Chg: update image tag in helm values to v4.2.0-RC1

Merge pull request #302 from Telecominfraproject/WIFI-15181-update-bitnami-image-repos2
Slight adjustment for os-shell image for older kafka helm chart
2026-03-20 03:40:49 +00:00 · 2025-12-12 23:56:58 +00:00 · 2025-10-16 11:21:30 -04:00 · 2025-10-16 10:42:53 -04:00 · 2025-10-16 10:02:14 -04:00 · 2025-10-16 09:30:22 -04:00
77 changed files with 3408 additions and 978 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,12 +44,12 @@ jobs:
        echo "tag=$(git tag | grep -v RC | tail -2 | head -1)" >> $GITHUB_OUTPUT

  trigger-docker-compose-testing:
-    if: startsWith(github.ref, 'refs/pull/')
+    if: startsWith(github.ref, 'DISABLEDrefs/pull/')
    runs-on: ubuntu-latest
    needs: envs
    steps:
    - name: Checkout actions repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
      with:
        repository: Telecominfraproject/.github
        path: github
@@ -67,12 +67,12 @@ jobs:
        inputs: '{"deployment_version": "${{ env.PR_BRANCH }}", "microservice": "all"}'

  trigger-k8s-testing:
-    if: startsWith(github.ref, 'refs/pull/')
+    if: startsWith(github.ref, 'DISABLEDrefs/pull/')
    runs-on: ubuntu-latest
    needs: envs
    steps:
    - name: Checkout actions repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
      with:
        repository: Telecominfraproject/.github
        path: github
@@ -90,12 +90,12 @@ jobs:
        inputs: '{"deployment_version": "${{ env.PR_BRANCH }}", "microservice": "all"}'

  trigger-docker-compose-upgrade-testing:
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: startsWith(github.ref, 'DISABLEDrefs/tags/v')
    runs-on: ubuntu-latest
    needs: envs
    steps:
    - name: Checkout actions repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
      with:
        repository: Telecominfraproject/.github
        path: github
--- a/.github/workflows/clustersysteminfo_image_ci.yml
+++ b/.github/workflows/clustersysteminfo_image_ci.yml
@@ -17,12 +17,12 @@ defaults:

 jobs:
  docker:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    env:
      DOCKER_REGISTRY_URL: tip-tip-wlan-cloud-ucentral.jfrog.io
      DOCKER_REGISTRY_USERNAME: ucentral
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4

    - name: Build Docker image
      working-directory: chart/docker
--- a/.github/workflows/enforce-jira-issue-key.yml
+++ b/.github/workflows/enforce-jira-issue-key.yml
@@ -9,7 +9,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout actions repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
        with:
          repository: Telecominfraproject/.github
          path: github
--- a/.github/workflows/git-release.yml
+++ b/.github/workflows/git-release.yml
@@ -28,7 +28,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
      with:
        path: wlan-cloud-ucentral-deploy

@@ -36,7 +36,7 @@ jobs:
      run: |
        pip3 install yq
        helm plugin install https://github.com/databus23/helm-diff
-        helm plugin install https://github.com/aslafy-z/helm-git
+        helm plugin install https://github.com/aslafy-z/helm-git --version 0.16.0
        ls ~/.local/share/helm/plugins/helm-git/helm-git-plugin.sh || true
        sed 's/--skip-refresh //' -i ~/.local/share/helm/plugins/helm-git/helm-git-plugin.sh

@@ -54,6 +54,6 @@ jobs:
        git config --global credential.helper store
        git config --global user.email "tip-automation@telecominfraproject.com"
        git config --global user.name "TIP Automation User"
-        helm repo add bitnami https://charts.bitnami.com/bitnami
-        helm repo update
+        #helm repo add bitnami https://charts.bitnami.com/bitnami
+        #helm repo update
        ./git-release-tool.sh
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,13 +11,13 @@ defaults:

 jobs:
  helm-package:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    env:
      HELM_REPO_URL: https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/
      HELM_REPO_USERNAME: ucentral
    steps:
      - name: Checkout uCentral assembly chart repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
        with:
          path: wlan-cloud-ucentral-deploy
          repository: Telecominfraproject/wlan-cloud-ucentral-deploy
@@ -42,9 +42,7 @@ jobs:
      - name: Build package
        working-directory: wlan-cloud-ucentral-deploy/chart
        run: |
-          helm plugin install https://github.com/aslafy-z/helm-git --version 0.10.0
-          helm repo add bitnami https://charts.bitnami.com/bitnami
-          helm repo update
+          helm plugin install https://github.com/aslafy-z/helm-git --version 0.16.0
          helm dependency update
          mkdir dist
          helm package . -d dist
@@ -70,7 +68,7 @@ jobs:
          cat Chart.yaml | yq -r '.dependencies[] | "\(.name) - \(.repository) v\(.version)"' >> release.txt

      - name: Create GitHub release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
        with:
          body_path: wlan-cloud-ucentral-deploy/chart/release.txt
          files: wlan-cloud-ucentral-deploy/chart/dist/*
@@ -80,7 +78,7 @@ jobs:
    needs: helm-package
    steps:
    - name: Trigger testing of release
-      uses: peter-evans/repository-dispatch@v1
+      uses: peter-evans/repository-dispatch@v3
      with:
        token: ${{ secrets.WLAN_TESTING_PAT }}
        repository: Telecominfraproject/wlan-testing
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,6 @@
 chart/charts/*
 chart/Chart.lock
 chart/environment-values/wlan-cloud-ucentral-deploy/
-/docker-compose/certs/
-/docker-compose/*_data
-/docker-compose/owls/*_data
+docker-compose/certs/websocket*pem
+docker-compose/*_data
+docker-compose/owls/*_data
--- a/README.PKI2.0.md
+++ b/README.PKI2.0.md
@@ -0,0 +1,60 @@
+# PKI 2.0 Upgrade
+
+## Checklist when upgrading or installing a new OpenWiFi Cloud SDK
+For PKI 2.0 support we will need to:
+- [ ] Upgrade to the latest version of the OpenWiFi Cloud SDK.
+- [ ] Switch to using the Insta certificates for the server certificate when all APs are updated to 4.1.0+.
+
+### Upgrade OpenWiFi Cloud SDK
+The latest version of the OpenWiFi Cloud SDK is available at https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy/tree/main. This is also the location for this README.PKI2.0.md file.
+
+### Docker Compose
+The file `docker-compose/certs/clientcas.pem` already contains the Insta Chain certificates (along with the previous Digicert ones.)
+
+**Do this only once all APs have been upgraded to support PKI2.0**:
+Once you receive your server certificate package from Insta, please update the `websocket-cert.pem` and `websocket-key.pem` files in the same directory.
+Restart the SDK by running the appropriate `docker-compose` command: `./dco stop && ./dco start`.
+
+Once the switch-over to Insta is complete, TIP will update the `docker-compose/certs/cert.pem` and `key.pem` files to contain the Insta versions of the `*.wlan.local` certificate. This is only a concern if you are using *wlan.local* has your host name. The Digicert chain certificates will also be removed at this time.
+
+## Advanced
+
+## Checklist when updating an existing deployment (4.0.0+)
+If you have a recent 4.0.0 based deployment already running.
+- [ ] Switch to using the Insta chain certificates.
+- [ ] Update 2 SDK components.
+- [ ] Switch to using the Insta certificates for the server certificate when all APs are updated to 4.1.0+.
+
+### Switch to using the Insta chain certificates
+
+#### Docker Compose
+The file `docker-compose/certs/clientcas.pem` contains the Insta Chain certificates (along with the previous Digicert ones.) This file needs to be updated locally.
+
+#### Kubernetes
+The file `charts/environment-values/values.openwifi-qa.yaml` under `clientcas.pem` already contains the Insta Chain certificates (along with the previous Digicert ones.) Please make sure that this file gets updated in any existing deployments. It should be reflected in the `owgw-certs` secret under `clientcas.pem`.
+
+### Update 2 SDK components
+Make sure the image for OWGW is `tip-tip-wlan-cloud-ucentral.jfrog.io/owgw:master` or a specific tag like `v4.1.0` (when version 4.1.0 is released.)
+Use `tip-tip-wlan-cloud-ucentral.jfrog.io/owgwui:main` for owgwui.
+
+#### Docker Compose
+Change your .env file to set the tags (use the release tag once available `v4.1.0`):
+```bash
+OWGW_TAG=master
+OWGWUI_TAG=main
+```
+Restart the stack by running the appropriate `docker-compose` command: `./dco stop && ./dco start`.
+
+#### Kubernetes
+If you are already running the 'main' version of the SDK, you can delete the owgw and owgw-ui pods and a new version should be retrieved. Otherwise change your deployment to switch to the images specified above, either by editing your deployments directly or upgrading the 2 respective helm charts of owgw to master owgw-ui to main (or *v4.1.0* release tag when available.)
+
+### Switch to using the Insta certificates for the server certificate
+*Do this only once all APs have been upgraded to support PKI2.0!*
+
+#### Docker Compose
+Once you receive your server certificate package from Insta, please update the `websocket-cert.pem` and `websocket-key.pem` secrets in the same location. If you are making a change to the secret then a GW restart is also required (by deleting the owgw pod.)
+
+#### Kubernetes
+Make sure you update the certificate and key referred to as `websocket-cert` and `websocket-key` in the `owgw-certs` secret. This is done by setting the following helm variables:
+- owgw.certs."websocket-cert\\.pem"
+- owgw.certs."websocket-key\\.pem"
--- a/cgw/.gitignore
+++ b/cgw/.gitignore
@@ -0,0 +1,3 @@
+values/certs.device.yaml
+websocket-key.pem
+websocket-cert.pem
--- a/cgw/.sops.yaml
+++ b/cgw/.sops.yaml
@@ -0,0 +1,2 @@
+creation_rules:
+- kms: 'arn:aws:kms:us-east-2:289708231103:alias/helm-secrets'
--- a/cgw/README.md
+++ b/cgw/README.md
@@ -0,0 +1,44 @@
+# CGW Charts
+
+## Pre-requisites
+
+The following binaries are needed:
+- [helmfile](https://github.com/helmfile/helmfile/releases/download/v0.165.0/helmfile_0.165.0_linux_amd64.tar.gz)
+- helm
+- kubectl
+
+The following helm plugins are needed:
+```bash
+helm plugin install https://github.com/aslafy-z/helm-git --version 0.16.0
+helm plugin install https://github.com/databus23/helm-diff
+```
+
+## Configuration
+
+_helmfile.yaml_ contains the configuration for all the environments. External values files are used for secrets or where appropriate. Each environment needs to be created in this file before it can be deployed. The _values/certs.device.yaml_ file is generated in github workflows.
+This file should contain the device cert and key for the domain you are deploying.
+```
+certs:
+  websocket-cert.pem: 5c0lvd0RRWUpLb1pJa...
+  websocket-key.pem: V6WEFqWEhNVFk3RGda...
+```
+To generate this file manually (with the two websocket pem files available):
+```
+./mkcertconfig websocket-cert.pem websocket-key.pem > values/certs.device.yaml
+```
+
+## Installation
+
+To install the entire stack: `helm --environment ENVNAME apply`.
+To install just cgw: `helm --environment ENVNAME -l app=cgw apply`.
+To install just cgw with a specific image tag: `helm --environment ENVNAME -l app=cgw apply --state-values-set "cgw.tag=main"`.
+
+## Removal
+
+To remove the entire stack: `helm --environment ENVNAME delete`.
+To remove just cgw: `helm --environment ENVNAME -l app=cgw delete`.
+Delete the namespace manually if it is no longer required.
+
+# Re-installation
+
+Note that the kafka, postgres and redis charts do not want to be reinstalled so will have to be removed and installed. If you wish to upgrade these then you must follow the respective Bitnami instructions on how to upgrade these charts.
--- a/cgw/helmfile.yaml
+++ b/cgw/helmfile.yaml
@@ -0,0 +1,285 @@
+environments:
+  default:
+    values:
+    - global:
+        name: devcgw
+        namespace: openwifi-devcgw
+        domain: cicd.lab.wlan.tip.build
+        certificateARN: arn:aws:acm:us-east-2:289708231103:certificate/299d7444-acc4-46c2-ae83-40d2cd5f49be
+    - kafka:
+        enabled: true
+    - redis:
+        enabled: true
+    - postgres:
+        enabled: true
+        pgUser:
+          password: postgres
+        cgwUser:
+          name: cgw
+          password: 123
+    - cgw:
+        enabled: true
+        tag: next
+    - cgw2:
+        enabled: true
+  cgw01:
+    values:
+    - global:
+        name: cgw01
+        namespace: openlan-cgw01
+        domain: cicd.lab.wlan.tip.build
+        certificateARN: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
+    - kafka:
+        enabled: true
+    - redis:
+        enabled: true
+    - postgres:
+        enabled: true
+        pgUser:
+          password: openlancgw
+        cgwUser:
+          name: cgw
+          password: openlancgw
+    - cgw:
+        enabled: true
+        tag: next
+    - cgw2:
+        enabled: true
+
+---
+
+helmDefaults:
+  force: false
+  timeout: 300
+  createNamespace: true
+
+releases:
+- name: kafka
+  version: 28.3.0
+  namespace: {{ .Environment.Values.global.namespace }}
+  condition: kafka.enabled
+  chart: oci://registry-1.docker.io/bitnamicharts/kafka
+  labels:
+    group: base
+    app: kafka
+  values:
+    - image:
+        repository: bitnamilegacy/kafka
+    - defaultInitContainers:
+        volumePermissions:
+          image:
+            repository: bitnamilegacy/os-shell
+    - autoDiscovery:
+        volumePermissions:
+          image:
+            repository: bitnamilegacy/kubectl
+    - metrics:
+        jmx:
+          image:
+            repository: bitnamilegacy/jmx-exporter
+    - fullnameOverride: kafka
+    - volumePermissions:
+        enabled: true
+    - commonAnnotations:
+        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
+    - readinessProbe:
+        initialDelaySeconds: 45
+    - livenessProbe:
+        initialDelaySeconds: 60
+    - heapOpts: -Xmx1024m -Xms1024m
+    - kraft:
+        enabled: true
+    - zookeeper:
+        enabled: false
+    - provisioning:
+        enabled: true
+        topics:
+          - name: CnC
+            partitions: 1
+            replicationFactor: 1
+          - name: CnC_Res
+            partitions: 1
+            replicationFactor: 1
+    - controller:
+        persistence:
+          size: 80Gi
+        replicaCount: 1
+        extraConfig: |-
+          maxMessageBytes = 1048588
+          offsets.topic.replication.factor = 1
+          transaction.state.log.replication.factor = 1
+        extraEnvVars:
+          - name: ALLOW_PLAINTEXT_LISTENER
+            value: "yes"
+        resources:
+          requests:
+            cpu: 500m
+            memory: 512Mi
+          limits:
+            cpu: 750m
+            memory: 2Gi
+    - listeners:
+        client:
+          protocol: PLAINTEXT
+          containerPort: 9092
+        controller:
+          protocol: "PLAINTEXT"
+    - broker:
+        replicaCount: 0
+        persistence:
+          size: 80Gi
+        resources:
+          requests:
+            cpu: 500m
+            memory: 512Mi
+          limits:
+            cpu: 750m
+            memory: 2Gi
+
+- name: postgres
+  namespace: {{ .Environment.Values.global.namespace }}
+  chart: oci://registry-1.docker.io/bitnamicharts/postgresql
+  version: 13.4.3
+  condition: postgres.enabled
+  labels:
+    group: base
+    app: postgres
+  values:
+    - image:
+        repository: bitnamilegacy/postgresql
+    - volumePermissions:
+        image:
+          repository: bitnamilegacy/os-shell
+    - metrics:
+        image:
+          repository: bitnamilegacy/postgres-exporter
+    - fullnameOverride: pgsql
+    # workaround for: postgresql.conf file not detected. Generating it...
+    # cp: cannot create regular file '/bitnami/postgresql/conf/postgresql.conf': Permission denied
+    - volumePermissions:
+        enabled: true
+    - global:
+        postgresql:
+          auth:
+            postgresPassword: {{ .Environment.Values.postgres.pgUser.password }}
+    - auth:
+        postgresPassword: {{ .Environment.Values.postgres.pgUser.password }}
+    - primary:
+        persistence:
+          size: 40Gi
+        extendedConfiguration: |-
+          max_connections = 550
+          shared_buffers = 128MB
+          log_error_verbosity = verbose
+          tcp_keepalives_idle = 300
+          tcp_keepalives_interval = 30
+          tcp_user_timeout = 300
+        initdb:
+          scripts:
+            initusers.sql: |-
+              CREATE USER {{ .Environment.Values.postgres.cgwUser.name }};
+              ALTER USER cgw WITH ENCRYPTED PASSWORD '{{ .Environment.Values.postgres.cgwUser.password }}';
+              CREATE DATABASE cgw OWNER {{ .Environment.Values.postgres.cgwUser.name }};
+              \c cgw
+              CREATE TABLE infrastructure_groups (id INT PRIMARY KEY, reserved_size INT, actual_size INT);
+              ALTER TABLE infrastructure_groups OWNER TO {{ .Environment.Values.postgres.cgwUser.name }};
+              CREATE TABLE infras (mac MACADDR PRIMARY KEY, infra_group_id INT, FOREIGN KEY(infra_group_id) REFERENCES infrastructure_groups(id) ON DELETE CASCADE);
+              ALTER TABLE infras OWNER TO {{ .Environment.Values.postgres.cgwUser.name }};
+
+- name: redis
+  namespace: {{ .Environment.Values.global.namespace }}
+  chart: oci://registry-1.docker.io/bitnamicharts/redis
+  version: 19.5.2
+  condition: redis.enabled
+  labels:
+    group: base
+    app: redis
+  values:
+    - image:
+        repository: bitnamilegacy/redis
+    - sentinel:
+        image:
+          repository: bitnamilegacy/redis-sentinel
+    - metrics:
+        image:
+          repository: bitnamilegacy/redis-exporter
+    - volumePermissions:
+        image:
+          repository: bitnamilegacy/os-shell
+    - kubectl:
+        image:
+          repository: bitnamilegacy/kubectl
+    - sysctl:
+        image:
+          repository: bitnamilegacy/os-shell
+    - architecture: standalone
+    - auth:
+        enabled: false
+    - master:
+        persistence:
+          size: 20Gi
+        extraEnvVars:
+          - name: ALLOW_EMPTY_PASSWORD
+            value: "yes"
+
+- name: cgw
+  namespace: {{ .Environment.Values.global.namespace }}
+  chart: ../../openlan-cgw/helm
+  #chart: "git+https://github.com/Telecominfraproject/openlan-cgw@helm?ref=main"
+  version: 0.1.0
+  condition: cgw.enabled
+  labels:
+    group: apps
+    app: cgw
+  values:
+    - values/certs.tip.yaml
+    # this one is generated from GH secrets:
+    - values/certs.device.yaml
+    - values/cgw.yaml
+    - values/cgw-{{ .Environment.Values.global.name }}-1.yaml
+    - images:
+        cgw:
+          tag: {{ .Environment.Values.cgw.tag }}
+    - public_env_variables:
+        CGW_ID: 0
+        CGW_DB_USERNAME: "{{ .Environment.Values.postgres.cgwUser.name }}"
+        CGW_GRPC_PUBLIC_HOST: cgw-cgw
+        CGW_GRPC_PUBLIC_PORT: 50051
+    - secret_env_variables:
+        CGW_DB_PASSWORD: "{{ .Environment.Values.postgres.cgwUser.password }}"
+    - services:
+        cgw:
+          annotations:
+            external-dns.alpha.kubernetes.io/hostname: cgw-{{ .Environment.Values.global.name }}.{{ .Environment.Values.global.domain }}
+            service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {{ .Environment.Values.global.certificateARN }}
+
+- name: cgw2
+  namespace: {{ .Environment.Values.global.namespace }}
+  chart: ../../openlan-cgw/helm
+  #chart: "git+https://github.com/Telecominfraproject/openlan-cgw@helm?ref=main"
+  version: 0.1.0
+  condition: cgw2.enabled
+  labels:
+    group: apps
+    app: cgw2
+  values:
+    - values/certs.tip.yaml
+    # this one is generated from GH secrets:
+    - values/certs.device.yaml
+    - values/cgw.yaml
+    - values/cgw-{{ .Environment.Values.global.name }}-2.yaml
+    - images:
+        cgw:
+          tag: {{ .Environment.Values.cgw.tag }}
+    - public_env_variables:
+        CGW_ID: 1
+        CGW_DB_USERNAME: "{{ .Environment.Values.postgres.cgwUser.name }}"
+        CGW_GRPC_PUBLIC_HOST: cgw2-cgw2
+        CGW_GRPC_PUBLIC_PORT: 50051
+    - secret_env_variables:
+        CGW_DB_PASSWORD: "{{ .Environment.Values.postgres.cgwUser.password }}"
+    - services:
+        cgw:
+          annotations:
+            external-dns.alpha.kubernetes.io/hostname: cgw2-{{ .Environment.Values.global.name }}.{{ .Environment.Values.global.domain }}
+            service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {{ .Environment.Values.global.certificateARN }}
--- a/cgw/mkcertconfig
+++ b/cgw/mkcertconfig
@@ -0,0 +1,6 @@
+#!/bin/bash
+echo "certs:"
+for f in $* ; do
+    echo "  $f: |"
+    sed -e 's/^/    /' < "$f"
+done
--- a/cgw/secrets/certs.tip.yaml
+++ b/cgw/secrets/certs.tip.yaml
--- a/cgw/secrets/values.postgres.yaml
+++ b/cgw/secrets/values.postgres.yaml
@@ -0,0 +1,21 @@
+postgres:
+    pgUser:
+        password: ENC[AES256_GCM,data:QHV7Y5Jfes4=,iv:QTs0fu7behn1g2CLheoJROFHNYvN6OpS/vcQQC0NrMs=,tag:PeaRcoDsOrEjDN9KgHUEPA==,type:str]
+    cgwUser:
+        name: ENC[AES256_GCM,data:g6J6,iv:H4HxE5orLFXZFDDVD2tAS0PkOqNJ9j6SNu1ief7Snk0=,tag:Tuj9yjBcJzZBBZRtwAY33w==,type:str]
+        password: ENC[AES256_GCM,data:5K0f,iv:+g61dhYOOTbr8TwnwwLHgW17R+6zXpQT2PfgjvofvlI=,tag:1nSVXgkTC41d1AnDDE19Hg==,type:int]
+sops:
+    kms:
+        - arn: arn:aws:kms:us-east-2:289708231103:alias/helm-secrets
+          created_at: "2024-06-12T13:45:13Z"
+          enc: AQICAHiG/4CitJjM31GdYxTw9OLz/Zs5oK+DCq0cU2fAjtAA3AEPrxIAaT+xE4C1IFYmWvmkAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMrFaPNxf0atKVKnFsAgEQgDu8uqj035qrcelG0Dq4/Ond4H5bmpUHNRVEj0C8BFxg+a4R3loIk4NBeyuA0yqC0cQeWnA5e+/SjVtGAA==
+          aws_profile: ""
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-06-25T17:29:15Z"
+    mac: ENC[AES256_GCM,data:gbXt2MRhlx9zGcm9ZvXjWuwSPh/QHkNngGx0j0UQ61jZTINRh4ZgERuUj7Vpo1tg/blIFWbl768wB89RAGq3n1C4AcQpX3xvC33QyCT0i4pitQmnec9RnJL0L197mioOikPxl8z56WE1014EV+Vvbk7rf1CQkqrrEIJINoqSdfE=,iv:ThbvKhY0fsaXJz9rORnvxY64vMWyM/IOgSI+kuFFbAQ=,tag:fSF4tdyf3wc5+uIfoYLc5g==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/cgw/values/certs.tip.yaml
+++ b/cgw/values/certs.tip.yaml
@@ -0,0 +1,103 @@
+certs:
+    root.pem: |
+        -----BEGIN CERTIFICATE-----
+        MIIDojCCAoqgAwIBAgIUPVYBpqNbcLYygF6Mx+qxSWwQyFowDQYJKoZIhvcNAQEL
+        BQAwaTELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG1RlbGVjb20gSW5mcmEgUHJvamVj
+        dCwgSW5jLjEMMAoGA1UECxMDVElQMSYwJAYDVQQDEx1UZWxlY29tIEluZnJhIFBy
+        b2plY3QgUm9vdCBDQTAeFw0yMTA0MTMyMjQyNDRaFw0zMTA0MTMyMjM4NDZaMGkx
+        CzAJBgNVBAYTAlVTMSQwIgYDVQQKExtUZWxlY29tIEluZnJhIFByb2plY3QsIElu
+        Yy4xDDAKBgNVBAsTA1RJUDEmMCQGA1UEAxMdVGVsZWNvbSBJbmZyYSBQcm9qZWN0
+        IFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIGCibwf5u
+        AAwZ+1H8U0e3u2V+0d2gSctucoK86XwUmfe1V2a/qlCYZd29r80IuN1IIeB0naIm
+        KnK/MzXW87clF6tFd1+HzEvmlY/W4KyIXalVCTEzirFSvBEG2oZpM0yC3AefytAO
+        aOpA00LaM3xTfTqMKIRhJBuLy0I4ANUVG6ixVebbGuc78IodleqiLoWy2Q9QHyEO
+        t/7hZndJhiVogh0PveRhho45EbsACu7ymDY+JhlIleevqwlE3iQoq0YcmYADHno6
+        Eq8vcwLpZFxihupUafkd1T3WJYQAJf9coCjBu2qIhNgrcrGD8R9fGswwNRzMRMpX
+        720+GjcDW3bJAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFAJG
+        lmB5sVP2qfL3xZ8hQOTpkQH6MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsF
+        AAOCAQEAVjl9dm4epG9NUYnagT9sg7scVQEPfz3Lt6w1NXJXgD8mAUlK0jXmEyvM
+        dCPD4514n+8+lM7US8fh+nxc7jO//LwK17Wm9FblgjNFR7+anv0Q99T9fP19DLlF
+        PSNHL2emogy1bl1lLTAoj8nxg2wVKPDSHBGviQ5LR9fsWUIJDv9Bs5k0qWugWYSj
+        19S6qnHeskRDB8MqRLhKMG82oDVLerSnhD0P6HjySBHgTTU7/tYS/OZr1jI6MPbG
+        L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
+        5IOM7ItsRmen6u3qu+JXros54e4juQ==
+        -----END CERTIFICATE-----
+    cas.pem: |
+        -----BEGIN CERTIFICATE-----
+        MIIEnDCCA4SgAwIBAgIUVpyCUx1MUeUwxg+7I1BvGFTz7HkwDQYJKoZIhvcNAQEL
+        BQAwaTELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG1RlbGVjb20gSW5mcmEgUHJvamVj
+        dCwgSW5jLjEMMAoGA1UECxMDVElQMSYwJAYDVQQDEx1UZWxlY29tIEluZnJhIFBy
+        b2plY3QgUm9vdCBDQTAeFw0yMTA0MTMyMjUxMjZaFw0yNjA0MTMyMjM4NDZaMGwx
+        CzAJBgNVBAYTAlVTMSQwIgYDVQQKExtUZWxlY29tIEluZnJhIFByb2plY3QsIElu
+        Yy4xDDAKBgNVBAsTA1RJUDEpMCcGA1UEAxMgVGVsZWNvbSBJbmZyYSBQcm9qZWN0
+        IElzc3VpbmcgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtKBrq
+        qd2aKVSk25KfL5xHu8X7/8rJrz3IvyPuVKWhk/N1zabot3suBcGaYNKjnRHxg78R
+        yKwKzajKYWtiQFqztu24g16LQeAnoUxZnF6a0z3JkkRPsz14A2y8TUhdEe1tx+UU
+        4VGsk3n+FMmOQHL+79FO57zQC1LwylgfLSltrI6mF3jowVUQvnwzKhUzT87AJ6EO
+        ndK/q0T/Bgi+aI39zfVOjJjsTJwghvrmYW3iarP1THSKxeib2s02bZKrvvHa5HL4
+        UI8+LvREpVZl4mzt1z6Nl344Y6f+UeJlYa/Ci0jJqaXJmyVnUbAz+c0i5JfwAVn3
+        YQzfC4eLnZCmdF8zAgMBAAGjggE3MIIBMzAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+        DgQWBBSzG1S44EerPfM4gOQ85f0AYW3R6DAfBgNVHSMEGDAWgBQCRpZgebFT9qny
+        98WfIUDk6ZEB+jAOBgNVHQ8BAf8EBAMCAYYwgYMGCCsGAQUFBwEBBHcwdTAoBggr
+        BgEFBQcwAYYcaHR0cDovL29jc3Aub25lLmRpZ2ljZXJ0LmNvbTBJBggrBgEFBQcw
+        AoY9aHR0cDovL2NhY2VydHMub25lLmRpZ2ljZXJ0LmNvbS9UZWxlY29tSW5mcmFQ
+        cm9qZWN0Um9vdENBLmNydDBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vY3JsLm9u
+        ZS5kaWdpY2VydC5jb20vVGVsZWNvbUluZnJhUHJvamVjdFJvb3RDQS5jcmwwDQYJ
+        KoZIhvcNAQELBQADggEBAFbz+K94bHIkBMJqps0dApniUmOn0pO6Q6cGh47UP/kX
+        IiPIsnYgG+hqYD/qtsiqJhaWi0hixRWn38UmvZxMRk27aSTGE/TWx0JTC3qDGsSe
+        XkUagumbSfmS0ZyiTwMPeGAjXwyzGorqZWeA95eKfImntMiOf3E7//GK0K7HpCx8
+        IPCnLZsZD2q/mLyBsduImFIRQJbLAhwIxpcd1qYJk+BlGFL+HtBpEbq6JxW2Xy+v
+        DpNWc2WIsUTle0rTc9JNJrLX4ChUJmKqf8obKHap3Xh3//qw/jDB9pOAinA33FLJ
+        EmCnwBvQr9mfNmPBGMYZVU8cPruDQJ57GjmmvdisbJY=
+        -----END CERTIFICATE-----
+        -----BEGIN CERTIFICATE-----
+        MIIDojCCAoqgAwIBAgIUPVYBpqNbcLYygF6Mx+qxSWwQyFowDQYJKoZIhvcNAQEL
+        BQAwaTELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG1RlbGVjb20gSW5mcmEgUHJvamVj
+        dCwgSW5jLjEMMAoGA1UECxMDVElQMSYwJAYDVQQDEx1UZWxlY29tIEluZnJhIFBy
+        b2plY3QgUm9vdCBDQTAeFw0yMTA0MTMyMjQyNDRaFw0zMTA0MTMyMjM4NDZaMGkx
+        CzAJBgNVBAYTAlVTMSQwIgYDVQQKExtUZWxlY29tIEluZnJhIFByb2plY3QsIElu
+        Yy4xDDAKBgNVBAsTA1RJUDEmMCQGA1UEAxMdVGVsZWNvbSBJbmZyYSBQcm9qZWN0
+        IFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIGCibwf5u
+        AAwZ+1H8U0e3u2V+0d2gSctucoK86XwUmfe1V2a/qlCYZd29r80IuN1IIeB0naIm
+        KnK/MzXW87clF6tFd1+HzEvmlY/W4KyIXalVCTEzirFSvBEG2oZpM0yC3AefytAO
+        aOpA00LaM3xTfTqMKIRhJBuLy0I4ANUVG6ixVebbGuc78IodleqiLoWy2Q9QHyEO
+        t/7hZndJhiVogh0PveRhho45EbsACu7ymDY+JhlIleevqwlE3iQoq0YcmYADHno6
+        Eq8vcwLpZFxihupUafkd1T3WJYQAJf9coCjBu2qIhNgrcrGD8R9fGswwNRzMRMpX
+        720+GjcDW3bJAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFAJG
+        lmB5sVP2qfL3xZ8hQOTpkQH6MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsF
+        AAOCAQEAVjl9dm4epG9NUYnagT9sg7scVQEPfz3Lt6w1NXJXgD8mAUlK0jXmEyvM
+        dCPD4514n+8+lM7US8fh+nxc7jO//LwK17Wm9FblgjNFR7+anv0Q99T9fP19DLlF
+        PSNHL2emogy1bl1lLTAoj8nxg2wVKPDSHBGviQ5LR9fsWUIJDv9Bs5k0qWugWYSj
+        19S6qnHeskRDB8MqRLhKMG82oDVLerSnhD0P6HjySBHgTTU7/tYS/OZr1jI6MPbG
+        L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
+        5IOM7ItsRmen6u3qu+JXros54e4juQ==
+        -----END CERTIFICATE-----
+        -----BEGIN CERTIFICATE-----
+        MIIE5DCCAsygAwIBAgIUJdCMN900+sZN4pJmZ4SVd2KRNBowDQYJKoZIhvcNAQEL
+        BQAwDTELMAkGA1UEAwwCQ0EwHhcNMjQwNjEzMTc1ODMwWhcNMjUwNjEzMTc1ODMw
+        WjANMQswCQYDVQQDDAJDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+        ALHSZH2fO1ho8aETiRwJZw1dlzk4ny364TdfY35AfhocvCozxmoKTcT69RqMtUIM
+        dStOoHhRenKnEPKHF4SrgrebsYJeXysLVb3UMEkrV6I9sKeBbUq2neAAibv+Xq0X
+        KpgJM8ZSq3WugI7pJ9kRIrRbErm8FycIW+BhBTn5g/thBnwtBn0FJ4QpnBkl38bZ
+        vYoOp77oVSk42hijD56hJwyg9yVo4MbZRhpROkL8/rPrLXDfeM3yXKx+kvNCY01m
+        8IxGUMh/3UuU8wWXaGRIAcWapZpDrDaM8YdDdVfoIv6pqCU6zLhrDm2gyYABkM2q
+        VKNruHDvrcV6BT1ldW59RkRWWW8UqsIUYuvjHMBSgEijiCCmCcrNTdd1dg+9ycdU
+        p2ZHw4g5QwyGrosUMC34Hl7zz+Aj+gA3gBAyeX2Mg9E0WtDoX6as9fRZebP5fYwj
+        Qh4bjv3Rx+a68G8DrPE7CJAJHTmthgyjINLn8/RcPpo0MYh/r47Sy1+nWBCnibYZ
+        vKkDCsRjVd5mDwRAQE0YCEiissgNgVdV6LjW4pnkIsPlHpI15A7PiDRQEKHdmRYL
+        NaIQKrn6x7Tj+o9Bs3VEoyIR1qNEYuuRGeXgTRWT1QWGX+0oN5OMzkcEKtLzPRJR
+        wW+h5C+gyp2KB7pU3umk5pFMVPlT7hbAaCyzuhNWQL5fAgMBAAGjPDA6MAwGA1Ud
+        EwQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBTEa33fF8DibprD2kyGKfts
+        +Gk2QTANBgkqhkiG9w0BAQsFAAOCAgEAjad+ygI3Cp5wFHyjc9cjkU5+6qQM8qXM
+        g6B9QAqbsejzBC2euFfkLKGPGTxyPoX5fjNGreMFu6bYVS4MdObMPfaEgUdJeTLA
+        t/FGw22/zJDsKceZDFvIGoW2BvyXbqKUXXzonhE1/OXSKI1Me5cJo8GqA8J97VGh
+        TooDNzNXjvOeMMXzvugoFtXGXey/4tus1S1pSYglW/rB/exhBgZVrW5ElOPqLeK4
+        QEiP90jD303Rhw7aogrMVMcQWQ8ONyBEuQdno8/Ypil4uQXh4kYbbhgbrzT6Ux4Y
+        x9KIGbydYkNlqU4M/B1GPDsOfYauJmDpMvoUxPTolaPbIhrPmONudbUZVnrSEgOo
+        NAREI2hWRTnsqb76ugQayr7UQCzX4gQ99UllDLuvoAsc45s2pY3fJlQHkhl1JkGw
+        YlB1lF22Z35aWxkhXaYJHvhtZpt0oJ9vN//JJveBPOSajNsVnY6MIk4numI30BlZ
+        YSKHKYrYvD1yR/MSCeKVGWqsWRGfFk2bZGFjVgdlusFrjZM8JNbZtTVnKzTdoDiW
+        BnVJcd552gsT2yhaIvBoqoq4ufVa1gDGM4qRz0dxTW7850Qp++iWHMbwXRoJ3dow
+        /vreJoe6yYx8dQDw/Adl8SNV5Uo0ws36VUI/Vkuj3vG2oMP0P5DSRVQIzKxZ8FM1
+        0bJQwZgh3Is=
+        -----END CERTIFICATE-----
--- a/cgw/values/cgw-cgw01-1.yaml
+++ b/cgw/values/cgw-cgw01-1.yaml
@@ -0,0 +1 @@
+# set the node affinity and tolerations here
--- a/cgw/values/cgw-cgw01-2.yaml
+++ b/cgw/values/cgw-cgw01-2.yaml
@@ -0,0 +1 @@
+# set the node affinity and tolerations here
--- a/cgw/values/cgw-devcgw-1.yaml
+++ b/cgw/values/cgw-devcgw-1.yaml
@@ -0,0 +1,16 @@
+# set the node affinity and tolerations here
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: alpha.eksctl.io/nodegroup-name
+          operator: In
+          values:
+          - gwm5lrg
+
+tolerations:
+- effect: NoSchedule
+  key: type
+  operator: Equal
+  value: onlygwm5lrg
--- a/cgw/values/cgw-devcgw-2.yaml
+++ b/cgw/values/cgw-devcgw-2.yaml
@@ -0,0 +1,16 @@
+# set the node affinity and tolerations here
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: alpha.eksctl.io/nodegroup-name
+          operator: In
+          values:
+          - gwmed
+
+tolerations:
+- effect: NoSchedule
+  key: type
+  operator: Equal
+  value: onlygwmed
--- a/cgw/values/cgw.yaml
+++ b/cgw/values/cgw.yaml
@@ -0,0 +1,24 @@
+public_env_variables:
+  CGW_DB_HOST: pgsql
+  CGW_DB_PORT: "5432"
+  CGW_KAFKA_HOST: kafka
+  CGW_KAFKA_PORT: "9092"
+  CGW_REDIS_HOST: redis-master
+  CGW_REDIS_PORT: "6379"
+  CGW_ALLOW_CERT_MISMATCH: "yes"
+  # use (#cpus * 2) - 2
+  DEFAULT_WSS_THREAD_NUM: "4"
+  # Useful for debugging:
+  #CGW_LOG_LEVEL: "debug"
+  #RUST_BACKTRACE: "full"
+services:
+  cgw:
+    type: LoadBalancer
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: metrics
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /health
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: http
+      service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002"
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -2,39 +2,32 @@ apiVersion: v2
 name: openwifi
 appVersion: "1.0"
 description: A Helm chart for Kubernetes
-version: 0.1.0
+version: 4.2.0-RC1
 dependencies:
 - name: owgw
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=master"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=v4.2.0-RC1"
  version: 0.1.0
 - name: owsec
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=v4.1.0"
  version: 0.1.0
 - name: owfms
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=v3.2.0"
  version: 0.1.0
 - name: owprov
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=v4.1.0"
  version: 0.1.0
 - name: owanalytics
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-analytics@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-analytics@helm?ref=v3.2.0"
  version: 0.1.0
 - name: owgwui
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=v4.2.0-RC1"
  version: 0.1.0
 - name: owprovui
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=v4.0.0"
  version: 0.1.0
 - name: owsub
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-userportal@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-userportal@helm?ref=v3.2.0"
  version: 0.1.0
- name: owrrm
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-rrm@helm?ref=main"
-  version: 0.1.0
- name: kafka
-  repository: https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/
-  version: 13.0.2
-  condition: kafka.enabled
 - name: owls
  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owls@helm?ref=main"
  version: 0.1.0
@@ -43,14 +36,14 @@ dependencies:
  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owls-ui@helm?ref=master"
  version: 0.1.0
  condition: owlsui.enabled
+- name: kafka
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 28.2.3
+  condition: kafka.enabled
 - name: haproxy
  repository: oci://registry-1.docker.io/bitnamicharts
  version: 0.13.3
  condition: haproxy.enabled
-#- name: postgresql-ha
-#  repository: https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/
-#  version: 8.6.13
-#  condition: postgresql-ha.enabled
 - name: postgresql
  repository: oci://registry-1.docker.io/bitnamicharts
  version: 13.4.3
--- a/chart/README.md
+++ b/chart/README.md
@@ -24,7 +24,6 @@ In order to access the UI and other RESTAPI endpoints you should run the followi

 ```
 $ kubectl port-forward deployment/proxy 5912 5913 16001 16002 16003 16004 16005 16006 16009 &
-$ kubectl port-forward deployment/owrrm 16789 &
 $ kubectl port-forward deployment/owgwui 8080:80 &
 $ kubectl port-forward deployment/owprovui 8088:80 &
 ```
@@ -47,7 +46,6 @@ In order to access the UI and other RESTAPI endpoints you should run the followi

 ```
 $ kubectl port-forward deployment/proxy 5912 5913 16001 16002 16003 16004 16005 16006 16009 &
-$ kubectl port-forward deployment/owrrm 16789 &
 $ kubectl port-forward deployment/owgwui 8080:80 &
 $ kubectl port-forward deployment/owprovui 8088:80 &
 ```
@@ -143,12 +141,10 @@ The following table lists the configurable parameters that overrides microservic
 | `owsub.configProperties."openwifi\.kafka\.enable"` | string | Configures OpenWIFI Subscription to use Kafka for communication | `'true'` |
 | `owsub.configProperties."openwifi\.kafka\.brokerlist"` | string | Sets up Kafka broker list for OpenWIFI Subscription to the predictable Kubernetes service name (see `kafka.fullnameOverride` option description for details) | `'kafka:9092'` |
 | `owsub.certs` | map | Map with multiline string containing TLS certificates and private keys required for REST API |  |
-| `owrrm.public_env_variables` | map | Map of public environment variables passed to OpenWIFI RRM service |  |
-| `owrrm.mysql.enabled` | boolean | Flag to enable MySQL database deployment of OpenWIFI RRM service using subchart | `true` |
 | `kafka.enabled` | boolean | Enables [kafka](https://github.com/bitnami/charts/blob/master/bitnami/kafka/) deployment | `true` |
 | `kafka.fullnameOverride` | string | Overrides Kafka Kubernetes service name so it could be predictable and set in microservices configs | `'kafka'` |
 | `kafka.image.registry` | string | Kafka Docker image registry | `'docker.io'` |
-| `kafka.image.repository` | string | Kafka Docker image repository | `'bitnami/kafka'` |
+| `kafka.image.repository` | string | Kafka Docker image repository | `'bitnamilegacy/kafka'` |
 | `kafka.image.tag` | string | Kafka Docker image tag | `'2.8.0-debian-10-r43'` |
 | `kafka.minBrokerId` | number | Sets Kafka minimal broker ID (useful for multi-node Kafka installations) | `100` |
 | `clustersysteminfo.enabled` | boolean | Enables post-install check that makes sure that all services are working correctly using systeminfo RESTAPI method | `false` |
@@ -258,7 +254,7 @@ You may see example values to enable this feature in [values.restapi-disable-tls

 ### PostgreSQL storage option for services

-By default, all microservices except RRM service use SQLite as default storage driver, but it is possible to use PostgreSQL for that purpose. Both [cluster-per-microservice](environment-values/values.openwifi-qa.external-db.yaml) and [cluster per installation](environment-values/values.openwifi-qa.single-external-db.yaml) deployments method may be used.
+By default, all microservices use SQLite as default storage driver, but it is possible to use PostgreSQL for that purpose. Both [cluster-per-microservice](environment-values/values.openwifi-qa.external-db.yaml) and [cluster per installation](environment-values/values.openwifi-qa.single-external-db.yaml) deployments method may be used.

 ## Environment specific values

--- a/chart/environment-values/.gitignore
+++ b/chart/environment-values/.gitignore
@@ -0,0 +1,3 @@
+_values.custom-*.yaml
+certs/
+env_*
--- a/chart/environment-values/cleanup.sh
+++ b/chart/environment-values/cleanup.sh
@@ -1,6 +1,15 @@
 #!/bin/bash
 [ -z "$NAMESPACE" ] && echo "No NAMESPACE set" && exit 1
-helm -n openwifi-"$NAMESPACE" delete tip-openwifi
-sleep 30
-kubectl delete ns openwifi-"$NAMESPACE"
-exit 0
+ns="openwifi-$NAMESPACE"
+echo "Cleaning up namespace $ns in 10 seconds..."
+sleep 10
+echo "- delete tip-openwifi helm release in $ns"
+helm -n "$ns" delete tip-openwifi
+if [[ "$1" == "full" ]] ; then
+    echo "- delete $ns namespace in 30 seconds..."
+    sleep 30
+    echo "- delete $ns namespace"
+    kubectl delete ns "$ns"
+fi
+echo "- cleaned up $ns namespace"
+exit 0
--- a/chart/environment-values/deploy.sh
+++ b/chart/environment-values/deploy.sh
@@ -5,8 +5,7 @@ set -e
 function usage()
 {
    cat <<-EOF >&2
-
-This script is indended for OpenWIFI Cloud SDK deployment to TIP QA/Dev environments using assembly Helm chart (https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy/tree/main/chart) with configuration through environment variables
+This script is intended for OpenWIFI Cloud SDK deployment to TIP QA/Dev environments using assembly Helm chart (https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy/tree/main/chart) with configuration through environment variables

 Required environment variables:
 - NAMESPACE - namespace suffix that will used added for the Kubernetes environment (i.e. if you pass 'test', kubernetes namespace will be named 'ucentral-test')
@@ -31,7 +30,6 @@ The following environmnet variables may be passed, but will be ignored if CHART_
 - OWPROVUI_VERSION - OpenWIFI Provisioning Web UI version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
 - OWANALYTICS_VERSION - OpenWIFI Analytics version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
 - OWSUB_VERSION - OpenWIFI Subscription (Userportal) version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
- OWRRM_VERSION - OpenWIFI radio resource management service (RRM) version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)

 Optional environment variables:
 - EXTRA_VALUES - extra values that should be passed to Helm deployment separated by comma (,)
@@ -42,12 +40,14 @@ Optional environment variables:
 - IPTOCOUNTRY_IPINFO_TOKEN - token that should be set for IPInfo support (owgw/owprov iptocountry.ipinfo.token properties), ommited if not passed
 - MAILER_USERNAME - SMTP username used for OWSEC mailer
 - MAILER_PASSWORD - SMTP password used for OWSEC mailer (only if both MAILER_PASSWORD and MAILER_USERNAME are set, mailer will be enabled)
+- CERTIFICATE_ARN - Certificate ARN (will default to ap-south-1 certificate ARN)
 EOF
 }

 # Global variables
 VALUES_FILE_LOCATION_SPLITTED=()
 EXTRA_VALUES_SPLITTED=()
+DEF_CERT_ARN="arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c"

 # Helper functions
 function check_if_chart_version_is_release()
@@ -72,7 +72,6 @@ if [[ "$DEPLOY_METHOD" != "local" ]] ; then
        [ -z ${OWPROVUI_VERSION+x} ] && echo "OWPROVUI_VERSION is unset" >&2 && usage && exit 1
        [ -z ${OWANALYTICS_VERSION+x} ] && echo "OWANALYTICS_VERSION is unset" >&2 && usage && exit 1
        [ -z ${OWSUB_VERSION+x} ] && echo "OWSUB_VERSION is unset" >&2 && usage && exit 1
-        [ -z ${OWRRM_VERSION+x} ] && echo "OWRRM_VERSION is unset" >&2 && usage && exit 1
    fi
 fi
 ## Environment specifics
@@ -90,9 +89,11 @@ fi
 [ -z ${DEVICE_CERT_LOCATION+x} ] && echo "DEVICE_CERT_LOCATION is unset, setting it to CERT_LOCATION" && export DEVICE_CERT_LOCATION=$CERT_LOCATION
 [ -z ${DEVICE_KEY_LOCATION+x} ] && echo "DEVICE_KEY_LOCATION is unset, setting it to KEY_LOCATION" && export DEVICE_KEY_LOCATION=$KEY_LOCATION
 [ -z ${INTERNAL_RESTAPI_ENDPOINT_SCHEMA+x} ] && echo "INTERNAL_RESTAPI_ENDPOINT_SCHEMA is unset, setting it to 'https'" && export INTERNAL_RESTAPI_ENDPOINT_SCHEMA=https
+[ -z ${USE_SEPARATE_OWGW_LB+x} ] && echo "USE_SEPARATE_OWGW_LB is unset, setting it to false" && export USE_SEPARATE_OWGW_LB=false
 export MAILER_ENABLED="false"
 [ ! -z ${MAILER_USERNAME+x} ] && [ ! -z ${MAILER_PASSWORD+x} ] && echo "MAILER_USERNAME and MAILER_PASSWORD are set, mailer will be enabled" && export MAILER_ENABLED="true"
 [ -z "${DOMAIN}" ] && echo "DOMAIN is unset, using cicd.lab.wlan.tip.build" && export DOMAIN="cicd.lab.wlan.tip.build"
+[ -z ${CERTIFICATE_ARN+x} ] && export CERTIFICATE_ARN=$DEF_CERT_ARN

 # Transform some environment variables
 export OWGW_VERSION_TAG=$(echo ${OWGW_VERSION} | tr '/' '-')
@@ -103,12 +104,11 @@ export OWPROV_VERSION_TAG=$(echo ${OWPROV_VERSION} | tr '/' '-')
 export OWPROVUI_VERSION_TAG=$(echo ${OWPROVUI_VERSION} | tr '/' '-')
 export OWANALYTICS_VERSION_TAG=$(echo ${OWANALYTICS_VERSION} | tr '/' '-')
 export OWSUB_VERSION_TAG=$(echo ${OWSUB_VERSION} | tr '/' '-')
-export OWRRM_VERSION_TAG=$(echo ${OWRRM_VERSION} | tr '/' '-')

 # Check deployment method that's required for this environment
 helm plugin install https://github.com/databus23/helm-diff || true
 if [[ "$DEPLOY_METHOD" == "git" ]] ; then
-    helm plugin install https://github.com/aslafy-z/helm-git --version 0.10.0 || true
+    helm plugin list | grep "^helm-git" || helm plugin install https://github.com/aslafy-z/helm-git || true
    rm -rf wlan-cloud-ucentral-deploy || true
    git clone https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy.git
    cd wlan-cloud-ucentral-deploy
@@ -123,10 +123,8 @@ if [[ "$DEPLOY_METHOD" == "git" ]] ; then
        sed -i '/wlan-cloud-owprov-ui@/s/ref=.*/ref='${OWPROVUI_VERSION}'\"/g' Chart.yaml
        sed -i '/wlan-cloud-analytics@/s/ref=.*/ref='${OWANALYTICS_VERSION}'\"/g' Chart.yaml
        sed -i '/wlan-cloud-userportal@/s/ref=.*/ref='${OWSUB_VERSION}'\"/g' Chart.yaml
-        sed -i '/wlan-cloud-rrm@/s/ref=.*/ref='${OWRRM_VERSION}'\"/g' Chart.yaml
    fi
-    helm repo add bitnami https://charts.bitnami.com/bitnami
-    helm repo update
+    #helm repo add bitnami https://charts.bitnami.com/bitnami && helm repo update
    [ -z "$SKIP_DEPS" ] && helm dependency update
    cd ../..
    export DEPLOY_SOURCE="wlan-cloud-ucentral-deploy/chart"
@@ -162,14 +160,13 @@ else
  export OWGW_SERVICE_DNS_RECORDS=""
 fi

-envsubst < values.custom.tpl.yaml > values.custom-${NAMESPACE}.yaml
+envsubst < values.custom.tpl.yaml > _values.custom-${NAMESPACE}.yaml

-set -x
 helm upgrade --install --create-namespace --wait --timeout 60m \
  --namespace openwifi-${NAMESPACE} \
  ${VALUES_FILES_FLAGS[*]} \
  ${EXTRA_VALUES_FLAGS[*]} \
-  -f values.custom-${NAMESPACE}.yaml \
+  -f _values.custom-${NAMESPACE}.yaml \
  --set-file owgw.certs."restapi-cert\.pem"=$CERT_LOCATION \
  --set-file owgw.certs."restapi-key\.pem"=$KEY_LOCATION \
  --set-file owgw.certs."websocket-cert\.pem"=$CERT_LOCATION \
--- a/chart/environment-values/values.aws.yaml
+++ b/chart/environment-values/values.aws.yaml
@@ -99,8 +99,7 @@ haproxy:
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "8080"
      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,16001,17001,5912,5913,16009,16007"
      service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
-      external-dns.alpha.kubernetes.io/hostname: "gw.cicd.lab.wlan.tip.build,sec.cicd.lab.wlan.tip.build,fms.cicd.lab.wlan.tip.build,prov.cicd.lab.wlan.tip.build,rtty.cicd.lab.wlan.tip.build,sub.cicd.lab.wlan.tip.build,analytics.cicd.lab.wlan.tip.build,rrm.cicd.lab.wlan.tip.build" # TODO change FQDNs
+      external-dns.alpha.kubernetes.io/hostname: "gw.cicd.lab.wlan.tip.build,sec.cicd.lab.wlan.tip.build,fms.cicd.lab.wlan.tip.build,prov.cicd.lab.wlan.tip.build,rtty.cicd.lab.wlan.tip.build,sub.cicd.lab.wlan.tip.build,analytics.cicd.lab.wlan.tip.build" # TODO change FQDNs

--- a/chart/environment-values/values.base.insecure.yaml
+++ b/chart/environment-values/values.base.insecure.yaml
@@ -52,22 +52,6 @@ owsub:
    openwifi.system.uri.private: http://owsub-owsub:17006
    openwifi.system.uri.ui: http://localhost

-owrrm:
-  public_env_variables:
-    SELFSIGNED_CERTS: "true"
-    KAFKACONFIG_BOOTSTRAPSERVER: kafka:9092
-    DATABASECONFIG_SERVER: owrrm-mysql:3306
-    DATABASECONFIG_DBNAME: owrrm
-    DATABASECONFIG_DATARETENTIONINTERVALDAYS: "1"
-
-  secret_env_variables:
-    DATABASECONFIG_USER: root
-    DATABASECONFIG_PASSWORD: openwifi
-
-  mysql:
-    enabled: true
-    fullnameOverride: "owrrm-mysql"
-
 owgwui:
  public_env_variables:
    REACT_APP_UCENTRALSEC_URL: http://localhost:16001
@@ -77,10 +61,35 @@ owprovui:
    REACT_APP_UCENTRALSEC_URL: http://localhost:16001

 kafka:
-  heapOpts: -Xmx512m -Xms512m
+  volumePermissions:
+    enabled: true
+  commonAnnotations:
+    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
  readinessProbe:
    initialDelaySeconds: 45
  livenessProbe:
    initialDelaySeconds: 60
+  kraft:
+    enabled: true
+  heapOpts: -Xmx1024m -Xms1024m
  zookeeper:
-    heapSize: 256
+    enabled: false
+  controller:
+    replicaCount: 1
+    extraConfig: |-
+      maxMessageBytes = 1048588
+      offsets.topic.replication.factor = 1
+      transaction.state.log.replication.factor = 1
+    extraEnvVars:
+      - name: ALLOW_PLAINTEXT_LISTENER
+        value: "yes"
+  listeners:
+    client:
+      protocol: PLAINTEXT
+      containerPort: 9092
+    controller:
+      protocol: "PLAINTEXT"
+  broker:
+    persistence:
+      size: 20Gi
+    replicaCount: 0
--- a/chart/environment-values/values.base.secure.yaml
+++ b/chart/environment-values/values.base.secure.yaml
@@ -298,22 +298,6 @@ owsub:
          secret:
            secretName: {{ include "owsub.fullname" . }}-owsub-restapi-tls

-owrrm:
-  public_env_variables:
-    SELFSIGNED_CERTS: "true"
-    KAFKACONFIG_BOOTSTRAPSERVER: kafka:9092
-    DATABASECONFIG_SERVER: owrrm-mysql:3306
-    DATABASECONFIG_DBNAME: owrrm
-    DATABASECONFIG_DATARETENTIONINTERVALDAYS: "1"
-
-  secret_env_variables:
-    DATABASECONFIG_USER: root
-    DATABASECONFIG_PASSWORD: openwifi
-
-  mysql:
-    enabled: true
-    fullnameOverride: "owrrm-mysql"
-
 owgwui:
  public_env_variables:
    REACT_APP_UCENTRALSEC_URL: https://localhost:16001
@@ -323,13 +307,45 @@ owprovui:
    REACT_APP_UCENTRALSEC_URL: https://localhost:16001

 kafka:
-  heapOpts: -Xmx512m -Xms512m
+  volumePermissions:
+    enabled: true
+  commonAnnotations:
+    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
+  #resources:
+  #  requests:
+  #    cpu: 100m
+  #    memory: 512Mi
+  #  limits:
+  #    cpu: 500m
+  #    memory: 1Gi
  readinessProbe:
    initialDelaySeconds: 45
  livenessProbe:
    initialDelaySeconds: 60
+  kraft:
+    enabled: true
+  heapOpts: -Xmx1024m -Xms1024m
  zookeeper:
-    heapSize: 256
+    enabled: false
+  controller:
+    replicaCount: 1
+    extraConfig: |-
+      maxMessageBytes = 1048588
+      offsets.topic.replication.factor = 1
+      transaction.state.log.replication.factor = 1
+    extraEnvVars:
+      - name: ALLOW_PLAINTEXT_LISTENER
+        value: "yes"
+  listeners:
+    client:
+      protocol: PLAINTEXT
+      containerPort: 9092
+    controller:
+      protocol: "PLAINTEXT"
+  broker:
+    persistence:
+      size: 20Gi
+    replicaCount: 0

 restapiCerts:
  enabled: true
--- a/chart/environment-values/values.custom.tpl.yaml
+++ b/chart/environment-values/values.custom.tpl.yaml
@@ -2,7 +2,8 @@ owgw:
  services:
    owgw:
      annotations:
-        external-dns.alpha.kubernetes.io/hostname: "$OWGW_SERVICE_DNS_RECORDS"
+        external-dns.alpha.kubernetes.io/hostname: gw-${NAMESPACE}.${DOMAIN}
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
  configProperties:
    openwifi.fileuploader.host.0.name: gw-${NAMESPACE}.${DOMAIN}
    rtty.server: gw-${NAMESPACE}.${DOMAIN}
@@ -27,6 +28,7 @@ owsec:
    owsec:
      annotations:
        external-dns.alpha.kubernetes.io/hostname: sec-${NAMESPACE}.${DOMAIN}
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
 owfms:
  configProperties:
    s3.secret: "${OWFMS_S3_SECRET}"
@@ -38,6 +40,20 @@ owfms:
    owfms:
      annotations:
        external-dns.alpha.kubernetes.io/hostname: fms-${NAMESPACE}.${DOMAIN}
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
+  public_env_variables:
+    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
+owprov:
+  services:
+    owprov:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: prov-${NAMESPACE}.${DOMAIN}
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
+  configProperties:
+    openwifi.system.uri.public: https://prov-${NAMESPACE}.${DOMAIN}:16005
+    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owprov-owprov:17005
+    openwifi.system.uri.ui: https://provui-${NAMESPACE}.${DOMAIN}
+    iptocountry.ipinfo.token: "${IPTOCOUNTRY_IPINFO_TOKEN}"
  public_env_variables:
    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
 owgwui:
@@ -47,20 +63,9 @@ owgwui:
      - webui-${NAMESPACE}.${DOMAIN}
      annotations:
        external-dns.alpha.kubernetes.io/hostname: webui-${NAMESPACE}.${DOMAIN}
+        alb.ingress.kubernetes.io/certificate-arn: ${CERTIFICATE_ARN}
  public_env_variables:
    REACT_APP_UCENTRALSEC_URL: https://sec-${NAMESPACE}.${DOMAIN}:16001
-owprov:
-  services:
-    owprov:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: prov-${NAMESPACE}.${DOMAIN}
-  configProperties:
-    openwifi.system.uri.public: https://prov-${NAMESPACE}.${DOMAIN}:16005
-    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owprov-owprov:17005
-    openwifi.system.uri.ui: https://provui-${NAMESPACE}.${DOMAIN}
-    iptocountry.ipinfo.token: "${IPTOCOUNTRY_IPINFO_TOKEN}"
-  public_env_variables:
-    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
 owprovui:
  ingresses:
    default:
@@ -68,6 +73,7 @@ owprovui:
      - provui-${NAMESPACE}.${DOMAIN}
      annotations:
        external-dns.alpha.kubernetes.io/hostname: provui-${NAMESPACE}.${DOMAIN}
+        alb.ingress.kubernetes.io/certificate-arn: ${CERTIFICATE_ARN}
  public_env_variables:
    REACT_APP_UCENTRALSEC_URL: https://sec-${NAMESPACE}.${DOMAIN}:16001
 owanalytics:
@@ -75,6 +81,7 @@ owanalytics:
    owanalytics:
      annotations:
        external-dns.alpha.kubernetes.io/hostname: analytics-${NAMESPACE}.${DOMAIN}
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
  configProperties:
    openwifi.system.uri.public: https://analytics-${NAMESPACE}.${DOMAIN}:16009
    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owanalytics-owanalytics:17009
@@ -86,6 +93,7 @@ owsub:
    owsub:
      annotations:
        external-dns.alpha.kubernetes.io/hostname: sub-${NAMESPACE}.${DOMAIN}
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
  configProperties:
    openwifi.system.uri.public: https://sub-${NAMESPACE}.${DOMAIN}:16006
    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsub-owsub:17006
@@ -102,6 +110,7 @@ owls:
    owls:
      annotations:
        external-dns.alpha.kubernetes.io/hostname: ls-${NAMESPACE}.${DOMAIN}
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
  configProperties:
    openwifi.system.uri.public: https://ls-${NAMESPACE}.${DOMAIN}:16007
    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owls-owls:17007
@@ -113,16 +122,11 @@ owlsui:
      - lsui-${NAMESPACE}.${DOMAIN}
      annotations:
        external-dns.alpha.kubernetes.io/hostname: lsui-${NAMESPACE}.${DOMAIN}
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
  public_env_variables:
    REACT_APP_UCENTRALSEC_URL: https://sec-${NAMESPACE}.${DOMAIN}:16001
-owrrm:
-  public_env_variables:
-    SERVICECONFIG_PUBLICENDPOINT: https://rrm-${NAMESPACE}.${DOMAIN}:16789
-  services:
-    owrrm:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: rrm-${NAMESPACE}.${DOMAIN}
 haproxy:
  service:
    annotations:
      external-dns.alpha.kubernetes.io/hostname: "$HAPROXY_SERVICE_DNS_RECORDS"
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
--- a/chart/environment-values/values.openwifi-qa-insta.yaml
+++ b/chart/environment-values/values.openwifi-qa-insta.yaml
--- a/chart/environment-values/values.openwifi-qa.disable-radiusproxy.yaml
+++ b/chart/environment-values/values.openwifi-qa.disable-radiusproxy.yaml
@@ -0,0 +1,7 @@
+owgw:
+  configProperties:
+    radius.proxy.enable: "false"
+    radius.proxy.accounting.port: 1813
+    radius.proxy.authentication.port: 1812
+    radius.proxy.coa.port: 3799
+    radsec.keepalive: 120
--- a/chart/environment-values/values.openwifi-qa.owls-enabled.yaml
+++ b/chart/environment-values/values.openwifi-qa.owls-enabled.yaml
@@ -1,43 +1,21 @@
 # This helm values file is to be used when OWLS is run in the same namespace.
 owgw:
-  services:
-    owgw:
-      type: LoadBalancer
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip"
-        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16102"
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002"
-
  configProperties:
    simulatorid: 53494D020202
-    storage.type: postgresql
-    storage.type.postgresql.host: owgw-pgsql
-    storage.type.postgresql.database: owgw
-    storage.type.postgresql.username: owgw
-    storage.type.postgresql.password: owgw
-    openwifi.certificates.allowmismatch: "true"
+    storage.type.postgresql.maxsessions: 120
+    # this actually disables websocket logging:
+    logging.websocket: true

  resources:
    requests:
      cpu: 2000m
-      memory: 3000Mi
+      memory: 3Gi
    limits:
      cpu: 2000m
-      memory: 3000Mi
-
-  postgresql:
-    enabled: true
-    fullnameOverride: owgw-pgsql
-    postgresqlDatabase: owgw
-    postgresqlUsername: owgw
-    postgresqlPassword: owgw
+      memory: 5Gi

 owls:
  enabled: true
-
  services:
    owls:
      type: LoadBalancer
@@ -46,7 +24,6 @@ owls:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16107"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16007,17007"
        external-dns.alpha.kubernetes.io/ttl: "60"

@@ -115,7 +92,6 @@ owls:
      - name: config
        mountPath: /owls-data/owls.properties
        subPath: owls.properties
-        # Template below will be rendered in template
        volumeDefinition: |
          secret:
            secretName: {{ include "owls.fullname" . }}-config
@@ -129,7 +105,6 @@ owls:
        volumeDefinition: |
          secret:
            secretName: {{ include "owls.fullname" . }}-certs-cas
-      # Change this if you want to use another volume type
      - name: persist
        mountPath: /owls-data/persist
        volumeDefinition: |
@@ -148,13 +123,12 @@ owls:
          secret:
            secretName: {{ include "owls.fullname" . }}-owls-restapi-tls

+
 owlsui:
  enabled: true
-
  services:
    owlsui:
      type: NodePort
-
  ingresses:
    default:
      enabled: true
@@ -162,145 +136,6 @@ owlsui:
        kubernetes.io/ingress.class: alb
        alb.ingress.kubernetes.io/scheme: internet-facing
        alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
-        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
-        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
-        external-dns.alpha.kubernetes.io/ttl: "60"
-      paths:
-      - path: /*
-        serviceName: owlsui
-        servicePort: http
-
-  podAnnotations:
-    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
-owls:
-  enabled: true
-
-  services:
-    owls:
-      type: LoadBalancer
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip"
-        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16107"
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16007,17007"
-        external-dns.alpha.kubernetes.io/ttl: "60"
-
-  podAnnotations:
-    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
-
-  resources:
-    requests:
-      cpu: 6000m
-      memory: 8000Mi
-    limits:
-      cpu: 6000m
-      memory: 8000Mi
-
-  checks:
-    owls:
-      liveness:
-        httpGet:
-          path: /
-          port: 16107
-        failureThreshold: 900
-      readiness:
-        httpGet:
-          path: /
-          port: 16107
-        failureThreshold: 900
-
-  certs:
-    restapi-ca.pem: |
-      -----BEGIN CERTIFICATE-----
-      MIIDojCCAoqgAwIBAgIUPVYBpqNbcLYygF6Mx+qxSWwQyFowDQYJKoZIhvcNAQEL
-      BQAwaTELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG1RlbGVjb20gSW5mcmEgUHJvamVj
-      dCwgSW5jLjEMMAoGA1UECxMDVElQMSYwJAYDVQQDEx1UZWxlY29tIEluZnJhIFBy
-      b2plY3QgUm9vdCBDQTAeFw0yMTA0MTMyMjQyNDRaFw0zMTA0MTMyMjM4NDZaMGkx
-      CzAJBgNVBAYTAlVTMSQwIgYDVQQKExtUZWxlY29tIEluZnJhIFByb2plY3QsIElu
-      Yy4xDDAKBgNVBAsTA1RJUDEmMCQGA1UEAxMdVGVsZWNvbSBJbmZyYSBQcm9qZWN0
-      IFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIGCibwf5u
-      AAwZ+1H8U0e3u2V+0d2gSctucoK86XwUmfe1V2a/qlCYZd29r80IuN1IIeB0naIm
-      KnK/MzXW87clF6tFd1+HzEvmlY/W4KyIXalVCTEzirFSvBEG2oZpM0yC3AefytAO
-      aOpA00LaM3xTfTqMKIRhJBuLy0I4ANUVG6ixVebbGuc78IodleqiLoWy2Q9QHyEO
-      t/7hZndJhiVogh0PveRhho45EbsACu7ymDY+JhlIleevqwlE3iQoq0YcmYADHno6
-      Eq8vcwLpZFxihupUafkd1T3WJYQAJf9coCjBu2qIhNgrcrGD8R9fGswwNRzMRMpX
-      720+GjcDW3bJAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFAJG
-      lmB5sVP2qfL3xZ8hQOTpkQH6MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsF
-      AAOCAQEAVjl9dm4epG9NUYnagT9sg7scVQEPfz3Lt6w1NXJXgD8mAUlK0jXmEyvM
-      dCPD4514n+8+lM7US8fh+nxc7jO//LwK17Wm9FblgjNFR7+anv0Q99T9fP19DLlF
-      PSNHL2emogy1bl1lLTAoj8nxg2wVKPDSHBGviQ5LR9fsWUIJDv9Bs5k0qWugWYSj
-      19S6qnHeskRDB8MqRLhKMG82oDVLerSnhD0P6HjySBHgTTU7/tYS/OZr1jI6MPbG
-      L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
-      5IOM7ItsRmen6u3qu+JXros54e4juQ==
-      -----END CERTIFICATE-----
-
-  public_env_variables:
-    SELFSIGNED_CERTS: "true"
-
-  configProperties:
-    openwifi.internal.restapi.host.0.rootca: $OWLS_ROOT/certs/restapi-certs/ca.crt
-    openwifi.internal.restapi.host.0.cert: $OWLS_ROOT/certs/restapi-certs/tls.crt
-    openwifi.internal.restapi.host.0.key: $OWLS_ROOT/certs/restapi-certs/tls.key
-    openwifi.restapi.host.0.rootca: $OWLS_ROOT/certs/restapi-certs/ca.crt
-    openwifi.restapi.host.0.cert: $OWLS_ROOT/certs/restapi-certs/tls.crt
-    openwifi.restapi.host.0.key: $OWLS_ROOT/certs/restapi-certs/tls.key
-
-  volumes:
-    owls:
-      - name: config
-        mountPath: /owls-data/owls.properties
-        subPath: owls.properties
-        # Template below will be rendered in template
-        volumeDefinition: |
-          secret:
-            secretName: {{ include "owls.fullname" . }}-config
-      - name: certs
-        mountPath: /owls-data/certs
-        volumeDefinition: |
-          secret:
-            secretName: {{ include "owls.fullname" . }}-certs
-      - name: certs-cas
-        mountPath: /owls-data/certs/cas
-        volumeDefinition: |
-          secret:
-            secretName: {{ include "owls.fullname" . }}-certs-cas
-      # Change this if you want to use another volume type
-      - name: persist
-        mountPath: /owls-data/persist
-        volumeDefinition: |
-          persistentVolumeClaim:
-            claimName: {{ template "owls.fullname" . }}-pvc
-
-      - name: restapi-certs
-        mountPath: /owls-data/certs/restapi-certs
-        volumeDefinition: |
-          secret:
-            secretName: {{ include "owls.fullname" . }}-owls-restapi-tls
-      - name: restapi-ca
-        mountPath: /usr/local/share/ca-certificates/restapi-ca-selfsigned.crt
-        subPath: ca.crt
-        volumeDefinition: |
-          secret:
-            secretName: {{ include "owls.fullname" . }}-owls-restapi-tls
-
-owlsui:
-  enabled: true
-
-  services:
-    owlsui:
-      type: NodePort
-
-  ingresses:
-    default:
-      enabled: true
-      annotations:
-        kubernetes.io/ingress.class: alb
-        alb.ingress.kubernetes.io/scheme: internet-facing
-        alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
        external-dns.alpha.kubernetes.io/ttl: "60"
--- a/chart/environment-values/values.openwifi-qa.owls-external.yaml
+++ b/chart/environment-values/values.openwifi-qa.owls-external.yaml
@@ -1,36 +1,51 @@
 # This helm values file is to be used when OWLS is run externally.
 owgw:
-  services:
-    owgw:
-      type: LoadBalancer
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip"
-        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16102"
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002"
-
  configProperties:
-    simulatorid: 53494D020202
-    storage.type: postgresql
-    storage.type.postgresql.host: owgw-pgsql
-    storage.type.postgresql.database: owgw
-    storage.type.postgresql.username: owgw
-    storage.type.postgresql.password: owgw
-    openwifi.certificates.allowmismatch: "true"
+    # done by default for owgw now:
+    #simulatorid: 53494D020202
+    # on a host with more CPUs you may need to bump this up from default of 64
+    storage.type.postgresql.maxsessions: 120
+    # this actually disables websocket logging:
+    logging.websocket: true
+    # consider lowering the # of days to keep archives in the database
+    #archiver.db.0.name = healthchecks
+    #archiver.db.0.keep = 1
+    #archiver.db.1.name = statistics
+    #archiver.db.1.keep = 1
+    #archiver.db.2.name = devicelogs
+    #archiver.db.2.keep = 1
+    #archiver.db.3.name = commandlist
+    #archiver.db.3.keep = 1

  resources:
    requests:
      cpu: 2000m
-      memory: 3000Mi
+      memory: 3Gi
    limits:
      cpu: 2000m
-      memory: 3000Mi
+      memory: 5Gi

-  postgresql:
-    enabled: true
-    fullnameOverride: owgw-pgsql
-    postgresqlDatabase: owgw
-    postgresqlUsername: owgw
-    postgresqlPassword: owgw
+owprov:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 200Mi
+    limits:
+      cpu: 100m
+      memory: 4Gi
+
+# Postgres tuning for larger # of APs
+#postgresql:
+#  primary:
+#    resourcesPreset: large
+#    persistence:
+#      size: 120Gi
+
+#kafka:
+#  controller:
+#    persistence:
+#      size: 80Gi
+#    extraConfig: |-
+#      # consider tuning this as otherwise kafka storage may be exceeded quickly
+#      # the default is 1 week!
+#      logRetentionHours = 24
--- a/chart/environment-values/values.openwifi-qa.separate-lbs.yaml
+++ b/chart/environment-values/values.openwifi-qa.separate-lbs.yaml
@@ -7,8 +7,8 @@ owgw:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16102"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002,5912,5913"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002,5913"
+        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 owsec:
  services:
@@ -19,8 +19,8 @@ owsec:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16101"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16001,17001"
+        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 owfms:
  services:
@@ -31,8 +31,8 @@ owfms:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16104"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004"
+        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 owprov:
  services:
@@ -43,8 +43,8 @@ owprov:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16105"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16005,17005"
+        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 owanalytics:
  services:
@@ -55,8 +55,8 @@ owanalytics:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16109"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16009,17009"
+        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 owsub:
  services:
@@ -67,8 +67,8 @@ owsub:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16106"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16006,17006"
+        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 haproxy:
  enabled: false
--- a/chart/environment-values/values.openwifi-qa.single-external-db.yaml
+++ b/chart/environment-values/values.openwifi-qa.single-external-db.yaml
@@ -61,12 +61,19 @@ postgresql:
  auth:
    postgresPassword: postgres
  primary:
+    # TODO: tweak this next major release - 8Gi default is a bit too low
+    #persistence:
+    #  size: 30Gi
+    # Consider using this resource model for small installations
+    #resourcesPreset: medium
    extendedConfiguration: |-
      max_connections = 550
      shared_buffers = 128MB
-    #  log_error_verbosity = verbose
    initdb:
      scriptsSecret: tip-openwifi-initdb-scripts
+    # Consider using this disk size for small installations
+    #persistence:
+    #  size: 30Gi

 postgresql-ha:
  enabled: false
--- a/chart/environment-values/values.openwifi-qa.test-nodes.yaml
+++ b/chart/environment-values/values.openwifi-qa.test-nodes.yaml
@@ -188,21 +188,6 @@ owsub:
        operator: "Exists"
        effect: "NoSchedule"

-owrrm:
-  nodeSelector:
-    env: tests
-  tolerations:
-  - key: "tests"
-    operator: "Exists"
-    effect: "NoSchedule"
-  mysql:
-    nodeSelector:
-      env: tests
-    tolerations:
-    - key: "tests"
-      operator: "Exists"
-      effect: "NoSchedule"
-
 kafka:
  nodeSelector:
    env: tests
--- a/chart/environment-values/values.openwifi-qa.yaml
+++ b/chart/environment-values/values.openwifi-qa.yaml
@@ -106,6 +106,235 @@ owgw:
      L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
      5IOM7ItsRmen6u3qu+JXros54e4juQ==
      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIFbzCCA1egAwIBAgICIjUwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+      bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+      WjAlMSMwIQYDVQQDExpPcGVuTEFOIERlbW8gQ29udHJvbGxlciBDQTCCAiIwDQYJ
+      KoZIhvcNAQEBBQADggIPADCCAgoCggIBAJauwpN+LAd/VubBpX3O3u/E5CXkmxLZ
+      di/F9zOTimAOPqfWP7K046TfbNj4twPYSzVzjawkenRkEK0yZQ1DOXmzkGWVnsih
+      gR/CA+IUUY1yCnmg6t9Dx9l5K0ZnAox90HO/ybIymcoSfRXhotuhle//eDNmGccd
+      XFsndvGdmxshaV1zN1h2POw7biCBZuypCzwvRitFfcpv3pdIk5xTt2G/yMbHPCNo
+      dUJHYHLWotridJIJ7DdhYoir5q+iSqWIqjKfDBlqCsvO7e+KidcW9ctljWspAHvl
+      B3/yHdJwJz816YTZ7r37I/DsXk9gmjj317gWRkGLMTx9fk6SiMfGW4kfUvClfg1v
+      0aRrDGPEcCagHM6ViqbW2+Tc5K38fySgNZKSTBPPI+59iAHd5RADEJDGankEYvzN
+      Le0sgB90RDjhTMleOpp5agtd2Yk/ZVjHtKfCnq13OLJfcgX76iY1Ko6AmKqiaxiE
+      V2zi9/UFVTIURT8S7JgiwF4ZNIZzHmcr4R4n5O7aSgYUlVjwFp/IEMC3ylTAX8cP
+      d4VW0p1f4D3HK7TRcaaqsERuxNh2KVtR48Au2MPGC/8YRKsz/qzH2GfsfFgjKxfF
+      z/mZYOA7913DvgVbDQoR9/6odGXZH0XDwH1e1w59dqbXBnIv2VVzElgZsPimIr+M
+      UxlZXZHMYtL3AgMBAAGjga4wgaswHwYDVR0jBBgwFoAUPMiDx7JMjfFzgDZHrR/w
+      dqeEFkMwHQYDVR0OBBYEFKqr/2rLqvEtxLDRsPCJ1L8WMr7VMA4GA1UdDwEB/wQE
+      AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6
+      Ly9kZW1vLmNlcnRpZmljYXRlLmZpL2NybC9PcGVuTEFORGVtb1Jvb3RDQS5jcmww
+      DQYJKoZIhvcNAQELBQADggIBAEyp07YjNm3WsMQo85OUcKp8kA5TJPKPxw0WgXBR
+      5RqfEV8u4b5FPJ1GjvHQqEXNxi0hlNit6oQpMafHrDSsnXR0rSquYeRBZWGig0PU
+      n8XHN8IlwsE8orGs7HkJTkQ/5Os7eGYhKCnMUyehoDHQPCPgsCawp6HnKAkntG6F
+      0AiOrhmh+ng0+9nKl6Vj11OSh9nw54G3HtQqnhWrDw8JRYp6kkzRIPcrlq/AavjW
+      g5aWBcyUSH7PscyIMGW5ICRM/5J1DXMcl/jXQhvSjv1Z6fUCrbpGyUiJ4mjmAOo+
+      M11ln5dedBRyRXEBg+0dKxe6758wWkJF2el44pgNx+xO00eKUY60lWRxkDExa6nh
+      rVRfEyvcCMfoFKBWreTyAcPyEJ0XR8wu+lfkerhYupE+m+YxUxhYywClfPdv/+m9
+      70/gKFR3IyBW+9aYl7xUapyuEYfMFA2iGD73HGqA3QcxCwxB8RFuHuVh7WUyMvJK
+      xd8qUNxVXGFzyY5qUUjt+D/OeDIHKn4uQWKpaSNdkumrTvj6/QhsstF2H0XoQv+v
+      fuI4IdnzoVVkPbf+Cyg7ZkW0Wu+sutyhsuN4eDOsiy8NxPkbRjnDQxUiNAK96Bkx
+      tDpSJgwSP4sPHfNgq6zv/Wu9IaBGIYmNsJBoKpOOITUl7n6DcsEvkcsRMJpuK60b
+      rHa2
+      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIFIDCCAwigAwIBAgICDnkwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+      bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+      WjAfMR0wGwYDVQQDDBRPcGVuTEFOIERlbW8gUm9vdCBDQTCCAiIwDQYJKoZIhvcN
+      AQEBBQADggIPADCCAgoCggIBAMjExylKdJWoJu9mOHPJ6yZFXKe1lE467G65acpS
+      2FKIWnPVFjNCmATMpkMOIFzEFwyFdbQjzOidtiL+73zlE52lOJpXCfOcxDFqDYDJ
+      J8//J1/gQWsBaKpSvgLiHU/0awkQg+yJYZpj8YZa4NkFe+zTjQScSfOsqPPb3rZ7
+      DOQ2BKAhjVShKmVbtNil0iO0zm8vE8DNkktTNMREp2pzb8MbCAgfOkwlrby6T+rV
+      3TvmjThGdFUb5lWDFxWtlF8W0SUII9qj7p5TdGpryeLsO0nZTBtS4HxZNdvmKOHf
+      gcRHmSZIJigB2NzKLNrXF9JBW0WnUSwZJZAG2C1RTx6lADILPueuusyfR/hZ3koK
+      i4PHnSiTwQghzia9K9QjNHq5z9R9ZoCnhBg1VyU4LKmp862L0sIp2vgnOYunEIi9
+      aCYBaDwo+0FuVjZuXyDIatwVuA7TN5IWPHA6XLdOt1mmkeYy1Ldr4XHjdondhtOy
+      eei1UFXmyyLm2+kmRYfTm91TqYmNzRgbRV2NHO50AmsnBknX4Rv3gishGe0+dV5y
+      FcUwZud0z2rSCkuoai5tKrPT+6Y6NqkT9u9HFifIBXnLwEzVUqHRtW6SuWj2DClV
+      QIXIUZtFnhY4GuTuf6DlzgnXO58oDVCZmCW4ULIpbqGeRsvBHR8Sw5JXP/1+TMUY
+      hE8TAgMBAAGjZjBkMB8GA1UdIwQYMBaAFDzIg8eyTI3xc4A2R60f8HanhBZDMB0G
+      A1UdDgQWBBQ8yIPHskyN8XOANketH/B2p4QWQzAOBgNVHQ8BAf8EBAMCAQYwEgYD
+      VR0TAQH/BAgwBgEB/wIBATANBgkqhkiG9w0BAQsFAAOCAgEAkHZ5KR8IOrdfMFy+
+      iOvauvZxfQ84LL6TpB2FQKDjneJUdd7c29UJJFNW/0mp4Gc6jKZab6J8Dx/pNnbH
+      0RqFjGjeRGtJ4Sk0G7gf9zw1S7qut5WJDcisM9l/wXC+zy/KSKKPQmbt0grWOtU7
+      +NNPh1YU76hIrInq/u2sVZyKH8SXQ957fbJk6BX6JTKyNEn05AB6rNSrbOWo8sy2
+      MlcJ7bBsrWYI1t6GcWFh4b36bLu7/dKJWpyFNXXIkKJsgMEDpEQae56+fSSDo0KR
+      NtYB82fNZDIQlGK81rGJWNzAahM+3GD1tgk/3ZVugfaJhcBpoHHKNOGqZAvtirLA
+      IDocno7AzqoeIz974Rh2Olsl2/arApYPyyfi8PMYuFe/d4h+Wie8n+jh5n48lZ2V
+      e4PK+j+QHD6tTZS4f0bGnPL1puMxzQloltuQWgLDeVfEgrc3snLvjOg8aDzWm/es
+      85lP8XcyW54U4t3JmrNUC2C7v+Uafx7cL7eDeunhs+BRhtGV+IUmjub2IrpqZp3z
+      Zqn+LVRdYJIy/qHhjS5+ImckXkFojOmeWhfmEmYSuNP8Oa6cGuXp829qnbxLh9Qz
+      i3TfXV883KLse4kL5Zl7gBA/4hz2hVMyGJ8fY+VvzbaTuOXyvKJ+rGZCTcRSeotB
+      LnIevVMiL7SqOEwN0j4Mfbznfq8=
+      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIFbjCCA1agAwIBAgICMJ0wDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+      bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+      WjAkMSIwIAYDVQQDExlPcGVuTEFOIERlbW8gT3BlcmF0aW5nIENBMIICIjANBgkq
+      hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4Q5dx+CWyaPxOlAGUC462FgnO4umYEqF
+      LQCuK31kgg0tBbbfaq0XApUnjH5IOMI1IGtYgZmm48q1noHaRwk4WFxxvr/dyS51
+      hAEa2GFb2S3pkG7VXAF/XYv33yyfM+1K0tyZPRm9tbBShUIfflGFjnrSwxkNhoOH
+      IIOVXxCHLBD/Aor74JAkEGtkIo30FPx2vQ+fg4rnQsm9aSffgWwWua7T590tnSMG
+      ljDMm++nCQIgONFQC7RQXeL0Ruu14FxB639oJxPmwDQhD/R5zQz/wFBhinjHuzYl
+      i0bmxHevdDQluNUxf2lHwJRy6eC/TzdRFOgDUre9kzu929skgNouM0q0y/Rpz7QU
+      bd5s1i8JnKebAqADqMT8Yz1Hph0oCvOT0Dc2joxmjGh3loolWRKufKTVe431pvdv
+      iV/rAooOSnm5Htmd8ClOADudhrheX886cSd9Z5JKucHhW34Lf1ze7uj1LjxoTh3O
+      eo7XedhjmJYcQavpQlVRLTbbY/LJHegPtqJAIvQkrwtOpe05rShl06MxO9wj0BPJ
+      0PFp/MxJd0ESDV0EM9dxWIWgXwZftowPzfj3ai5OQEazpTr1IMRehsbCn3JEJ77N
+      hCqKPaZmRtKRD9e5cu0YiGfRddr7xaXiwtPGId/ZHsNUASbv7NMDdemRv3TiFwv4
+      z8OKCm8QeisCAwEAAaOBrjCBqzAfBgNVHSMEGDAWgBQ8yIPHskyN8XOANketH/B2
+      p4QWQzAdBgNVHQ4EFgQUe/uhewyjB6GNj5Dbq9s+I5mWexMwDgYDVR0PAQH/BAQD
+      AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwRQYDVR0fBD4wPDA6oDigNoY0aHR0cDov
+      L2RlbW8uY2VydGlmaWNhdGUuZmkvY3JsL09wZW5MQU5EZW1vUm9vdENBLmNybDAN
+      BgkqhkiG9w0BAQsFAAOCAgEAoj6D9yZIbWEP3MobeV5c3KpNyH4k2Ho2keIE0nT1
+      kc2sb1pfHzcZC7qDX1QWdcuKYUctmVEw5xhIWZhOLOy4QONUSx1E5WOHvGKMPfAt
+      l5pS8C2XjiC+SP/8KvbcpYM+iopsoJx2qDLX927OaqP0J+XSMikqaOhP4LW9Fb+Z
+      aRci9Kfd5WeA76mE3b1/9RSE1xxDNv88R6I2gFiLQeDqvdwaYUdYeCWYjg6mx3GD
+      Fc3vf2j/jj606vnbUDrI8uLfL4SDvCdtlmP6IvJGRAS3e48Eao4/C72uCW4LJBxA
+      G9sP7yvFCZhBo6+xIAbU2rhZeqiJQi7uK4LjPCck4QK6N32qEVyGpksuA3GXlJGC
+      fNDQ7PNA+r4AhCKs1b5xMUJH9O40Oq3vVfH1HhcGt5Pyl0LHFg0ml5PmCpTSPLBP
+      x26EizoF7vQmCdZ7HvPPY/L4DkiY//jhp4yBLWFP5MQm9TLjZ6uEj07S/oFCa3vW
+      dScZDtJ/AuojDMoDPvrSGuDHPBg1NBvs4mICx90DKjEZNHo5l7nMT7/KF8D6v2Rt
+      dRU8vfmPo6R0wbGV6suItRPUG5qpnHL4wc/iK0hRBl4nIgH1SwE4YHlx42FJTJej
+      EGAlrLr3LG0BxQaB3JEx82lGDlxz7Y3pCk2uiaVUnqWY5HglOdxdtAaox3HBgMa9
+      tHk=
+      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIGBjCCA+6gAwIBAgICAxMwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+      bkxBTiBSb290IENBMB4XDTI1MDUxNDA4NDcyNVoXDTQ1MDUxNDA5MTcyNVowIzEh
+      MB8GA1UEAwwYT3BlbkxBTiBCaXJ0aCBJc3N1aW5nIENBMIICIjANBgkqhkiG9w0B
+      AQEFAAOCAg8AMIICCgKCAgEAqkekr6rYqlnicopx8WgKhEUctfrMD3J8jC2YshEI
+      hlVFI6lRbA9EFjv1hq0BhXhOY52lwOTOQtIgdn7HNcViSoiKqrVBYRskbhVqIA+7
+      nPhwB/4BYYZnbzCELjROHnMn/drFScNUaUvf+EDh9WmO4vZHD5xstK729RDZE51n
+      vLlFwe5O4ckekPH17r4WojoVSczkXXRhKJXV3GXdrA/epoIUn0poUM6bCjddiEbJ
+      NPknqqkS8Z9a8GYt2IX33kZD3NdHjTQRnMd7g+xroJiQ/faZ9zc0ul6l85sl1G43
+      AqriEI2aOWYhSxY7sDleuy5ggz8UA5lR6/z6ZIR8IfMSJag8aVkvxt51Gx2aDaVu
+      PixyMFoXyhKQPSP+cL3rzSF/767iXqINw4oOb83Jy77Ocwgp2cfW06KI4l4CTymy
+      83wCBEZ6pvLmjCmbz0DIg7V7yGPGjEePNyxYG0sM+aHQEpJnaib2yza9adiXlJ4s
+      M+UEMnLjEu0i8Xy15hvItgo7FYTZgWh89LIhE63HDk6qteV836K2oL9PWtVUEg9v
+      pElapnq+v+8BUsvmY6Nr8eYeAnCPyW2e49a91/vCP8B1Ydbe5ms3mYcGO3Kdx/k5
+      QWLquKnt5ZAeJ2werO/8mUabq8eyt4EH9tZzDKJvV/xbmhluKmamfSg4GHCpOUl1
+      +IcCAwEAAaOCAUswggFHMB8GA1UdIwQYMBaAFJRoW6g4+ThAsHJk/juSPinUhsIm
+      MB0GA1UdDgQWBBRO5RI5Dr0FesZ3+QQ9ugAapLBaeDAOBgNVHQ8BAf8EBAMCAYYw
+      EgYDVR0TAQH/BAgwBgEB/wIBADBHBgNVHR8EQDA+MDygOqA4hjZodHRwOi8vY3Js
+      LmNlcnRpZmljYXRlcy5vcGVuLWxhbi5vcmcvb3BlbmxhbnJvb3RjYS5jcmwwgZcG
+      CCsGAQUFBwEBBIGKMIGHMEQGCCsGAQUFBzAChjhodHRwOi8vY2VydHMuY2VydGlm
+      aWNhdGVzLm9wZW4tbGFuLm9yZy9vcGVubGFucm9vdGNhLmNlcjA/BggrBgEFBQcw
+      AYYzaHR0cDovL29jc3AuY2VydGlmaWNhdGVzLm9wZW4tbGFuLm9yZy9vcGVubGFu
+      cm9vdGNhMA0GCSqGSIb3DQEBCwUAA4ICAQBQq28kQUcK88zs5YzZ3b6Y3t77yrSF
+      lZLWsbNE/KVlvEuTIrtkRMX9PAC4tRjOpV0oxp6NdrqUKJ35gt4EKjw1vbtyXZD0
+      VQwimBv1qapZEuNe5lwNssyySAnXxUIyhCV6QVD4G9vmRPzNVtIwssjffVPjjpZ9
+      LBQdliOG3FBbcCWGuRiUMysVxHxdO2rokoFuO1ye+oURrqe9zeDtE0k9QNzAi36F
+      FhuWYQnn+2QHfTX58cpMb1Aql3yTO/pz5fQRUF/hmfTuuk+dLlkWoem55oRGfMVL
+      coAnW3We251iEawqrR9ZDgcIWlmloZFSNylpZ/iIZOIQdYFqreRo0DiSZG4kPxcW
+      RKQTSJ9F3v2j0BZan2xxaSE1tJ54IJUPUND/O6ITVQLfexVLIggRfeIAsURdhPn9
+      1KUrZu3HoIYX6kcpuhl++BQgOx3qr6RomAVDhXSGRVRQ2B76N0N1ZC+mEEhJUYbb
+      0DlZntDp7q2ZDzn6gFYOnrGhoXe55Yrx8c45wMOBZmz0Q6xzc0jydgZoAG9/20l8
+      6S9G2j+UuMYRBCSzouILsGwTloU7XR3qIuO2WbYcG+UV0o/3lVOkAk5992HPG7DT
+      hZ1qNe72WFHmtKVwfYJTcQG/TucWFvplUE3hMDMqS80tmx9TrXiRdI4R5IrTxfsS
+      znGN0LCQ5YzAAw==
+      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIGBzCCA++gAwIBAgICBAYwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+      bkxBTiBSb290IENBMB4XDTI1MDUxNDA4NTQwNVoXDTQ1MDUxNDA5MjQwNVowJDEi
+      MCAGA1UEAwwZT3BlbkxBTiBEZXZpY2UgSXNzdWluZyBDQTCCAiIwDQYJKoZIhvcN
+      AQEBBQADggIPADCCAgoCggIBALrPh3nxxKWaPQbcQeZdihRrGwJNYgdrzz/YAsss
+      EbKXYKAOwb/EJKSv52eUysI59lcvfJrsqn4wyUaXQvgYxJUatCSpmCCKEzftgudS
+      UAlPY8L/4qeqUvxz6CN3qiKivxQ31Z7SJTLgR7OTXxk5ckXHkc8QPB2GPWkU3BzV
+      RbBNKcVxwMK6JaZbB0ZlR6r1ImnLnsDUI0qkgSV8NBO7bJd1yvqfn04yc0/pIo+1
+      9uX/gh7AA0RsZeXw1SO3wCfUO5Cr65X+MW2T3LsbnBPbKOqHnF0YWJGx5RPOWVIS
+      wudAy4zlqdwPInrb4BCMkJUoZlRhhx7vvNmP9HwNwCp8+COjE77caAEAi+0VHamY
+      spu9IgDZCr5FmgHBMu9WiaWpB3RxxbFa6UdVl3sMzRFS6SEHhs6RCAXwQj7KiZLf
+      tb3UCRps5XMlhmjAApyDKsJEXKnd5cSpSYxCQQlOB9BCG6QVc6vQLdu/uq8X6Z+2
+      0EcP7NVyzMDgHdozp4jP+M4Sow6pv7KE4SZaBfpbgM+Ht22sYoBwMouRYbzSAhJS
+      8qBH+IiDqwMRWyox8TuhCsn9WJr9t6l8p3O1pUB0IccraUTVo7XydZWaprtrvMTf
+      RtudowCxea9Iz6md9zlqNZAQu2QNUpH9YQT408N02qukp2uaAGvQjbSfAtnWduTD
+      F6AbAgMBAAGjggFLMIIBRzAfBgNVHSMEGDAWgBSUaFuoOPk4QLByZP47kj4p1IbC
+      JjAdBgNVHQ4EFgQUVRP31JMaQoUd6psw0tjQpKbhmvUwDgYDVR0PAQH/BAQDAgGG
+      MBIGA1UdEwEB/wQIMAYBAf8CAQAwRwYDVR0fBEAwPjA8oDqgOIY2aHR0cDovL2Ny
+      bC5jZXJ0aWZpY2F0ZXMub3Blbi1sYW4ub3JnL29wZW5sYW5yb290Y2EuY3JsMIGX
+      BggrBgEFBQcBAQSBijCBhzBEBggrBgEFBQcwAoY4aHR0cDovL2NlcnRzLmNlcnRp
+      ZmljYXRlcy5vcGVuLWxhbi5vcmcvb3BlbmxhbnJvb3RjYS5jZXIwPwYIKwYBBQUH
+      MAGGM2h0dHA6Ly9vY3NwLmNlcnRpZmljYXRlcy5vcGVuLWxhbi5vcmcvb3Blbmxh
+      bnJvb3RjYTANBgkqhkiG9w0BAQsFAAOCAgEALMFsYRqB8NDMMWZV8NqbjNT5QA3Y
+      O3ODxYOuFC4NjSzUSh3Lh73f5+Ec4slQNFuOQeqhqFJaDAPIxUI5ekKtVjzmt7St
+      crbW1dE47+ZHkPXrWVRwRmlV1qP5TqS5oTH6dvpEpEcSxT/IKGQB1cwQ1C+Qp3dd
+      3rZnylXfL5dimIpKDGHYqiHyltktlv3uMWnQhUwrKjt2GW0TnF7bVJ0OJko7aDL7
+      wdY0TGUH9eLQOoz/a0e9sKSsqOxrq9grN7npbUHOr23CdQBnSjF1Q5dXKvza8kRj
+      +agDJW5h/fyBvZ5I4U6m4jFyUnAKso6Xd0+feejPCH7f6kYY+pT7NKO4dVqaRLrj
+      yDmtXGsMza6C0h8wBgYwg4d7jxTqOx6iJfJLyLGWKT94HeChiWOL2X0HpF+Gn9Uf
+      C7rtLO4QwQzGHdEGyFlw/pBTs6g3wTYVv7ZZfh8DJ9PIedqJmUdwMVE89ThEpu4Z
+      q1bFfqENwDmrj2erS3fweEY3G+w2m8f24tJiLWOW/hBRcR3fm+73C8svmtwVGo5Q
+      2i6yJxQ12Q42oa1sfsohr22J2NxotqbQz0gq1J9QparEJ5qUjMKkO9Rj3s24KW2t
+      E6WIb5d1WpIxownlqOgFE7FftxXmQdJNJ2t4XyUMWhwXbOxfc2RlLek0LtnHPA8N
+      hCFqyfjUtMPqafk=
+      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIFFTCCAv2gAwIBAgICAxIwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+      bkxBTiBSb290IENBMCAXDTI1MDUxNDA4NDcxMFoYDzIwNTUwNTE0MDg0NzEwWjAa
+      MRgwFgYDVQQDDA9PcGVuTEFOIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+      DwAwggIKAoICAQDGibJ04A55kSURTBSKgcBmLnND2I5wws1taKqqU9aaRhB7NtvM
+      Hwh2voH9b1brUiulZaZwTN/9kzd4AnXeKQ+0u5tV7Ofk0fzF2MK47n17TS30Yenq
+      c4NuQEKdpKK/pM3VvOEppR/bqtgyLtDmbDnmFOx+zTj/+smTgouwA+Iier0P4s5O
+      ohYxn/bjOqwQbHbU79VpGBIWv6/kt55AhH7zvsqqKHkrzTxnsRBv3SBIufrjJr9P
+      IhZBLDrqr56P6KgAi0eoutNt2ToiJbE0WfjU7GI1RSiSN5bGj1zXhjNVzQWs1H9Q
+      zRf3c9pl3+haHQZ7FZ1UqiTRewmbNrQ6I9k81au3SttUlb87MyAuDSzatkiq7CjQ
+      8VE1J6te6ZBt2zWpUhHsR/Lg7g3eOw5dL4oZJdK5GgGu/MUajLUXifIqM13Mvg0V
+      TzDhN69VLXLSL0gPcicsQCwJuAza1IC/VqmBGx19fAkyJhOurCXWOgisi0g1+xzP
+      KRphUNwMPUf8vBVOM/Vc6xDIvwVGE3+eWXyhixneFlSpAI03nWWjpwWXihTBoxbf
+      RXO3Y/ilJqrgFN+U4PJcCPA+Wo7ThH0mgX6bOTPcgXMUzT3v3FF6Bx5/PNV3kYrw
+      2yLzribUiS6AGvVGnW4hX2Z6OQvA/aHME8KF+6y6m4pC7FkUjVaRlzWu/wIDAQAB
+      o2MwYTAfBgNVHSMEGDAWgBSUaFuoOPk4QLByZP47kj4p1IbCJjAdBgNVHQ4EFgQU
+      lGhbqDj5OECwcmT+O5I+KdSGwiYwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
+      MAMBAf8wDQYJKoZIhvcNAQELBQADggIBAB+/RUC2X6eVoPsFNMkaXO5Iib/ub0Jo
+      WhODQm8j2Mr5dpGXESSpXjfDcqDOLuJbWWoflXBLdr8BsVCBqOA9YgCX0H8Br7dU
+      WmCScixxLW0he592/424EvdwifxcKHZLjv9CKV5Txhqnm2djc5RY/nTH5MYVrIh/
+      If2TNO5ydDP6+vgy9GQ4en04VK7rz+PW17O8l7k9/lOmYptZmHgSDAPj/cT3PlG+
+      McqaI5rMSHeEHlzH+PvgWjtSeEhF4FwFBXroDl4/yb4l2JB8bqAZ3vsOXSkigFcZ
+      h5MXPe+zuSSW+G8iLr4xoi0CFsP2DaHEyxgqP4B1FtE9nFPo6cvWbwqTVT7QSzqf
+      H+jPJuQvpFXeRF5UFegNZTFT5/uFFPamihakFslEYxeJey1y+OJdLcP6ef87ruSt
+      8amsq56OAETYpnW4JFowlEh0C+QwLGHGGY6WrOgHY/90hJmPgXBdBVg/IoOhzbvk
+      5A+LqZDvxV2/rLNfClw8Kr3g5e8obcB6dWgMCy2z+us0H79ucnmhzQKsjpxM9T1n
+      cHovAQfiD3jVqfHULY53avh0wIAjosoTGbe8dyx80quHe+16qWan7C9idXeAYYJX
+      bZt5hs6hLw4I8M1LsjTg6vwsqiaHZpsmDyyQLdFjNJldG7aosfS9F+BIpuwijF+1
+      dashL0CPsbIJ
+      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIGBzCCA++gAwIBAgICCQYwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+      bkxBTiBSb290IENBMB4XDTI1MDUxNDA4NTY0MVoXDTQ1MDUxNDA5MjY0MVowJDEi
+      MCAGA1UEAwwZT3BlbkxBTiBTZXJ2ZXIgSXNzdWluZyBDQTCCAiIwDQYJKoZIhvcN
+      AQEBBQADggIPADCCAgoCggIBALSdJpzwPfQM9oHBGt6w8UDLDJNznxI7cpfl0u0x
+      VCHN1YY7onpwxFVkFRzUx/JrQ/tbEGZH19XtngaCZ91KbGbqVao9S32H0tyn2t3e
+      TJ5h+klJ7+7YAbZr8UfOi3nG4bZzNSa5dDBPaNPvI51byKDN7siXXnALV3f0l6lZ
+      gDpLQco/E7ANU3lslUVjVNALfFUEonDyP7XV+lFAyidpjIn6dRn7oYs3SUwkzZUn
+      tYJAhAykmxXMWox+85gDkdb+2O3G8ci0uHVbb0A9LP+MeIhzxHgnnAMfWLfEZexd
+      mEd2PwVHaz/D2Xp/gYrpPDTsbqWjQ9NmgdASwqN5j8BuJ8vHDVBVCztVDltm6JPw
+      3Y6GQPN1LmiSLUzst7VYpydUJRDHYIAKJhT9DYxQ126VfiyMo6Xl4IQO8YZ/J6r8
+      yR7gyvyUiBW+wvvC1bCY5+VuI4P/cY+6iA1qwC1SOWjYlccy+tbfGj9zr32Qf27e
+      9RXSAkcATHen1rc/9AGEeAuSpKrzhmZIIvM4+EtYgbBvf91NkP51zbGpvsAbfWN/
+      ecNmqH9SeyrrVgv68Z34hMijCcvJNyIvloo3nkb/gHYV4tAiwTTrX13Rio/8qNF4
+      nwHLsjw0t7jEyRiXdOciePyhGbtdicuiUxrShzbGY7ID0yNwyTKcJYhorL/8r+YF
+      psXrAgMBAAGjggFLMIIBRzAfBgNVHSMEGDAWgBSUaFuoOPk4QLByZP47kj4p1IbC
+      JjAdBgNVHQ4EFgQUBwUkiaCh5hdY+ZH6O8NmEE/nH5EwDgYDVR0PAQH/BAQDAgGG
+      MBIGA1UdEwEB/wQIMAYBAf8CAQAwRwYDVR0fBEAwPjA8oDqgOIY2aHR0cDovL2Ny
+      bC5jZXJ0aWZpY2F0ZXMub3Blbi1sYW4ub3JnL29wZW5sYW5yb290Y2EuY3JsMIGX
+      BggrBgEFBQcBAQSBijCBhzBEBggrBgEFBQcwAoY4aHR0cDovL2NlcnRzLmNlcnRp
+      ZmljYXRlcy5vcGVuLWxhbi5vcmcvb3BlbmxhbnJvb3RjYS5jZXIwPwYIKwYBBQUH
+      MAGGM2h0dHA6Ly9vY3NwLmNlcnRpZmljYXRlcy5vcGVuLWxhbi5vcmcvb3Blbmxh
+      bnJvb3RjYTANBgkqhkiG9w0BAQsFAAOCAgEAqEk5ZJdpMVr2U0YhmqEU6gqxEeih
+      9MWKcQfmsT/lhf5m5V7VuLMc3r+EBCsPssw60umdQcAU2IPlJXLAeWwdRyY7ZNNw
+      QVgl9GBI/CM2b7x18+12/llCdXW9FOagdChTuuhwRnGTt71jcrJkleQyEYhqwwIE
+      N82hxq4HSZO6XJDev4IsMRF00+qt8biJcf7OVGOSLoyiU6Dm/EzxoB+DZf3HdUc0
+      vzfVjD4Im+yYzqXuwWV6c9oIBQH6obzaqlpg926CtEBFR8E1LQe93ahMvF7pExpI
+      OkE5PTuqONvy7Xn3Ui8NRxHhmm8j/unql6bUTGENz9s68n8Im7weq6awC9Hfu8aG
+      WjcnXI7tsDY5uJEguP5fSwCUrdTE85XgPgPHeKaIwBZsyRZTqVSvbky+c15Yv6IT
+      XLWoA0AUxz9ste3WpqiWCNJVI90MCruSYKdpXGV0KU3QQXJDMKhHJBF5DLpuKibo
+      Ffh9O8pB7B4/tJ76JpAc6Z0rfaQUo2vxSpb3Sbd/IHNcL08zB8Ay+YUBULspxe+1
+      StKthmCzCHI9DOhIgeASyNBpcL7uZPjCXiYGhUuzsFGv4sQ+d267Jyvql/Piw/vY
+      g1k2aVBfdIoIU4TpIEVyQqPz4aAW+0SgL7OM+/zD9jxn3gVdusCpmHcoTzOfZRri
+      H0FGIeDSQydpOJU=
+      -----END CERTIFICATE-----
    issuer.pem: |
      -----BEGIN CERTIFICATE-----
      MIIEnDCCA4SgAwIBAgIUVpyCUx1MUeUwxg+7I1BvGFTz7HkwDQYJKoZIhvcNAQEL
@@ -357,7 +586,6 @@ owgwui:
    default:
      enabled: true
      annotations:
-        kubernetes.io/ingress.class: alb
        alb.ingress.kubernetes.io/scheme: internet-facing
        alb.ingress.kubernetes.io/group.name: wlan-cicd
        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
@@ -522,7 +750,6 @@ owprov:
    openwifi.restapi.host.0.rootca: $OWPROV_ROOT/certs/restapi-certs/ca.crt
    openwifi.restapi.host.0.cert: $OWPROV_ROOT/certs/restapi-certs/tls.crt
    openwifi.restapi.host.0.key: $OWPROV_ROOT/certs/restapi-certs/tls.key
-    rrm.providers: owrrm

  volumes:
    owprov:
@@ -565,7 +792,6 @@ owprovui:
    default:
      enabled: true
      annotations:
-        kubernetes.io/ingress.class: alb
        alb.ingress.kubernetes.io/scheme: internet-facing
        alb.ingress.kubernetes.io/group.name: wlan-cicd
        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
@@ -745,99 +971,55 @@ owsub:
          secret:
            secretName: {{ include "owsub.fullname" . }}-owsub-restapi-tls

-owrrm:
-  fullnameOverride: owrrm
-
-  services:
-    owrrm:
-      type: LoadBalancer
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip"
-        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16789"
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c"
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16789,16790"
-
-  resources:
-    requests:
-      cpu: 1000m
-      memory: 2048Mi
-    limits:
-      cpu: 1000m
-      memory: 2048Mi
-
-  podAnnotations:
-    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
-
-  public_env_variables:
-    SELFSIGNED_CERTS: "true"
-    SERVICECONFIG_PRIVATEENDPOINT: http://owrrm-owrrm:16789
-    KAFKACONFIG_BOOTSTRAPSERVER: kafka:9092
-    DATABASECONFIG_DBNAME: owrrm
-    DATABASECONFIG_DATARETENTIONINTERVALDAYS: "1"
-    # Empty string will disable DB usage
-    DATABASECONFIG_SERVER: ""
-    # Uncomment these parameters to enable DB usage + enable mysql below
-    #DATABASECONFIG_SERVER: owrrm-mysql:3306
-
-  secret_env_variables:
-    DATABASECONFIG_USER: root
-    DATABASECONFIG_PASSWORD: openwifi
-
-  volumes:
-    owrrm:
-      - name: persist
-        mountPath: /owrrm-data/
-        volumeDefinition: |
-          persistentVolumeClaim:
-            claimName: {{ template "owrrm.fullname" . }}-pvc
-
-      - name: restapi-ca
-        mountPath: /usr/local/share/ca-certificates/restapi-ca-selfsigned.crt
-        subPath: ca.crt
-        volumeDefinition: |
-          secret:
-            secretName: {{ include "owrrm.fullname" . }}-owrrm-restapi-tls
-
-  mysql:
-    enabled: false
-    fullnameOverride: "owrrm-mysql"
-
-    resources:
-      requests:
-        cpu: 100m
-        memory: 512Mi
-      limits:
-        cpu: 100m
-        memory: 512Mi
-
 kafka:
+  volumePermissions:
+    enabled: true
  commonAnnotations:
    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
-  heapOpts: -Xmx512m -Xms512m
-  resources:
-    requests:
-      cpu: 100m
-      memory: 512Mi
-    limits:
-      cpu: 500m
-      memory: 1Gi
  readinessProbe:
    initialDelaySeconds: 45
  livenessProbe:
    initialDelaySeconds: 60
+  heapOpts: -Xmx1024m -Xms1024m
+  kraft:
+    enabled: true
  zookeeper:
-    commonAnnotations:
-      cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
-    heapSize: 256
+    enabled: false
+  controller:
+    replicaCount: 1
+    persistence:
+      size: 20Gi
+    extraConfig: |-
+      maxMessageBytes = 1048588
+      offsets.topic.replication.factor = 1
+      transaction.state.log.replication.factor = 1
+    extraEnvVars:
+      - name: ALLOW_PLAINTEXT_LISTENER
+        value: "yes"
    resources:
      requests:
-        cpu: 100m
-        memory: 256Mi
+        cpu: 500m
+        memory: 512Mi
      limits:
-        cpu: 200m
-        memory: 384Mi
+        cpu: 750m
+        memory: 2Gi
+  listeners:
+    client:
+      protocol: PLAINTEXT
+      containerPort: 9092
+    controller:
+      protocol: "PLAINTEXT"
+  broker:
+    persistence:
+      size: 20Gi
+    replicaCount: 0
+    resources:
+      requests:
+        cpu: 500m
+        memory: 512Mi
+      limits:
+        cpu: 750m
+        memory: 2Gi

 clustersysteminfo:
  enabled: true
@@ -846,17 +1028,16 @@ clustersysteminfo:
 haproxy:
  resources:
    requests:
-      cpu: 10m
-      memory: 20Mi
+      cpu: 50m
+      memory: 50Mi
    limits:
-      cpu: 10m
-      memory: 20Mi
+      cpu: 50m
+      memory: 50Mi
  service:
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "8080"
      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,5913,16001,17001,16009,16006,17006"
      service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip

--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -48,23 +48,23 @@ owsub:
    openwifi.kafka.enable: "true"
    openwifi.kafka.brokerlist: kafka:9092

-# OpenWIFI radio resource management (https://github.com/Telecominfraproject/wlan-cloud-rrm/)
-owrrm:
-  fullnameOverride: owrrm
-  mysql:
-    enabled: true
-
 # kafka (https://github.com/bitnami/charts/blob/master/bitnami/kafka/)
 kafka:
  enabled: true
  fullnameOverride: kafka
  image:
-    registry: docker.io
-    repository: bitnami/kafka
-    tag: 2.8.0-debian-10-r43
-  minBrokerId: 100
-  zookeeper:
-    fullnameOverride: zookeeper
+    repository: bitnamilegacy/kafka
+  volumePermissions:
+    image:
+      repository: bitnamilegacy/os-shell
+  autoDiscovery:
+    volumePermissions:
+      image:
+        repository: bitnamilegacy/kubectl
+  metrics:
+    jmx:
+      image:
+        repository: bitnamilegacy/jmx-exporter

 # clustersysteminfo check
 clustersysteminfo:
@@ -73,7 +73,7 @@ clustersysteminfo:
  images:
    clustersysteminfo:
      repository: tip-tip-wlan-cloud-ucentral.jfrog.io/clustersysteminfo
-      tag: main
+      tag: v4.2.0-RC1
      pullPolicy: Always
 #      regcred:
 #        registry: tip-tip-wlan-cloud-ucentral.jfrog.io
@@ -121,6 +121,8 @@ owlsui:

 # HAproxy (https://github.com/bitnami/charts/tree/master/bitnami/haproxy)
 haproxy:
+  image:
+    repository: bitnamilegacy/haproxy
  enabled: true
  fullnameOverride: proxy
  replicaCount: 1
@@ -412,10 +414,17 @@ restapiCerts:
    - owls-owls
    - owanalytics-owanalytics
    - owsub-owsub
-    - owrrm-owrrm
  clusterDomain: cluster.local

 postgresql:
+  image:
+    repository: bitnamilegacy/postgresql
+  volumePermissions:
+    image:
+      repository: bitnamilegacy/os-shell
+  metrics:
+    image:
+      repository: bitnamilegacy/postgres-exporter
  enabled: false
  nameOverride: pgsql
  fullnameOverride: pgsql
@@ -430,6 +439,18 @@ postgresql:
      - owsub

 postgresql-ha:
+  postgresql:
+    image:
+      repository: bitnamilegacy/postgresql-repl
+  pgpool:
+    image:
+      repository: bitnamilegacy/pgpool
+  volumePermissions:
+    image:
+      repository: bitnamilegacy/os-shell
+  metrics:
+    image:
+      repository: bitnamilegacy/postgres-exporter
  enabled: false
  nameOverride: pgsql
  fullnameOverride: pgsql
--- a/docker-compose/.env
+++ b/docker-compose/.env
@@ -1,19 +1,21 @@
-# Image tags
 COMPOSE_PROJECT_NAME=openwifi
-OWGW_TAG=master
-OWGWUI_TAG=main
-OWSEC_TAG=main
-OWFMS_TAG=main
-OWPROV_TAG=main
-OWPROVUI_TAG=main
-OWANALYTICS_TAG=main
-OWSUB_TAG=main
-KAFKA_TAG=2.8.0-debian-10-r43
-ZOOKEEPER_TAG=3.8
+# set either default, selfsigned or letsencrypt
+# if not default then please look at .env.letsencrypt or .env.selfsigned
+# instead for configuration!
+DEPLOY_TYPE=default
+
+# Image tags
+OWGW_TAG=v4.2.0-RC1
+OWGWUI_TAG=v4.2.0-RC1
+OWSEC_TAG=v4.1.0
+OWFMS_TAG=v3.2.0
+OWPROV_TAG=v4.1.0
+OWPROVUI_TAG=v4.0.0
+OWANALYTICS_TAG=v3.2.0
+OWSUB_TAG=v3.2.0
+
+KAFKA_TAG=3.7-debian-12
 POSTGRESQL_TAG=15.0
-MYSQL_TAG=latest
-# NOTE currently OWRRM is only supported in LB installations
-#OWRRM_TAG=main

 # Microservice root/config directories
 OWGW_ROOT=/owgw-data
@@ -36,4 +38,3 @@ INTERNAL_OWFMS_HOSTNAME=owfms.wlan.local
 INTERNAL_OWPROV_HOSTNAME=owprov.wlan.local
 INTERNAL_OWANALYTICS_HOSTNAME=owanalytics.wlan.local
 INTERNAL_OWSUB_HOSTNAME=owsub.wlan.local
-#INTERNAL_OWRRM_HOSTNAME=owrrm.wlan.local
--- a/docker-compose/.env.letsencrypt
+++ b/docker-compose/.env.letsencrypt
@@ -1,19 +1,19 @@
-# Image tags
 COMPOSE_PROJECT_NAME=openwifi
-OWGW_TAG=master
-OWGWUI_TAG=main
-OWSEC_TAG=main
-OWFMS_TAG=main
-OWPROV_TAG=main
-OWPROVUI_TAG=main
-OWANALYTICS_TAG=main
-OWSUB_TAG=main
-OWRRM_TAG=main
-KAFKA_TAG=2.8.0-debian-10-r43
-ZOOKEEPER_TAG=3.8
+
+# Image tags
+OWGW_TAG=v4.2.0-RC1
+OWGWUI_TAG=v4.2.0-RC1
+OWSEC_TAG=v4.1.0
+OWFMS_TAG=v3.2.0
+OWPROV_TAG=v4.1.0
+OWPROVUI_TAG=v4.0.0
+OWANALYTICS_TAG=v3.2.0
+OWSUB_TAG=v3.2.0
+
+KAFKA_TAG=3.7-debian-12
+POSTGRESQL_TAG=15.0
 ACMESH_TAG=latest
-TRAEFIK_TAG=latest
-MYSQL_TAG=latest
+TRAEFIK_TAG=v3.1.0

 # Microservice root/config directories
 OWGW_ROOT=/owgw-data
@@ -39,5 +39,5 @@ INTERNAL_OWPROVUI_HOSTNAME=owprov-ui.wlan.local
 INTERNAL_OWANALYTICS_HOSTNAME=owanalytics.wlan.local
 INTERNAL_RTTYS_HOSTNAME=rttys.wlan.local
 INTERNAL_OWSUB_HOSTNAME=owsub.wlan.local
-INTERNAL_OWRRM_HOSTNAME=owrrm.wlan.local
 SDKHOSTNAME=
+#SDKHOSTNAME=openwifi.example.com
--- a/docker-compose/.env.selfsigned
+++ b/docker-compose/.env.selfsigned
@@ -1,19 +1,19 @@
-# Image tags
 COMPOSE_PROJECT_NAME=openwifi
-OWGW_TAG=master
-OWGWUI_TAG=main
-OWSEC_TAG=main
-OWFMS_TAG=main
-OWPROV_TAG=main
-OWPROVUI_TAG=main
-OWANALYTICS_TAG=main
-OWSUB_TAG=main
-OWRRM_TAG=main
-KAFKA_TAG=2.8.0-debian-10-r43
-ZOOKEEPER_TAG=3.8
+
+# Image tags
+OWGW_TAG=v4.2.0-RC1
+OWGWUI_TAG=v4.2.0-RC1
+OWSEC_TAG=v4.1.0
+OWFMS_TAG=v3.2.0
+OWPROV_TAG=v4.1.0
+OWPROVUI_TAG=v4.0.0
+OWANALYTICS_TAG=v3.2.0
+OWSUB_TAG=v3.2.0
+
+KAFKA_TAG=3.7-debian-12
+POSTGRESQL_TAG=15.0
 ACMESH_TAG=latest
 TRAEFIK_TAG=latest
-MYSQL_TAG=latest

 # Microservice root/config directories
 OWGW_ROOT=/owgw-data
@@ -38,4 +38,3 @@ INTERNAL_OWPROV_HOSTNAME=owprov.wlan.local
 INTERNAL_OWPROVUI_HOSTNAME=owprov-ui.wlan.local
 INTERNAL_OWANALYTICS_HOSTNAME=owanalytics.wlan.local
 INTERNAL_OWSUB_HOSTNAME=owsub.wlan.local
-INTERNAL_OWRRM_HOSTNAME=owrrm.wlan.local
--- a/docker-compose/README.md
+++ b/docker-compose/README.md
@@ -1,10 +1,10 @@
 # OpenWifi SDK Docker Compose
+
 ### Overview
 With the provided Docker Compose files you can instantiate a deployment of the OpenWifi microservices and related components. The repository contains a self-signed certificate and a TIP-signed gateway certificate which are valid for the `*.wlan.local` domain. You also have the possibility to either generate and use Let's Encrypt certs or provide your own certificates. Furthermore the deployments are split by whether Traefik is used as a reverse proxy/load balancer in front of the microservices or if they are exposed directly on the host. The advantage of using the deployments with Traefik is that you can use Let's Encrypt certs (automatic certificate generation and renewal) and you have the ability to scale specific containers to multiple replicas.
 The repository also contains a separate Docker Compose deployment to set up the [OWLS microservice](https://github.com/Telecominfraproject/wlan-cloud-owls) and related components for running a load simulation test against an existing controller.
 - [Non-LB deployment with self-signed certificates](#non-lb-deployment-with-self-signed-certificates)
 - [Non-LB deployment with own certificates](#non-lb-deployment-with-own-certificates)
- [Non-LB deployment with PostgreSQL](#non-lb-deployment-with-postgresql)
 - [LB deployment with self-signed certificates](#lb-deployment-with-self-signed-certificates)
 - [LB deployment with Let's Encrypt certificates](#lb-deployment-with-letsencrypt-certificates)
 - [OWLS deployment with self-signed certificates](owls/README.md)
@@ -13,92 +13,21 @@ The repository also contains a separate Docker Compose deployment to set up the
 ### Configuration
 Config files for the microservices are generated on every startup based on the environment variables in the microservice specific env files. For an overview of the supported configuration properties have a look into these files. For an explanation of the configuration properties please see the README in the respective microservice repository.
 Be aware that local changes to the config files will be overwritten on every startup if `TEMPLATE_CONFIG` is set to `true` in the microservice env files. If you want to bind mount your own config file or make local changes, please set this variable to `false`.
+
 #### Required password changing on the first startup
 One important action that must be done before using the deployment is changing password for the default user in owsec as described in [owsec docs](https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/tree/main#changing-default-password). Please use these docs to find the actions that must be done **after** the deployment in order to start using your deployment.
+
 ### Ports
 Every OpenWifi service is exposed via a separate port either directly on the host or through Traefik. For an overview of the exposed ports have a look into the deployment specific Docker Compose file. If you use your own certificates, you can also configure different hostnames for the microservices.
 Please note that the OWProv-UI is exposed on port `8080(HTTP)/8443(HTTPS)` by default.
+
 ### owsec templates and wwwassets
 On the startup of owsec directories for wwwassets and mailer templates are created from the base files included in Docker image. After the initial startup you may edit those files as you wish in the [owsec-data/persist](./owsec-data/persist) directory.
-## Non-LB deployment with self-signed certificates
-1. Switch into the project directory with `cd docker-compose/`.
-2. Add an entry for `openwifi.wlan.local` in your hosts file which points to `127.0.0.1` or whatever the IP of the host running the deployment is.
-3. Spin up the deployment with `docker-compose up -d`.
-4. Check if the containers are up and running with `docker-compose ps`.
-5. Add SSL certificate exceptions in your browser by visiting https://openwifi.wlan.local:16001, https://openwifi.wlan.local:16002, https://openwifi.wlan.local:16004, https://openwifi.wlan.local:16005, https://openwifi.wlan.local:16006 and https://openwifi.wlan.local:16009.
-6. Connect to your AP via SSH and add a static hosts entry in `/etc/hosts` for `openwifi.wlan.local`. This should point to the address of the host the Compose deployment runs on.
-7. Login to the UI `https://openwifi.wlan.local` and follow the instructions to change your default password.
-8. To use the curl test scripts included in the microservice repositories set the following environment variables:
-```
-export OWSEC="openwifi.wlan.local:16001"
-export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-compose/certs/restapi-ca.pem"
-```
-⚠️**Note**: When deploying with self-signed certificates you can not use the 'Trace' and 'Connect' features in the UI since the AP will throw a TLS error. Please use the Let's Encrypt deployment or provide your own valid certificates if you want to use these features.
-## Non-LB deployment with own certificates
-1. Switch into the project directory with `cd docker-compose/`. Copy your websocket and REST API certificates into the `certs/` directory. Make sure to reference the certificates accordingly in the service config if you use different file names or if you want to use different certificates for the respective microservices.
-2. Adapt the following hostname and URI variables according to your environment:
-### .env
-| Variable                        | Description                                                                        |
-| ------------------------------- | ---------------------------------------------------------------------------------- |
-| `INTERNAL_OWGW_HOSTNAME`        | Set this to your OWGW hostname, for example `owgw.example.com`.                    |
-| `INTERNAL_OWSEC_HOSTNAME`       | Set this to your OWSec hostname, for example `owsec.example.com`.                  |
-| `INTERNAL_OWFMS_HOSTNAME`       | Set this to your OWFms hostname, for example `owfms.example.com`.                  |
-| `INTERNAL_OWPROV_HOSTNAME`      | Set this to your OWProv hostname, for example `owprov.example.com`.                |
-| `INTERNAL_OWANALYTICS_HOSTNAME` | Set this to your OWAnalytics hostname, for example `owanalytics.example.com`.      |
-| `INTERNAL_OWSUB_HOSTNAME`       | Set this to your OWSub hostname, for example `owsub.example.com`.                  |
-| `INTERNAL_OWRRM_HOSTNAME`       | Set this to your OWRRM hostname, for example `owrrm.example.com`.                  |
-### owgw.env
-| Variable                                 | Description                                                                         |
-| ---------------------------------------- | ----------------------------------------------------------------------------------- |
-| `FILEUPLOADER_HOST_NAME`                 | Set this to your OWGW fileupload hostname, for example `owgw.example.com`.          |
-| `FILEUPLOADER_URI`                       | Set this to your OWGW fileupload URL, for example `https://owgw.example.com:16003`. |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWGW REST API URL, for example `https://owgw.example.com:16002`.   |
-| `RTTY_SERVER`                            | Set this to your OWGW RTTYS hostname, for example `owgw.example.com`.               |
-| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
-### owgw-ui.env
-| Variable                    | Description                                                                |
-| --------------------------- | -------------------------------------------------------------------------- |
-| `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
-### owsec.env
-| Variable                                 | Description                                                                         |
-| ---------------------------------------- | ----------------------------------------------------------------------------------- |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
-| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
-### owfms.env
-| Variable                                 | Description                                                                         |
-| ---------------------------------------- | ----------------------------------------------------------------------------------- |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWFms URL, for example `https://owfms.example.com:16004`. |
-| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
-### owprov.env
-| Variable                                 | Description                                                                           |
-| ---------------------------------------- | ------------------------------------------------------------------------------------- |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWProv URL, for example `https://owprov.example.com:16005`. |
-| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.              |
-### owprov-ui.env
-| Variable                    | Description                                                                |
-| --------------------------- | -------------------------------------------------------------------------- |
-| `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
-### owanalytics.env
-| Variable                                 | Description                                                                            |
-| ---------------------------------------- | -------------------------------------------------------------------------------------- |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWAnalytics URL, for example `https://owanalytics.example.com:16009`. |
-| `SYSTEM_URI_UI`                          | Set this to your OWProv-UI URL, for example `https://owprov-ui.example.com`.           |
-### owrrm.env
-| Variable                                 | Description                                                                                     |
-| ---------------------------------------- | ----------------------------------------------------------------------------------------------- |
-| `SERVICECONFIG_PRIVATEENDPOINT`, `SERVICECONFIG_PUBLICENDPOINT` | Set this to your OWRRM URL, for example https://owrrm.example.com:16789. |
-| `DATABASECONFIG_PASSWORD`                                       | Set this to a random and safe password.                                  |
-### mysql.env
-| Variable                                 | Description                                      |
-| ---------------- | ------------------------------------------------------------------------ |
-| `MYSQL_PASSWORD` | Set this to the same value as `$DATABASECONFIG_PASSWORD` in `owrrm.env`. |

-3. Spin up the deployment with `docker-compose up -d`.
-4. Check if the containers are up and running with `docker-compose ps`.
-5. Login to the UI and and follow the instructions to change your default password.
-## Non-LB deployment with PostgreSQL
-1. Switch into the project directory with `cd docker-compose/`.
-2. Set the following variables in the env files and make sure to uncomment the lines. It is highly recommended that you change the DB passwords to some random string.
+## PostgreSQL
+PostgreSQL is used by default for the database for all components.
+The following variables may be set in the env files. It is highly recommended that you change the DB passwords to some random string. The defaults are shown here.
+
 ### owgw.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -107,6 +36,7 @@ export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-comp
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owgw`            |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owgw`            |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owgw`            |
+
 ### owsec.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -115,6 +45,7 @@ export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-comp
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owsec`           |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owsec`           |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owsec`           |
+
 ### owfms.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -123,6 +54,7 @@ export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-comp
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owfms`           |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owfms`           |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owfms`           |
+
 ### owprov.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -131,6 +63,7 @@ export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-comp
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owprov`          |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owprov`          |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owprov`          |
+
 ### owanalytics.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -139,6 +72,7 @@ export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-comp
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owanalytics`     |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owanalytics`     |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owanalytics`     |
+
 ### postgresql.env
 | Variable                  | Value         |
 | --------------------------| ------------- |
@@ -162,13 +96,91 @@ export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-comp
 | `OWSUB_DB`                | `owsub`       |
 | `OWSUB_DB_USER`           | `owsub`       |
 | `OWSUB_DB_PASSWORD`       | `owsub`       |
-3. Depending on whether you want to use [self-signed certificates](#non-lb-deployment-with-self-signed-certificates) or [provide your own](#non-lb-deployment-with-own-certificates), follow the instructions of the according deployment model. Spin up the deployment with `docker-compose -f docker-compose.yml -f docker-compose.postgresql.yml up -d`. It is recommended to create an alias for this deployment model with `alias docker-compose-postgresql="docker-compose -f docker-compose.yml -f docker-compose.postgresql.yml"`.
+
+## Non-LB deployment with self-signed certificates
+1. Switch into the project directory with `cd docker-compose/`.
+2. Add an entry for `openwifi.wlan.local` in your hosts file which points to `127.0.0.1` or whatever the IP of the host running the deployment is.
+3. Spin up the deployment with `docker-compose up -d`.
+4. Check if the containers are up and running with `docker-compose ps`.
+5. Add SSL certificate exceptions in your browser by visiting https://openwifi.wlan.local:16001, https://openwifi.wlan.local:16002, https://openwifi.wlan.local:16004, https://openwifi.wlan.local:16005, https://openwifi.wlan.local:16006 and https://openwifi.wlan.local:16009.
+6. Connect to your AP via SSH and add a static hosts entry in `/etc/hosts` for `openwifi.wlan.local`. This should point to the address of the host the Compose deployment runs on.
+7. Login to the UI `https://openwifi.wlan.local` and follow the instructions to change your default password.
+8. To use the curl test scripts included in the microservice repositories set the following environment variables:
+```
+export OWSEC="openwifi.wlan.local:16001"
+export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-compose/certs/restapi-ca.pem"
+```
+⚠️**Note**: When deploying with self-signed certificates you can not use the 'Trace' and 'Connect' features in the UI since the AP will throw a TLS error. Please use the Let's Encrypt deployment or provide your own valid certificates if you want to use these features.
+
+## Non-LB deployment with own certificates
+1. Switch into the project directory with `cd docker-compose/`. Copy your websocket and REST API certificates into the `certs/` directory. Make sure to reference the certificates accordingly in the service config if you use different file names or if you want to use different certificates for the respective microservices.
+2. Adapt the following hostname and URI variables according to your environment:
+
+### .env
+| Variable                        | Description                                                                        |
+| ------------------------------- | ---------------------------------------------------------------------------------- |
+| `INTERNAL_OWGW_HOSTNAME`        | Set this to your OWGW hostname, for example `owgw.example.com`.                    |
+| `INTERNAL_OWSEC_HOSTNAME`       | Set this to your OWSec hostname, for example `owsec.example.com`.                  |
+| `INTERNAL_OWFMS_HOSTNAME`       | Set this to your OWFms hostname, for example `owfms.example.com`.                  |
+| `INTERNAL_OWPROV_HOSTNAME`      | Set this to your OWProv hostname, for example `owprov.example.com`.                |
+| `INTERNAL_OWANALYTICS_HOSTNAME` | Set this to your OWAnalytics hostname, for example `owanalytics.example.com`.      |
+| `INTERNAL_OWSUB_HOSTNAME`       | Set this to your OWSub hostname, for example `owsub.example.com`.                  |
+
+### owgw.env
+| Variable                                 | Description                                                                         |
+| ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `FILEUPLOADER_HOST_NAME`                 | Set this to your OWGW fileupload hostname, for example `owgw.example.com`.          |
+| `FILEUPLOADER_URI`                       | Set this to your OWGW fileupload URL, for example `https://owgw.example.com:16003`. |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWGW REST API URL, for example `https://owgw.example.com:16002`.   |
+| `RTTY_SERVER`                            | Set this to your OWGW RTTYS hostname, for example `owgw.example.com`.               |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
+
+### owgw-ui.env
+| Variable                    | Description                                                                |
+| --------------------------- | -------------------------------------------------------------------------- |
+| `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
+
+### owsec.env
+| Variable                                 | Description                                                                         |
+| ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
+
+### owfms.env
+| Variable                                 | Description                                                                         |
+| ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWFms URL, for example `https://owfms.example.com:16004`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
+
+### owprov.env
+| Variable                                 | Description                                                                           |
+| ---------------------------------------- | ------------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWProv URL, for example `https://owprov.example.com:16005`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.              |
+
+### owprov-ui.env
+| Variable                    | Description                                                                |
+| --------------------------- | -------------------------------------------------------------------------- |
+| `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
+
+### owanalytics.env
+| Variable                                 | Description                                                                            |
+| ---------------------------------------- | -------------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWAnalytics URL, for example `https://owanalytics.example.com:16009`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWProv-UI URL, for example `https://owprov-ui.example.com`.           |
+
+3. Spin up the deployment with `docker-compose up -d`.
+4. Check if the containers are up and running with `docker-compose ps`.
+5. Login to the UI and and follow the instructions to change your default password.
+
 ## LB deployment with self-signed certificates
 Follow the same instructions as for the self-signed deployment without Traefik. The only difference is that you have to spin up the deployment with `docker-compose -f docker-compose.lb.selfsigned.yml --env-file .env.selfsigned up -d`. Make sure to specify the Compose and the according .env file every time you're working with the deployment or create an alias, for example `alias docker-compose-lb-selfsigned="docker-compose -f docker-compose.lb.selfsigned.yml --env-file .env.selfsigned"`. You also have the possibility to scale specific services to a specified number of instances with `docker-compose-lb-selfsigned up -d --scale SERVICE=NUM`, where `SERVICE` is the service name as defined in the Compose file.
+
 ## LB deployment with Let's Encrypt certificates
 For the Let's Encrypt challenge to work you need a public IP address. The hostname which you set in the `$SDKHOSTNAME` env variable has to resolve to this IP address to pass the HTTP-01 challenge (https://letsencrypt.org/docs/challenge-types/#http-01-challenge).
 1. Switch into the project directory with `cd docker-compose/`.
 2. Adapt the following hostname and URI variables according to your environment.
+
 ### .env.letsencrypt
 | Variable      | Description                                                                                                |
 | ------------- | ---------------------------------------------------------------------------------------------------------- |
@@ -199,34 +211,31 @@ For the Let's Encrypt challenge to work you need a public IP address. The hostna
 | ------------------- | ----------------------------------------------------------------------------- |
 | `SYSTEM_URI_PUBLIC` | Set this to your OWFms URL, for example `https://openwifi.example.com:16004`. |
 | `SYSTEM_URI_UI`     | Set this to your OWGW-UI URL, for example `https://openwifi.example.com`.     |
+
 ### owprov.env
-| Variable             | Description                                                                    | 
+| Variable             | Description                                                                    |
 | -------------------- | ------------------------------------------------------------------------------ |
 | `SYSTEM_URI_PUBLIC`  | Set this to your OWProv URL, for example `https://openwifi.example.com:16005`. |
 | `SYSTEM_URI_UI`      | Set this to your OWGW-UI URL, for example `https://openwifi.example.com`.      |
+
 ### owprov-ui.env
 | Variable                    | Description                                                                   |
 | --------------------------- | ----------------------------------------------------------------------------- |
 | `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://openwifi.example.com:16001`. |
+
 ### owanalytics.env
 | Variable             | Description                                                                         |
 | -------------------- | ----------------------------------------------------------------------------------- |
 | `SYSTEM_URI_PUBLIC`  | Set this to your OWAnalytics URL, for example `https://openwifi.example.com:16009`. |
 | `SYSTEM_URI_UI`      | Set this to your OWProv-UI URL, for example `https://openwifi.example.com`.         |
+
 ### owsub.env
 | Variable             | Description                                                                   |
 | -------------------- | ----------------------------------------------------------------------------- |
 | `SYSTEM_URI_PUBLIC`  | Set this to your OWSub URL, for example `https://openwifi.example.com:16006`. |
+
 | `SYSTEM_URI_UI`      | Set this to your OWGW-UI URL, for example `https://openwifi.example.com`.     |
-### owrrm.env
-| Variable                                 | Description                     |
-| ---------------------------------------- | ------------------------------- |
-| `SERVICECONFIG_PUBLICENDPOINT`   | Set this to your OWRRM URL, for example https://openwifi.example.com:16789. |
-| `DATABASECONFIG_PASSWORD`        | Set this to a random and safe password.                                     |
-### mysql.env
-| Variable         | Description                                                              |
-| ---------------- | ------------------------------------------------------------------------ |
-| `MYSQL_PASSWORD` | Set this to the same value as `$DATABASECONFIG_PASSWORD` in `owrrm.env`. |
+
 ### traefik.env
 | Variable                                            | Description                               |
 | --------------------------------------------------- | ----------------------------------------- |
--- a/docker-compose/certs/clientcas.pem
+++ b/docker-compose/certs/clientcas.pem
@@ -47,3 +47,232 @@ PSNHL2emogy1bl1lLTAoj8nxg2wVKPDSHBGviQ5LR9fsWUIJDv9Bs5k0qWugWYSj
 L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
 5IOM7ItsRmen6u3qu+JXros54e4juQ==
 -----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFbzCCA1egAwIBAgICIjUwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+WjAlMSMwIQYDVQQDExpPcGVuTEFOIERlbW8gQ29udHJvbGxlciBDQTCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAJauwpN+LAd/VubBpX3O3u/E5CXkmxLZ
+di/F9zOTimAOPqfWP7K046TfbNj4twPYSzVzjawkenRkEK0yZQ1DOXmzkGWVnsih
+gR/CA+IUUY1yCnmg6t9Dx9l5K0ZnAox90HO/ybIymcoSfRXhotuhle//eDNmGccd
+XFsndvGdmxshaV1zN1h2POw7biCBZuypCzwvRitFfcpv3pdIk5xTt2G/yMbHPCNo
+dUJHYHLWotridJIJ7DdhYoir5q+iSqWIqjKfDBlqCsvO7e+KidcW9ctljWspAHvl
+B3/yHdJwJz816YTZ7r37I/DsXk9gmjj317gWRkGLMTx9fk6SiMfGW4kfUvClfg1v
+0aRrDGPEcCagHM6ViqbW2+Tc5K38fySgNZKSTBPPI+59iAHd5RADEJDGankEYvzN
+Le0sgB90RDjhTMleOpp5agtd2Yk/ZVjHtKfCnq13OLJfcgX76iY1Ko6AmKqiaxiE
+V2zi9/UFVTIURT8S7JgiwF4ZNIZzHmcr4R4n5O7aSgYUlVjwFp/IEMC3ylTAX8cP
+d4VW0p1f4D3HK7TRcaaqsERuxNh2KVtR48Au2MPGC/8YRKsz/qzH2GfsfFgjKxfF
+z/mZYOA7913DvgVbDQoR9/6odGXZH0XDwH1e1w59dqbXBnIv2VVzElgZsPimIr+M
+UxlZXZHMYtL3AgMBAAGjga4wgaswHwYDVR0jBBgwFoAUPMiDx7JMjfFzgDZHrR/w
+dqeEFkMwHQYDVR0OBBYEFKqr/2rLqvEtxLDRsPCJ1L8WMr7VMA4GA1UdDwEB/wQE
+AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6
+Ly9kZW1vLmNlcnRpZmljYXRlLmZpL2NybC9PcGVuTEFORGVtb1Jvb3RDQS5jcmww
+DQYJKoZIhvcNAQELBQADggIBAEyp07YjNm3WsMQo85OUcKp8kA5TJPKPxw0WgXBR
+5RqfEV8u4b5FPJ1GjvHQqEXNxi0hlNit6oQpMafHrDSsnXR0rSquYeRBZWGig0PU
+n8XHN8IlwsE8orGs7HkJTkQ/5Os7eGYhKCnMUyehoDHQPCPgsCawp6HnKAkntG6F
+0AiOrhmh+ng0+9nKl6Vj11OSh9nw54G3HtQqnhWrDw8JRYp6kkzRIPcrlq/AavjW
+g5aWBcyUSH7PscyIMGW5ICRM/5J1DXMcl/jXQhvSjv1Z6fUCrbpGyUiJ4mjmAOo+
+M11ln5dedBRyRXEBg+0dKxe6758wWkJF2el44pgNx+xO00eKUY60lWRxkDExa6nh
+rVRfEyvcCMfoFKBWreTyAcPyEJ0XR8wu+lfkerhYupE+m+YxUxhYywClfPdv/+m9
+70/gKFR3IyBW+9aYl7xUapyuEYfMFA2iGD73HGqA3QcxCwxB8RFuHuVh7WUyMvJK
+xd8qUNxVXGFzyY5qUUjt+D/OeDIHKn4uQWKpaSNdkumrTvj6/QhsstF2H0XoQv+v
+fuI4IdnzoVVkPbf+Cyg7ZkW0Wu+sutyhsuN4eDOsiy8NxPkbRjnDQxUiNAK96Bkx
+tDpSJgwSP4sPHfNgq6zv/Wu9IaBGIYmNsJBoKpOOITUl7n6DcsEvkcsRMJpuK60b
+rHa2
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFIDCCAwigAwIBAgICDnkwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+WjAfMR0wGwYDVQQDDBRPcGVuTEFOIERlbW8gUm9vdCBDQTCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAMjExylKdJWoJu9mOHPJ6yZFXKe1lE467G65acpS
+2FKIWnPVFjNCmATMpkMOIFzEFwyFdbQjzOidtiL+73zlE52lOJpXCfOcxDFqDYDJ
+J8//J1/gQWsBaKpSvgLiHU/0awkQg+yJYZpj8YZa4NkFe+zTjQScSfOsqPPb3rZ7
+DOQ2BKAhjVShKmVbtNil0iO0zm8vE8DNkktTNMREp2pzb8MbCAgfOkwlrby6T+rV
+3TvmjThGdFUb5lWDFxWtlF8W0SUII9qj7p5TdGpryeLsO0nZTBtS4HxZNdvmKOHf
+gcRHmSZIJigB2NzKLNrXF9JBW0WnUSwZJZAG2C1RTx6lADILPueuusyfR/hZ3koK
+i4PHnSiTwQghzia9K9QjNHq5z9R9ZoCnhBg1VyU4LKmp862L0sIp2vgnOYunEIi9
+aCYBaDwo+0FuVjZuXyDIatwVuA7TN5IWPHA6XLdOt1mmkeYy1Ldr4XHjdondhtOy
+eei1UFXmyyLm2+kmRYfTm91TqYmNzRgbRV2NHO50AmsnBknX4Rv3gishGe0+dV5y
+FcUwZud0z2rSCkuoai5tKrPT+6Y6NqkT9u9HFifIBXnLwEzVUqHRtW6SuWj2DClV
+QIXIUZtFnhY4GuTuf6DlzgnXO58oDVCZmCW4ULIpbqGeRsvBHR8Sw5JXP/1+TMUY
+hE8TAgMBAAGjZjBkMB8GA1UdIwQYMBaAFDzIg8eyTI3xc4A2R60f8HanhBZDMB0G
+A1UdDgQWBBQ8yIPHskyN8XOANketH/B2p4QWQzAOBgNVHQ8BAf8EBAMCAQYwEgYD
+VR0TAQH/BAgwBgEB/wIBATANBgkqhkiG9w0BAQsFAAOCAgEAkHZ5KR8IOrdfMFy+
+iOvauvZxfQ84LL6TpB2FQKDjneJUdd7c29UJJFNW/0mp4Gc6jKZab6J8Dx/pNnbH
+0RqFjGjeRGtJ4Sk0G7gf9zw1S7qut5WJDcisM9l/wXC+zy/KSKKPQmbt0grWOtU7
+NNPh1YU76hIrInq/u2sVZyKH8SXQ957fbJk6BX6JTKyNEn05AB6rNSrbOWo8sy2
+MlcJ7bBsrWYI1t6GcWFh4b36bLu7/dKJWpyFNXXIkKJsgMEDpEQae56+fSSDo0KR
+NtYB82fNZDIQlGK81rGJWNzAahM+3GD1tgk/3ZVugfaJhcBpoHHKNOGqZAvtirLA
+IDocno7AzqoeIz974Rh2Olsl2/arApYPyyfi8PMYuFe/d4h+Wie8n+jh5n48lZ2V
+e4PK+j+QHD6tTZS4f0bGnPL1puMxzQloltuQWgLDeVfEgrc3snLvjOg8aDzWm/es
+85lP8XcyW54U4t3JmrNUC2C7v+Uafx7cL7eDeunhs+BRhtGV+IUmjub2IrpqZp3z
+Zqn+LVRdYJIy/qHhjS5+ImckXkFojOmeWhfmEmYSuNP8Oa6cGuXp829qnbxLh9Qz
+i3TfXV883KLse4kL5Zl7gBA/4hz2hVMyGJ8fY+VvzbaTuOXyvKJ+rGZCTcRSeotB
+LnIevVMiL7SqOEwN0j4Mfbznfq8=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFbjCCA1agAwIBAgICMJ0wDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+WjAkMSIwIAYDVQQDExlPcGVuTEFOIERlbW8gT3BlcmF0aW5nIENBMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4Q5dx+CWyaPxOlAGUC462FgnO4umYEqF
+LQCuK31kgg0tBbbfaq0XApUnjH5IOMI1IGtYgZmm48q1noHaRwk4WFxxvr/dyS51
+hAEa2GFb2S3pkG7VXAF/XYv33yyfM+1K0tyZPRm9tbBShUIfflGFjnrSwxkNhoOH
+IIOVXxCHLBD/Aor74JAkEGtkIo30FPx2vQ+fg4rnQsm9aSffgWwWua7T590tnSMG
+ljDMm++nCQIgONFQC7RQXeL0Ruu14FxB639oJxPmwDQhD/R5zQz/wFBhinjHuzYl
+i0bmxHevdDQluNUxf2lHwJRy6eC/TzdRFOgDUre9kzu929skgNouM0q0y/Rpz7QU
+bd5s1i8JnKebAqADqMT8Yz1Hph0oCvOT0Dc2joxmjGh3loolWRKufKTVe431pvdv
+iV/rAooOSnm5Htmd8ClOADudhrheX886cSd9Z5JKucHhW34Lf1ze7uj1LjxoTh3O
+eo7XedhjmJYcQavpQlVRLTbbY/LJHegPtqJAIvQkrwtOpe05rShl06MxO9wj0BPJ
+0PFp/MxJd0ESDV0EM9dxWIWgXwZftowPzfj3ai5OQEazpTr1IMRehsbCn3JEJ77N
+hCqKPaZmRtKRD9e5cu0YiGfRddr7xaXiwtPGId/ZHsNUASbv7NMDdemRv3TiFwv4
+z8OKCm8QeisCAwEAAaOBrjCBqzAfBgNVHSMEGDAWgBQ8yIPHskyN8XOANketH/B2
+p4QWQzAdBgNVHQ4EFgQUe/uhewyjB6GNj5Dbq9s+I5mWexMwDgYDVR0PAQH/BAQD
+AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwRQYDVR0fBD4wPDA6oDigNoY0aHR0cDov
+L2RlbW8uY2VydGlmaWNhdGUuZmkvY3JsL09wZW5MQU5EZW1vUm9vdENBLmNybDAN
+BgkqhkiG9w0BAQsFAAOCAgEAoj6D9yZIbWEP3MobeV5c3KpNyH4k2Ho2keIE0nT1
+kc2sb1pfHzcZC7qDX1QWdcuKYUctmVEw5xhIWZhOLOy4QONUSx1E5WOHvGKMPfAt
+l5pS8C2XjiC+SP/8KvbcpYM+iopsoJx2qDLX927OaqP0J+XSMikqaOhP4LW9Fb+Z
+aRci9Kfd5WeA76mE3b1/9RSE1xxDNv88R6I2gFiLQeDqvdwaYUdYeCWYjg6mx3GD
+Fc3vf2j/jj606vnbUDrI8uLfL4SDvCdtlmP6IvJGRAS3e48Eao4/C72uCW4LJBxA
+G9sP7yvFCZhBo6+xIAbU2rhZeqiJQi7uK4LjPCck4QK6N32qEVyGpksuA3GXlJGC
+fNDQ7PNA+r4AhCKs1b5xMUJH9O40Oq3vVfH1HhcGt5Pyl0LHFg0ml5PmCpTSPLBP
+x26EizoF7vQmCdZ7HvPPY/L4DkiY//jhp4yBLWFP5MQm9TLjZ6uEj07S/oFCa3vW
+dScZDtJ/AuojDMoDPvrSGuDHPBg1NBvs4mICx90DKjEZNHo5l7nMT7/KF8D6v2Rt
+dRU8vfmPo6R0wbGV6suItRPUG5qpnHL4wc/iK0hRBl4nIgH1SwE4YHlx42FJTJej
+EGAlrLr3LG0BxQaB3JEx82lGDlxz7Y3pCk2uiaVUnqWY5HglOdxdtAaox3HBgMa9
+tHk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGBjCCA+6gAwIBAgICAxMwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+bkxBTiBSb290IENBMB4XDTI1MDUxNDA4NDcyNVoXDTQ1MDUxNDA5MTcyNVowIzEh
+MB8GA1UEAwwYT3BlbkxBTiBCaXJ0aCBJc3N1aW5nIENBMIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAqkekr6rYqlnicopx8WgKhEUctfrMD3J8jC2YshEI
+hlVFI6lRbA9EFjv1hq0BhXhOY52lwOTOQtIgdn7HNcViSoiKqrVBYRskbhVqIA+7
+nPhwB/4BYYZnbzCELjROHnMn/drFScNUaUvf+EDh9WmO4vZHD5xstK729RDZE51n
+vLlFwe5O4ckekPH17r4WojoVSczkXXRhKJXV3GXdrA/epoIUn0poUM6bCjddiEbJ
+NPknqqkS8Z9a8GYt2IX33kZD3NdHjTQRnMd7g+xroJiQ/faZ9zc0ul6l85sl1G43
+AqriEI2aOWYhSxY7sDleuy5ggz8UA5lR6/z6ZIR8IfMSJag8aVkvxt51Gx2aDaVu
+PixyMFoXyhKQPSP+cL3rzSF/767iXqINw4oOb83Jy77Ocwgp2cfW06KI4l4CTymy
+83wCBEZ6pvLmjCmbz0DIg7V7yGPGjEePNyxYG0sM+aHQEpJnaib2yza9adiXlJ4s
+M+UEMnLjEu0i8Xy15hvItgo7FYTZgWh89LIhE63HDk6qteV836K2oL9PWtVUEg9v
+pElapnq+v+8BUsvmY6Nr8eYeAnCPyW2e49a91/vCP8B1Ydbe5ms3mYcGO3Kdx/k5
+QWLquKnt5ZAeJ2werO/8mUabq8eyt4EH9tZzDKJvV/xbmhluKmamfSg4GHCpOUl1
+IcCAwEAAaOCAUswggFHMB8GA1UdIwQYMBaAFJRoW6g4+ThAsHJk/juSPinUhsIm
+MB0GA1UdDgQWBBRO5RI5Dr0FesZ3+QQ9ugAapLBaeDAOBgNVHQ8BAf8EBAMCAYYw
+EgYDVR0TAQH/BAgwBgEB/wIBADBHBgNVHR8EQDA+MDygOqA4hjZodHRwOi8vY3Js
+LmNlcnRpZmljYXRlcy5vcGVuLWxhbi5vcmcvb3BlbmxhbnJvb3RjYS5jcmwwgZcG
+CCsGAQUFBwEBBIGKMIGHMEQGCCsGAQUFBzAChjhodHRwOi8vY2VydHMuY2VydGlm
+aWNhdGVzLm9wZW4tbGFuLm9yZy9vcGVubGFucm9vdGNhLmNlcjA/BggrBgEFBQcw
+AYYzaHR0cDovL29jc3AuY2VydGlmaWNhdGVzLm9wZW4tbGFuLm9yZy9vcGVubGFu
+cm9vdGNhMA0GCSqGSIb3DQEBCwUAA4ICAQBQq28kQUcK88zs5YzZ3b6Y3t77yrSF
+lZLWsbNE/KVlvEuTIrtkRMX9PAC4tRjOpV0oxp6NdrqUKJ35gt4EKjw1vbtyXZD0
+VQwimBv1qapZEuNe5lwNssyySAnXxUIyhCV6QVD4G9vmRPzNVtIwssjffVPjjpZ9
+LBQdliOG3FBbcCWGuRiUMysVxHxdO2rokoFuO1ye+oURrqe9zeDtE0k9QNzAi36F
+FhuWYQnn+2QHfTX58cpMb1Aql3yTO/pz5fQRUF/hmfTuuk+dLlkWoem55oRGfMVL
+coAnW3We251iEawqrR9ZDgcIWlmloZFSNylpZ/iIZOIQdYFqreRo0DiSZG4kPxcW
+RKQTSJ9F3v2j0BZan2xxaSE1tJ54IJUPUND/O6ITVQLfexVLIggRfeIAsURdhPn9
+1KUrZu3HoIYX6kcpuhl++BQgOx3qr6RomAVDhXSGRVRQ2B76N0N1ZC+mEEhJUYbb
+0DlZntDp7q2ZDzn6gFYOnrGhoXe55Yrx8c45wMOBZmz0Q6xzc0jydgZoAG9/20l8
+6S9G2j+UuMYRBCSzouILsGwTloU7XR3qIuO2WbYcG+UV0o/3lVOkAk5992HPG7DT
+hZ1qNe72WFHmtKVwfYJTcQG/TucWFvplUE3hMDMqS80tmx9TrXiRdI4R5IrTxfsS
+znGN0LCQ5YzAAw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGBzCCA++gAwIBAgICBAYwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+bkxBTiBSb290IENBMB4XDTI1MDUxNDA4NTQwNVoXDTQ1MDUxNDA5MjQwNVowJDEi
+MCAGA1UEAwwZT3BlbkxBTiBEZXZpY2UgSXNzdWluZyBDQTCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBALrPh3nxxKWaPQbcQeZdihRrGwJNYgdrzz/YAsss
+EbKXYKAOwb/EJKSv52eUysI59lcvfJrsqn4wyUaXQvgYxJUatCSpmCCKEzftgudS
+UAlPY8L/4qeqUvxz6CN3qiKivxQ31Z7SJTLgR7OTXxk5ckXHkc8QPB2GPWkU3BzV
+RbBNKcVxwMK6JaZbB0ZlR6r1ImnLnsDUI0qkgSV8NBO7bJd1yvqfn04yc0/pIo+1
+9uX/gh7AA0RsZeXw1SO3wCfUO5Cr65X+MW2T3LsbnBPbKOqHnF0YWJGx5RPOWVIS
+wudAy4zlqdwPInrb4BCMkJUoZlRhhx7vvNmP9HwNwCp8+COjE77caAEAi+0VHamY
+spu9IgDZCr5FmgHBMu9WiaWpB3RxxbFa6UdVl3sMzRFS6SEHhs6RCAXwQj7KiZLf
+tb3UCRps5XMlhmjAApyDKsJEXKnd5cSpSYxCQQlOB9BCG6QVc6vQLdu/uq8X6Z+2
+0EcP7NVyzMDgHdozp4jP+M4Sow6pv7KE4SZaBfpbgM+Ht22sYoBwMouRYbzSAhJS
+8qBH+IiDqwMRWyox8TuhCsn9WJr9t6l8p3O1pUB0IccraUTVo7XydZWaprtrvMTf
+RtudowCxea9Iz6md9zlqNZAQu2QNUpH9YQT408N02qukp2uaAGvQjbSfAtnWduTD
+F6AbAgMBAAGjggFLMIIBRzAfBgNVHSMEGDAWgBSUaFuoOPk4QLByZP47kj4p1IbC
+JjAdBgNVHQ4EFgQUVRP31JMaQoUd6psw0tjQpKbhmvUwDgYDVR0PAQH/BAQDAgGG
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwRwYDVR0fBEAwPjA8oDqgOIY2aHR0cDovL2Ny
+bC5jZXJ0aWZpY2F0ZXMub3Blbi1sYW4ub3JnL29wZW5sYW5yb290Y2EuY3JsMIGX
+BggrBgEFBQcBAQSBijCBhzBEBggrBgEFBQcwAoY4aHR0cDovL2NlcnRzLmNlcnRp
+ZmljYXRlcy5vcGVuLWxhbi5vcmcvb3BlbmxhbnJvb3RjYS5jZXIwPwYIKwYBBQUH
+MAGGM2h0dHA6Ly9vY3NwLmNlcnRpZmljYXRlcy5vcGVuLWxhbi5vcmcvb3Blbmxh
+bnJvb3RjYTANBgkqhkiG9w0BAQsFAAOCAgEALMFsYRqB8NDMMWZV8NqbjNT5QA3Y
+O3ODxYOuFC4NjSzUSh3Lh73f5+Ec4slQNFuOQeqhqFJaDAPIxUI5ekKtVjzmt7St
+crbW1dE47+ZHkPXrWVRwRmlV1qP5TqS5oTH6dvpEpEcSxT/IKGQB1cwQ1C+Qp3dd
+3rZnylXfL5dimIpKDGHYqiHyltktlv3uMWnQhUwrKjt2GW0TnF7bVJ0OJko7aDL7
+wdY0TGUH9eLQOoz/a0e9sKSsqOxrq9grN7npbUHOr23CdQBnSjF1Q5dXKvza8kRj
+agDJW5h/fyBvZ5I4U6m4jFyUnAKso6Xd0+feejPCH7f6kYY+pT7NKO4dVqaRLrj
+yDmtXGsMza6C0h8wBgYwg4d7jxTqOx6iJfJLyLGWKT94HeChiWOL2X0HpF+Gn9Uf
+C7rtLO4QwQzGHdEGyFlw/pBTs6g3wTYVv7ZZfh8DJ9PIedqJmUdwMVE89ThEpu4Z
+q1bFfqENwDmrj2erS3fweEY3G+w2m8f24tJiLWOW/hBRcR3fm+73C8svmtwVGo5Q
+2i6yJxQ12Q42oa1sfsohr22J2NxotqbQz0gq1J9QparEJ5qUjMKkO9Rj3s24KW2t
+E6WIb5d1WpIxownlqOgFE7FftxXmQdJNJ2t4XyUMWhwXbOxfc2RlLek0LtnHPA8N
+hCFqyfjUtMPqafk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFFTCCAv2gAwIBAgICAxIwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+bkxBTiBSb290IENBMCAXDTI1MDUxNDA4NDcxMFoYDzIwNTUwNTE0MDg0NzEwWjAa
+MRgwFgYDVQQDDA9PcGVuTEFOIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQDGibJ04A55kSURTBSKgcBmLnND2I5wws1taKqqU9aaRhB7NtvM
+Hwh2voH9b1brUiulZaZwTN/9kzd4AnXeKQ+0u5tV7Ofk0fzF2MK47n17TS30Yenq
+c4NuQEKdpKK/pM3VvOEppR/bqtgyLtDmbDnmFOx+zTj/+smTgouwA+Iier0P4s5O
+ohYxn/bjOqwQbHbU79VpGBIWv6/kt55AhH7zvsqqKHkrzTxnsRBv3SBIufrjJr9P
+IhZBLDrqr56P6KgAi0eoutNt2ToiJbE0WfjU7GI1RSiSN5bGj1zXhjNVzQWs1H9Q
+zRf3c9pl3+haHQZ7FZ1UqiTRewmbNrQ6I9k81au3SttUlb87MyAuDSzatkiq7CjQ
+8VE1J6te6ZBt2zWpUhHsR/Lg7g3eOw5dL4oZJdK5GgGu/MUajLUXifIqM13Mvg0V
+TzDhN69VLXLSL0gPcicsQCwJuAza1IC/VqmBGx19fAkyJhOurCXWOgisi0g1+xzP
+KRphUNwMPUf8vBVOM/Vc6xDIvwVGE3+eWXyhixneFlSpAI03nWWjpwWXihTBoxbf
+RXO3Y/ilJqrgFN+U4PJcCPA+Wo7ThH0mgX6bOTPcgXMUzT3v3FF6Bx5/PNV3kYrw
+2yLzribUiS6AGvVGnW4hX2Z6OQvA/aHME8KF+6y6m4pC7FkUjVaRlzWu/wIDAQAB
+o2MwYTAfBgNVHSMEGDAWgBSUaFuoOPk4QLByZP47kj4p1IbCJjAdBgNVHQ4EFgQU
+lGhbqDj5OECwcmT+O5I+KdSGwiYwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
+MAMBAf8wDQYJKoZIhvcNAQELBQADggIBAB+/RUC2X6eVoPsFNMkaXO5Iib/ub0Jo
+WhODQm8j2Mr5dpGXESSpXjfDcqDOLuJbWWoflXBLdr8BsVCBqOA9YgCX0H8Br7dU
+WmCScixxLW0he592/424EvdwifxcKHZLjv9CKV5Txhqnm2djc5RY/nTH5MYVrIh/
+If2TNO5ydDP6+vgy9GQ4en04VK7rz+PW17O8l7k9/lOmYptZmHgSDAPj/cT3PlG+
+McqaI5rMSHeEHlzH+PvgWjtSeEhF4FwFBXroDl4/yb4l2JB8bqAZ3vsOXSkigFcZ
+h5MXPe+zuSSW+G8iLr4xoi0CFsP2DaHEyxgqP4B1FtE9nFPo6cvWbwqTVT7QSzqf
+H+jPJuQvpFXeRF5UFegNZTFT5/uFFPamihakFslEYxeJey1y+OJdLcP6ef87ruSt
+8amsq56OAETYpnW4JFowlEh0C+QwLGHGGY6WrOgHY/90hJmPgXBdBVg/IoOhzbvk
+5A+LqZDvxV2/rLNfClw8Kr3g5e8obcB6dWgMCy2z+us0H79ucnmhzQKsjpxM9T1n
+cHovAQfiD3jVqfHULY53avh0wIAjosoTGbe8dyx80quHe+16qWan7C9idXeAYYJX
+bZt5hs6hLw4I8M1LsjTg6vwsqiaHZpsmDyyQLdFjNJldG7aosfS9F+BIpuwijF+1
+dashL0CPsbIJ
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGBzCCA++gAwIBAgICCQYwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+bkxBTiBSb290IENBMB4XDTI1MDUxNDA4NTY0MVoXDTQ1MDUxNDA5MjY0MVowJDEi
+MCAGA1UEAwwZT3BlbkxBTiBTZXJ2ZXIgSXNzdWluZyBDQTCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBALSdJpzwPfQM9oHBGt6w8UDLDJNznxI7cpfl0u0x
+VCHN1YY7onpwxFVkFRzUx/JrQ/tbEGZH19XtngaCZ91KbGbqVao9S32H0tyn2t3e
+TJ5h+klJ7+7YAbZr8UfOi3nG4bZzNSa5dDBPaNPvI51byKDN7siXXnALV3f0l6lZ
+gDpLQco/E7ANU3lslUVjVNALfFUEonDyP7XV+lFAyidpjIn6dRn7oYs3SUwkzZUn
+tYJAhAykmxXMWox+85gDkdb+2O3G8ci0uHVbb0A9LP+MeIhzxHgnnAMfWLfEZexd
+mEd2PwVHaz/D2Xp/gYrpPDTsbqWjQ9NmgdASwqN5j8BuJ8vHDVBVCztVDltm6JPw
+3Y6GQPN1LmiSLUzst7VYpydUJRDHYIAKJhT9DYxQ126VfiyMo6Xl4IQO8YZ/J6r8
+yR7gyvyUiBW+wvvC1bCY5+VuI4P/cY+6iA1qwC1SOWjYlccy+tbfGj9zr32Qf27e
+9RXSAkcATHen1rc/9AGEeAuSpKrzhmZIIvM4+EtYgbBvf91NkP51zbGpvsAbfWN/
+ecNmqH9SeyrrVgv68Z34hMijCcvJNyIvloo3nkb/gHYV4tAiwTTrX13Rio/8qNF4
+nwHLsjw0t7jEyRiXdOciePyhGbtdicuiUxrShzbGY7ID0yNwyTKcJYhorL/8r+YF
+psXrAgMBAAGjggFLMIIBRzAfBgNVHSMEGDAWgBSUaFuoOPk4QLByZP47kj4p1IbC
+JjAdBgNVHQ4EFgQUBwUkiaCh5hdY+ZH6O8NmEE/nH5EwDgYDVR0PAQH/BAQDAgGG
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwRwYDVR0fBEAwPjA8oDqgOIY2aHR0cDovL2Ny
+bC5jZXJ0aWZpY2F0ZXMub3Blbi1sYW4ub3JnL29wZW5sYW5yb290Y2EuY3JsMIGX
+BggrBgEFBQcBAQSBijCBhzBEBggrBgEFBQcwAoY4aHR0cDovL2NlcnRzLmNlcnRp
+ZmljYXRlcy5vcGVuLWxhbi5vcmcvb3BlbmxhbnJvb3RjYS5jZXIwPwYIKwYBBQUH
+MAGGM2h0dHA6Ly9vY3NwLmNlcnRpZmljYXRlcy5vcGVuLWxhbi5vcmcvb3Blbmxh
+bnJvb3RjYTANBgkqhkiG9w0BAQsFAAOCAgEAqEk5ZJdpMVr2U0YhmqEU6gqxEeih
+9MWKcQfmsT/lhf5m5V7VuLMc3r+EBCsPssw60umdQcAU2IPlJXLAeWwdRyY7ZNNw
+QVgl9GBI/CM2b7x18+12/llCdXW9FOagdChTuuhwRnGTt71jcrJkleQyEYhqwwIE
+N82hxq4HSZO6XJDev4IsMRF00+qt8biJcf7OVGOSLoyiU6Dm/EzxoB+DZf3HdUc0
+vzfVjD4Im+yYzqXuwWV6c9oIBQH6obzaqlpg926CtEBFR8E1LQe93ahMvF7pExpI
+OkE5PTuqONvy7Xn3Ui8NRxHhmm8j/unql6bUTGENz9s68n8Im7weq6awC9Hfu8aG
+WjcnXI7tsDY5uJEguP5fSwCUrdTE85XgPgPHeKaIwBZsyRZTqVSvbky+c15Yv6IT
+XLWoA0AUxz9ste3WpqiWCNJVI90MCruSYKdpXGV0KU3QQXJDMKhHJBF5DLpuKibo
+Ffh9O8pB7B4/tJ76JpAc6Z0rfaQUo2vxSpb3Sbd/IHNcL08zB8Ay+YUBULspxe+1
+StKthmCzCHI9DOhIgeASyNBpcL7uZPjCXiYGhUuzsFGv4sQ+d267Jyvql/Piw/vY
+g1k2aVBfdIoIU4TpIEVyQqPz4aAW+0SgL7OM+/zD9jxn3gVdusCpmHcoTzOfZRri
+H0FGIeDSQydpOJU=
+-----END CERTIFICATE-----
--- a/docker-compose/certs/issuer_insta.pem
+++ b/docker-compose/certs/issuer_insta.pem
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGBzCCA++gAwIBAgICCQYwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+bkxBTiBSb290IENBMB4XDTI1MDUxNDA4NTY0MVoXDTQ1MDUxNDA5MjY0MVowJDEi
+MCAGA1UEAwwZT3BlbkxBTiBTZXJ2ZXIgSXNzdWluZyBDQTCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBALSdJpzwPfQM9oHBGt6w8UDLDJNznxI7cpfl0u0x
+VCHN1YY7onpwxFVkFRzUx/JrQ/tbEGZH19XtngaCZ91KbGbqVao9S32H0tyn2t3e
+TJ5h+klJ7+7YAbZr8UfOi3nG4bZzNSa5dDBPaNPvI51byKDN7siXXnALV3f0l6lZ
+gDpLQco/E7ANU3lslUVjVNALfFUEonDyP7XV+lFAyidpjIn6dRn7oYs3SUwkzZUn
+tYJAhAykmxXMWox+85gDkdb+2O3G8ci0uHVbb0A9LP+MeIhzxHgnnAMfWLfEZexd
+mEd2PwVHaz/D2Xp/gYrpPDTsbqWjQ9NmgdASwqN5j8BuJ8vHDVBVCztVDltm6JPw
+3Y6GQPN1LmiSLUzst7VYpydUJRDHYIAKJhT9DYxQ126VfiyMo6Xl4IQO8YZ/J6r8
+yR7gyvyUiBW+wvvC1bCY5+VuI4P/cY+6iA1qwC1SOWjYlccy+tbfGj9zr32Qf27e
+9RXSAkcATHen1rc/9AGEeAuSpKrzhmZIIvM4+EtYgbBvf91NkP51zbGpvsAbfWN/
+ecNmqH9SeyrrVgv68Z34hMijCcvJNyIvloo3nkb/gHYV4tAiwTTrX13Rio/8qNF4
+nwHLsjw0t7jEyRiXdOciePyhGbtdicuiUxrShzbGY7ID0yNwyTKcJYhorL/8r+YF
+psXrAgMBAAGjggFLMIIBRzAfBgNVHSMEGDAWgBSUaFuoOPk4QLByZP47kj4p1IbC
+JjAdBgNVHQ4EFgQUBwUkiaCh5hdY+ZH6O8NmEE/nH5EwDgYDVR0PAQH/BAQDAgGG
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwRwYDVR0fBEAwPjA8oDqgOIY2aHR0cDovL2Ny
+bC5jZXJ0aWZpY2F0ZXMub3Blbi1sYW4ub3JnL29wZW5sYW5yb290Y2EuY3JsMIGX
+BggrBgEFBQcBAQSBijCBhzBEBggrBgEFBQcwAoY4aHR0cDovL2NlcnRzLmNlcnRp
+ZmljYXRlcy5vcGVuLWxhbi5vcmcvb3BlbmxhbnJvb3RjYS5jZXIwPwYIKwYBBQUH
+MAGGM2h0dHA6Ly9vY3NwLmNlcnRpZmljYXRlcy5vcGVuLWxhbi5vcmcvb3Blbmxh
+bnJvb3RjYTANBgkqhkiG9w0BAQsFAAOCAgEAqEk5ZJdpMVr2U0YhmqEU6gqxEeih
+9MWKcQfmsT/lhf5m5V7VuLMc3r+EBCsPssw60umdQcAU2IPlJXLAeWwdRyY7ZNNw
+QVgl9GBI/CM2b7x18+12/llCdXW9FOagdChTuuhwRnGTt71jcrJkleQyEYhqwwIE
+N82hxq4HSZO6XJDev4IsMRF00+qt8biJcf7OVGOSLoyiU6Dm/EzxoB+DZf3HdUc0
+vzfVjD4Im+yYzqXuwWV6c9oIBQH6obzaqlpg926CtEBFR8E1LQe93ahMvF7pExpI
+OkE5PTuqONvy7Xn3Ui8NRxHhmm8j/unql6bUTGENz9s68n8Im7weq6awC9Hfu8aG
+WjcnXI7tsDY5uJEguP5fSwCUrdTE85XgPgPHeKaIwBZsyRZTqVSvbky+c15Yv6IT
+XLWoA0AUxz9ste3WpqiWCNJVI90MCruSYKdpXGV0KU3QQXJDMKhHJBF5DLpuKibo
+Ffh9O8pB7B4/tJ76JpAc6Z0rfaQUo2vxSpb3Sbd/IHNcL08zB8Ay+YUBULspxe+1
+StKthmCzCHI9DOhIgeASyNBpcL7uZPjCXiYGhUuzsFGv4sQ+d267Jyvql/Piw/vY
+g1k2aVBfdIoIU4TpIEVyQqPz4aAW+0SgL7OM+/zD9jxn3gVdusCpmHcoTzOfZRri
+H0FGIeDSQydpOJU=
+-----END CERTIFICATE-----
--- a/docker-compose/certs/root_insta.pem
+++ b/docker-compose/certs/root_insta.pem
@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFFTCCAv2gAwIBAgICAxIwDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPT3Bl
+bkxBTiBSb290IENBMCAXDTI1MDUxNDA4NDcxMFoYDzIwNTUwNTE0MDg0NzEwWjAa
+MRgwFgYDVQQDDA9PcGVuTEFOIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQDGibJ04A55kSURTBSKgcBmLnND2I5wws1taKqqU9aaRhB7NtvM
+Hwh2voH9b1brUiulZaZwTN/9kzd4AnXeKQ+0u5tV7Ofk0fzF2MK47n17TS30Yenq
+c4NuQEKdpKK/pM3VvOEppR/bqtgyLtDmbDnmFOx+zTj/+smTgouwA+Iier0P4s5O
+ohYxn/bjOqwQbHbU79VpGBIWv6/kt55AhH7zvsqqKHkrzTxnsRBv3SBIufrjJr9P
+IhZBLDrqr56P6KgAi0eoutNt2ToiJbE0WfjU7GI1RSiSN5bGj1zXhjNVzQWs1H9Q
+zRf3c9pl3+haHQZ7FZ1UqiTRewmbNrQ6I9k81au3SttUlb87MyAuDSzatkiq7CjQ
+8VE1J6te6ZBt2zWpUhHsR/Lg7g3eOw5dL4oZJdK5GgGu/MUajLUXifIqM13Mvg0V
+TzDhN69VLXLSL0gPcicsQCwJuAza1IC/VqmBGx19fAkyJhOurCXWOgisi0g1+xzP
+KRphUNwMPUf8vBVOM/Vc6xDIvwVGE3+eWXyhixneFlSpAI03nWWjpwWXihTBoxbf
+RXO3Y/ilJqrgFN+U4PJcCPA+Wo7ThH0mgX6bOTPcgXMUzT3v3FF6Bx5/PNV3kYrw
+2yLzribUiS6AGvVGnW4hX2Z6OQvA/aHME8KF+6y6m4pC7FkUjVaRlzWu/wIDAQAB
+o2MwYTAfBgNVHSMEGDAWgBSUaFuoOPk4QLByZP47kj4p1IbCJjAdBgNVHQ4EFgQU
+lGhbqDj5OECwcmT+O5I+KdSGwiYwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
+MAMBAf8wDQYJKoZIhvcNAQELBQADggIBAB+/RUC2X6eVoPsFNMkaXO5Iib/ub0Jo
+WhODQm8j2Mr5dpGXESSpXjfDcqDOLuJbWWoflXBLdr8BsVCBqOA9YgCX0H8Br7dU
+WmCScixxLW0he592/424EvdwifxcKHZLjv9CKV5Txhqnm2djc5RY/nTH5MYVrIh/
+If2TNO5ydDP6+vgy9GQ4en04VK7rz+PW17O8l7k9/lOmYptZmHgSDAPj/cT3PlG+
+McqaI5rMSHeEHlzH+PvgWjtSeEhF4FwFBXroDl4/yb4l2JB8bqAZ3vsOXSkigFcZ
+h5MXPe+zuSSW+G8iLr4xoi0CFsP2DaHEyxgqP4B1FtE9nFPo6cvWbwqTVT7QSzqf
+H+jPJuQvpFXeRF5UFegNZTFT5/uFFPamihakFslEYxeJey1y+OJdLcP6ef87ruSt
+8amsq56OAETYpnW4JFowlEh0C+QwLGHGGY6WrOgHY/90hJmPgXBdBVg/IoOhzbvk
+5A+LqZDvxV2/rLNfClw8Kr3g5e8obcB6dWgMCy2z+us0H79ucnmhzQKsjpxM9T1n
+cHovAQfiD3jVqfHULY53avh0wIAjosoTGbe8dyx80quHe+16qWan7C9idXeAYYJX
+bZt5hs6hLw4I8M1LsjTg6vwsqiaHZpsmDyyQLdFjNJldG7aosfS9F+BIpuwijF+1
+dashL0CPsbIJ
+-----END CERTIFICATE-----
--- a/docker-compose/certs/websocket-cert.pem
+++ b/docker-compose/certs/websocket-cert.pem
@@ -1,27 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIIEgDCCA2igAwIBAgIUaKVB2xg9gr/sS6FvzMex0xSbEzswDQYJKoZIhvcNAQEL
+MIIEijCCA3KgAwIBAgIUOmn9ubcITrhJKE6uLJYw9J3CfCkwDQYJKoZIhvcNAQEL
 BQAwbDELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG1RlbGVjb20gSW5mcmEgUHJvamVj
 dCwgSW5jLjEMMAoGA1UECxMDVElQMSkwJwYDVQQDEyBUZWxlY29tIEluZnJhIFBy
-b2plY3QgSXNzdWluZyBDQTAeFw0yMTA3MDgxMDQ5MTVaFw0yNTA3MDgxMDQ5MTVa
+b2plY3QgSXNzdWluZyBDQTAeFw0yNTA3MTUyMzU3NTlaFw0yNjA0MTMyMjM4NDZa
 MDIxCzAJBgNVBAYTAlVTMQwwCgYDVQQKEwNUSVAxFTATBgNVBAMMDCoud2xhbi5s
-b2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL2rlMfV7/Si2Svx
-J1YOEz6KJLvey995/0MkQvAG0RM6TpFwgUNnpYFFozcWME8MGSxws+6hOzDoMmHC
-pgpP/KZ/Fyu9iUdzTxsJMyMxIW9sYbBMkQgBmvjkBlXDk5NfHh+yJBVxb7JlJ6vJ
-oT7EJMzgKpYpFnO+bddalUVsDp3qQIjSvJIxl77vwgZQUJx0qCm17VTBhyM2RTJ3
-jtr7kcWDm3jyyTVUvlM9g3DM9g0hUPMN0R5PP2HuqDdtYoY51krsm2mmVIYYnyAN
-BDawmwYnZJfcC4gFzZJ5wK5NFjSKmd1mYp0damlSh0/uHxPyd4rm2QhUCQH92yKM
-+9qYU70CAwEAAaOCAVIwggFOMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFM0mIZuE
-6aly7ZKXl0KWjprcO9/uMB8GA1UdIwQYMBaAFLMbVLjgR6s98ziA5Dzl/QBhbdHo
-MA4GA1UdDwEB/wQEAwIFoDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDATCBhgYIKwYB
-BQUHAQEEejB4MCgGCCsGAQUFBzABhhxodHRwOi8vb2NzcC5vbmUuZGlnaWNlcnQu
-Y29tMEwGCCsGAQUFBzAChkBodHRwOi8vY2FjZXJ0cy5vbmUuZGlnaWNlcnQuY29t
-L1RlbGVjb21JbmZyYVByb2plY3RJc3N1aW5nQ0EuY3J0ME0GA1UdHwRGMEQwQqBA
-oD6GPGh0dHA6Ly9jcmwub25lLmRpZ2ljZXJ0LmNvbS9UZWxlY29tSW5mcmFQcm9q
-ZWN0SXNzdWluZ0NBLmNybDANBgkqhkiG9w0BAQsFAAOCAQEAAyb7X9qW0z0QJrl2
-oAalMCh/gSJy5oER3L7iu/pnP3GREbr6bh6+1/MAf2bgnN2CUOKQHbozB7yCkM6V
-8m5RnL4ePKVP5yIrbs48uM5Hl14QFLU4ZtFao6js0haoWWEgMo3sfbeyfOU0ScyW
-ET5zfbDub3gUbWYmlz6hyV5aJoznaFjJTNP7SRQ9CHMTMHh3wAPfVlvG2TdcwwbM
-ZKkdAHpl1NwRxyiBPJfkejGWrY3ZAs10te7u9Lsc9yZZKL8SU9J/mrO9tM5HLeUr
-nCJN4RI7RyTuDw4LdMZW1Ju5QBXoZL9mj4KXIbUkDwryhbAxdQ1OnwD4O/avMChk
-TNJzIw==
-----END CERTIFICATE-----
+b2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL0vG6Ol1JiIPrSQ
+D046Nj2zmw2lUh00gNFU7rvAzfH+Lj5fKjyi7ejZQL41r9kvfOYJGNVl9Jca4TBJ
+Nyfved/i8LAMyywaAaQyCrITzcFdw3MfnO5Eo4KAAP2kvqsufYKYxbeiNEIyWhHV
+B2iUAX1PLegnPSuHIZeHLrDB/mX/xxmY5z3u0inIVeG/xjbD1deA59xLLzrxhwGx
+pMz/cx9NLWymfAUBJVGfj2M8fJNK9D0wqljzHMFe9r/jCVvBmEpXklTVd0AXvrZr
+4b9BbqU9FT4QIhq0Qi2yIcOaUHZY81NvGcNc8gSJyiDG5zlLfeOU3HfHxViQZYhr
+hbeOj9cCAwEAAaOCAVwwggFYMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDm+cEul
+fwzf7rkuJp25mFzvYKNTMB8GA1UdIwQYMBaAFLMbVLjgR6s98ziA5Dzl/QBhbdHo
+MA4GA1UdDwEB/wQEAwIFoDAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUH
+AwIwgYYGCCsGAQUFBwEBBHoweDAoBggrBgEFBQcwAYYcaHR0cDovL29jc3Aub25l
+LmRpZ2ljZXJ0LmNvbTBMBggrBgEFBQcwAoZAaHR0cDovL2NhY2VydHMub25lLmRp
+Z2ljZXJ0LmNvbS9UZWxlY29tSW5mcmFQcm9qZWN0SXNzdWluZ0NBLmNydDBNBgNV
+HR8ERjBEMEKgQKA+hjxodHRwOi8vY3JsLm9uZS5kaWdpY2VydC5jb20vVGVsZWNv
+bUluZnJhUHJvamVjdElzc3VpbmdDQS5jcmwwDQYJKoZIhvcNAQELBQADggEBAKab
+NayATB4dIy5M7spBHHpbT4eqCNHRxXnw+ph7DGtUCx5InjSVjJU7HVzHDHzOTSl5
+TCkxWJ1pCTn6ZodphUWYax+e6Dm7mvOjohAQRvUwvZp+4w7PwqiwjM+wfvCAPM/f
+ln9EfDTvBxTUXk7xGmPWSexAeL2PyoNLbyMJS6MzSiJmHodbocpib8uMXz3a7J4e
+UcqbX1HGXDuDFBZdOcd2pjqBYnnHv5eL6W1hf/wSgkUeKsBRpYkcz7oulSD67eWx
+zXI5Ynmd2WIHVGONsoSySnSkEVW/KlzpZK4bec2hG9hIHbJo1vO2cg4qBvHxmLUs
+bKkYh7fah/VjfkcSuzk=
+-----END CERTIFICATE-----
--- a/docker-compose/certs/websocket-key.pem
+++ b/docker-compose/certs/websocket-key.pem
@@ -1,28 +1,27 @@
-----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC9q5TH1e/0otkr
-8SdWDhM+iiS73svfef9DJELwBtETOk6RcIFDZ6WBRaM3FjBPDBkscLPuoTsw6DJh
-wqYKT/ymfxcrvYlHc08bCTMjMSFvbGGwTJEIAZr45AZVw5OTXx4fsiQVcW+yZSer
-yaE+xCTM4CqWKRZzvm3XWpVFbA6d6kCI0rySMZe+78IGUFCcdKgpte1UwYcjNkUy
-d47a+5HFg5t48sk1VL5TPYNwzPYNIVDzDdEeTz9h7qg3bWKGOdZK7JtpplSGGJ8g
-DQQ2sJsGJ2SX3AuIBc2SecCuTRY0ipndZmKdHWppUodP7h8T8neK5tkIVAkB/dsi
-jPvamFO9AgMBAAECggEBAJgYoaRmcJfShyhvp8WgX9pE2RQ2o3I/2Gy1BWCJdtte
-ZGbIuz+cO+IgP7QK/Q5Ge2Fht0hizp53dP9kIdYfMlEplSEkSpObahIaHIHaAh/h
-36yKmbq73tQ7tsDLpuoE2pk8Nydi4dlCuL9PXxiAHaqVEFF9/V0vldGd+BnFfyst
-retXgockCH+fqddM5Kp+H0bmjXzLke/b8T9KsdSBz7lg1Z67kmMrHLe14Q4Hgmr/
-pFBkGGWKTFn48OXfncrv+oQAGED7r9c5UEdpOB6SBDxuddfzgkw9urnpKrYC/KOs
-HLBTaGew73O81BsbaZlUiVxTdewrmFk2nG6UIPoGaxkCgYEA7IYOjIfNJOEPIWYP
-zj4eipTy6zFk4L7tX3wX4wsor93rz8ArlF8sgNoyUhbKm6H++ZfVezLs2jcjJJ8Q
-sXLwQ6L/D8aVb6AOVeC1WYJu5+wXIDX0H+1318a5+3bKVPn+hktJGEgCBvplVRnh
-yzpQ+2v1SBp9qEzoSl1sV6gm1tsCgYEAzUnZcjUhHvoXLXJ1lfagCC6QsmjqzpJv
-VdTKJlDuZ0qQGC6Ts+wKfM3MoiOsXW0pByC5lWwE43c/KU8J358j3OSSNafIFeD1
-cxtYzJlMgnw5Y2Zt9tj+QW/1BOMdOftnPSOnsk6rpdCBMW6a2tYubJjbAuge+a2O
-939XGnV0R0cCgYEA0bvmNtNNJAC2LAWWymnnJzgBWHFKZMipMNyXSethPuHo8yYS
-/tSOYAwcRxKSwwMZWDY9RavYv3/ZF+Y9JT0otLFav6B2bq9dRuWlqiOxONLvhs6R
-Faa7eIlt7gBeVpAAFRG5VWC0+38aUCZNRKsHmIsYy8FB3/Winh7NrcUb+7UCgYBi
-egCTZqUixPmFVZjOfWY7Rosm6mlo+pnp5I+sXbpfVkdVMlKsRpipUdfOF6rBjnHV
-937PDOgzbaqg2Ed2PFLpzcPNdVToGefkdcPdMdSf65Nj+WjatzEQlvJEi+YjQFQ/
-4fC5+j8g5apz2gjy3Teb5J96/3qMbxNb6nwQNzO2VQKBgHyHUJOrhvv9+vs7v8nu
-9DgV0b5eNO0g6Q4Ji7oqs24PssPQRA4gMtwmPT8Ha+wWGVzQt2U5LmjsLlrqAO6O
-+Fa3c63sgmt672A8BJ3PL8LI8E2keZiH6rwADSUFp3TZoU2SHamw5NEruNRMIF1R
-0LMsuAs2KEdnwAth2ZmUF2+S
-----END PRIVATE KEY-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAvS8bo6XUmIg+tJAPTjo2PbObDaVSHTSA0VTuu8DN8f4uPl8q
+PKLt6NlAvjWv2S985gkY1WX0lxrhMEk3J+953+LwsAzLLBoBpDIKshPNwV3Dcx+c
+7kSjgoAA/aS+qy59gpjFt6I0QjJaEdUHaJQBfU8t6Cc9K4chl4cusMH+Zf/HGZjn
+Pe7SKchV4b/GNsPV14Dn3EsvOvGHAbGkzP9zH00tbKZ8BQElUZ+PYzx8k0r0PTCq
+WPMcwV72v+MJW8GYSleSVNV3QBe+tmvhv0FupT0VPhAiGrRCLbIhw5pQdljzU28Z
+w1zyBInKIMbnOUt945Tcd8fFWJBliGuFt46P1wIDAQABAoIBAGCYyB0UFGxZzOK3
+WAlScdWpendKPZZJ86hvHILjnIR+i7AvOUrCyoWFQKiekw5rT/PJG1QC/hOVlvvn
+tnD+txUZNFo//hGjqcjkAFATCpE8RgrnTmLeyzpcD6VzVCPl1hIz3Wi5OsO+H/1Q
+77p3MBeCsWcDehlao01SqgV42GPNhliYHi4jjtMTYIH6A+UvfJbd9hcvB2dHtVfI
+Vbv2KKCP8NTlVckR38DoriZSrrK8AoocLh2qe7te0EYMn5v59plgODsBgVMQCzvK
+ZiYUqflLu4NpztvDQParL6kzlCOU8Acm6/V8GEb4BB4miFHxglpgvrzwT2ujAWwl
+kD8b07ECgYEA+/KdruR57XN7BBK+R7I31dFWHAcSs0lIJVMvV0ZDEKPrzFTqL9fE
+gsNngWqZOGZfrB/6vrs6f2d9JJ9ofuUIanSp6e/C0W3pnuR4UZWEWfUHQpwYfxzV
+OCbM5qw0bvWQze2DKF9caoDJMCj0VU5Rz0tAFp787T0aSvR/St6E2VkCgYEAwDoQ
+rFFF2jQX6KVM5V22GeETGJoZQk/3Hlkgi0rGLCjkIljA76DvHc9rLEv5Hf1rw/Ci
+g4knGKyRw4YLR0RhYWcA8u/hfg7xdpka9GaFbMYEA3aKx4Jy9WrzqBq3Ykk1uyqM
+a9Js28v/vPtf+yiZbKadB0oXkNCpY/0FmktyXK8CgYEAurKKTnNYNrEAU4BgKFjU
+L0m0eYh0Pw7qu13tEssqH0aZEQ1LjLBjGlMafDg12ilic/YupO+w5YAWp/DISmAF
+4H0a/BODVhYQrIG49xvIu7Bq9N0e+fKvvbBi3fx1zlOCPlbmfiBMJ0/PxjRS+nPT
+A71LfHfMDTDeLvUG7r/9yeECgYBxIrulb8AZCQf5WTDE3j7LRHkkxa2QJdhf+Dz7
+PmscmoSK4onLf4C8ntOJIr3gNMM0c3By0ko8b3TrCv2gWFKoLSOV2DFzLABZuQrw
+RVbKClFaaG6Nte1LHEOD8RV1t3j0S7qRyytewdYmuBxpih+inv1UyPrNtMG9o7Gk
+ejs46QKBgQChL0z/Ezw/57TGqX7Z5pF2Ej2pckGu3BqObWL2SIALvgog5XpdAess
+sF8DMVXWs4g4YjgDV3HA3WB6u3b/YX9LEuWwIFQ7yxAZXn3RQBigf7SZdZZrrY0H
+argG3/1a52PtwAHjCwpu/JlePgMFEOhK8rjaLj+4trBmTRjK+s/VjQ==
+-----END RSA PRIVATE KEY-----
--- a/docker-compose/cloudformation/README.md
+++ b/docker-compose/cloudformation/README.md
@@ -3,7 +3,7 @@ With the YAML template included in this directory you can create an OpenWiFi Clo
 The template creates a CloudFormation stack based on the Docker Compose Let's Encrypt deployment (https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy/tree/main/docker-compose#lb-deployment-with-letsencrypt-certificates). The created stack consists of an EC2 instance, and depending on the input parameters, also adds a Route53 hosted zone and a DNS record.  
 ⚠️**Note**: Please be aware that you will be billed for the AWS resources if you create a stack from this template.
 1. Login into the AWS Management Console (https://aws.amazon.com/de/console).
-2. Go to the AWS Systems Manager Parameter Store page and create two parameters according to these instructions https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-create-console.html: one for your Digicert-signed websocket certificate and the other one for the corresponding key. You can leave the default parameter details: you need two standard parameters with type `String` and data type `text`. Just copy and paste your certificate and key into the `Value` field of the respective parameter and remember the parameter names.
+2. Go to the AWS Systems Manager Parameter Store page and create two parameters according to these instructions https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-create-console.html: one for your Digicert or Insta signed websocket certificate and the other one for the corresponding key. You can leave the default parameter details: you need two standard parameters with type `String` and data type `text`. Just copy and paste your certificate and key into the `Value` field of the respective parameter and remember the parameter names.
 3. Go to the CloudFormation service page and follow the instructions described here https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-console-create-stack-template.html to upload a template file and choose the template included in this repository.
 4. In the next step you have to enter multiple input parameters required for a successful deployment. Here's an explanation of all parameters:

@@ -15,6 +15,6 @@ The template creates a CloudFormation stack based on the Docker Compose Let's En
 **HostedZoneName**: If you didn't create the hosted zone yet which you want to use for your Route53 record, please specify the domain name of the hosted zone you want to create. Be aware that if you set **CreateRoute53Record** to `True`, you only have to specify either `ExistingHostedZoneId` or `HostedZoneName`. If you decide to create the DNS record yourself, you can leave both parameters empty.  
 **SDKVersion**: The SDK version you want to use for your deployment. You can either use release names (e.g. `v2.6.0`) or Git branch names (for example `release/v2.6.0`).  
 **SDKHostname**: Enter a valid public hostname which you want to use for your deployment. This has to resolve to the public IP address of the created EC2 instance. If you set **CreateRoute53Record** to `False`, don't forget to create a DNS entry manually afterwards.  
-**WebsocketCertParameter**: The name of the AWS Systems Manager parameter containing your Digicert-signed websocket certificate.  
-**WebsocketKeyParameter**: The name of the AWS Systems Manager parameter containing the key to your Digicert-signed websocket certificate.  
+**WebsocketCertParameter**: The name of the AWS Systems Manager parameter containing your Digicert or Insta signed websocket certificate.  
+**WebsocketKeyParameter**: The name of the AWS Systems Manager parameter containing the key to your Digicert or Insta signed websocket certificate.  
 **TraefikAcmeEmail**: Enter a valid email address to complete Let's Encrypt ACME registration.  
--- a/docker-compose/cloudformation/openwifi-cloudsdk-docker-compose.yml
+++ b/docker-compose/cloudformation/openwifi-cloudsdk-docker-compose.yml
@@ -57,7 +57,7 @@ Parameters:
  ExistingHostedZoneId:
    Description: |
      If you want to create the Route53 record in an existing hosted zone,
-      please specify the according hosted zone ID. 
+      please specify the according hosted zone ID.
    Type: String
 #    MinLength: 21
 #    MaxLength: 21
@@ -205,8 +205,6 @@ Resources:
                docker-compose.lb.letsencrypt.yml --env-file .env.letsencrypt"
                alias docker-compose-lb-selfsigned="docker-compose -f \
                docker-compose.lb.selfsigned.yml --env-file .env.selfsigned"
-                alias docker-compose-postgresql="docker-compose -f \
-                docker-compose.yml -f docker-compose.postgresql.yml"
              mode: "000644"
              owner: "root"
              group: "root"
@@ -235,8 +233,6 @@ Resources:
                OWPROV_SYSTEM_URI_PUBLIC: !Sub "https://${SDKHostname}:16005"
                OWANALYTICS_SYSTEM_URI_PUBLIC: !Sub "https://${SDKHostname}:16009"
                OWSUB_SYSTEM_URI_PUBLIC: !Sub "https://${SDKHostname}:16006"
-                OWRRM_SERVICECONFIG_PRIVATEENDPOINT: !Sub "http://owrrm.wlan.local:17007"
-                OWRRM_SERVICECONFIG_PUBLICENDPOINT: !Sub "https://${SDKHostname}:16789"
                TRAEFIK_ACME_EMAIL: !Sub "${TraefikAcmeEmail}"
              cwd: "~/wlan-cloud-ucentral-deploy/docker-compose"
    Properties:
@@ -293,10 +289,6 @@ Resources:
          FromPort: "16009"
          ToPort: "16009"
          CidrIp: 0.0.0.0/0
-        - IpProtocol: tcp
-          FromPort: "16789"
-          ToPort: "16789"
-          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: "5912"
          ToPort: "5913"
@@ -308,7 +300,7 @@ Resources:
  CloudSDKHostedZone:
    Condition: HasHostedZoneName
    Type: AWS::Route53::HostedZone
-    Properties: 
+    Properties:
      Name: !Ref HostedZoneName
  CloudSDKRoute53RecordExistingHostedZone:
    Condition: CreateRecordInExistingZone
--- a/docker-compose/dco
+++ b/docker-compose/dco
@@ -0,0 +1,45 @@
+#!/bin/bash
+# Wrapper around docker-compose that will use the correct command line options
+# depending on what type of setup you have.
+# It captures $1 == clean and performs cleanup of the volumes and data directories,
+# It captures $1 == launch or l and runs: ... up -d,
+# but passes everything else straight to the docker-compose command.
+cmd="docker-compose"
+if command -v docker-compose > /dev/null 2>&1 ; then
+    cmd="docker-compose"
+elif command -v docker > /dev/null 2>&1 ; then
+    cmd="docker compose"
+else
+    echo "Could not find docker-compose or docker commands."
+    exit 1
+fi
+deploy_type=$(grep "^DEPLOY_TYPE=" .env | awk -F= '{ print $2 }')
+[ -z "$deploy_type" ] && deploy_type="default"
+if [[ "$deploy_type" == "letsencrypt" ]] ; then
+    cmd="$cmd -f docker-compose.lb.letsencrypt.yml --env-file .env.letsencrypt"
+elif [[ "$deploy_type" == "selfsigned" ]] ; then
+    cmd="$cmd -f docker-compose.lb.selfsigned.yml --env-file .env.selfsigned"
+elif [[ "$deploy_type" == "default" ]] ; then
+    # ok
+    true
+else
+    echo "Invalid DEPLOY_TYPE: $deploy_type"
+    echo "Should be one of: default, letsencrypt or selfsigned"
+    exit 1
+fi
+if [[ "$1" == "clean" ]] ; then
+    set -x
+    $cmd down -v
+    rm -rf *_data
+elif [[ "$1" == "launch" || "$1" == "l" ]] ; then
+    set -x
+    $cmd up -d
+elif [[ "$1" == "relaunch" || "$1" == "rel" ]] ; then
+    set -x
+    $cmd down
+    sleep 5
+    $cmd up -d
+else
+    set -x
+    $cmd "$@"
+fi
--- a/docker-compose/deploy.sh
+++ b/docker-compose/deploy.sh
@@ -39,12 +39,9 @@ usage () {
 #  echo "- OWSUB_SYSTEM_URI_PRIVATE - private URL to be used for OWSub";
  echo "- OWSUB_SYSTEM_URI_PUBLIC - public URL to be used for OWSub";
  echo;
-  echo "- OWRRM_SERVICECONFIG_PRIVATEENDPOINT - private URL to be used for OWRRM";
-  echo "- OWRRM_SERVICECONFIG_PUBLICENDPOINT - public URL to be used for OWRRM";
-  echo;
  echo "Optional environment variables:"
-  echo "- WEBSOCKET_CERT - Your Digicert-signed websocket certificate"
-  echo "- WEBSOCKET_KEY - The key to your Digicert-signed websocket certificate"
+  echo "- WEBSOCKET_CERT - Your Digicert or Insta signed websocket certificate"
+  echo "- WEBSOCKET_KEY - The key to your Digicert or Insta signed websocket certificate"
  echo;
  echo "- OWSEC_AUTHENTICATION_DEFAULT_USERNAME - username to be used for requests to OWSec";
  echo "- OWSEC_AUTHENTICATION_DEFAULT_PASSWORD - hashed password for OWSec (details on this may be found in https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/#authenticationdefaultpassword)";
@@ -91,9 +88,6 @@ usage () {
 ## OWSub configuration variables
 #[ -z ${OWSUB_SYSTEM_URI_PRIVATE+x} ] && echo "OWSUB_SYSTEM_URI_PRIVATE is unset" && usage && exit 1
 [ -z ${OWSUB_SYSTEM_URI_PUBLIC+x} ] && echo "OWSUB_SYSTEM_URI_PUBLIC is unset" && usage && exit 1
-## OWRRM configuration variables
-[ -z ${OWRRM_SERVICECONFIG_PRIVATEENDPOINT+x} ] && echo "OWRRM_SERVICECONFIG_PRIVATEENDPOINT is unset" && usage && exit 1
-[ -z ${OWRRM_SERVICECONFIG_PUBLICENDPOINT+x} ] && echo "OWRRM_SERVICECONFIG_PUBLICENDPOINT is unset" && usage && exit 1

 # Search and replace image version tags if set
 if [[ ! -z "$OWGW_VERSION" ]]; then
@@ -181,9 +175,6 @@ sed -i "s~.*SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$SYSTEM_URI_UI~" owanalytics.env
 sed -i "s~.*SYSTEM_URI_PUBLIC=.*~SYSTEM_URI_PUBLIC=$OWSUB_SYSTEM_URI_PUBLIC~" owsub.env
 sed -i "s~.*SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$SYSTEM_URI_UI~" owsub.env

-sed -i "s~.*SERVICECONFIG_PRIVATEENDPOINT=.*~SERVICECONFIG_PRIVATEENDPOINT=$OWRRM_SERVICECONFIG_PRIVATEENDPOINT~" owrrm.env
-sed -i "s~.*SERVICECONFIG_PUBLICENDPOINT=.*~SERVICECONFIG_PUBLICENDPOINT=$OWRRM_SERVICECONFIG_PUBLICENDPOINT~" owrrm.env
-
 if [[ ! -z "$TRAEFIK_ACME_EMAIL" ]]; then
  sed -i "s~.*TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_EMAIL=.*~TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_EMAIL=$TRAEFIK_ACME_EMAIL~" traefik.env
 fi
--- a/docker-compose/docker-compose.lb.letsencrypt.yml
+++ b/docker-compose/docker-compose.lb.letsencrypt.yml
@@ -1,5 +1,3 @@
-version: '3'
-
 volumes:
  owgw_data:
    driver: local
@@ -13,15 +11,9 @@ volumes:
    driver: local
  owsub_data:
    driver: local
-  owrrm_data:
-    driver: local
-  zookeeper_data:
-    driver: local
-  zookeeper_datalog:
-    driver: local
  kafka_data:
    driver: local
-  mysql_data:
+  postgresql_data:
    driver: local
  letsencrypt_certs:
    driver: local
@@ -40,7 +32,11 @@ services:
      - .env.letsencrypt
      - owgw.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owgw"]
    restart: unless-stopped
    volumes:
      - owgw_data:${OWGW_ROOT}/persist
@@ -75,7 +71,11 @@ services:
      - .env.letsencrypt
      - owsec.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsec"]
    restart: unless-stopped
    volumes:
      - owsec_data:${OWSEC_ROOT}/persist
@@ -91,7 +91,11 @@ services:
      - .env.letsencrypt
      - owfms.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owfms"]
    restart: unless-stopped
    volumes:
      - owfms_data:${OWFMS_ROOT}/persist
@@ -107,7 +111,11 @@ services:
      - .env.letsencrypt
      - owprov.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owprov"]
    restart: unless-stopped
    volumes:
      - owprov_data:${OWPROV_ROOT}
@@ -138,7 +146,11 @@ services:
      - .env.letsencrypt
      - owanalytics.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owanalytics"]
    restart: unless-stopped
    volumes:
      - owanalytics_data:${OWANALYTICS_ROOT}
@@ -154,50 +166,28 @@ services:
      - .env.letsencrypt
      - owsub.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsub"]
    restart: unless-stopped
    volumes:
      - owsub_data:${OWSUB_ROOT}
      - ./certs:/${OWSUB_ROOT}/certs

-  owrrm:
-    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owrrm:${OWRRM_TAG}"
-    networks:
-      openwifi:
-        aliases:
-          - ${INTERNAL_OWRRM_HOSTNAME}
-    env_file:
-      - owrrm.env
-    depends_on:
-      - mysql
-      - kafka
-    restart: unless-stopped
-    volumes:
-      - owrrm_data:/owrrm-data
-
-  zookeeper:
-    image: "zookeeper:${ZOOKEEPER_TAG}"
-    networks:
-      openwifi:
-    restart: unless-stopped
-    volumes:
-      - zookeeper_data:/data
-      - zookeeper_datalog:/datalog
-
  kafka:
-    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
    networks:
      openwifi:
    env_file:
      - kafka.env
    restart: unless-stopped
-    depends_on:
-      - zookeeper
    volumes:
      - kafka_data:/bitnami/kafka

  init-kafka:
-    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
    networks:
      openwifi:
    depends_on:
@@ -208,6 +198,8 @@ services:
      - /bin/sh
      - -c
      - |
+        echo "Sleeping to allow kafka to start up..."
+        sleep 10
        echo "Creating all required Kafka topics..."
        for topic in $$TOPICS; do
          /opt/bitnami/kafka/bin/kafka-topics.sh \
@@ -215,16 +207,6 @@ services:
          --partitions 1 --bootstrap-server kafka:9092
        done && echo "Successfully created Kafka topics, exiting." && exit 0

-  mysql:
-    image: "mysql:${MYSQL_TAG}"
-    networks:
-      openwifi:
-    env_file:
-      - mysql.env
-    restart: unless-stopped
-    volumes:
-      - mysql_data:/var/lib/mysql
-
  traefik:
    image: "traefik:${TRAEFIK_TAG}"
    networks:
@@ -241,7 +223,6 @@ services:
      - owprov-ui
      - owanalytics
      - owsub
-      - owrrm
    restart: unless-stopped
    volumes:
      - "./traefik/openwifi_letsencrypt.yaml:/etc/traefik/openwifi.yaml"
@@ -268,7 +249,30 @@ services:
      - "16006:16006"
      - "5912:5912"
      - "5913:5913"
-      - "16789:16789"
      - "1812:1812/udp"
      - "1813:1813/udp"
      - "3799:3799/udp"
+
+  postgresql:
+    image: "postgres:${POSTGRESQL_TAG}"
+    networks:
+      openwifi:
+    command:
+      - "postgres"
+      - "-c"
+      - "max_connections=400"
+      - "-c"
+      - "shared_buffers=20MB"
+    env_file:
+      - postgresql.env
+    restart: unless-stopped
+    volumes:
+      - postgresql_data:/var/lib/postgresql/data
+      - ./postgresql/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
+    healthcheck:
+      # owsub is the last DB created in init-db.sh
+      test: ["CMD-SHELL", "pg_isready -U postgres -d owsub"]
+      interval: 10s
+      retries: 5
+      start_period: 30s
+      timeout: 10s
--- a/docker-compose/docker-compose.lb.selfsigned.yml
+++ b/docker-compose/docker-compose.lb.selfsigned.yml
@@ -1,5 +1,3 @@
-version: '3'
-
 volumes:
  owgw_data:
    driver: local
@@ -13,15 +11,9 @@ volumes:
    driver: local
  owsub_data:
    driver: local
-  owrrm_data:
-    driver: local
-  zookeeper_data:
-    driver: local
-  zookeeper_datalog:
-    driver: local
  kafka_data:
    driver: local
-  mysql_data:
+  postgresql_data:
    driver: local

 networks:
@@ -38,7 +30,11 @@ services:
      - .env.selfsigned
      - owgw.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owgw"]
    restart: unless-stopped
    volumes:
      - owgw_data:${OWGW_ROOT}/persist
@@ -50,8 +46,6 @@ services:

  owgw-ui:
    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owgw-ui:${OWGWUI_TAG}"
-    env_file: 
-      - owgw-ui.env
    networks:
      openwifi:
        aliases:
@@ -75,7 +69,11 @@ services:
      - .env.selfsigned
      - owsec.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsec"]
    restart: unless-stopped
    volumes:
      - owsec_data:${OWSEC_ROOT}/persist
@@ -91,7 +89,11 @@ services:
      - .env.selfsigned
      - owfms.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owfms"]
    restart: unless-stopped
    volumes:
      - owfms_data:${OWFMS_ROOT}/persist
@@ -107,7 +109,11 @@ services:
      - .env.selfsigned
      - owprov.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owprov"]
    restart: unless-stopped
    volumes:
      - owprov_data:${OWPROV_ROOT}
@@ -138,7 +144,11 @@ services:
      - .env.selfsigned
      - owanalytics.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owanalytics"]
    restart: unless-stopped
    volumes:
      - owanalytics_data:${OWANALYTICS_ROOT}
@@ -154,50 +164,28 @@ services:
      - .env.selfsigned
      - owsub.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsub"]
    restart: unless-stopped
    volumes:
      - owsub_data:${OWSUB_ROOT}
      - ./certs:/${OWSUB_ROOT}/certs

-  owrrm:
-    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owrrm:${OWRRM_TAG}"
-    networks:
-      openwifi:
-        aliases:
-          - ${INTERNAL_OWRRM_HOSTNAME}
-    env_file:
-      - owrrm.env
-    depends_on:
-      - mysql
-      - kafka
-    restart: unless-stopped
-    volumes:
-      - owrrm_data:/owrrm-data
-
-  zookeeper:
-    image: "zookeeper:${ZOOKEEPER_TAG}"
-    networks:
-      openwifi:
-    restart: unless-stopped
-    volumes:
-      - zookeeper_data:/data
-      - zookeeper_datalog:/datalog
-
  kafka:
-    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
    networks:
      openwifi:
    env_file:
      - kafka.env
    restart: unless-stopped
-    depends_on:
-      - zookeeper
    volumes:
      - kafka_data:/bitnami/kafka

  init-kafka:
-    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
    networks:
      openwifi:
    depends_on:
@@ -208,6 +196,8 @@ services:
      - /bin/sh
      - -c
      - |
+        echo "Sleeping to allow kafka to start up..."
+        sleep 10
        echo "Creating all required Kafka topics..."
        for topic in $$TOPICS; do
          /opt/bitnami/kafka/bin/kafka-topics.sh \
@@ -215,16 +205,6 @@ services:
          --partitions 1 --bootstrap-server kafka:9092
        done && echo "Successfully created Kafka topics, exiting." && exit 0

-  mysql:
-    image: "mysql:${MYSQL_TAG}"
-    networks:
-      openwifi:
-    env_file:
-      - mysql.env
-    restart: unless-stopped
-    volumes:
-      - mysql_data:/var/lib/mysql
-
  traefik:
    image: "traefik:${TRAEFIK_TAG}"
    networks:
@@ -240,7 +220,6 @@ services:
      - owprov-ui
      - owanalytics
      - owsub
-      - owrrm
    restart: unless-stopped
    volumes:
      - "./traefik/openwifi_selfsigned.yaml:/etc/traefik/openwifi.yaml"
@@ -262,7 +241,30 @@ services:
      - "16006:16006"
      - "5912:5912"
      - "5913:5913"
-      - "16789:16789"
      - "1812:1812/udp"
      - "1813:1813/udp"
      - "3799:3799/udp"
+
+  postgresql:
+    image: "postgres:${POSTGRESQL_TAG}"
+    networks:
+      openwifi:
+    command:
+      - "postgres"
+      - "-c"
+      - "max_connections=400"
+      - "-c"
+      - "shared_buffers=20MB"
+    env_file:
+      - postgresql.env
+    restart: unless-stopped
+    volumes:
+      - postgresql_data:/var/lib/postgresql/data
+      - ./postgresql/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
+    healthcheck:
+      # owsub is the last DB created in init-db.sh
+      test: ["CMD-SHELL", "pg_isready -U postgres -d owsub"]
+      interval: 10s
+      retries: 5
+      start_period: 30s
+      timeout: 10s
--- a/docker-compose/docker-compose.postgresql.yml
+++ b/docker-compose/docker-compose.postgresql.yml
@@ -1,53 +0,0 @@
-version: '3'
-
-volumes:
-  postgresql_data:
-    driver: local
-
-services:
-  owgw:
-    depends_on:
-      - postgresql
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owgw"]
-
-  owsec:
-    depends_on:
-      - postgresql
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsec"]
-
-  owfms:
-    depends_on:
-      - postgresql
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owfms"]
-
-  owprov:
-    depends_on:
-      - postgresql
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owprov"]
-
-  owanalytics:
-    depends_on:
-      - postgresql
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owanalytics"]
-
-  owsub:
-    depends_on:
-      - postgresql
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsub"]
-
-  postgresql:
-    image: "postgres:${POSTGRESQL_TAG}"
-    networks:
-      openwifi:
-    command:
-      - "postgres"
-      - "-c"
-      - "max_connections=400"
-      - "-c"
-      - "shared_buffers=20MB"    
-    env_file:
-      - postgresql.env
-    restart: unless-stopped
-    volumes:
-      - postgresql_data:/var/lib/postgresql/data
-      - ./postgresql/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
--- a/docker-compose/docker-compose.yml
+++ b/docker-compose/docker-compose.yml
@@ -1,18 +1,9 @@
-version: '3'
-
 volumes:
-#  owrrm_data:
-#    driver: local
-  zookeeper_data:
-    driver: local
-  zookeeper_datalog:
-    driver: local
  kafka_data:
    driver: local
-  mysql_data:
+  postgresql_data:
    driver: local

-
 networks:
  openwifi:

@@ -26,7 +17,11 @@ services:
    env_file:
      - owgw.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owgw"]
    restart: unless-stopped
    volumes:
      - "./owgw_data:${OWGW_ROOT}"
@@ -77,7 +72,11 @@ services:
    env_file:
      - owsec.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsec"]
    restart: unless-stopped
    volumes:
      - "./owsec_data:${OWSEC_ROOT}"
@@ -95,7 +94,11 @@ services:
    env_file:
      - owfms.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owfms"]
    restart: unless-stopped
    volumes:
      - "./owfms_data:${OWFMS_ROOT}"
@@ -113,7 +116,11 @@ services:
    env_file:
      - owprov.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owprov"]
    restart: unless-stopped
    volumes:
      - "./owprov_data:${OWPROV_ROOT}"
@@ -153,7 +160,11 @@ services:
    env_file:
      - owanalytics.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owanalytics"]
    restart: unless-stopped
    volumes:
      - "./owanalytics_data:${OWANALYTICS_ROOT}"
@@ -171,7 +182,11 @@ services:
    env_file:
      - owsub.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
+      postgresql:
+        condition: service_healthy
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsub"]
    restart: unless-stopped
    volumes:
      - "./owsub_data:${OWSUB_ROOT}"
@@ -180,30 +195,18 @@ services:
      - "16006:16006"
      - "16106:16106"

-
-  zookeeper:
-    image: "zookeeper:${ZOOKEEPER_TAG}"
-    networks:
-      openwifi:
-    restart: unless-stopped
-    volumes:
-      - zookeeper_data:/data
-      - zookeeper_datalog:/datalog
-
  kafka:
-    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
    networks:
      openwifi:
    env_file:
      - kafka.env
    restart: unless-stopped
-    depends_on:
-      - zookeeper
    volumes:
      - kafka_data:/bitnami/kafka

  init-kafka:
-    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
    networks:
      openwifi:
    depends_on:
@@ -214,6 +217,8 @@ services:
      - /bin/sh
      - -c
      - |
+        echo "Sleeping to allow kafka to start up..."
+        sleep 10
        echo "Creating all required Kafka topics..."
        for topic in $$TOPICS; do
          /opt/bitnami/kafka/bin/kafka-topics.sh \
@@ -221,29 +226,26 @@ services:
          --partitions 1 --bootstrap-server kafka:9092
        done && echo "Successfully created Kafka topics, exiting." && exit 0

-# NOTE currently OWRRM is only supported in LB installations
-#  owrrm:
-#    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owrrm:${OWRRM_TAG}"
-#    networks:
-#      openwifi:
-#        aliases:
-#          - ${INTERNAL_OWRRM_HOSTNAME}
-#    env_file:
-#      - owrrm.env
-#    depends_on:
-#      - mysql
-#      - kafka
-#    restart: unless-stopped
-#    volumes:
-#      - owrrm_data:/owrrm-data
-#    ports:
-#      - "16789:16789"
-#  mysql:
-#    image: "mysql:${MYSQL_TAG}"
-#    networks:
-#      openwifi:
-#    env_file:
-#      - mysql.env
-#    restart: unless-stopped
-#    volumes:
-#      - mysql_data:/var/lib/mysql
+  postgresql:
+    image: "postgres:${POSTGRESQL_TAG}"
+    networks:
+      openwifi:
+    command:
+      - "postgres"
+      - "-c"
+      - "max_connections=400"
+      - "-c"
+      - "shared_buffers=20MB"
+    env_file:
+      - postgresql.env
+    restart: unless-stopped
+    volumes:
+      - postgresql_data:/var/lib/postgresql/data
+      - ./postgresql/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
+    healthcheck:
+      # owsub is the last DB created in init-db.sh
+      test: ["CMD-SHELL", "pg_isready -U postgres -d owsub"]
+      interval: 10s
+      retries: 5
+      start_period: 30s
+      timeout: 10s
--- a/docker-compose/kafka.env
+++ b/docker-compose/kafka.env
@@ -1,3 +1,10 @@
-KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
 ALLOW_PLAINTEXT_LISTENER=yes
-TOPICS=command connection device_event_queue device telemetry healthcheck provisioning_change service_events state wifiscan rrm
+TOPICS=command connection device_event_queue device_telemetry healthcheck provisioning_change service_events state wifiscan
+KAFKA_CFG_NODE_ID=0
+KAFKA_CFG_PROCESS_ROLES=controller,broker
+KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=0@kafka:9093
+KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:9093
+KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://:9092
+KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT
+KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
+KAFKA_CFG_INTER_BROKER_LISTENER_NAME=PLAINTEXT
--- a/docker-compose/mysql.env
+++ b/docker-compose/mysql.env
@@ -1,5 +0,0 @@
-#MYSQL_RANDOM_ROOT_PASSWORD=yes
-MYSQL_ROOT_PASSWORD=openwifi
-MYSQL_DATABASE=owrrm
-#MYSQL_USER=owrrm
-#MYSQL_PASSWORD=openwifi
--- a/docker-compose/owanalytics.env
+++ b/docker-compose/owanalytics.env
@@ -23,17 +23,19 @@ SYSTEM_DATA=$OWANALYTICS_ROOT/persist
 SYSTEM_URI_PRIVATE=https://owanalytics.wlan.local:17009
 SYSTEM_URI_PUBLIC=https://openwifi.wlan.local:16009
 SYSTEM_URI_UI=https://openwifi.wlan.local
+
 #SECURITY_RESTAPI_DISABLE=false
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-#STORAGE_TYPE=sqlite
-#STORAGE_TYPE_POSTGRESQL_HOST=localhost
-#STORAGE_TYPE_POSTGRESQL_USERNAME=owanalytics
-#STORAGE_TYPE_POSTGRESQL_PASSWORD=owanalytics
-#STORAGE_TYPE_POSTGRESQL_DATABASE=owanalytics
-#STORAGE_TYPE_POSTGRESQL_PORT=5432
+STORAGE_TYPE=postgresql
+STORAGE_TYPE_POSTGRESQL_HOST=postgresql
+STORAGE_TYPE_POSTGRESQL_USERNAME=owanalytics
+STORAGE_TYPE_POSTGRESQL_PASSWORD=owanalytics
+STORAGE_TYPE_POSTGRESQL_DATABASE=owanalytics
+STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owanalytics
 #STORAGE_TYPE_MYSQL_PASSWORD=owanalytics
 #STORAGE_TYPE_MYSQL_DATABASE=owanalytics
 #STORAGE_TYPE_MYSQL_PORT=3306
+#STORAGE_TYPE=sqlite
--- a/docker-compose/owfms.env
+++ b/docker-compose/owfms.env
@@ -29,14 +29,15 @@ S3_KEY=AKIAUG47UZG7R6SRLD7F
 #S3_BUCKET_URI=ucentral-ap-firmware.s3.amazonaws.com
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-#STORAGE_TYPE=sqlite
-#STORAGE_TYPE_POSTGRESQL_HOST=localhost
-#STORAGE_TYPE_POSTGRESQL_USERNAME=owfms
-#STORAGE_TYPE_POSTGRESQL_PASSWORD=owfms
-#STORAGE_TYPE_POSTGRESQL_DATABASE=owfms
-#STORAGE_TYPE_POSTGRESQL_PORT=5432
+STORAGE_TYPE=postgresql
+STORAGE_TYPE_POSTGRESQL_HOST=postgresql
+STORAGE_TYPE_POSTGRESQL_USERNAME=owfms
+STORAGE_TYPE_POSTGRESQL_PASSWORD=owfms
+STORAGE_TYPE_POSTGRESQL_DATABASE=owfms
+STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owfms
 #STORAGE_TYPE_MYSQL_PASSWORD=owfms
 #STORAGE_TYPE_MYSQL_DATABASE=owfms
 #STORAGE_TYPE_MYSQL_PORT=3306
+#STORAGE_TYPE=sqlite
--- a/docker-compose/owgw.env
+++ b/docker-compose/owgw.env
@@ -56,15 +56,17 @@ RADIUS_PROXY_ENABLE=true
 #RADIUS_PROXY_COA_PORT=3799
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-#STORAGE_TYPE=sqlite
-#STORAGE_TYPE_POSTGRESQL_HOST=localhost
-#STORAGE_TYPE_POSTGRESQL_USERNAME=owgw
-#STORAGE_TYPE_POSTGRESQL_PASSWORD=owgw
-#STORAGE_TYPE_POSTGRESQL_DATABASE=owgw
-#STORAGE_TYPE_POSTGRESQL_PORT=5432
+STORAGE_TYPE=postgresql
+STORAGE_TYPE_POSTGRESQL_HOST=postgresql
+STORAGE_TYPE_POSTGRESQL_USERNAME=owgw
+STORAGE_TYPE_POSTGRESQL_PASSWORD=owgw
+STORAGE_TYPE_POSTGRESQL_DATABASE=owgw
+STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owgw
 #STORAGE_TYPE_MYSQL_PASSWORD=owgw
 #STORAGE_TYPE_MYSQL_DATABASE=owgw
 #STORAGE_TYPE_MYSQL_PORT=3306
+#STORAGE_TYPE=sqlite
+
 #CERTIFICATES_ALLOWMISMATCH=false
--- a/docker-compose/owls/.env
+++ b/docker-compose/owls/.env
@@ -1,17 +1,28 @@
-# Image tags
 COMPOSE_PROJECT_NAME=owls
-OWSEC_TAG=main
+
+# Image tags
+# Currently main branches don't work - owlsui is not compatible with owls.
+#OWSEC_TAG=main
+#OWLSUI_TAG=master
+OWSEC_TAG=v2.9.0
+OWFMS_TAG=v2.9.0
+OWLSUI_TAG=v2.9.0
 OWLS_TAG=main
-OWLSUI_TAG=master
-KAFKA_TAG=2.8.0-debian-10-r43
-ZOOKEEPER_TAG=latest
+
+KAFKA_TAG=3.7-debian-12
+ACMESH_TAG=latest
+TRAEFIK_TAG=v3.1.2

 # Microservice root/config directories
 OWSEC_ROOT=/owsec-data
 OWSEC_CONFIG=/owsec-data
+OWFMS_ROOT=/owfms-data
+OWFMS_CONFIG=/owfms-data
 OWLS_ROOT=/owls-data
 OWLS_CONFIG=/owls-data

 # Microservice hostnames
 INTERNAL_OWSEC_HOSTNAME=owsec.wlan.local
 INTERNAL_OWLS_HOSTNAME=owls.wlan.local
+INTERNAL_OWFMS_HOSTNAME=owfms.wlan.local
+INTERNAL_OWLSUI_HOSTNAME=owls-ui.wlan.local
--- a/docker-compose/owls/README.md
+++ b/docker-compose/owls/README.md
@@ -1,6 +1,6 @@
 # OpenWifi OWLS Docker Compose
 ## Deployment with self-signed certificates
-To run a load simulation you need to generate a specific Digicert-signed AP certificate which will be used to connect to the gateway. The certificate serial number has to start with the digits `53494d` since otherwise the gateway won't allow a load simulation. The rest of the serial number and the specified redirector URL can be chosen randomly. You only need to generate one AP certificate for your simulations.  
+To run a load simulation you need to generate a specific Digicert or Insta signed AP certificate which will be used to connect to the gateway. The certificate serial number has to start with the digits `53494d` since otherwise the gateway won't allow a load simulation. The rest of the serial number and the specified redirector URL can be chosen randomly. You only need to generate one AP certificate for your simulations.
 Be aware that since the OWLS deployment partly exposes the same ports on the host as the OpenWifi deployment, it is not intended that both run on the same host.
 1. Copy or move your AP load simulation certificate into the `docker-compose/certs` directory. Don't forget to name the files `device-cert.pem` and `device-key.pem` or adapt the path names in the OWLS configuration if you're using different file names.
 2. To be able to run load simulation tests against your OpenWifi SDK deployment, you'll have to [add the serial number of your generated AP certificate to the gateway configuration](https://github.com/Telecominfraproject/wlan-cloud-owls#prepare-your-openwifi-gateway). You can do that by either editing [owgw.env](../owgw.env) or doing the changes directly in your OWGW configuration file if it is exposed on your Docker host.
@@ -14,3 +14,22 @@ Be aware that since the OWLS deployment partly exposes the same ports on the hos
 10. In the Simulation tab, click on the + sign on the right side to add a load simulation.
 11. Fill out the required fields. MAC prefix is used for the MAC addresses of the simulated devices, so you can use any six-digit hexadecimal number. Specify the remote address of your OpenWifi gateway in the Gateway field, for example `https://openwifi.wlan.local:15002`. Adapt the rest of the settings according to your needs.
 12. Click on the floppy disk icon to save your load simulation. You can run it by clicking the play symbol in the table view.
+
+## Deployment with Let's Encrypt certificates
+To run a load simulation you need to generate a specific Digicert or Insta signed AP certificate which will be used to connect to the gateway. The certificate serial number has to start with the digits `53494d` since otherwise the gateway won't allow a load simulation. The rest of the serial number and the specified redirector URL can be chosen randomly. You only need to generate one AP certificate for your simulations.  Be aware that since the OWLS deployment partly exposes the same ports on the host as the OpenWifi deployment, it is not intended that both run on the same host.
+1. Copy or move your AP load simulation certificate into the `docker-compose/certs` directory. Don't forget to name the files `device-cert.pem` and `device-key.pem` or adapt the path names in the OWLS configuration if you're using different file names.
+2. To be able to run load simulation tests against your OpenWifi SDK deployment, you'll have to [add the serial number of your generated AP certificate to the gateway configuration](https://github.com/Telecominfraproject/wlan-cloud-owls#prepare-your-openwifi-gateway). You can do that by either editing [owgw.env](../owgw.env) or doing the changes directly in your OWGW configuration file if it is exposed on your Docker host.
+3. Switch into the project directory with `cd docker-compose/owls`.
+4. Add an entry for `openwifi-owls.wlan.local` in your hosts file which points to `127.0.0.1` or whatever the IP of the host running the OWLS deployment is.
+5. Create an alias `alias dcowls='docker-compose -f docker-compose.lb.letsencrypt.yml`.
+6. Change SDKHOSTNAME in .env to the desired externally reachable host name. This name must resolve to the IP of the host. ie. SDKHOSTNAME=owls.example.com
+7. Change in owls-ui.env: `REACT_APP_UCENTRALSEC_URL=https://owls.example.com:16001`
+8. Change SYSTEM_URI_PUBLIC in owsec.env, owfms.env and owls.env.
+ie. for owls.env: `SYSTEM_URI_PUBLIC=https://owls.example.com:16007 SYSTEM_URI_UI=https://owls.example.com`. Make sure you maintain the correct port for each service in SYSTEM_URI_PUBLIC.
+9. Make sure the following ports are open: 80, 443, 16001, 16004, 16007 (80 is required by the initial Let's Encrypt challenge.)
+10. Spin up the deployment with `dcowls up -d`.
+11. Check if the containers are up and running with `dcowls ps`.
+12. Login to the UI by visiting ie. https://owls.example.com and follow the instructions to change your default password.
+13. In the Simulation tab, click on the + sign on the right side to add a load simulation.
+14. Fill out the required fields. MAC prefix is used for the MAC addresses of the simulated devices, so you can use any six-digit hexadecimal number. Specify the remote address of your OpenWifi gateway in the Gateway field, for example `https://gw.sdk.example.com:15002`. Adapt the rest of the settings according to your needs.
+15. Click on the floppy disk icon to save your load simulation. You can run it by clicking the play symbol in the table view.
--- a/docker-compose/owls/docker-compose.lb.letsencrypt.yml
+++ b/docker-compose/owls/docker-compose.lb.letsencrypt.yml
@@ -0,0 +1,136 @@
+volumes:
+  kafka_data:
+    driver: local
+
+networks:
+  owls:
+
+services:
+  owsec:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owsec:${OWSEC_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWSEC_HOSTNAME}
+    env_file:
+      - owsec.env
+    depends_on:
+      init-kafka:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    volumes:
+      - "./owsec_data:${OWSEC_ROOT}"
+      - "../certs:/${OWSEC_ROOT}/certs"
+
+  owfms:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owfms:${OWFMS_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWFMS_HOSTNAME}
+    env_file:
+      - owfms.env
+    depends_on:
+      init-kafka:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    volumes:
+      - "./owfms_data:${OWFMS_ROOT}"
+      - "../certs:/${OWFMS_ROOT}/certs"
+
+  owls:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owls:${OWLS_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWLS_HOSTNAME}
+    env_file:
+      - owls.env
+    depends_on:
+      owsec:
+        condition: service_started
+      init-kafka:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    volumes:
+      - "./owls_data:${OWLS_ROOT}"
+      - "../certs:/${OWLS_ROOT}/certs"
+
+  owls-ui:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owls-ui:${OWLSUI_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWLSUI_HOSTNAME}
+    env_file:
+      - owls-ui.env
+    depends_on:
+      - owsec
+      - owfms
+      - owls
+    restart: unless-stopped
+    volumes:
+      - "./owls-ui/default.conf:/etc/nginx/conf.d/default.conf"
+      - "../certs/restapi-cert.pem:/etc/nginx/restapi-cert.pem"
+      - "../certs/restapi-key.pem:/etc/nginx/restapi-key.pem"
+
+  traefik:
+    image: "traefik:${TRAEFIK_TAG}"
+    networks:
+      owls:
+    env_file:
+      - traefik.env
+    depends_on:
+      - owsec
+      - owfms
+      - owls
+      - owls-ui
+    restart: unless-stopped
+    volumes:
+      - "./traefik/openwifi_letsencrypt.yaml:/etc/traefik/openwifi.yaml"
+      - "../certs/restapi-ca.pem:/certs/restapi-ca.pem"
+      - "./letsencrypt_certs:/letsencrypt"
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        timeout 10m sh -c 'until [[ "$$(getent hosts $SDKHOSTNAME)" ]]; do echo "Waiting until DNS record for $SDKHOSTNAME is resolvable"; sleep 5; done' \
+        && ./entrypoint.sh traefik
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8080:8080"
+      - "16001:16001"
+      - "16004:16004"
+      - "16007:16007"
+
+  kafka:
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
+    networks:
+      owls:
+    env_file:
+      - kafka.env
+    restart: unless-stopped
+    volumes:
+      - kafka_data:/bitnami/kafka
+
+  init-kafka:
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
+    networks:
+      owls:
+    depends_on:
+      - kafka
+    env_file:
+      - kafka.env
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        echo "Sleeping to allow kafka to start up..."
+        sleep 10
+        echo "Creating all required Kafka topics..."
+        for topic in $$TOPICS; do
+          /opt/bitnami/kafka/bin/kafka-topics.sh \
+          --create --if-not-exists --topic $$topic --replication-factor 1 \
+          --partitions 1 --bootstrap-server kafka:9092
+        done && echo "Successfully created Kafka topics, exiting." && exit 0
--- a/docker-compose/owls/docker-compose.yml
+++ b/docker-compose/owls/docker-compose.yml
@@ -1,10 +1,4 @@
-version: '3'
-
 volumes:
-  zookeeper_data:
-    driver: local
-  zookeeper_datalog:
-    driver: local
  kafka_data:
    driver: local

@@ -21,7 +15,8 @@ services:
    env_file:
      - owsec.env
    depends_on:
-      - kafka
+      init-kafka:
+        condition: service_completed_successfully
    restart: unless-stopped
    volumes:
      - "./owsec_data:${OWSEC_ROOT}"
@@ -30,6 +25,25 @@ services:
      - "16001:16001"
      - "16101:16101"

+  owfms:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owfms:${OWFMS_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWFMS_HOSTNAME}
+    env_file:
+      - owfms.env
+    depends_on:
+      init-kafka:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    volumes:
+      - "./owfms_data:${OWFMS_ROOT}"
+      - "../certs:/${OWFMS_ROOT}/certs"
+    ports:
+      - "16004:16004"
+      - "16104:16104"
+
  owls:
    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owls:${OWLS_TAG}"
    networks:
@@ -39,8 +53,10 @@ services:
    env_file:
      - owls.env
    depends_on:
-      - owsec
-      - kafka
+      owsec:
+        condition: service_started
+      init-kafka:
+        condition: service_completed_successfully
    restart: unless-stopped
    volumes:
      - "./owls_data:${OWLS_ROOT}"
@@ -58,6 +74,7 @@ services:
    depends_on:
      - owsec
      - owls
+      - owfms
    restart: unless-stopped
    volumes:
      - "./owls-ui/default.conf:/etc/nginx/conf.d/default.conf"
@@ -67,23 +84,33 @@ services:
      - "80:80"
      - "443:443"

-  zookeeper:
-    image: "zookeeper:${ZOOKEEPER_TAG}"
-    networks:
-      owls:
-    restart: unless-stopped
-    volumes:
-      - zookeeper_data:/data
-      - zookeeper_datalog:/datalog
-
  kafka:
-    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
    networks:
      owls:
    env_file:
      - kafka.env
    restart: unless-stopped
-    depends_on:
-      - zookeeper
    volumes:
      - kafka_data:/bitnami/kafka
+
+  init-kafka:
+    image: "docker.io/bitnamilegacy/kafka:${KAFKA_TAG}"
+    networks:
+      owls:
+    depends_on:
+      - kafka
+    env_file:
+      - kafka.env
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        echo "Sleeping to allow kafka to start up..."
+        sleep 10
+        echo "Creating all required Kafka topics..."
+        for topic in $$TOPICS; do
+          /opt/bitnami/kafka/bin/kafka-topics.sh \
+          --create --if-not-exists --topic $$topic --replication-factor 1 \
+          --partitions 1 --bootstrap-server kafka:9092
+        done && echo "Successfully created Kafka topics, exiting." && exit 0
--- a/docker-compose/owls/environments/create_tip_deploy.sh
+++ b/docker-compose/owls/environments/create_tip_deploy.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+# Create a deploy directory for a particular environment.
+# Only support the letsencrypt setup here!
+# Optionally copy it over.
+
+set -e
+USAGE="$0 environment"
+
+env="$1"
+if [ -z "$env" ] ; then
+    echo $USAGE
+    exit 1
+fi
+dir="$env"
+dhost=""
+if [[ "$env" == "owls1" ]] ; then
+    hostname="owls1.lab.wlan.tip.build"
+    dhost="tipowlsls"
+    destdir="deploy-owls"
+elif [[ "$env" == "owls2" ]] ; then
+    hostname="owls2.lab.wlan.tip.build"
+    dhost="tipowlsgw"
+    destdir="deploy-owls"
+else
+    echo "Unknown environment: $env"
+    exit 1
+fi
+
+# need newer GNU sed (mac one isn't compatible) [on mac install sed using homebrew]
+sed=$(command -v gsed)
+[ -z "$sed" ] && sed="sed"
+
+set -x
+
+
+echo
+echo "Make sure you have created/updated the device-cert.pem and device-key.pem files!"
+echo
+url="https://$hostname"
+[ -d "$dir" ] || mkdir "$dir"
+cd "$dir"
+mkdir -p owls-ui traefik certs/cas || true
+cp ../../.env ../../*.env .
+cp ../../docker-compose.lb.letsencrypt.yml docker-compose.yml
+cp ../../owls-ui/default-lb.conf owls-ui/default.conf
+cp ../../traefik/* traefik
+cp ../../../certs/cas/* certs/cas 2>/dev/null || true
+cp ../../../certs/*.pem certs
+echo "SDKHOSTNAME=$hostname" >> .env
+$sed -i "s~REACT_APP_UCENTRALSEC_URL=.*~REACT_APP_UCENTRALSEC_URL=$url:16001~" owls-ui.env
+$sed -i "s~SYSTEM_URI_PUBLIC=.*~SYSTEM_URI_PUBLIC=$url:16001~" owsec.env
+$sed -i "s~SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$url~" owsec.env
+$sed -i "s~SYSTEM_URI_PUBLIC=.*~SYSTEM_URI_PUBLIC=$url:16004~" owfms.env
+$sed -i "s~SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$url~" owfms.env
+$sed -i "s~SYSTEM_URI_PUBLIC=.*~SYSTEM_URI_PUBLIC=$url:16007~" owls.env
+$sed -i "s~SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$url~" owls.env
+$sed -i "s~../certs:~./certs:~" docker-compose.yml
+
+
+if [[ -n "$dhost" && -n "$destdir" ]] ; then
+    rsync -avh --progress ./ $dhost:$destdir
+fi
--- a/docker-compose/owls/kafka.env
+++ b/docker-compose/owls/kafka.env
@@ -1,2 +1,10 @@
-KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
 ALLOW_PLAINTEXT_LISTENER=yes
+TOPICS=service_events
+KAFKA_CFG_NODE_ID=0
+KAFKA_CFG_PROCESS_ROLES=controller,broker
+KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=0@kafka:9093
+KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:9093
+KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://:9092
+KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT
+KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
+KAFKA_CFG_INTER_BROKER_LISTENER_NAME=PLAINTEXT
--- a/docker-compose/owls/owfms.env
+++ b/docker-compose/owls/owfms.env
@@ -0,0 +1,43 @@
+RUN_CHOWN=true
+TEMPLATE_CONFIG=true
+SELFSIGNED_CERTS=true
+
+OWFMS_ROOT=/owfms-data
+OWFMS_CONFIG=/owfms-data
+
+#RESTAPI_HOST_ROOTCA=$OWFMS_ROOT/certs/restapi-ca.pem
+#RESTAPI_HOST_PORT=16004
+#RESTAPI_HOST_CERT=$OWFMS_ROOT/certs/restapi-cert.pem
+#RESTAPI_HOST_KEY=$OWFMS_ROOT/certs/restapi-key.pem
+#RESTAPI_HOST_KEY_PASSWORD=mypassword
+#INTERNAL_RESTAPI_HOST_ROOTCA=$OWFMS_ROOT/certs/restapi-ca.pem
+#INTERNAL_RESTAPI_HOST_PORT=17004
+#INTERNAL_RESTAPI_HOST_CERT=$OWFMS_ROOT/certs/restapi-cert.pem
+#INTERNAL_RESTAPI_HOST_KEY=$OWFMS_ROOT/certs/restapi-key.pem
+#INTERNAL_RESTAPI_HOST_KEY_PASSWORD=mypassword
+#SERVICE_KEY=$OWFMS_ROOT/certs/restapi-key.pem
+#SERVICE_KEY_PASSWORD=mypassword
+SYSTEM_DATA=$OWFMS_ROOT/persist
+SYSTEM_URI_PRIVATE=https://owfms.wlan.local:17004
+SYSTEM_URI_PUBLIC=https://openwifi.wlan.local:16004
+SYSTEM_URI_UI=https://openwifi.wlan.local
+#SECURITY_RESTAPI_DISABLE=false
+#S3_BUCKETNAME=ucentral-ap-firmware
+#S3_REGION=us-east-1
+S3_SECRET=b0S6EiR5RLIxoe7Xvz9YXPPdxQCoZ6ze37qunTAI
+S3_KEY=AKIAUG47UZG7R6SRLD7F
+#S3_BUCKET_URI=ucentral-ap-firmware.s3.amazonaws.com
+#KAFKA_ENABLE=true
+KAFKA_BROKERLIST=kafka:9092
+#STORAGE_TYPE=postgresql
+#STORAGE_TYPE_POSTGRESQL_HOST=postgresql
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owfms
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owfms
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owfms
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE_MYSQL_HOST=localhost
+#STORAGE_TYPE_MYSQL_USERNAME=owfms
+#STORAGE_TYPE_MYSQL_PASSWORD=owfms
+#STORAGE_TYPE_MYSQL_DATABASE=owfms
+#STORAGE_TYPE_MYSQL_PORT=3306
+STORAGE_TYPE=sqlite
--- a/docker-compose/owls/owls-ui/default-lb.conf
+++ b/docker-compose/owls/owls-ui/default-lb.conf
@@ -0,0 +1,41 @@
+server {
+    listen       80;
+    listen  [::]:80;
+
+    # Disable emitting nginx version
+    server_tokens off;
+
+    #return 301 https://$host$request_uri;
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    # redirect server error pages to the static page /50x.html
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}
+
+server {
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+
+    # Disable emitting nginx version
+    server_tokens off;
+
+    ssl_certificate     /etc/nginx/restapi-cert.pem;
+    ssl_certificate_key /etc/nginx/restapi-key.pem;
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    # redirect server error pages to the static page /50x.html
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}
--- a/docker-compose/owls/traefik.env
+++ b/docker-compose/owls/traefik.env
@@ -0,0 +1,15 @@
+TRAEFIK_ENTRYPOINTS_OWLSUIHTTP_ADDRESS=:80
+TRAEFIK_ENTRYPOINTS_OWLSUIHTTP_HTTP_REDIRECTIONS_ENTRYPOINT_TO=owlsuihttps
+TRAEFIK_ENTRYPOINTS_OWLSUIHTTPS_ADDRESS=:443
+TRAEFIK_ENTRYPOINTS_OWSECRESTAPI_ADDRESS=:16001
+TRAEFIK_ENTRYPOINTS_OWLSRESTAPI_ADDRESS=:16007
+TRAEFIK_ENTRYPOINTS_OWFMSRESTAPI_ADDRESS=:16004
+TRAEFIK_PROVIDERS_FILE_FILENAME=/etc/traefik/openwifi.yaml
+TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_EMAIL=
+TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_HTTPCHALLENGE=true
+TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_HTTPCHALLENGE_ENTRYPOINT=owlsuihttp
+TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_STORAGE=/letsencrypt/acme.json
+TRAEFIK_SERVERSTRANSPORT_ROOTCAS=/certs/restapi-ca.pem
+SDKHOSTNAME=owls2.lab.wlan.tip.build
+TRAEFIK_LOG=true
+TRAEFIK_LOG_LEVEL=DEBUG
--- a/docker-compose/owls/traefik/openwifi_letsencrypt.yaml
+++ b/docker-compose/owls/traefik/openwifi_letsencrypt.yaml
@@ -0,0 +1,50 @@
+log:
+  level: DEBUG
+http:
+  services:
+    owls-ui:
+      loadBalancer:
+        servers:
+          - url: "http://owls-ui.wlan.local:80/"
+    owsec-restapi:
+      loadBalancer:
+        servers:
+          - url: "https://owsec.wlan.local:16001/"
+    owfms-restapi:
+      loadBalancer:
+        servers:
+          - url: "https://owfms.wlan.local:16004/"
+    owls-restapi:
+      loadBalancer:
+        servers:
+          - url: "https://owls.wlan.local:16007/"
+
+  routers:
+    owls-ui-http:
+      entryPoints: "owlsuihttp"
+      service: "owls-ui"
+      rule: "Host(`{{ env "SDKHOSTNAME" }}`)"
+    owls-ui-https:
+      entryPoints: "owlsuihttps"
+      service: "owls-ui"
+      rule: "Host(`{{ env "SDKHOSTNAME" }}`)"
+      tls:
+        certResolver: "openwifi"
+    owls-restapi:
+      entryPoints: "owlsrestapi"
+      service: "owls-restapi"
+      rule: "Host(`{{ env "SDKHOSTNAME" }}`)"
+      tls:
+        certResolver: "openwifi"
+    owsec-restapi:
+      entryPoints: "owsecrestapi"
+      service: "owsec-restapi"
+      rule: "Host(`{{ env "SDKHOSTNAME" }}`)"
+      tls:
+        certResolver: "openwifi"
+    owfms-restapi:
+      entryPoints: "owfmsrestapi"
+      service: "owfms-restapi"
+      rule: "Host(`{{env "SDKHOSTNAME"}}`)"
+      tls:
+        certResolver: "openwifi"
--- a/docker-compose/owprov.env
+++ b/docker-compose/owprov.env
@@ -26,14 +26,15 @@ SYSTEM_URI_UI=https://openwifi.wlan.local
 #SECURITY_RESTAPI_DISABLE=false
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-#STORAGE_TYPE=sqlite
-#STORAGE_TYPE_POSTGRESQL_HOST=localhost
-#STORAGE_TYPE_POSTGRESQL_USERNAME=owprov
-#STORAGE_TYPE_POSTGRESQL_PASSWORD=owprov
-#STORAGE_TYPE_POSTGRESQL_DATABASE=owprov
-#STORAGE_TYPE_POSTGRESQL_PORT=5432
+STORAGE_TYPE=postgresql
+STORAGE_TYPE_POSTGRESQL_HOST=postgresql
+STORAGE_TYPE_POSTGRESQL_USERNAME=owprov
+STORAGE_TYPE_POSTGRESQL_PASSWORD=owprov
+STORAGE_TYPE_POSTGRESQL_DATABASE=owprov
+STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owprov
 #STORAGE_TYPE_MYSQL_PASSWORD=owprov
 #STORAGE_TYPE_MYSQL_DATABASE=owprov
 #STORAGE_TYPE_MYSQL_PORT=3306
+#STORAGE_TYPE=sqlite
--- a/docker-compose/owrrm.env
+++ b/docker-compose/owrrm.env
@@ -1,8 +0,0 @@
-SELFSIGNED_CERTS=true
-SERVICECONFIG_PRIVATEENDPOINT=https://owrrm.wlan.local:16789
-SERVICECONFIG_PUBLICENDPOINT=https://openwifi.wlan.local:16789
-KAFKACONFIG_BOOTSTRAPSERVER=kafka:9092
-DATABASECONFIG_SERVER=mysql:3306
-DATABASECONFIG_USER=root
-#DATABASECONFIG_PASSWORD=openwifi
-DATABASECONFIG_DBNAME=owrrm
--- a/docker-compose/owsec.env
+++ b/docker-compose/owsec.env
@@ -35,14 +35,15 @@ SYSTEM_URI_UI=https://openwifi.wlan.local
 KAFKA_BROKERLIST=kafka:9092
 #DOCUMENT_POLICY_ACCESS=$OWSEC_ROOT/wwwassets/access_policy.html
 #DOCUMENT_POLICY_PASSWORD=$OWSEC_ROOT/wwwassets/password_policy.html
-#STORAGE_TYPE=sqlite
-#STORAGE_TYPE_POSTGRESQL_HOST=localhost
-#STORAGE_TYPE_POSTGRESQL_USERNAME=owsec
-#STORAGE_TYPE_POSTGRESQL_PASSWORD=owsec
-#STORAGE_TYPE_POSTGRESQL_DATABASE=owsec
-#STORAGE_TYPE_POSTGRESQL_PORT=5432
+STORAGE_TYPE=postgresql
+STORAGE_TYPE_POSTGRESQL_HOST=postgresql
+STORAGE_TYPE_POSTGRESQL_USERNAME=owsec
+STORAGE_TYPE_POSTGRESQL_PASSWORD=owsec
+STORAGE_TYPE_POSTGRESQL_DATABASE=owsec
+STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owsec
 #STORAGE_TYPE_MYSQL_PASSWORD=owsec
 #STORAGE_TYPE_MYSQL_DATABASE=owsec
 #STORAGE_TYPE_MYSQL_PORT=3306
+#STORAGE_TYPE=sqlite
--- a/docker-compose/owsub.env
+++ b/docker-compose/owsub.env
@@ -26,14 +26,15 @@ SYSTEM_URI_UI=https://openwifi.wlan.local
 #SECURITY_RESTAPI_DISABLE=false
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-#STORAGE_TYPE=sqlite
-#STORAGE_TYPE_POSTGRESQL_HOST=localhost
-#STORAGE_TYPE_POSTGRESQL_USERNAME=owsub
-#STORAGE_TYPE_POSTGRESQL_PASSWORD=owsub
-#STORAGE_TYPE_POSTGRESQL_DATABASE=owsub
-#STORAGE_TYPE_POSTGRESQL_PORT=5432
+STORAGE_TYPE=postgresql
+STORAGE_TYPE_POSTGRESQL_HOST=postgresql
+STORAGE_TYPE_POSTGRESQL_USERNAME=owsub
+STORAGE_TYPE_POSTGRESQL_PASSWORD=owsub
+STORAGE_TYPE_POSTGRESQL_DATABASE=owsub
+STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owsub
 #STORAGE_TYPE_MYSQL_PASSWORD=owsub
 #STORAGE_TYPE_MYSQL_DATABASE=owsub
 #STORAGE_TYPE_MYSQL_PORT=3306
+#STORAGE_TYPE=sqlite
--- a/docker-compose/traefik.env
+++ b/docker-compose/traefik.env
@@ -17,7 +17,6 @@ TRAEFIK_ENTRYPOINTS_OWFMSRESTAPI_ADDRESS=:16004
 TRAEFIK_ENTRYPOINTS_OWPROVRESTAPI_ADDRESS=:16005
 TRAEFIK_ENTRYPOINTS_OWANALYTICSRESTAPI_ADDRESS=:16009
 TRAEFIK_ENTRYPOINTS_OWSUBRESTAPI_ADDRESS=:16006
-TRAEFIK_ENTRYPOINTS_OWRRMOPENAPI_ADDRESS=:16789
 TRAEFIK_PROVIDERS_FILE_FILENAME=/etc/traefik/openwifi.yaml
 TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_EMAIL=
 TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_HTTPCHALLENGE=true
--- a/docker-compose/traefik/openwifi_letsencrypt.yaml
+++ b/docker-compose/traefik/openwifi_letsencrypt.yaml
@@ -40,10 +40,6 @@ http:
      loadBalancer:
        servers:
          - url: "https://owgw.wlan.local:5913/"
-    owrrm-openapi:
-      loadBalancer:
-        servers:
-          - url: "http://owrrm.wlan.local:16789/"

  routers:
    owgw-ui-http:
@@ -114,12 +110,6 @@ http:
      rule: "Host(`{{env "SDKHOSTNAME"}}`)"
      tls:
        certResolver: "openwifi"
-    owrrm-openapi:
-      entryPoints: "owrrmopenapi"
-      service: "owrrm-openapi"
-      rule: "Host(`{{env "SDKHOSTNAME"}}`)"
-      tls:
-        certResolver: "openwifi"

 tcp:
  services:
--- a/docker-compose/traefik/openwifi_selfsigned.yaml
+++ b/docker-compose/traefik/openwifi_selfsigned.yaml
@@ -15,11 +15,6 @@ http:
        servers:
          - url: "http://owprov-ui.wlan.local:80/"

-    owrrm-openapi:
-      loadBalancer:
-        servers:
-          - url: "http://owrrm.wlan.local:16789/"
-
  routers:
    owgw-ui-http:
      entryPoints: "owgwuihttp"
@@ -43,12 +38,6 @@ http:
      rule: "PathPrefix(`/`)"
      tls: {}

-    owrrm-openapi:
-      entryPoints: "owrrmopenapi"
-      service: "owrrm-openapi"
-      rule: "PathPrefix(`/`)"
-      tls: {}
-
 tcp:
  services:
    owgw-websocket:
Author	SHA1	Message	Date
TIP Automation User	f610f80a93	Chg: update image tag in helm values to v4.2.0-RC1	2025-12-12 23:56:58 +00:00
Carsten Schafer	6d156da3be	Merge pull request #302 from Telecominfraproject/WIFI-15181-update-bitnami-image-repos2 Slight adjustment for os-shell image for older kafka helm chart	2025-10-16 11:21:30 -04:00
Carsten Schafer	b9912d30c0	Slight adjustment for os-shell image for older kafka helm chart Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-10-16 10:42:53 -04:00
Carsten Schafer	98fdf4b3cc	Merge pull request #301 from Telecominfraproject/WIFI-15181-update-bitnami-image-repos Point to bitnamilegacy repos for bitnami images	2025-10-16 10:02:14 -04:00
Carsten Schafer	1e5b81b698	Point to bitnamilegacy repos for bitnami images Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-10-16 09:30:22 -04:00
Carsten Schafer	12c1051293	Merge pull request #300 from Telecominfraproject/PKI2-188-update-insta-certs Add support for insta only certs	2025-09-23 11:27:10 -04:00
Carsten Schafer	039fb87d8c	Add support for insta only certs Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-09-23 11:17:15 -04:00
Carsten Schafer	ae2ba7fa44	Merge pull request #299 from Telecominfraproject/prod_clientcas_updates Add prod OpenLAN certs to clientcas - docker/k8s	2025-08-12 13:18:04 -04:00
Carsten Schafer	54e58b21f6	Add prod OpenLAN certs to clientcas - docker/k8s Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-08-12 11:05:13 -04:00
Carsten Schafer	b53f1e9478	Merge pull request #298 from Telecominfraproject/WIFI-14521-update-pki2-readme Updated PKI README	2025-07-23 09:51:41 -04:00
Carsten Schafer	2bff90c79d	Updated PKI README Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-07-17 10:19:40 -04:00
Carsten Schafer	a51a8e03f6	Merge pull request #297 from Telecominfraproject/WIFI-14861-update-wlan-local-cert WIFI-14861: update expired wlan.local cert	2025-07-16 14:22:30 -04:00
Carsten Schafer	183c93ece0	WIFI-14861: update expired wlan.local cert Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-07-16 13:07:20 -04:00
Carsten Schafer	77440e73bc	Merge pull request #295 from Telecominfraproject/WIFI-14521-add-pki2-readme Wifi 14521 add pki2 readme	2025-07-02 13:27:05 -04:00
Carsten Schafer	0b75c52822	Add PKI 2.0 README Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-07-02 12:08:08 -04:00
Carsten Schafer	b9a294bfd5	Add Insta references where there are Digicert references Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-07-02 12:07:56 -04:00
Carsten Schafer	dc411baee3	Fix broken workflows Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-07-02 12:06:49 -04:00
i-chvets	a54fc0cf6a	Merge pull request #292 from Telecominfraproject/openlan_cas_in_clientcas feat: PKI 2.0: Added OpenLAN CAS to clientcas in docker-compose deploment	2025-04-25 11:32:49 -04:00
Carsten Schafer	841886869e	Merge pull request #293 from Telecominfraproject/WIFI-14521-fix-old-ubuntu WIFI-14521 Update to newer GH runner version	2025-04-25 11:25:45 -04:00
Carsten Schafer	2d0e42ec9f	Update to newer GH runner version Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-04-25 11:22:11 -04:00
Ivan Chvets	72f0fd28a4	feat: PKI 2.0: Added OpenLAN CAS to clientcas in docker-compose deployment. Signed-off-by: Ivan Chvets <ivan.chvets@kinarasystems.com>	2025-04-24 12:38:33 -04:00
jaspreetsachdev	c853e252c1	Merge pull request #291 from Telecominfraproject/openlan_cas_in_clientcas feat: PKI 2.0: Added OpenLAN CAS to clientcas	2025-04-09 15:19:55 -04:00
Ivan Chvets	820f4d0925	feat: PKI 2.0: Added OpenLAN CAS to clientcas Signed-off-by: Ivan Chvets <ivan.chvets@kinarasystems.com>	2025-04-09 15:12:52 -04:00
jaspreetsachdev	6f9a4ac7c5	Merge pull request #290 from Telecominfraproject/rever-certs-update Rever certs update	2025-04-08 21:47:34 -04:00
Ivan Chvets	a5413d0c36	Revert "Update values.openwifi-qa.yaml" This reverts commit `5e87e15cc0`. Signed-off-by: Ivan Chvets <ivan.chvets@kinarasystems.com>	2025-04-08 21:25:21 -04:00
Ivan Chvets	c682a7f070	Revert "Update values.openwifi-qa.yaml" This reverts commit `8a84f2e86f`. Signed-off-by: Ivan Chvets <ivan.chvets@kinarasystems.com>	2025-04-08 21:24:29 -04:00
jaspreetsachdev	8a84f2e86f	Update values.openwifi-qa.yaml Added demo chains	2025-04-08 20:25:48 -04:00
jaspreetsachdev	5e87e15cc0	Update values.openwifi-qa.yaml Added trust chain for insta openlan demo	2025-04-08 18:50:13 -04:00
Carsten Schafer	02b0863abd	Merge pull request #289 from Telecominfraproject/WIFI-13821-fix-alb-health-checks WIFI-13821 - Load balancer started acting up: change annotations	2024-09-27 11:50:47 -04:00
Carsten Schafer	0ac8f8c29b	WIFI-13821 - Load balancer started acting up: change annotations Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-27 11:42:56 -04:00
Carsten Schafer	6e8eb3a26c	Merge pull request #287 from Telecominfraproject/WIFI-14148-multiple-cgw-4 WIFI-13821: Change pinning targets for cgw hosts, set grpc endpoint n…	2024-09-20 15:46:19 -04:00
Carsten Schafer	9143143351	WIFI-13821: Change pinning targets for cgw hosts, set grpc endpoint names Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-20 15:33:36 -04:00
Carsten Schafer	448c7319df	Merge pull request #286 from Telecominfraproject/WIFI-14148-multiple-cgw-2 WIFI-14148 Adapt to the idiosyncrasies of each cluster env	2024-09-19 13:43:22 -04:00
Carsten Schafer	7399215578	WIFI-14148 Adapt to the idiosyncrasies of each cluster env Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-19 11:55:29 -04:00
Carsten Schafer	03525b8a8f	Merge pull request #285 from Telecominfraproject/WIFI-14148-multiple-cgw WIFI-14148 add 2nd cgw	2024-09-19 11:16:00 -04:00
Carsten Schafer	91f1f2446a	WIFI-14148 add 2nd cgw Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-19 09:56:04 -04:00
Carsten Schafer	423d25b14c	Merge pull request #284 from Telecominfraproject/WIFI-13871-add-owls-envs WIFI-13871: Be able to generate owls environments, fix device type an…	2024-09-18 16:19:30 -04:00
Carsten Schafer	5e07d2570a	WIFI-13871: Be able to generate owls environments, fix device type and add ability to use letsencrypt Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-18 15:15:13 -04:00
Carsten Schafer	694588f8dc	Merge pull request #282 from Telecominfraproject/WIFI-14014-upgrade-kafka-wo-zookeeper Wifi 14014 upgrade kafka wo zookeeper	2024-08-06 09:43:35 -04:00
Carsten Schafer	ff06b109ee	dco tweak Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-08-06 09:37:20 -04:00
Carsten Schafer	4faa01ac74	Merge remote-tracking branch 'origin/main' into WIFI-14014-upgrade-kafka-wo-zookeeper	2024-08-02 14:07:01 -04:00
Carsten Schafer	1f6f114ff8	Merge pull request #281 from Telecominfraproject/WIFI-14020-dont-mark-5912-as-ssl-port WIFI-14020: 5912 should not be marked as ssl port	2024-08-02 12:57:46 -04:00
Carsten Schafer	c0569267f7	WIFI-14020: 5912 should not be marked as ssl port Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-08-02 11:36:53 -04:00
Carsten Schafer	8157ef0d00	Also wait for kafka to be up for owls Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-29 14:26:31 -04:00
Carsten Schafer	7ba34c8398	Resolve merge conflicts Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-29 14:05:48 -04:00
Carsten Schafer	f8dcdf64f3	Adjust owls image tags as new ones don't work Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-29 14:02:03 -04:00
Carsten Schafer	3e8795a6d5	Merge pull request #279 from Telecominfraproject/WIFI-13969-docker-compose-default-to-postgres Wifi 13969 docker compose default to postgres	2024-07-29 13:06:38 -04:00
Carsten Schafer	0185aece01	Merge remote-tracking branch 'origin/main' into WIFI-14014-upgrade-kafka-wo-zookeeper	2024-07-29 11:50:10 -04:00
Carsten Schafer	4fcbd327a6	Merge pull request #280 from Telecominfraproject/WIFI-13821-set-LB-variables Make sure Cert ARN is exported - otherwise will not be set	2024-07-29 10:33:07 -04:00
Carsten Schafer	b0a5640a4d	Make sure Cert ARN is exported - otherwise will not be set Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-29 10:24:19 -04:00
Carsten Schafer	dceb24d0bb	SQL init script can't work, DB check to last one Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-26 16:42:33 -04:00
Carsten Schafer	8580689ce8	Switch to latest kafka wo zookeeper Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-26 16:39:36 -04:00
Carsten Schafer	1c43883094	move to postgres for the other LB based docker compose samples Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-26 11:08:59 -04:00
Carsten Schafer	aa6ef772e2	Merge remote-tracking branch 'origin/main' into WIFI-13969-docker-compose-default-to-postgres	2024-07-25 17:44:18 -04:00
Carsten Schafer	a4b8738ac5	Make postgres the default storage option	2024-07-25 17:44:03 -04:00
Carsten Schafer	034ed6ac89	Merge pull request #278 from Telecominfraproject/WIFI-13866-remove-rrm-dc Remove rrm, wait for kafka and postgres to be available	2024-07-25 16:10:58 -04:00
Carsten Schafer	fd7288f449	Remove rrm, wait for kafka and postgres to be available Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-10 16:05:50 -04:00
Carsten Schafer	3d791d31f7	Merge pull request #276 from Telecominfraproject/WIFI-13871-CICD-changes2 WIFI-13871 rework of secret handling and adjust volume sizes	2024-07-08 17:07:38 -04:00
Carsten Schafer	423f7d43fe	WIFI-13871 rework of secret handling and adjust volume sizes Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-08 15:11:03 -04:00
Carsten Schafer	3ac6b014e0	Merge pull request #275 from Telecominfraproject/WIFI-13796-remove-haproxy Wifi 13796 remove haproxy, rrm and kafka brokers	2024-07-05 10:36:09 -04:00
Carsten Schafer	79f13fb117	WIFI-13796 Switch to brokerless kafka setup - more likely to work with most recent OW components Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-07-05 10:17:28 -04:00
Carsten Schafer	05da3898f7	Merge remote-tracking branch 'origin/main' into WIFI-13796-remove-haproxy	2024-07-02 13:34:46 -04:00
Carsten Schafer	9b7124b71a	Merge pull request #274 from Telecominfraproject/WIFI-13871-CICD-changes WIFI-13871 Correct log setting and point to chart	2024-06-27 09:14:02 -04:00
Carsten Schafer	a3d8615d79	WIFI-13871 Correct log setting and point to chart Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-06-27 09:13:25 -04:00
Carsten Schafer	e49bd3a6c9	Merge pull request #273 from Telecominfraproject/WIFI-13836 WIFI-13836: first cgw helmfile checkin	2024-06-26 10:16:54 -04:00
Carsten Schafer	5b2ff48836	More helmfile tweaks Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-06-25 14:51:41 -04:00
Carsten Schafer	3f11a39ec0	Disable haproxy and remove owrrm Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-06-25 11:26:18 -04:00
Carsten Schafer	d9bb26ec4c	Update git-release.yml No repo added, don't run helm repo update.	2024-06-19 07:26:44 -04:00
jaspreetsachdev	065f719d1f	Merge pull request #272 from Telecominfraproject/WIFI-13821-main WIFI-13821 copy GH fixes from 3.1.0	2024-06-10 15:58:46 -04:00
Carsten Schafer	3cb9debe91	copy GH fixes from 3.1.0 Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-06-10 15:50:54 -04:00
Carsten Schafer	f02dd63750	Merge pull request #269 from Telecominfraproject/WIFI-13130-tuning WIFI-13130 Document some OWLS tuning and try to fix GH issues	2024-06-10 15:01:25 -04:00
Carsten Schafer	8d673a8e90	Document some OWLS tuning and try to fix GH issues Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-06-10 14:50:15 -04:00
Carsten Schafer	f4720fcb33	Merge pull request #268 from Telecominfraproject/WIFI-13361 Bump up resources for kafka - from default chart resources	2024-05-30 16:46:25 -04:00
Carsten Schafer	7b93a3a6cc	Bump up resources for kafka - from default chart resources Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-05-30 15:58:30 -04:00
Carsten Schafer	d8674a82b2	Merge pull request #266 from Telecominfraproject/WIFI-13361 Wifi 13361: Change to most recent kafka version	2024-05-16 16:19:25 -04:00
Carsten Schafer	f4a8649bad	WIFI-13361 - fix CI issues Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-05-15 12:15:23 -04:00
Carsten Schafer	bc00e6244e	WIFI-13361 - remove old bitnami chart ref Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-05-15 12:02:27 -04:00
Carsten Schafer	123c341f9b	WIFI-13361: change to most recent kafka without zookeeper Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-05-15 10:48:06 -04:00
Carsten Schafer	a377966ac9	initial Kafka version changes Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-04-15 11:34:46 -04:00
Carsten Schafer	9093a85ccf	Merge pull request #265 from Telecominfraproject/WIFI-13130 WIFI-13130 - add support for qa03 and dev03 env on another cluster	2024-04-10 13:29:06 -04:00
Carsten Schafer	3133f07edb	WIFI-13130 - add support for qa03 and dev03 env on another cluster Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-04-10 09:48:35 -04:00
Carsten Schafer	c7692c9107	Merge pull request #262 from Telecominfraproject/WIFI-13357-be-able-to-set-ingress-class-name-for-all-the-component-helm-charts-as-the-annotation-is-no-longer-supported Wifi 13357 be able to set ingress class name for all the component helm charts as the annotation is no longer supported	2024-02-15 11:48:55 -05:00
Carsten Schafer	536e84ce50	Give haproxy a few more resources Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-02-14 10:10:30 -05:00
Carsten Schafer	70c8886d24	Don't always cleanup the namespace unless called with full argument Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-02-13 12:07:17 -05:00
Carsten Schafer	0ee5ea9648	Remove ingress.class annotation	2024-02-13 12:05:29 -05:00
Carsten Schafer	6f2c8d9b02	Merge pull request #261 from Telecominfraproject/WIFI-13246-CS-postgres WIFI-13246 Switch to non-HA postgres without pgpool	2024-02-13 10:41:06 -05:00
				`@@ -0,0 +1 @@`
				`# set the node affinity and tolerations here`