Creating a cluster of 1C:Enterprise Linux servers with a Managed Service for PostgreSQL cluster

In Yandex Cloud, you can create a Yandex Managed Service for PostgreSQL cluster optimized for 1C:Enterprise.

Your new 1C:Enterprise infrastructure will consist of a 1C working server, a 1C license server, and a Managed Service for PostgreSQL cluster. 1C servers will be running CentOS 7 with no internet access. The cluster will be accessed via an encrypted OpenVPN server connection.

To configure a 1C cluster and make sure the created infrastructure works properly, your local computer running Windows (outside Yandex Cloud) must have the 1С: Enterprise client and the 1C administration console installed.

The process of creating the 1C:Enterprise infrastructure described in this guide was tested in 1C version 8.3.25.

To configure a 1C:Enterprise server cluster:

1. Prepare your cloud.
2. Set up a VPN to access the cloud infrastructure.
3. Create virtual machines for 1C:Enterprise servers.
4. Create a Managed Service for PostgreSQL cluster.
5. Configure a Samba server on 1С servers.
6. Configure 1C:Enterprise servers.
7. Configure a 1C server cluster and infobase.
8. Connect to the infobase.

If you no longer need the resources you created, delete them.

Prepare your cloudPrepare your cloud

Sign up for Yandex Cloud and create a billing account:

1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The infrastructure support cost for 1C-Enterprise in Yandex Cloud includes:

• Fee for disks and continuously running VMs (see Yandex Compute Cloud pricing).
• Fee for a continuously running Managed Service for PostgreSQL cluster (see Managed Service for PostgreSQL pricing).
• Fee for using a static public IP address (see Yandex Virtual Private Cloud pricing).

Set up a VPN to access the cloud infrastructureSet up a VPN to access the cloud infrastructure

To ensure secure access to the 1С:Enterprise infrastructure you are creating in Yandex Cloud, set up a VPN. To address this task, use OpenVPN Access Server and its Windows client.

Create a cloud network and subnetsCreate a cloud network and subnets

To create a cloud network with subnets in three availability zones:

Configure network traffic permissionsConfigure network traffic permissions

Security groups act as a virtual firewall for incoming and outgoing traffic. Learn more about the default security group here.

To ensure proper operation of OpenVPN Access Server and the Managed Service for PostgreSQL cluster, add additional rules to the default security group of the my-1c-network cloud network:

Start the VPN serverStart the VPN server

Create a VM to serve as a gateway for VPN connections:

Get the administrator passwordGet the administrator password

The openvpn user with administrator privileges was created on the OpenVPN server in advance. The password is generated automatically when you create a VM.

Get the password in the serial port output or the serial console. The password will display in the following string:

To log in, please use the `openvpn` account with the <password> password.

Where <password> is the openvpn user password.

Log in to the admin panel using the openvpn username and the obtained password.

If you do not get the password after launching the VPN server for the first time, you need to re-create the VM running OpenVPN Access Server. The password will not display when reboot.

Activate licenseActivate license

To activate the license:

1. Create an account on openvpn.net.
2. Enter the confirmation code sent to your email address.
3. In the Where would you like to Go? window, select the Remember my choice option and select the Access serve product.
4. In the Tell us more window, select the purpose: Business use or Personal use.
5. On the Subscriptions tab, select the maximum number of connections in the How many VPN connections do you need? field and click Create.
6. Your subscription will be displayed on the screen: Subscription 1.
7. To copy the activation key, click Copy Key under Subscription Key.

Wait until the VM status changes to RUNNING and enter the activation key in the admin panel at https://<VM_public_IP_address>/admin/.

You can look up the VM's public IP address in the management console by checking the Public IPv4 address field under Network on the VM page.

Create an OpenVPN userCreate an OpenVPN user

OpenVPN Access Server provides two web interfaces:

1. Client Web UI at https://<VM_public_IP_address>/. This interface is used by regular users to download client applications and configuration profiles.
2. Admin Web UI at https://<VM_public_IP_address>/admin/. This interface is used to configure the server.

To create a user, log in to the admin panel:

1. In the browser, open a URL, such as https://<VM_public_IP_address>/admin/.
2. Enter the openvpn username and password (to learn how to get the admin password, see this section).
3. Read the license agreement of click Agree. This will open the home screen of the OpenVPN admin panel.
4. Go to the User management tab and select User permissions.
5. In the user list, enter a username for the new user in the New Username field, e.g., test-user.
6. Click the pencil icon in the More Settings column and enter a password for the new user in the Password field.
7. Click Save settings.
8. Click Update running server.

Connect to the VPNConnect to the VPN

In the admin panel, you can download the OpenVPN Connect client for Windows, Linux, MacOS, Android, and iOS.

As this guide covers configuring the 1C:Enterprise client in the Windows environment, download and install the OpenVPN client for Windows on your local computer:

1. Download the installation distribution:

   • In your browser, open the user panel at https://<VM_public_IP_address>/.
   • Sign in using the test-user username and password.
   • Download OpenVPN Connect version 2 or 3 by clicking the Windows icon.

2. Install and run OpenVPN Connect.

3. A VPN connection will turn on automatically if auto-login is enabled in the user profile.

You can import a new configuration profile into the application. To do this, specify https://<VM_public_IP_address>/ or select a profile file.

Create virtual machines for 1C:Enterprise serversCreate virtual machines for 1C:Enterprise servers

The 1C:Enterprise license must be installed on a separate server for changes to the configurations of other 1С servers to have no effect on the installed license. At this stage, you will create two virtual machines: one will serve as the 1C:Enterprise server and the other, as the licensing server.

Create a VM for the 1C:Enterprise server:

Similarly, create a VM named licensing-server-1c for the licensing server using the same parameters.

Create a Managed Service for PostgreSQL clusterCreate a Managed Service for PostgreSQL cluster

Yandex Cloud allows you to create Managed Service for PostgreSQL clusters optimized for 1C:Enterprise. Cluster settings may vary depending on your project requirements.

To create a Managed Service for PostgreSQL cluster optimized for 1C:

Creating a DB cluster may take a few minutes.

Configure a Samba server on 1С serversConfigure a Samba server on 1С servers

1. Connect to the server-1c VM over SSH.

2. Install Samba, the required dependencies, and the nano text editor:

   sudo yum install nano samba samba-client samba-common
   

3. Disable IPv6 to avoid server conflicts.

   • Open the /etc/sysctl.conf file:

     sudo nano /etc/sysctl.conf
     

     Add the following lines to the /etc/sysctl.conf file:

     net.ipv6.conf.all.disable_ipv6 = 1
     net.ipv6.conf.default.disable_ipv6 = 1
     

   • Open the /etc/sysconfig/network file:

     sudo nano /etc/sysconfig/network
     

     Add the following lines to the /etc/sysconfig/network file:

     NETWORKING_IPv6=no
     HOSTNAME=server-1c
     

4. Set up Samba. To do this, open the /etc/samba/smb.conf configuration file:

   sudo nano /etc/samba/smb.conf
   

   Edit the file as follows:

   [global]
           workgroup = WORKGROUP
           server string = Samba Server%v
           netbios name = centos
           security = user
           map to guest = bad user
           dns proxy = no
           passdb backend = tdbsam
           printing = cups
           printcap name = cups
           load printers = yes
           cups iptions = raw
           security = user
   
   [files]
           path = /1c-files
           browsable = yes
           writable = yes
           guest ok = yes
           read only = no
   

5. Create a shared folder and grant the required access permissions for it:

   sudo mkdir /1c-files
   sudo chmod -R 777 /1c-files
   

6. Disable SELinux. To do this, open the /etc/sysconfig/selinux configuration file:

   sudo nano /etc/sysconfig/selinux
   

   Change the value of the SELINUX parameter:

   SELINUX=disabled
   

7. Add the Samba server service to the startup script:

   sudo systemctl enable smb.service
   

   Result:

   Created symlink from /etc/systemd/system/multi-user.target.wants/smb.service to /usr/lib/systemd/system/smb.service.
   

8. Restart the Samba server service:

   sudo systemctl restart smb.service
   

Similarly, configure the Samba server on the licensing-server-1c VM.

Configure 1C:Enterprise serversConfigure 1C:Enterprise servers

1. Copy the 1C:Enterprise server distribution from your local computer to the server-1c VM:

   scp <file_name> <username>@<VM_public_IP_address>:/1c-files
   

   Where:

   • <file_name>: Name of the binary distribution file, e.g., setup-full-8.3.25.1257-x86_64.run.
   • <username>: VM user name, e.g., yc-user.
   • <VM_public_IP_address>: Public IP address of the VM with the 1С server.

2. Connect to the server-1c VM over SSH.

3. Install the 1C:Enterprise server on the VM:

   cd /1c-files
   sudo ./<file_name> --mode unattended --enable-components server,ws,server_admin
   

   Where <file_name> is the name of the binary distribution file, e.g., setup-full-8.3.25.1257-x86_64.run.

4. After installation is complete, delete the distribution file by specifying the name of the binary distribution file:

   rm <file_name>
   

5. Start the 1C server service and add it to the startup script:

   sudo ln /opt/1cv8/x86_64/8.3.25.1257/srv1cv8-8.3.25.1257@.service /etc/systemd/system
   sudo systemctl start srv1cv8-8.3.25.1257@.services.service
   sudo systemctl enable srv1cv8-8.3.25.1257@.services.service
   

   Result:

   Created symlink from /etc/systemd/system/multi-user.target.wants/srv1cv8-8.3.25.1257@.services.service to /etc/systemd/system/srv1cv8-8.3.25.1257@.service.
   

   The path to the 1C:Enterprise server installation files depends on the 1C platform version installed. The example shows commands to start the 1C:Enterprise 8.3.25 server service.

6. Make sure the 1C:Enterprise server service is running:

   systemctl status -l srv1cv8-8.3.25.1257@.services
   

   Result:

   ● srv1cv8-8.3.25.1257@.services.service - 1C:Enterprise Server 8.3 (8.3.25.1257) (.services)
      Loaded: loaded (/etc/systemd/system/srv1cv8-8.3.25.1257@.service; disabled; vendor preset: disabled)
      Active: active (running) since Thu 2024-07-18 09:09:12 UTC; 6min ago
    Main PID: 16656 (ragent)
      CGroup: /system.slice/system-srv1cv8\x2d8.3.25.1257.slice/srv1cv8-8.3.25.1257@.services.service
              ├─16656 /opt/1cv8/x86_64/8.3.25.1257/ragent -d /home/usr1cv8/.1cv8/1C/1cv8 -port 1540 -regport 1541 -range 1560:1591 -seclev 0 -pingPeriod 1000 -pingTimeout 5000
              ├─16670 /opt/1cv8/x86_64/8.3.25.1257/rmngr -port 1541 -host server-1c.ru-central1.internal -range 1560:1591 -d /home/usr1cv8/.1cv8/1C/1cv8/ -clstid 29361c8c-d4b8-47fd-8b53-43d8349f0e94
              └─16769 /opt/1cv8/x86_64/8.3.25.1257/rphost -range 1560:1591 -reghost server-1c.ru-central1.internal -regport 1541 -pid 43049953-184b-453f-985c-604fb96300ae
   

Similarly, configure the 1C server on the licensing-server-1c VM.

When you are done configuring both 1C servers, detach the public IP addresses from the server-1c and licensing-server-1c VMs. For further access to the 1C servers, use the OpenVPN server.

Configure a 1C server cluster and infobaseConfigure a 1C server cluster and infobase

Before getting started with 1C:Enterprise, configure the server roles and add the infobase to the cluster:

1. Start the 1C administration console on your local Windows computer with the OpenVPN client running.

2. Add the central 1C:Enterprise server to the cluster:

   1. Right-click Central 1C:Enterprise 8.3 servers and select Create → Central 1C:Enterprise 8.3 server from the context menu that opens. In the window that opens:

      1. In the Name field, enter the server's internal FQDN: server-1c.ru-central1.internal.

         You can look up the VM's internal FQDN in the management console by checking the Internal FQDN field on the VM page.

      2. Click OK.

      You will see the local cluster in the tree on the left.

3. Add the 1C licensing server to the server cluster:

   1. Expand the Clusters tab and select Local cluster.
   2. Right-click Working servers and select Create → Working server from the context menu that opens.
   3. In the Computer field of the window that opens, specify licensing-server-1c.ru-central1.internal and click OK.

   This server will be used to distribute licenses to other 1C servers.

4. Add functionality assignment requirements to licensing-server-1c:

   1. Expand the tab of the licensing-server-1c.ru-central1.internal server you added, right-click Functionality assignment requirements, and select Create → Functionality assignment requirement from the context menu that opens. In the window that opens:

      • In the Requirement object list, select Any requirement object.
      • In the Requirement type list, select Do not assign.
      • Leave all other parameters as they are and click OK.

   2. Open the Local cluster context menu and select Apply functionality assignment requirements (full) to apply the new requirement to the cluster.

   3. Add another requirement for assigning functionality to the licensing-server-1c.ru-central1.internal with the following parameters:

      • In the Requirement object list, select Licensing service.
      • In the Requirement type list, select Assign.
      • Leave all other parameters as they are and click OK.

   4. Open the Local cluster context menu and select Apply functionality assignment requirements (full) to apply the new requirement to the cluster.

5. Add functionality assignment requirements to server-1c:

   1. Expand the server-1c.ru-central1.internal server tab, right-click Functionality assignment requirements, and select Create → Functionality assignment requirement from the context menu that opens. In the window that opens:

      • In the Requirement object list, select Client connection to infobase.
      • In the Requirement type list, select Assign.
      • Leave all other parameters as they are and click OK.

   2. Open the Local cluster context menu and select Apply functionality assignment requirements (full) to apply the new requirement to the cluster.

   3. Add another requirement for assigning functionality to the server-1c.ru-central1.internal server with the following parameters:

      • In the Requirement object list, select Licensing service.
      • In the Requirement type list, select Do not assign.
      • Leave all other parameters as they are and click OK.

   4. Open the Local cluster context menu and select Apply functionality assignment requirements (full) to apply the new requirement to the cluster.

6. Right-click Infobases inside the Local cluster section and select Create → Infobase from the context menu that opens. In the window that opens, specify:

   • Name: 1c-database.

   • Secure connection: Continuously.

   • Database server: Your DB host address and port, e.g., rc1b-cfazv1db********.mdb.yandexcloud.net port=6432.

     To find out the host address:

     Management console

     • In the management console, go to the folder page.
     • In the list of services, select Managed Service for PostgreSQL.
     • In the window that opens, select the 1c-pg cluster you created earlier.
     • Select the Hosts tab in the left-hand menu.
     • In the Host FQDN field, hover over the host name (format: rc1b-cfazv1db********) and copy the database FQDN by clicking . The FQDN will be added to the host name, so the Database server field should contain a name in rc1c-cfazv1db********.mdb.yandexcloud.net port=6432 format.

   • DBMS type: PostgreSQL.

   • Database: Database name, 1c-database.

   • Database server user: user1.

   • Database user password: User password you set when creating the cluster.

   • Allow license issuing by 1C:Enterprise server: Yes.

   • Language (Country): English (United States).

   • Create database if none present: Disabled.

   • Lock execution of scheduled jobs: Disabled.

   Click ОК.

Connect to the infobaseConnect to the infobase

1. Start the 1C: Enterprise client on your local Windows computer with the OpenVPN client running.

2. Click Add.

3. Select Add an existing infobase to the list and click Next.

4. Enter the infobase name, select On 1C:Enterprise server, and specify the following settings:

   • Server cluster: server-1c.ru-central1.internal.
   • Infobase name: 1c-database.

5. Click Next.

6. Click Ready.

The infobase should appear on the list of infobases. You can now proceed to configuring and using it.

Delete the resources you createdDelete the resources you created

To stop paying for the deployed infrastructure:

1. Delete the server-1c, licensing-server-1c, and vpn-server VMs.
2. Delete the 1c-pg cluster.
3. Delete the public static IP address.