Designing a multi-datacenter FreeIPA topology
Laying out FreeIPA replicas across sites: replicas per data center, agreements per replica, which servers carry CA, DNS and trust roles, and keeping the topology connected when a site is lost.
FreeIPA replication and topology
Designing and changing the server layout of a FreeIPA deployment: replicas per site, server roles, DNS locations, sizing, and adding, removing or renaming servers.
Installing a FreeIPA replica
Adding a FreeIPA replica: DNS and reverse resolution checks, choosing CA, DNS and KRA roles, replication agreements to create, and verifying the new server before clients use it.
FreeIPA CA renewal server and CRL publisher roles
Understanding the FreeIPA server that renews shared certificates and publishes CRLs: why the first server holds it by default, moving it during migrations, and what breaks if it disappears.
FreeIPA DNS locations for site-aware clients
Making clients prefer nearby FreeIPA servers with DNS locations and location-aware SRV records, assigning servers to locations, and how this reduces cross-site authentication traffic.
Decommissioning a FreeIPA server
Removing a FreeIPA server safely: confirming other servers hold DNS, CA, KRA, renewal and CRL roles, checking DNA ID ranges, ipa server-del, uninstalling, cleaning NS records, and HSM keys.
Renaming a FreeIPA server
Changing a FreeIPA server's host name by replacing it, since renaming in place is not possible: installing a replica with the new name, moving roles, and retiring the old server.
Sizing FreeIPA servers, clients and hardware
How many FreeIPA servers and how much memory a deployment needs: the 60-server limit, clients per server, RAM and swap for 10,000 and 100,000 users, and entry sizes for capacity planning.
How many FreeIPA servers should run the CA
Choosing which FreeIPA replicas carry the certificate authority: Red Hat's guidance by deployment size and region, certificate replication requirements, and the risk of a single CA server.
