<table>
  <thead>
    <tr>
      <th><em><strong>Variable</strong></em></th>
      <th><em><strong>Description</strong></em> </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><strong>encrypted\_blockdev</strong></td>
      <td>Enter the block device to be encrypted (for example, <code>/dev/sdb1</code>). Disk partition name is expected. To use disk partition labels, set <strong>use\_labels=true</strong>.</td>
    </tr>

    <tr>
      <td><strong>encrypted\_mountpoint</strong></td>
      <td>Enter a mount point for the device (for example, <code>/data1</code>). The mount point must exist before the installation.</td>
    </tr>

    <tr>
      <td><strong>encrypted\_mountnames</strong></td>
      <td>Enter a partition name. Each name must be unique for each partition on the node. (for example, <strong>crypt1</strong>)</td>
    </tr>

    <tr>
      <td><strong>encrypted\_preserve</strong> </td>
      <td>Use one of the following values:<ul><li><strong>y</strong>: Preserves existing data. <ul><li>The file system must be mounted before the installation. If the partition is not mounted, the data is overwritten. </li><li>The partition must also be unmountable. If a process prevents the unmount, encryption cannot start. </li><li>Only ext file systems can be preserved.</li></ul></li><li><strong>n</strong>: Does not preserve existing data. <ul><li>The partition must be unmounted.</li></ul></li><li><strong>w</strong>: Securely wipes the partition before the new encrypted file system is created. <ul><li>The partition must be unmounted.</li></ul></li></ul></td>
    </tr>

    <tr>
      <td><strong>fstype</strong></td>
      <td>Must be set to the type of file system to make when <strong>encrypted\_preserve</strong> is <strong>y</strong> or <strong>w</strong>. <br />Must be set to the existing file system type when <strong>encrypted\_preserve=n</strong>. <br />Typical file system types include <strong>ext4</strong> and <strong>xfs</strong>.</td>
    </tr>

    <tr>
      <td><strong>newfsargs</strong></td>
      <td>A string of arguments to pass to the <strong>mkfs </strong>command. <br />If spaces exist between multiple arguments, surround the string in double quotes (for example, "<strong>-b 2048 -d su=64k,sw=4</strong>"). <br />When no arguments are to be passed, set this value to <strong>none</strong>.<br />Use colons to separate values. </td>
    </tr>

    <tr>
      <td><strong>mountargs</strong></td>
      <td>A string of mount options to pass to the <code>crypt\_mount.sh</code> script. <br />If spaces exist between multiple arguments, surround the string in double quotes (for example, "<strong>noatime,inode64,allocsize=16m</strong>"). <br />When no arguments are to be passed, set this value to <strong>none</strong>.</td>
    </tr>

    <tr>
      <td><strong>kmip\_client\_jks</strong></td>
      <td>The location of the keystore that contains the client certificate. <br />The keystore must be in this location on the installer node before installation.</td>
    </tr>

    <tr>
      <td><strong>kmip\_client\_jks\_password</strong></td>
      <td>The password for the <strong>jks</strong> file.</td>
    </tr>
  </tbody>
</table>

Include values for all settings.

In the following example, the hostnames provided must resolve. If some nodes are separated by a proxy (such as if you deploy to nodes in **skytap** from your laptop), use the **ansible\_ssh\_host** and **ansible\_ssh\_port** variables. Otherwise, do not use those variables.

```none expandable lines wrap title="None" theme={null}
target03 encrypted_blockdev=/dev/sdb1,/dev/sdb2 encrypted_mountpoint=/data1,/
data2 encrypted_mountnames=crypt1,crypt2 encrypted_preserve=n,n fstype=ext4,xfs
newfsargs=none:"-b size=2048 -d su=64k,sw=4" mountargs=none:"noatime,inode64"
```

## PRODUCT NAME

PRODUCT NAME is a section of the inventory file.

```none expandable lines wrap title="None" theme={null}
# PRODUCT NAME
zts_product=xcrypt_full_disk
```

This line displays the product name.

## SOFTWARE LICENSE

SOFTWARE LICENSE is a section of the inventory file.

```none expandable lines wrap title="None" theme={null}
# SOFTWARE LICENSE
license_file=/path/to/your.license
```

In this line, include the full path to the license file.

## FIPS MODE

FIPS MODE is a section of the inventory file.

```none expandable lines wrap title="None" theme={null}
# FIPS MODE
fips_mode=false
```

If you use OS versions 7.x and later, you can set **fips\_mode** to `true` to enable FIPS 140 mode. All ZTS processes run in FIPS mode.

## DISK LABELS

DISK LABELS is a section of the inventory file.

```none expandable lines wrap title="None" theme={null}
# DISK LABELS
use_labels=false
```

By default, the Zettaset software expects the **encrypted\_blockdev** value shown in the **ALL NODES** section to point to a disk partition, such as `/dev/sdb`. To use disk partition labels instead, set **use\_labels=true**.

## CA CONFIGURATION

CA CONFIGURATION is a section of the inventory file.

```none expandable lines wrap title="None" theme={null}
# CA CONFIGURATION
internal_ca=false
external_ca_cert_source=
ca_org_name=
ca_org_unit=
ca_org_email=
ca_org_locale=
ca_org_state=
ca_org_country=
```

You must have a CA to authenticate nodes within your deployment. To use your pre-defined CA, set **internal\_ca=false** and enter the full path to the CA `PEM` file in **external\_ca\_cert\_source**. This is the location of the CA PEM file on the installer node.

While using an external CA, you can ignore the **ca\_org\_\*** values.

## KMIP SERVER CONFIGURATION

KMIP SERVER CONFIGURATION is a section of the inventory file.

```none expandable lines wrap title="None" theme={null}
# KMIP SERVER CONFIGURATION

internal_kmip=false
kmip_master_ip=172.24.166.20
kmip_server_port=9000
kmip_client_timeout=300000
kmip_compatible_user=true
install_ha=false
kmip_client_jks_test=
kmip_client_jks_test_passwd=
```

You need a KMIP server server to process key requests. To use an external KMIP server, set `internal_kmip=false` and set the **kmip\_master\_ip** and **kmip\_master\_port** to point to your third-party device.

Use **kmip\_client\_timeout** to configure the timeout setting or keep the default value of **300000**.

When using an external KMIP server, use **kmip\_client\_jks\_test** and **kmip\_client\_jks\_passwd** to enter the **jks** path and password and check the KMIP server connectivity before installing XCrypt. Using these values installs a KMIP client on the installation node. Leave these values blank if you do not need to check external KMIP connectivity or install a KMIP client on the installation node.

## HSM CONFIGURATION

HSM CONFIGURATION is a section of the inventory file.

```none expandable lines wrap title="None" theme={null}
# HSM CONFIGURATION

hsm_so_pin=safest
hsm_user_pin=safest
hsm_slot=0
hsm_lib_cfg_env_var=COMPAT_MODE=3
hsm_lib_file=/usr/local/bin/fxpkcs11/libfxpkcs11.so
```

You need a software or hardware-based HSM for key storage. To use the Vectera Plus HSM for hardware-based key storage, set the values for each of the following parameters:

<table>
  <thead>
    <tr>
      <th><em><strong>Variable</strong></em></th>
      <th><em><strong>Description</strong></em></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><strong>hsm\_so\_pin</strong></td>
      <td>Password of identity created on the Vectera Plus and set inside the Futurex PKCS #11 (<strong>FXPKCS11</strong>) configuration file.</td>
    </tr>

    <tr>
      <td><strong>hsm\_user\_pin</strong></td>
      <td>Password of identity created on the Vectera Plus and set inside the Futurex PKCS #11 (<strong>FXPKCS11</strong>) configuration file.</td>
    </tr>

    <tr>
      <td><strong>hsm\_slot</strong></td>
      <td>Slot number configured in the <strong>FXPKCS11</strong> configuration file (<code>fxpkcs11.cfg</code>). The slot number is <strong>0</strong> by default.</td>
    </tr>

    <tr>
      <td><strong>hsm\_lib\_cfg\_env\_var</strong></td>
      <td>Specify <strong>COMPAT\_MODE=3</strong> exactly.</td>
    </tr>

    <tr>
      <td><strong>hsm\_lib\_file</strong></td>
      <td>Path and filename for the <strong>FXPKCS11</strong> module.</td>
    </tr>
  </tbody>
</table>

## NODE FUNCTIONS

NODE FUNCTIONS is a section of the inventory file.

```none expandable lines wrap title="None" theme={null}
# NODE FUNCTIONS

[ca_master]
target01
[kmip]
target01
target02
[kmip_master]
target01
[slave]
target01
target02
target03
[license_server]
target04
[zookeeper]
target01
target02
target03
```

The values for the bracketed elements in this section indicate the function a node has in the deployment. Be sure that these settings agree with the other values in this file.

<table>
  <thead>
    <tr>
      <th><em><strong>Bracketed element</strong></em></th>
      <th><em><strong>Description</strong></em></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><strong>\[ca\_master] </strong></td>
      <td>The node that stores licenses and generates the CA. If using an external CA, set this value to a node within the cluster.</td>
    </tr>

    <tr>
      <td><strong>\[kmip] </strong></td>
      <td>List of the KMIP server and backup server nodes. The first entry must be the <strong>kmip\_master</strong>. Ignore when using an external KMIP server.</td>
    </tr>

    <tr>
      <td><strong>\[kmip\_master] </strong></td>
      <td>The KMIP master node. Must be the same as <strong>kmip\_master\_ip</strong>. Ignore when using an external KMIP server.</td>
    </tr>

    <tr>
      <td><strong>\[slave] </strong></td>
      <td>List of the nodes that have encrypted partitions.</td>
    </tr>

    <tr>
      <td><strong>\[license\_server]</strong></td>
      <td>List of the nodes where the License server should be installed. Must not intersect with <strong>\[kmip]</strong> or <strong>\[slave]</strong> nodes.</td>
    </tr>

    <tr>
      <td><strong>\[zookeeper]</strong></td>
      <td>List of the zookeeper nodes used when KMIP HA is enabled. List at least three nodes. These nodes cannot be members of the <strong>\[kmip]</strong> group.</td>
    </tr>
  </tbody>
</table>