Skip to Content
Last modified by Erik Duraja on 2026/10/23 11:59
Hide last authors
Roman Slavík 7.1 1 {{toc/}}
Jan Šimeček 1.1 2
Jan Gazarek 8.1 3 = General =
Jan Šimeček 1.1 4
Jan Gazarek 8.1 5 You can run Tritius on your own server in the form of a pre-installed virtual machine.
Jan Šimeček 1.1 6
Jan Gazarek 8.1 7 You take care of the server, the virtualization solution and its administration yourselves, or together with us if remote access is agreed.
Jan Šimeček 1.1 8
Jan Gazarek 8.1 9 Tritius is then available as an ordinary web application and all you need to use it is a common web browser.
Jan Šimeček 1.1 10
Jan Gazarek 8.1 11 You are responsible for data backup and archiving - you can use our ready-made tools, which only need access to a remote storage to be set up.
Jan Šimeček 1.1 12
Jan Gazarek 8.1 13 = Hardware requirements for the server =
Jan Šimeček 1.1 14
Jan Gazarek 8.1 15 The requirements for running Tritius are approximate, because the real demands of the system may differ, mainly depending on the total volume of catalogued data and the number of users working at the same time.
Jan Šimeček 1.1 16
Jan Gazarek 8.1 17 The recommended configurations assume that the whole system runs on one server (database + Tritius server application + web catalogue). These parts can, however, be run separately (for security and performance reasons).
Jan Šimeček 1.1 18
Jan Gazarek 8.1 19 Above 200,000 items we do not recommend running the system on external disks (disk arrays), but only on dedicated disks located directly in the servers.
Jan Šimeček 1.1 20
21 |=(((
Jan Gazarek 8.1 22 Collection size
Jan Šimeček 1.1 23
Jan Gazarek 8.1 24 (number of items)
Jan Šimeček 1.1 25 )))|=(% colspan="1" %)(((
Jan Gazarek 8.1 26 Number of concurrently
Jan Šimeček 1.1 27
Jan Gazarek 8.1 28 working users
Jan Šimeček 1.1 29 )))|=(% colspan="1" %)(((
Jan Gazarek 8.1 30 Tritius
Jan Šimeček 1.1 31
Jan Gazarek 8.1 32 processor
Jan Šimeček 1.1 33 )))|=(% colspan="1" %)(((
Jan Gazarek 8.1 34 Processor
Jan Šimeček 1.1 35
Jan Gazarek 8.1 36 number of cores
Jan Šimeček 1.1 37 )))|=(((
Jan Gazarek 8.1 38 Tritius
Jan Šimeček 1.1 39
Jan Gazarek 8.1 40 disk
Jan Šimeček 1.1 41 )))|=(% colspan="1" %)(((
42 Disk
43
Jan Gazarek 8.1 44 (type)
Jan Šimeček 1.1 45 )))|=(((
Jan Gazarek 8.1 46 Tritius
47
Jan Šimeček 1.1 48 RAM
49 )))
Jan Gazarek 8.1 50 |up to 20,000|(% colspan="1" %)< 5|(% colspan="1" %)2.4GHz|(% colspan="1" %)4|50GB|(% colspan="1" %) |8GB
51 |up to 50,000|(% colspan="1" %)< 10|(% colspan="1" %)2.4GHz|(% colspan="1" %)4|100GB|(% colspan="1" %) |12GB
52 |up to 100,000|< 20|2.4GHz|6|100GB| |16GB
53 |up to 200,000|(% colspan="1" %)< 30|(% colspan="1" %)3.2GHz|(% colspan="1" %)6|200GB|(% colspan="1" %) |24GB
54 |(% colspan="1" %)up to 500,000|(% colspan="1" %)< 50|(% colspan="1" %)3.2GHz|(% colspan="1" %)8|(% colspan="1" %)250GB|(% colspan="1" %)SSD / M.2|(% colspan="1" %)48GB
55 |(% colspan="1" %)up to 1,000,000|(% colspan="1" %)< 100|(% colspan="1" %)3.2GHz|(% colspan="1" %)> 12|(% colspan="1" %)500GB|(% colspan="1" %)SSD / M.2|(% colspan="1" %)64GB
56 |(% colspan="1" %)over 1,000,000|(% colspan="6" %)individual assessment
Jan Šimeček 1.1 57
Jan Gazarek 8.1 58 = Software requirements for the server - virtualization =
Jan Šimeček 1.1 59
Jan Gazarek 8.1 60 The Tritius system is now distributed exclusively as a pre-installed virtual machine in the OVF format ([[https:~~/~~/en.wikipedia.org/wiki/Open_Virtualization_Format>>url:https://en.wikipedia.org/wiki/Open_Virtualization_Format]]).
Jan Šimeček 1.1 61
Jan Gazarek 8.1 62 The virtual machine can be run on any virtualization solution that supports OVF:
Jan Šimeček 1.1 63
Jan Gazarek 8.1 64 * **VirtualBox** - the basic version is completely free,
65 * **VMware** - a high-quality paid solution,
Jan Šimeček 1.1 66 * **KVM**,
67 * **Hyper-V,**
Jan Gazarek 8.1 68 * **Xen** (PV mode).
Jan Šimeček 1.1 69
Jan Gazarek 8.1 70 //We provide full support and help with installation into VirtualBox on the Windows operating system. For other solutions, please check the table below.//
Jan Šimeček 1.1 71
Jan Gazarek 8.1 72 //Basic support with importing and running the VM means providing basic information or a guide that has been used with other customers, or a contact to other customers using this solution - all without warranty.//
Jan Šimeček 1.1 73
Jan Gazarek 8.1 74 |=Virtualization solution|=Handover of the pre-installed VM (OVF)|=Basic support with importing and running the VM|=(% colspan="1" %)Installation and configuration of the virtualization solution and import of the VM
75 |VirtualBox on Windows OS|Yes|Yes|(% colspan="1" %)free of charge
76 |VirtualBox on Linux OS|Yes|Yes|(% colspan="1" %)on request as a paid service or by arranging a third party
77 |(% colspan="1" %)VMware, KVM, Hyper-V, XEN|(% colspan="1" %)Yes|(% colspan="1" %)Yes|(% colspan="1" %)entirely at your own expense
Jan Šimeček 1.1 78
Jan Gazarek 8.1 79 = Backup - remote storage =
Jan Šimeček 1.1 80
Jan Gazarek 8.1 81 Backups are created automatically on the virtual machine itself and are then moved to a remote storage.
Jan Šimeček 1.1 82
Jan Gazarek 8.1 83 Optionally, a ready-made script for rotating backups (X daily, weekly and monthly backups) can be used.
Jan Šimeček 1.1 84
Jan Gazarek 8.1 85 We currently support automatic saving to remote storages available through the following protocols:
Jan Šimeček 1.1 86
87 * **FTP**,
Jan Gazarek 8.1 88 * **NFS **(Linux network filesystem),
89 * **CIFS** (Windows folder sharing),
90 * **SMB** (Windows folder sharing).
Jan Šimeček 1.1 91
Jan Gazarek 8.1 92 = Network infrastructure =
Jan Šimeček 1.1 93
Jan Gazarek 8.1 94 **Running Tritius requires an internet connection, a public IP address and the following network infrastructure settings.**
Jan Šimeček 1.1 95
Jan Gazarek 8.1 96 **If you want to use our offer of a free HTTPS certificate, you need a public IP address with free (unused) ports 80 and 443.**
Jan Šimeček 1.1 97
Jan Gazarek 8.1 98 == Opening ports (inbound direction) ==
Jan Šimeček 1.1 99
Jan Gazarek 8.1 100 The following ports must be made accessible on your public IP address and must be tunnelled (redirected) to the local ports of the VM.
Jan Šimeček 1.1 101
Jan Gazarek 8.1 102 |=(% colspan="1" %)Public IP|=Public port|=(% colspan="1" %)Local IP|=(% colspan="1" %)Local port|=Protocol|=Recommended access restriction|=(% colspan="1" %)Note
103 |Your public IP|**443^^*^^**|Local IP of the VM|**443**|HTTPS|Unrestricted access|Access to the secured Tritius web application (web catalogue and library staff client).
104 |Your public IP|**80^^*^^**|Local IP of the VM|**80**|HTTP|Unrestricted access|Access to the Tritius web application (web catalogue and library staff client).
105 //The Tritius web server always redirects users to the secured HTTPS automatically.//
106 |Your public IP|**9998**|Local IP of the VM|**9998**|Z-Server|Unrestricted access|Access to the Z-server, if it is enabled for the instance.
107 |(% colspan="1" %)Your public IP|**22** ^^(or another agreed port)^^|(% colspan="1" %)Local IP of the VM|(% colspan="1" %)**22**|SSH|Only IP addresses of the service centres|SSH connection to the VM with Tritius for administration and maintenance purposes.
108 |(% colspan="1" %)Your public IP|**10050** ^^(or another agreed port)^^|(% colspan="1" %)Local IP of the VM|(% colspan="1" %)**10050**|ZBX|Only IP addresses of the service centres|Monitoring of the state of the VM with Tritius via Zabbix (passive monitoring, for incoming connections).
109 |Your public IP|**9010**^^ (or another agreed port)^^|Local IP of the VM|**9010**|JMX|Only IP addresses of the service centres|Monitoring of the state of Tritius via JMX.
Jan Šimeček 1.1 110
Jan Gazarek 8.1 111 //*If you have a reverse proxy and wish to run the system behind it, the HTTP and HTTPS ports do not need to be tunnelled. The configuration of the web proxy is up to you, including providing and installing the SSL certificate.//
Jan Šimeček 1.1 112
Jan Gazarek 8.1 113 == IP addresses of the service centres ==
Jan Šimeček 1.1 114
Jan Gazarek 8.1 115 Service operations and regular maintenance are carried out from the following IP addresses. We recommend restricting access to some of the exposed ports to these IP addresses (see the network infrastructure requirements tables).
Jan Šimeček 1.1 116
Jan Gazarek 8.1 117 |=**Public IP address**|=Description
Jan Šimeček 1.1 118 |**77.240.190.199**|Brno 1 (Server hosting ZD - VPN)
119 |**95.129.100.95**|Brno 2 (Server hosting ZD)
Jan Gazarek 8.1 120 |**95.129.102.38**|Brno 3 (Technical centre)
121 |**95.129.102.97**|Brno 4 (Technical centre - backup)
122 |(% colspan="1" %)**81.19.2.225**|(% colspan="1" %)Brno 5 (Technical support - new internet provider)
Jiri Tobias 6.1 123 |(% colspan="1" %)**77.240.184.80**|(% colspan="1" %)Brno 6 (Gateway)
Jan Gazarek 8.1 124 |(% colspan="1" %)**31.30.125.177**|(% colspan="1" %)Tábor office
Jan Šimeček 1.1 125 |**195.113.153.8**|Tábor 1
126 |(% colspan="1" %)**82.142.98.148**|(% colspan="1" %)Tábor 2
127
Jan Gazarek 8.1 128 == Allowing outbound communication (outbound direction) ==
Jan Šimeček 1.1 129
Jan Gazarek 8.1 130 **This chapter does not concern you if you do not restrict outbound communication on your network.**
Jan Šimeček 1.1 131
Jan Gazarek 8.1 132 If you restrict outbound communication on your network (a firewall on the router or on a physical server), the following communication from the VM to the target ports and IP addresses must be allowed.
Jan Šimeček 1.1 133
Jan Gazarek 8.1 134 |=(% colspan="1" %)Target IP addresses|=Target port|=Protocol|=(% colspan="1" %)Note
135 |Intranet, internet|**80**|HTTP|Connection to external unsecured services (e.g. downloading covers, discussions, etc.)
136 |Intranet, internet|**443**|HTTPS|Connection to secured external services (e.g. MojeId, electronic loans, etc.)
137 |(% colspan="1" %)Internet|**9991**|Z39.50|(% colspan="1" %)Downloading records via Z39.50 from public Z39.50 servers.
138 |(% colspan="1" %)Internet|(% colspan="1" %)**9000**|(% colspan="1" %)Z39.50|(% colspan="1" %)Downloading records via Z39.50 from public Z39.50 servers.
139 |(% colspan="1" %)vega.nkp.cz|**57779**|SSH|(% colspan="1" %)SSH tunnel for sending authorities to the National Library.
Jan Šimeček 1.1 140 |emvs0.tritius.eu
141 emvs2.clavius.cz |**2516^^*^^**
Jan Gazarek 8.1 142 2517**^^*^^**|SMTP|Sending emails via the default external primary and secondary SMTP server.
Jan Šimeček 1.1 143 |(% colspan="1" %)carmen.skat.cz|(% colspan="1" %)(((
144 **8080**
145
146 **8433**
147
148 **80**
149
150 **443**
Jan Gazarek 8.1 151 )))|(% colspan="1" %)HTTP|(% colspan="1" %)Ratings and book covers from Jessica
152 |(% colspan="1" %)Only IP addresses of the service centres|(% colspan="1" %)**10051**|(% colspan="1" %)ZBX|(% colspan="1" %)Monitoring of the state of the VM with Tritius via Zabbix (active sending, for outbound connections).
153 |ftp.nkp.cz|**21~*~***|FTP|Sending [[DILIA statistics>>doc:uzivatelsky-manual.vypujcky.DILIA-LITA-statistiky.WebHome]].
154 |sqlmicro0.vkta.cz|**33063~*~****| |Connection to the database when importing data.
155 |(% colspan="1" %)knihovny.net|(% colspan="1" %)**33062~*~****|(% colspan="1" %) |(% colspan="1" %)Connection to the database when importing data.
Jan Šimeček 1.1 156
Jan Gazarek 8.1 157 //*If you have your own SMTP server that you want to use, communication to the default external SMTP servers does not need to be allowed.//
Jan Šimeček 1.1 158
Jan Gazarek 8.1 159 //~*~*If you do not plan to send DILIA statistics, setting up this port is not mandatory.//
Jan Šimeček 1.1 160
Jan Gazarek 8.1 161 //~*~**If a connection to our database is needed during implementation.//
Jan Šimeček 1.1 162
Jan Gazarek 8.1 163 == Correct proxy / firewall / router settings ==
Jan Šimeček 1.1 164
Jan Gazarek 8.1 165 Almost always there is some device in the library that handles the public IP address and then redirects the data to the VM with Tritius. This is classic redirection, and therefore the IP addresses contained in the headers of HTTP requests change. Some Tritius functions depend on distinguishing internal and external users (especially catalogue access statistics), so it is necessary to ensure that the catalogue receives the information about the original IP address from which the request came. The HTTP header X-FORWARDED-FOR serves this purpose, and the proxy element must set it correctly.
Jan Šimeček 1.1 166
Jan Gazarek 8.1 167 The specific settings differ depending on the network device or server used. Please consult your administrator.
Jan Šimeček 1.1 168
Jan Gazarek 8.1 169 == Secure placement in the network infrastructure ==
Jan Šimeček 1.1 170
Jan Gazarek 8.1 171 **This chapter does not concern you if you do not require a high level of security.**
Jan Šimeček 1.1 172
Jan Gazarek 8.1 173 If a very high level of security is needed, the VM must be placed securely within the network infrastructure. This applies only to special cases in which customers themselves know about this need.
Jan Šimeček 1.1 174
Jan Gazarek 8.1 175 In such cases the VM must be placed in the network infrastructure so that it has access exclusively to the necessary resources, and only in the direction that is required. The VM must not have access to risky resources - this can be ensured e.g. by a firewall or by placing it in a DMZ. In practice this means network communication allowed only on carefully selected ports, which are in addition restricted by IP addresses.
Jan Šimeček 1.1 176
Jan Gazarek 8.1 177 === Technologies, protocols and software used ===
Jan Šimeček 1.1 178
Jan Gazarek 8.1 179 If you use a sophisticated firewall that monitors traffic in detail, you will need to set up for the VM with Tritius what traffic is expected and which protocols and software are used. An overview table is given below.
Jan Šimeček 1.1 180
Jan Gazarek 8.1 181 |=Category|=(% colspan="1" %)Component|=(% colspan="1" %)Note
182 |OS|(% colspan="1" %)Debian 9|(% colspan="1" %)Operating system
183 |(% colspan="1" %) |(% colspan="1" %)NTP|(% colspan="1" %)Protocol for setting the internal time.
184 |(% colspan="1" %) |(% colspan="1" %)SSH|(% colspan="1" %)Access for service staff. Protected by certificates.
185 |(% colspan="1" %)Web|(% colspan="1" %)Apache HTTP Server|(% colspan="1" %)Ports 80/433
186 |(% colspan="1" %)Web|(% colspan="1" %)Apache Tomcat|(% colspan="1" %)Application server, not visible from outside, communicates with Apache HTTP Server using the AJP protocol.
187 |(% colspan="1" %)Database|(% colspan="1" %)PostgreSQL|(% colspan="1" %)The PostgreSQL database cannot be accessed from outside.
188 |(% colspan="1" %)Monitoring|(% colspan="1" %)Zabbix|(% colspan="1" %)By default on port 10051. Protected by login credentials.
189 |(% colspan="1" %)Monitoring|(% colspan="1" %)JMX|(% colspan="1" %)By default on port 9010. Protected by login credentials.
190 |(% colspan="1" %)Email|(% colspan="1" %)SMTP|(% colspan="1" %)Tritius sends emails using an external SMTP server.
191 |(% colspan="1" %)Integration|(% colspan="1" %)Z-server|(% colspan="1" %)By default on port 9998**.**
192 |(% colspan="1" %)Integration|(% colspan="1" %)OAI server|(% colspan="1" %)Communicates over the HTTP protocol.
193 |(% colspan="1" %)Integration|(% colspan="1" %)NCIP server|(% colspan="1" %)Communicates over the HTTP protocol.
Jan Šimeček 1.1 194
Jan Gazarek 8.1 195 == Public access to the web system (HTTPS) ==
Jan Šimeček 1.1 196
Jan Gazarek 8.1 197 The Tritius web system can be exposed at an agreed domain address.
Jan Šimeček 1.1 198
Jan Gazarek 8.1 199 For security reasons, the system supports communication exclusively over the secured HTTPS protocol. We provide the SSL certificate for the agreed domain free of charge (or an already existing certificate can be used, if you own one).
Jan Šimeček 1.1 200
Jan Gazarek 8.1 201 There are the following options for ensuring public access to the Tritius web system:
Jan Šimeček 1.1 202
Jan Gazarek 8.1 203 1. Placing the web system on a new 3rd-level domain - the easiest variant and the one we recommend
204 1*. **Requires owning a free public IP address with free ports 80 and 443. **(Port 80 is required only for automatic redirection of users who accidentally access the unsecured HTTP)
205 1*. //Example for a library named "Good Library" that owns the domain "dobraknihovna.cz" and the public IP address 99.88.77.66~://
206 1**. //A DNS record of type A must be created: "tritius.dobraknihovna.cz A 99.88.77.66"//
207 1**. //Catalogue for readers: https:~/~/**tritius**.dobraknihovna.cz/Katalog//
208 1**. //Access for library staff: https:~/~/**tritius**.dobraknihovna.cz/Tritius//
Jan Šimeček 1.1 209
Jan Gazarek 8.1 210 1. Placing the web system on an existing domain behind a reverse proxy server - a more complicated variant, but it does not require a free public IP address
211 1*. **Requires access to an existing web server on the given domain and the possibility of setting it up as a reverse proxy server.**
212 1*. //Example for a library named "Good Library" that owns the domain "dobraknihovna.cz", on which it runs a website at http:~/~/www.dobraknihovna.cz~://
213 1**. //The existing web server must be made to run over HTTPS - the website will newly also run at https:~/~/www.dobraknihovna.cz (an SSL certificate must be obtained)//
214 1**. //The existing web server must be set up as a reverse proxy for the addresses https:~/~/www.dobraknihovna.cz/Katalog and https:~/~/www.dobraknihovna.cz/Tritius, which will be redirected in the local network to the virtual machine running Tritius//
215 1**. //Catalogue for readers: https:~/~/**www**.dobraknihovna.cz/Katalog//
216 1**. //Access for library staff: https:~/~/**www**.dobraknihovna.cz/Tritius//
217 1*. //Reverse proxy settings//
Jan Šimeček 1.1 218 1**. //Apache//
219 1***. //ProxyRequests Off//
220 1***. //ProxyPreserveHost On//
221 1***. //Timeout 300//
222 1***. //ProxyTimeout 300//
223 1***. //RequestHeader X-Forwarded-Proto "https"//
224 1**. IIS
Jan Gazarek 8.1 225 1***. Actions → add
Jan Šimeček 1.1 226 1***. HTTP_X_FORWARDED_HOST = tritius.knihovna.cz
227 1***. HTTP_X_FORWARDED_PROTO = https
228
Jan Gazarek 8.1 229 == Operation on a local network ==
Jan Šimeček 1.1 230
Jan Gazarek 8.1 231 If the server with Tritius is placed directly in the library's local network, it must be ensured that local computers can communicate with Tritius. Several potential problems need to be considered and the network infrastructure and/or settings adapted accordingly:
Jan Šimeček 1.1 232
Jan Gazarek 8.1 233 * The DNS resolution of the name e.g. tritius.knihovna.cz leads to the public IP address of the server with Tritius. This IP address must also be reachable from the local network. This is not always possible.
234 * A local DNS server can be used, which will return the local IP address directly for queries from the local network.
235 * A proxy/firewall can be used, which redirects requests addressed to the given domain to the local server.
236 * Local DNS records in the hosts file can be used, forcing the workstations to communicate with the local IP address.
Jan Šimeček 1.1 237
Jan Gazarek 8.1 238 == Outgoing SMTP server ==
Jan Šimeček 1.1 239
Jan Gazarek 8.1 240 Tritius sends many different types of emails (reminders, news, etc.) and therefore needs an SMTP server for sending mail. In the standard Tritius setup, the servers of Tritius Solutions a.s. are used. When Tritius is installed on the library's own server, it is common to use the library's internal SMTP server.
Jan Šimeček 1.1 241
Jan Gazarek 8.1 242 Tritius places no special requirements on the library's SMTP. We only recommend considering proper security of the SMTP server (its placement in the infrastructure, encryption and protocol versions used), so that the library does not become a spam sender.
Jan Šimeček 1.1 243
Jan Gazarek 8.1 244 Further:
Jan Šimeček 1.1 245
Jan Gazarek 8.1 246 [[Technical requirements for running Tritius as a service>>doc:uzivatelsky-manual.Pro-spravce.Technicke-pozadavky-na-provoz-systemu-Tritius-jako-sluzby.WebHome]]