Wiab automation

[jschumacher-wire]

https://wearezeta.atlassian.net/browse/WPB-9381

[lwille]

is there a reason we manually download and unpack charts instead of using helm repo add?

[jschumacher-wire]

Taken from https://github.com/wireapp/wire-server-deploy/blob/master/offline/docs_ubuntu_22.04.md

I guess the original thought was to avoid creating external dependencies for a "true" offline install, without internet. Which does not work anyway with (automated) demo WIAB, but I wanted to avoid upstreaming changes to the "official" offline documentation.

[amitsagtani97]

I think we can remove this manual pulling of cert-manager helm chart in another pr and use our new helm-charts / wire-builds repo to put in the offline artifact.

[lwille]

thought: is there a reason to avoid an else branch and instead duplicate the conditions in the following ifs?

Suggested change

	fi
	if [ "$DO_SYSTEM_CLEANUP" = true ] && [ "$FORCE_REDEPLOY" = 0 ]; then
	elif [ "$FORCE_REDEPLOY" = 0 ]; then

[jschumacher-wire]

The existing logic accounts for the case of a "clean" target system where no resource removal is necessary, in which we don't need to jump into the system_cleanup() function. Otherwise the output looks like this:

INFO: Target system clean, no previous wire-server-deploy installation found.

INFO: Cleaning up all VMs, docker resources and wire-server-deploy files on wiab-autodeploy.wire.link.

It's just cosmetics, but I's like to have consistent script output.

[lwille]

thought: why do we use Ansible at all if we use imperative provisioning everywhere?

suggestion: use a suitable Ansible module to manage firewall rules.

[jschumacher-wire]

The existing playbooks are supposed to take care of that AFAIK, which did not work reliably in the past - some deployments did have the rules applied, some did not.
I admit it's hacky, but it works reliably, and actual customer site deployments use their own networking / firewalling.

[amitsagtani97]

While trying to run it locally for an installation, got the following error -

./autodeploy.sh --artifact-hash dc4dc2e2d3c70d2de6fcb956107224c82d4dfac5 --target-system wiab-test-box.wire.link

INFO: running local ansible playbook for inital server deployment.
INFO: This will setup up the Hetzner system with basic defaults, download and unpack the wire-server-deploy artifact.
/nix/store/x1xxsh1gp6y389hyl40a0i74dkxiprl7-bash-5.2-p15/bin/bash: warning: setlocale: LC_ALL: cannot change locale (C.UTF-8): No such file or directory
ERROR: Ansible could not initialize the preferred locale: unsupported locale setting

[jschumacher-wire]

While trying to run it locally for an installation, got the following error -

./autodeploy.sh --artifact-hash dc4dc2e2d3c70d2de6fcb956107224c82d4dfac5 --target-system wiab-test-box.wire.link

INFO: running local ansible playbook for inital server deployment.
INFO: This will setup up the Hetzner system with basic defaults, download and unpack the wire-server-deploy artifact.
/nix/store/x1xxsh1gp6y389hyl40a0i74dkxiprl7-bash-5.2-p15/bin/bash: warning: setlocale: LC_ALL: cannot change locale (C.UTF-8): No such file or directory
ERROR: Ansible could not initialize the preferred locale: unsupported locale setting

Hmm I think that's a nix / ansible issue. I'm allready explicitly setting LC_ALL to UTF-8 here:
https://github.com/wireapp/wire-server-deploy/pull/728/files#diff-36ed65637f210713f6026a6b191f249cf1697bc0b9680da066cbdd36f32676abR140

There's more discussion here NixOS/nixpkgs#223151

[arthurwolf]

I think it would be good if this parameter contained the "domain" string somewhere, I initially expected it was like the OS version.

[jschumacher-wire]

Good point, I've renamed the --target-system flag to --target-domain.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud