Skip to Content
Last modified by Erik Duraja on 2026/10/23 11:59
Show last authors
1 {{toc/}}
2
3 = General =
4
5 You can run Tritius on your own server in the form of a pre-installed virtual machine.
6
7 You take care of the server, the virtualization solution and its administration yourselves, or together with us if remote access is agreed.
8
9 Tritius is then available as an ordinary web application and all you need to use it is a common web browser.
10
11 You are responsible for data backup and archiving - you can use our ready-made tools, which only need access to a remote storage to be set up.
12
13 = Hardware requirements for the server =
14
15 The requirements for running Tritius are approximate, because the real demands of the system may differ, mainly depending on the total volume of catalogued data and the number of users working at the same time.
16
17 The recommended configurations assume that the whole system runs on one server (database + Tritius server application + web catalogue). These parts can, however, be run separately (for security and performance reasons).
18
19 Above 200,000 items we do not recommend running the system on external disks (disk arrays), but only on dedicated disks located directly in the servers.
20
21 |=(((
22 Collection size
23
24 (number of items)
25 )))|=(% colspan="1" %)(((
26 Number of concurrently
27
28 working users
29 )))|=(% colspan="1" %)(((
30 Tritius
31
32 processor
33 )))|=(% colspan="1" %)(((
34 Processor
35
36 number of cores
37 )))|=(((
38 Tritius
39
40 disk
41 )))|=(% colspan="1" %)(((
42 Disk
43
44 (type)
45 )))|=(((
46 Tritius
47
48 RAM
49 )))
50 |up to 20,000|(% colspan="1" %)< 5|(% colspan="1" %)2.4GHz|(% colspan="1" %)4|50GB|(% colspan="1" %) |8GB
51 |up to 50,000|(% colspan="1" %)< 10|(% colspan="1" %)2.4GHz|(% colspan="1" %)4|100GB|(% colspan="1" %) |12GB
52 |up to 100,000|< 20|2.4GHz|6|100GB| |16GB
53 |up to 200,000|(% colspan="1" %)< 30|(% colspan="1" %)3.2GHz|(% colspan="1" %)6|200GB|(% colspan="1" %) |24GB
54 |(% colspan="1" %)up to 500,000|(% colspan="1" %)< 50|(% colspan="1" %)3.2GHz|(% colspan="1" %)8|(% colspan="1" %)250GB|(% colspan="1" %)SSD / M.2|(% colspan="1" %)48GB
55 |(% colspan="1" %)up to 1,000,000|(% colspan="1" %)< 100|(% colspan="1" %)3.2GHz|(% colspan="1" %)> 12|(% colspan="1" %)500GB|(% colspan="1" %)SSD / M.2|(% colspan="1" %)64GB
56 |(% colspan="1" %)over 1,000,000|(% colspan="6" %)individual assessment
57
58 = Software requirements for the server - virtualization =
59
60 The Tritius system is now distributed exclusively as a pre-installed virtual machine in the OVF format ([[https:~~/~~/en.wikipedia.org/wiki/Open_Virtualization_Format>>url:https://en.wikipedia.org/wiki/Open_Virtualization_Format]]).
61
62 The virtual machine can be run on any virtualization solution that supports OVF:
63
64 * **VirtualBox** - the basic version is completely free,
65 * **VMware** - a high-quality paid solution,
66 * **KVM**,
67 * **Hyper-V,**
68 * **Xen** (PV mode).
69
70 //We provide full support and help with installation into VirtualBox on the Windows operating system. For other solutions, please check the table below.//
71
72 //Basic support with importing and running the VM means providing basic information or a guide that has been used with other customers, or a contact to other customers using this solution - all without warranty.//
73
74 |=Virtualization solution|=Handover of the pre-installed VM (OVF)|=Basic support with importing and running the VM|=(% colspan="1" %)Installation and configuration of the virtualization solution and import of the VM
75 |VirtualBox on Windows OS|Yes|Yes|(% colspan="1" %)free of charge
76 |VirtualBox on Linux OS|Yes|Yes|(% colspan="1" %)on request as a paid service or by arranging a third party
77 |(% colspan="1" %)VMware, KVM, Hyper-V, XEN|(% colspan="1" %)Yes|(% colspan="1" %)Yes|(% colspan="1" %)entirely at your own expense
78
79 = Backup - remote storage =
80
81 Backups are created automatically on the virtual machine itself and are then moved to a remote storage.
82
83 Optionally, a ready-made script for rotating backups (X daily, weekly and monthly backups) can be used.
84
85 We currently support automatic saving to remote storages available through the following protocols:
86
87 * **FTP**,
88 * **NFS **(Linux network filesystem),
89 * **CIFS** (Windows folder sharing),
90 * **SMB** (Windows folder sharing).
91
92 = Network infrastructure =
93
94 **Running Tritius requires an internet connection, a public IP address and the following network infrastructure settings.**
95
96 **If you want to use our offer of a free HTTPS certificate, you need a public IP address with free (unused) ports 80 and 443.**
97
98 == Opening ports (inbound direction) ==
99
100 The following ports must be made accessible on your public IP address and must be tunnelled (redirected) to the local ports of the VM.
101
102 |=(% colspan="1" %)Public IP|=Public port|=(% colspan="1" %)Local IP|=(% colspan="1" %)Local port|=Protocol|=Recommended access restriction|=(% colspan="1" %)Note
103 |Your public IP|**443^^*^^**|Local IP of the VM|**443**|HTTPS|Unrestricted access|Access to the secured Tritius web application (web catalogue and library staff client).
104 |Your public IP|**80^^*^^**|Local IP of the VM|**80**|HTTP|Unrestricted access|Access to the Tritius web application (web catalogue and library staff client).
105 //The Tritius web server always redirects users to the secured HTTPS automatically.//
106 |Your public IP|**9998**|Local IP of the VM|**9998**|Z-Server|Unrestricted access|Access to the Z-server, if it is enabled for the instance.
107 |(% colspan="1" %)Your public IP|**22** ^^(or another agreed port)^^|(% colspan="1" %)Local IP of the VM|(% colspan="1" %)**22**|SSH|Only IP addresses of the service centres|SSH connection to the VM with Tritius for administration and maintenance purposes.
108 |(% colspan="1" %)Your public IP|**10050** ^^(or another agreed port)^^|(% colspan="1" %)Local IP of the VM|(% colspan="1" %)**10050**|ZBX|Only IP addresses of the service centres|Monitoring of the state of the VM with Tritius via Zabbix (passive monitoring, for incoming connections).
109 |Your public IP|**9010**^^ (or another agreed port)^^|Local IP of the VM|**9010**|JMX|Only IP addresses of the service centres|Monitoring of the state of Tritius via JMX.
110
111 //*If you have a reverse proxy and wish to run the system behind it, the HTTP and HTTPS ports do not need to be tunnelled. The configuration of the web proxy is up to you, including providing and installing the SSL certificate.//
112
113 == IP addresses of the service centres ==
114
115 Service operations and regular maintenance are carried out from the following IP addresses. We recommend restricting access to some of the exposed ports to these IP addresses (see the network infrastructure requirements tables).
116
117 |=**Public IP address**|=Description
118 |**77.240.190.199**|Brno 1 (Server hosting ZD - VPN)
119 |**95.129.100.95**|Brno 2 (Server hosting ZD)
120 |**95.129.102.38**|Brno 3 (Technical centre)
121 |**95.129.102.97**|Brno 4 (Technical centre - backup)
122 |(% colspan="1" %)**81.19.2.225**|(% colspan="1" %)Brno 5 (Technical support - new internet provider)
123 |(% colspan="1" %)**77.240.184.80**|(% colspan="1" %)Brno 6 (Gateway)
124 |(% colspan="1" %)**31.30.125.177**|(% colspan="1" %)Tábor office
125 |**195.113.153.8**|Tábor 1
126 |(% colspan="1" %)**82.142.98.148**|(% colspan="1" %)Tábor 2
127
128 == Allowing outbound communication (outbound direction) ==
129
130 **This chapter does not concern you if you do not restrict outbound communication on your network.**
131
132 If you restrict outbound communication on your network (a firewall on the router or on a physical server), the following communication from the VM to the target ports and IP addresses must be allowed.
133
134 |=(% colspan="1" %)Target IP addresses|=Target port|=Protocol|=(% colspan="1" %)Note
135 |Intranet, internet|**80**|HTTP|Connection to external unsecured services (e.g. downloading covers, discussions, etc.)
136 |Intranet, internet|**443**|HTTPS|Connection to secured external services (e.g. MojeId, electronic loans, etc.)
137 |(% colspan="1" %)Internet|**9991**|Z39.50|(% colspan="1" %)Downloading records via Z39.50 from public Z39.50 servers.
138 |(% colspan="1" %)Internet|(% colspan="1" %)**9000**|(% colspan="1" %)Z39.50|(% colspan="1" %)Downloading records via Z39.50 from public Z39.50 servers.
139 |(% colspan="1" %)vega.nkp.cz|**57779**|SSH|(% colspan="1" %)SSH tunnel for sending authorities to the National Library.
140 |emvs0.tritius.eu
141 emvs2.clavius.cz |**2516^^*^^**
142 2517**^^*^^**|SMTP|Sending emails via the default external primary and secondary SMTP server.
143 |(% colspan="1" %)carmen.skat.cz|(% colspan="1" %)(((
144 **8080**
145
146 **8433**
147
148 **80**
149
150 **443**
151 )))|(% colspan="1" %)HTTP|(% colspan="1" %)Ratings and book covers from Jessica
152 |(% colspan="1" %)Only IP addresses of the service centres|(% colspan="1" %)**10051**|(% colspan="1" %)ZBX|(% colspan="1" %)Monitoring of the state of the VM with Tritius via Zabbix (active sending, for outbound connections).
153 |ftp.nkp.cz|**21~*~***|FTP|Sending [[DILIA statistics>>doc:uzivatelsky-manual.vypujcky.DILIA-LITA-statistiky.WebHome]].
154 |sqlmicro0.vkta.cz|**33063~*~****| |Connection to the database when importing data.
155 |(% colspan="1" %)knihovny.net|(% colspan="1" %)**33062~*~****|(% colspan="1" %) |(% colspan="1" %)Connection to the database when importing data.
156
157 //*If you have your own SMTP server that you want to use, communication to the default external SMTP servers does not need to be allowed.//
158
159 //~*~*If you do not plan to send DILIA statistics, setting up this port is not mandatory.//
160
161 //~*~**If a connection to our database is needed during implementation.//
162
163 == Correct proxy / firewall / router settings ==
164
165 Almost always there is some device in the library that handles the public IP address and then redirects the data to the VM with Tritius. This is classic redirection, and therefore the IP addresses contained in the headers of HTTP requests change. Some Tritius functions depend on distinguishing internal and external users (especially catalogue access statistics), so it is necessary to ensure that the catalogue receives the information about the original IP address from which the request came. The HTTP header X-FORWARDED-FOR serves this purpose, and the proxy element must set it correctly.
166
167 The specific settings differ depending on the network device or server used. Please consult your administrator.
168
169 == Secure placement in the network infrastructure ==
170
171 **This chapter does not concern you if you do not require a high level of security.**
172
173 If a very high level of security is needed, the VM must be placed securely within the network infrastructure. This applies only to special cases in which customers themselves know about this need.
174
175 In such cases the VM must be placed in the network infrastructure so that it has access exclusively to the necessary resources, and only in the direction that is required. The VM must not have access to risky resources - this can be ensured e.g. by a firewall or by placing it in a DMZ. In practice this means network communication allowed only on carefully selected ports, which are in addition restricted by IP addresses.
176
177 === Technologies, protocols and software used ===
178
179 If you use a sophisticated firewall that monitors traffic in detail, you will need to set up for the VM with Tritius what traffic is expected and which protocols and software are used. An overview table is given below.
180
181 |=Category|=(% colspan="1" %)Component|=(% colspan="1" %)Note
182 |OS|(% colspan="1" %)Debian 9|(% colspan="1" %)Operating system
183 |(% colspan="1" %) |(% colspan="1" %)NTP|(% colspan="1" %)Protocol for setting the internal time.
184 |(% colspan="1" %) |(% colspan="1" %)SSH|(% colspan="1" %)Access for service staff. Protected by certificates.
185 |(% colspan="1" %)Web|(% colspan="1" %)Apache HTTP Server|(% colspan="1" %)Ports 80/433
186 |(% colspan="1" %)Web|(% colspan="1" %)Apache Tomcat|(% colspan="1" %)Application server, not visible from outside, communicates with Apache HTTP Server using the AJP protocol.
187 |(% colspan="1" %)Database|(% colspan="1" %)PostgreSQL|(% colspan="1" %)The PostgreSQL database cannot be accessed from outside.
188 |(% colspan="1" %)Monitoring|(% colspan="1" %)Zabbix|(% colspan="1" %)By default on port 10051. Protected by login credentials.
189 |(% colspan="1" %)Monitoring|(% colspan="1" %)JMX|(% colspan="1" %)By default on port 9010. Protected by login credentials.
190 |(% colspan="1" %)Email|(% colspan="1" %)SMTP|(% colspan="1" %)Tritius sends emails using an external SMTP server.
191 |(% colspan="1" %)Integration|(% colspan="1" %)Z-server|(% colspan="1" %)By default on port 9998**.**
192 |(% colspan="1" %)Integration|(% colspan="1" %)OAI server|(% colspan="1" %)Communicates over the HTTP protocol.
193 |(% colspan="1" %)Integration|(% colspan="1" %)NCIP server|(% colspan="1" %)Communicates over the HTTP protocol.
194
195 == Public access to the web system (HTTPS) ==
196
197 The Tritius web system can be exposed at an agreed domain address.
198
199 For security reasons, the system supports communication exclusively over the secured HTTPS protocol. We provide the SSL certificate for the agreed domain free of charge (or an already existing certificate can be used, if you own one).
200
201 There are the following options for ensuring public access to the Tritius web system:
202
203 1. Placing the web system on a new 3rd-level domain - the easiest variant and the one we recommend
204 1*. **Requires owning a free public IP address with free ports 80 and 443. **(Port 80 is required only for automatic redirection of users who accidentally access the unsecured HTTP)
205 1*. //Example for a library named "Good Library" that owns the domain "dobraknihovna.cz" and the public IP address 99.88.77.66~://
206 1**. //A DNS record of type A must be created: "tritius.dobraknihovna.cz A 99.88.77.66"//
207 1**. //Catalogue for readers: https:~/~/**tritius**.dobraknihovna.cz/Katalog//
208 1**. //Access for library staff: https:~/~/**tritius**.dobraknihovna.cz/Tritius//
209
210 1. Placing the web system on an existing domain behind a reverse proxy server - a more complicated variant, but it does not require a free public IP address
211 1*. **Requires access to an existing web server on the given domain and the possibility of setting it up as a reverse proxy server.**
212 1*. //Example for a library named "Good Library" that owns the domain "dobraknihovna.cz", on which it runs a website at http:~/~/www.dobraknihovna.cz~://
213 1**. //The existing web server must be made to run over HTTPS - the website will newly also run at https:~/~/www.dobraknihovna.cz (an SSL certificate must be obtained)//
214 1**. //The existing web server must be set up as a reverse proxy for the addresses https:~/~/www.dobraknihovna.cz/Katalog and https:~/~/www.dobraknihovna.cz/Tritius, which will be redirected in the local network to the virtual machine running Tritius//
215 1**. //Catalogue for readers: https:~/~/**www**.dobraknihovna.cz/Katalog//
216 1**. //Access for library staff: https:~/~/**www**.dobraknihovna.cz/Tritius//
217 1*. //Reverse proxy settings//
218 1**. //Apache//
219 1***. //ProxyRequests Off//
220 1***. //ProxyPreserveHost On//
221 1***. //Timeout 300//
222 1***. //ProxyTimeout 300//
223 1***. //RequestHeader X-Forwarded-Proto "https"//
224 1**. IIS
225 1***. Actions → add
226 1***. HTTP_X_FORWARDED_HOST = tritius.knihovna.cz
227 1***. HTTP_X_FORWARDED_PROTO = https
228
229 == Operation on a local network ==
230
231 If the server with Tritius is placed directly in the library's local network, it must be ensured that local computers can communicate with Tritius. Several potential problems need to be considered and the network infrastructure and/or settings adapted accordingly:
232
233 * The DNS resolution of the name e.g. tritius.knihovna.cz leads to the public IP address of the server with Tritius. This IP address must also be reachable from the local network. This is not always possible.
234 * A local DNS server can be used, which will return the local IP address directly for queries from the local network.
235 * A proxy/firewall can be used, which redirects requests addressed to the given domain to the local server.
236 * Local DNS records in the hosts file can be used, forcing the workstations to communicate with the local IP address.
237
238 == Outgoing SMTP server ==
239
240 Tritius sends many different types of emails (reminders, news, etc.) and therefore needs an SMTP server for sending mail. In the standard Tritius setup, the servers of Tritius Solutions a.s. are used. When Tritius is installed on the library's own server, it is common to use the library's internal SMTP server.
241
242 Tritius places no special requirements on the library's SMTP. We only recommend considering proper security of the SMTP server (its placement in the infrastructure, encryption and protocol versions used), so that the library does not become a spam sender.
243
244 Further:
245
246 [[Technical requirements for running Tritius as a service>>doc:uzivatelsky-manual.Pro-spravce.Technicke-pozadavky-na-provoz-systemu-Tritius-jako-sluzby.WebHome]]