= Setting up {prod} on a remote server

Configure a remote server to run an {ocp} cluster provided by {prod}.

This procedure assumes the use of a {rhel}, {fed}, or {centos} server.
Run every command in this procedure on the remote server.

[WARNING]
====
**Perform this procedure only on a local network.**
Exposing an insecure server on the internet has many security implications.
====

.Prerequisites
* {prod} is installed and set up on the remote server.
For more information, see link:{crc-gsg-url}#installing_gsg[Installing {prod}] and link:{crc-gsg-url}#setting-up_gsg[Setting up {prod}].
* {prod} is configured to use the {openshift} preset on the remote server.
For more information, see link:{crc-gsg-url}#changing-the-selected-preset_gsg[Changing the selected preset].
* Your user account has `sudo` permissions on the remote server.

.Procedure
. Start the cluster:
+
[subs="+quotes,attributes"]
----
$ {bin} start
----
+
Ensure that the cluster remains running during this procedure.

. Install the [package]`haproxy` package and other utilities:
+
----
$ sudo dnf install haproxy /usr/sbin/semanage
----

. Modify the firewall to allow communication with the cluster:
+
----
$ sudo systemctl enable --now firewalld
$ sudo firewall-cmd --add-service=http --permanent
$ sudo firewall-cmd --add-service=https --permanent
$ sudo firewall-cmd --add-service=kube-apiserver --permanent
$ sudo firewall-cmd --reload
----

. For SELinux, allow HAProxy to listen on TCP port 6443 to serve `kube-apiserver` on this port:
+
----
$ sudo semanage port -a -t http_port_t -p tcp 6443
----

. Create a backup of the default [application]`haproxy` configuration:
+
----
$ sudo cp /etc/haproxy/haproxy.cfg{,.bak}
----

. Configure [application]`haproxy` for use with the cluster:
+
[subs="+quotes,attributes"]
----
$ export CRC_IP=$({bin} ip)
$ sudo tee /etc/haproxy/haproxy.cfg &>/dev/null <<EOF
global
    log /dev/log local0

defaults
    balance roundrobin
    log global
    maxconn 100
    mode tcp
    timeout connect 5s
    timeout client 500s
    timeout server 500s

listen apps
    bind 0.0.0.0:80
    server crcvm $CRC_IP:80 check

listen apps_ssl
    bind 0.0.0.0:443
    server crcvm $CRC_IP:443 check

listen api
    bind 0.0.0.0:6443
    server crcvm $CRC_IP:6443 check
EOF
----

. Start the [application]`haproxy` service:
+
----
$ sudo systemctl start haproxy
----
