Architecture & Prerequisites

What you’ll accomplish: Understand the full deployment architecture, size your VM correctly, and confirm all prerequisites are in place before touching a terminal.

The Big Picture

Here’s what we’re building. Every component runs on a single Rocky Linux 9 host, with SSH connections outbound to your managed nodes:

                      +--------------------+
                      |   Your Browser     |
                      +--------+-----------+
                               |
                         HTTPS (443)
                               |
                      +--------+-----------+
                      |   Apache httpd     |
                      |   (reverse proxy,  |
                      |    SSL termination)|
                      +--------+-----------+
                               |
                        HTTP (4440, loopback only)
                               |
                      +--------+-----------+
                      |   Rundeck Server   |
                      |   (Java / Jetty)   |
                      |                    |
                      |   - Web UI         |
                      |   - REST API       |
                      |   - Job engine     |
                      |   - Log storage    |
                      +----+----------+----+
                           |          |
              +------------+          +-------------+
              |                                     |
    +---------+----------+              +-----------+---------+
    |   MariaDB           |              |   Ansible           |
    |   (job metadata,   |              |   (playbook         |
    |    execution        |              |    execution via    |
    |    history,         |              |    plugin)          |
    |    project config)  |              +-----------+---------+
    +--------------------+                          |
                                               SSH (port 22)
                                                    |
                                       +------------+------------+
                                       |    Managed Nodes        |
                                       |   (Rocky, Pi, etc.)     |
                                       +-------------------------+

The key design decisions here:

• Apache sits in front of Rundeck. Users hit port 443 (HTTPS). Apache terminates SSL and proxies to Rundeck on localhost:4440. Rundeck never handles SSL directly — that means no Java keystore headaches, and certificate management works the way you’re used to.
• MariaDB runs locally. Port 3306 is bound to loopback. Rundeck connects over localhost. No network exposure for the database.
• Ansible runs on the Rundeck host. When Rundeck executes a playbook job, it invokes ansible-playbook locally. Ansible then reaches out to managed nodes over SSH.

Component Overview

Hardware Sizing

Here’s what actually works for a home lab, not what the official docs say you need:

Pro tip: If you’re running this on Proxmox, a VM with 4 cores, 4 GB RAM, and 32 GB disk is the sweet spot. You can always increase later — Proxmox makes that easy.

Network Requirements

Only one port needs to be exposed to your network. Everything else stays on loopback.

Firewall strategy: Open port 443 inbound. That’s it. Ports 4440 and 3306 stay on loopback and don’t need firewall rules. Outbound SSH to your managed node subnet should already be allowed by default.

Software Prerequisites

On the Rundeck host (the Rocky Linux 9 VM you’re building):

On your workstation (where you run the deployment playbooks):

Pre-Flight Checklist

Run these on your Rundeck host before starting Chapter 3. Every check should pass.

Confirm the OS:

cat /etc/os-release | grep PRETTY_NAME

Expected output:

PRETTY_NAME="Rocky Linux 9.x (Blue Onyx)"

Confirm SELinux is enforcing:

getenforce

Expected output:

Enforcing

If this says Permissive or Disabled, fix it before proceeding. Edit /etc/selinux/config, set SELINUX=enforcing, and reboot. Running with SELinux disabled means every tutorial works — until you re-enable it in six months and everything breaks at once.

Confirm available RAM:

free -h

You need at least 4 GB total. If you’re under that, resize the VM before continuing.

Confirm available disk:

df -h /

You need at least 20 GB free on the root filesystem (or wherever /var/lib/ lives).

Confirm internet access:

curl -sL -o /dev/null -w "%{http_code}" https://packages.rundeck.com

Expected output:

200

The -L flag follows redirects. If you get a timeout or connection refused, fix your DNS or firewall rules first. The installation in later chapters pulls packages from the internet.

What to Have Ready

Before you start Chapter 3, gather these:

1. The IP address or hostname of your Rundeck host. We’ll use 192.168.1.50 as the example throughout this guide.
2. A DNS record (optional but recommended). Point rundeck.example.com at your Rundeck host’s IP. If you don’t have internal DNS, the IP address works — you’ll just use https://192.168.1.50 instead of a hostname.
3. An SSL certificate and key for the Rundeck hostname. Self-signed is fine for a home lab. If you don’t have one yet, we’ll cover generating a self-signed cert in Chapter 4.
4. A list of managed nodes you want Rundeck to control — their IPs or hostnames, and a user account with SSH access.
5. A strong password for the MariaDB rundeck user. Generate one now and store it in your Ansible vault. You’ll need it in the next chapter.

Everything in place? Let’s set up MariaDB.