• 1 General
• 2 Hardware requirements for the server
• 3 Software requirements for the server - virtualization
• 4 Backup - remote storage
• 5 Network infrastructure
  • 5.1 Opening ports (inbound direction
  • 5.2 IP addresses of the service centres
  • 5.3 Allowing outbound communication (outbound direction
  • 5.4 Correct proxy / firewall / router settings
  • 5.5 Secure placement in the network infrastructure
    • 5.5.1 Technologies, protocols and software used
  • 5.6 Public access to the web system (HTTPS
  • 5.7 Operation on a local network
  • 5.8 Outgoing SMTP server

General

You can run Tritius on your own server in the form of a pre-installed virtual machine.

You take care of the server, the virtualization solution and its administration yourselves, or together with us if remote access is agreed.

Tritius is then available as an ordinary web application and all you need to use it is a common web browser.

You are responsible for data backup and archiving - you can use our ready-made tools, which only need access to a remote storage to be set up.

Hardware requirements for the server

The requirements for running Tritius are approximate, because the real demands of the system may differ, mainly depending on the total volume of catalogued data and the number of users working at the same time.

The recommended configurations assume that the whole system runs on one server (database + Tritius server application + web catalogue). These parts can, however, be run separately (for security and performance reasons).

Above 200,000 items we do not recommend running the system on external disks (disk arrays), but only on dedicated disks located directly in the servers.

Software requirements for the server - virtualization

The Tritius system is now distributed exclusively as a pre-installed virtual machine in the OVF format (https://en.wikipedia.org/wiki/Open_Virtualization_Format).

The virtual machine can be run on any virtualization solution that supports OVF:

• VirtualBox - the basic version is completely free,
• VMware - a high-quality paid solution,
• KVM,
• Hyper-V,
• Xen (PV mode).

We provide full support and help with installation into VirtualBox on the Windows operating system. For other solutions, please check the table below.

Basic support with importing and running the VM means providing basic information or a guide that has been used with other customers, or a contact to other customers using this solution - all without warranty.

Backup - remote storage

Backups are created automatically on the virtual machine itself and are then moved to a remote storage.

Optionally, a ready-made script for rotating backups (X daily, weekly and monthly backups) can be used.

We currently support automatic saving to remote storages available through the following protocols:

• FTP,
• NFS (Linux network filesystem), 
• CIFS (Windows folder sharing),
• SMB (Windows folder sharing).

Network infrastructure

Running Tritius requires an internet connection, a public IP address and the following network infrastructure settings.

If you want to use our offer of a free HTTPS certificate, you need a public IP address with free (unused) ports 80 and 443.

Opening ports (inbound direction)

The following ports must be made accessible on your public IP address and must be tunnelled (redirected) to the local ports of the VM.

*If you have a reverse proxy and wish to run the system behind it, the HTTP and HTTPS ports do not need to be tunnelled. The configuration of the web proxy is up to you, including providing and installing the SSL certificate.

IP addresses of the service centres

Service operations and regular maintenance are carried out from the following IP addresses. We recommend restricting access to some of the exposed ports to these IP addresses (see the network infrastructure requirements tables).

Allowing outbound communication (outbound direction)

This chapter does not concern you if you do not restrict outbound communication on your network.

If you restrict outbound communication on your network (a firewall on the router or on a physical server), the following communication from the VM to the target ports and IP addresses must be allowed.

*If you have your own SMTP server that you want to use, communication to the default external SMTP servers does not need to be allowed.

**If you do not plan to send DILIA statistics, setting up this port is not mandatory.

***If a connection to our database is needed during implementation. 

Correct proxy / firewall / router settings

Almost always there is some device in the library that handles the public IP address and then redirects the data to the VM with Tritius. This is classic redirection, and therefore the IP addresses contained in the headers of HTTP requests change. Some Tritius functions depend on distinguishing internal and external users (especially catalogue access statistics), so it is necessary to ensure that the catalogue receives the information about the original IP address from which the request came. The HTTP header X-FORWARDED-FOR serves this purpose, and the proxy element must set it correctly.

The specific settings differ depending on the network device or server used. Please consult your administrator.

Secure placement in the network infrastructure

This chapter does not concern you if you do not require a high level of security.

If a very high level of security is needed, the VM must be placed securely within the network infrastructure. This applies only to special cases in which customers themselves know about this need.

In such cases the VM must be placed in the network infrastructure so that it has access exclusively to the necessary resources, and only in the direction that is required. The VM must not have access to risky resources - this can be ensured e.g. by a firewall or by placing it in a DMZ. In practice this means network communication allowed only on carefully selected ports, which are in addition restricted by IP addresses.

Technologies, protocols and software used

If you use a sophisticated firewall that monitors traffic in detail, you will need to set up for the VM with Tritius what traffic is expected and which protocols and software are used. An overview table is given below.

Public access to the web system (HTTPS)

The Tritius web system can be exposed at an agreed domain address.

For security reasons, the system supports communication exclusively over the secured HTTPS protocol. We provide the SSL certificate for the agreed domain free of charge (or an already existing certificate can be used, if you own one).

There are the following options for ensuring public access to the Tritius web system:

1. Placing the web system on a new 3rd-level domain - the easiest variant and the one we recommend
   • Requires owning a free public IP address with free ports 80 and 443. (Port 80 is required only for automatic redirection of users who accidentally access the unsecured HTTP)
   • Example for a library named "Good Library" that owns the domain "dobraknihovna.cz" and the public IP address 99.88.77.66:
     • A DNS record of type A must be created: "tritius.dobraknihovna.cz    A 99.88.77.66"
     • Catalogue for readers: https://tritius.dobraknihovna.cz/Katalog
     • Access for library staff: https://tritius.dobraknihovna.cz/Tritius
        
2. Placing the web system on an existing domain behind a reverse proxy server - a more complicated variant, but it does not require a free public IP address
   • Requires access to an existing web server on the given domain and the possibility of setting it up as a reverse proxy server.
   • Example for a library named "Good Library" that owns the domain "dobraknihovna.cz", on which it runs a website at http://www.dobraknihovna.cz:
     • The existing web server must be made to run over HTTPS - the website will newly also run at https://www.dobraknihovna.cz (an SSL certificate must be obtained)
     • The existing web server must be set up as a reverse proxy for the addresses https://www.dobraknihovna.cz/Katalog and https://www.dobraknihovna.cz/Tritius, which will be redirected in the local network to the virtual machine running Tritius
     • Catalogue for readers: https://www.dobraknihovna.cz/Katalog
     • Access for library staff: https://www.dobraknihovna.cz/Tritius
   • Reverse proxy settings
     • Apache
       • ProxyRequests Off
       • ProxyPreserveHost On
       • Timeout 300
       • ProxyTimeout 300
       • RequestHeader X-Forwarded-Proto "https"
     • IIS
       • Actions → add
       • HTTP_X_FORWARDED_HOST = tritius.knihovna.cz
       • HTTP_X_FORWARDED_PROTO = https

Operation on a local network

If the server with Tritius is placed directly in the library's local network, it must be ensured that local computers can communicate with Tritius. Several potential problems need to be considered and the network infrastructure and/or settings adapted accordingly:

• The DNS resolution of the name e.g. tritius.knihovna.cz leads to the public IP address of the server with Tritius. This IP address must also be reachable from the local network. This is not always possible.
• A local DNS server can be used, which will return the local IP address directly for queries from the local network.
• A proxy/firewall can be used, which redirects requests addressed to the given domain to the local server.
• Local DNS records in the hosts file can be used, forcing the workstations to communicate with the local IP address.

Outgoing SMTP server

Tritius sends many different types of emails (reminders, news, etc.) and therefore needs an SMTP server for sending mail. In the standard Tritius setup, the servers of Tritius Solutions a.s. are used. When Tritius is installed on the library's own server, it is common to use the library's internal SMTP server.

Tritius places no special requirements on the library's SMTP. We only recommend considering proper security of the SMTP server (its placement in the infrastructure, encryption and protocol versions used), so that the library does not become a spam sender.

Further:

Technical requirements for running Tritius as a service