Chg: update image tag in helm values to v2.4.0-RC6

Signed-off-by: Dmitry Dunaev <dmitry@opsfleet.com>

.github/workflows/clustersysteminfo_image_ci.yml

@@ -0,0 +1,67 @@
+name: Build cluster systeminfo checker image
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*'
+  # TODO delete after tests
+  pull_request:
+    branches:
+      - main
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  docker:
+    runs-on: ubuntu-20.04
+    env:
+      DOCKER_REGISTRY_URL: tip-tip-wlan-cloud-ucentral.jfrog.io
+      DOCKER_REGISTRY_USERNAME: ucentral
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Build Docker image
+      working-directory: chart/docker
+      run: docker build -t wlan-cloud-clustersysteminfo:${{ github.sha }} .
+
+    - name: Tag Docker image
+      run: |
+        TAGS="${{ github.sha }}"
+
+        if [[ ${GITHUB_REF} == "refs/heads/"* ]]
+        then
+          CURRENT_TAG=$(echo ${GITHUB_REF#refs/heads/} | tr '/' '-')
+          TAGS="$TAGS $CURRENT_TAG"
+        else
+          if [[ ${GITHUB_REF} == "refs/tags/"* ]]
+          then
+            CURRENT_TAG=$(echo ${GITHUB_REF#refs/tags/} | tr '/' '-')
+            TAGS="$TAGS $CURRENT_TAG"
+          else # PR build
+            CURRENT_TAG=$(echo ${GITHUB_HEAD_REF#refs/heads/} | tr '/' '-')
+            TAGS="$TAGS $CURRENT_TAG"
+          fi
+        fi
+
+        echo "Result tags: $TAGS"
+
+        for tag in $TAGS; do
+          docker tag wlan-cloud-clustersysteminfo:${{ github.sha }} ${{ env.DOCKER_REGISTRY_URL }}/clustersysteminfo:$tag
+        done
+
+    - name: Log into Docker registry
+      if: startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/pull/') || github.ref == 'refs/heads/main'
+      uses: docker/login-action@v1
+      with:
+        registry: ${{ env.DOCKER_REGISTRY_URL }}
+        username: ${{ env.DOCKER_REGISTRY_USERNAME }}
+        password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
+
+    - name: Push Docker images
+      if: startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/pull/') || github.ref == 'refs/heads/main'
+      run: |
+        docker images | grep ${{ env.DOCKER_REGISTRY_URL }}/clustersysteminfo | awk -F ' ' '{print $1":"$2}' | xargs -I {} docker push {}

.github/workflows/release.yml

@@ -33,11 +33,11 @@ jobs:
             exit 1
           fi
 
-          if [ "$(cat Chart.yaml | yq '.dependencies[].repository' -r | grep -E 'ref=(main|master)' | wc -l)" != "0" ]; then
-            echo "Some of the dependencies does not have a fixed version set. List of affected dependencies:";
-            cat Chart.yaml | yq '.dependencies[].repository' -r | grep -E 'ref=(main|master)';
-            exit 1
-          fi
+          #if [ "$(cat Chart.yaml | yq '.dependencies[].repository' -r | grep -E 'ref=(main|master)' | wc -l)" != "0" ]; then
+          #  echo "Some of the dependencies does not have a fixed version set. List of affected dependencies:";
+          #  cat Chart.yaml | yq '.dependencies[].repository' -r | grep -E 'ref=(main|master)';
+          #  exit 1
+          #fi
 
       - name: Build package
         working-directory: wlan-cloud-ucentral-deploy/chart

README.md

@@ -15,6 +15,6 @@ This is a short version of [uCentral branching model](https://telecominfraprojec
 
 1. Create release branch with next Chart version (check Git tags for the latest version - for example if latest tag was `v0.1.0`, create release branch `release/v0.1.1`), set required microservices tags in refs in Chart.yaml (for example, if we want to have this version to be tied to ucentralgw release version `v2.0.0`, we should set it’s repository to `"git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=v2.0.0"`).
 2. Increase Helm version in [Chart.yaml](./chart/Chart.yaml) to the same version as Git tag (for example if the latest git tag is `v0.1.0`, set version `0.1.1` (**without v in it**) in Chart.yaml).
-3. Also increase the microservice image tags used by the Docker Compose deployments according to the release in the 'Image tags' section of the `docker-compose/.env.selfsigned` and `docker-compose/.env.letsencrypt` files.
+3. Also increase the microservice image tags used by the Docker Compose deployments according to the release in the 'Image tags' section of the `docker-compose/.env`, `docker-compose/.env.selfsigned` and `docker-compose/.env.letsencrypt` files.
 4. Create new git tag from release branch. The Git tag should have the same name as the intended release version. Once the tag is pushed to the repo, Github will trigger a build process that will create an assembly Helm chart bundle with all version fixed to the release equal to the Git tag name and will publish it to the public Artifactory and as GitHub release asset.
 5. Release to the QA namespace using the packaged Helm assembly chart to verify there are no issues related to the deployment.

chart/Chart.lock

@@ -0,0 +1,27 @@
+dependencies:
+- name: owgw
+  repository: git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=v2.4.0-RC5
+  version: 0.1.0
+- name: owsec
+  repository: git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=v2.4.0-RC4
+  version: 0.1.0
+- name: owfms
+  repository: git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=v2.4.0-RC4
+  version: 0.1.0
+- name: owprov
+  repository: git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=main
+  version: 0.1.0
+- name: owgwui
+  repository: git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=v2.4.0-RC2
+  version: 0.1.0
+- name: owprovui
+  repository: git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=main
+  version: 0.1.0
+- name: rttys
+  repository: git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-rtty@chart?ref=v0.1.0
+  version: 0.1.0
+- name: kafka
+  repository: https://charts.bitnami.com/bitnami
+  version: 13.0.2
+digest: sha256:ee31eac99378e10a0387c7b0cb3f243c9e6d57c7ca61e924046b15d097b77401
+generated: "2021-12-08T07:43:27.890681384Z"

chart/Chart.yaml

@@ -2,22 +2,28 @@ apiVersion: v2
 name: openwifi
 appVersion: "1.0"
 description: A Helm chart for Kubernetes
-version: 0.1.0
+version: 2.4.0-RC6
 dependencies:
 - name: owgw
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=master"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=v2.4.0-RC5"
   version: 0.1.0
 - name: owsec
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=v2.4.0-RC4"
   version: 0.1.0
 - name: owfms
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=v2.4.0-RC4"
+  version: 0.1.0
+- name: owprov
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=main"
   version: 0.1.0
 - name: owgwui
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=v2.4.0-RC2"
+  version: 0.1.0
+- name: owprovui
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=main"
   version: 0.1.0
 - name: rttys
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-rtty@chart?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-rtty@chart?ref=v0.1.0"
   version: 0.1.0
   condition: rttys.enabled
 - name: kafka

chart/README.md

@@ -10,6 +10,8 @@ This Helm chart helps to deploy OpenWIFI Cloud SDK with all required dependencie
 $ helm install .
 ```
 
+Then change the default password as described in [owsec docs](https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/tree/main#changing-default-password).
+
 ## Introduction
 
 This chart bootstraps the OpenWIFI Cloud SDK on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
@@ -34,6 +36,10 @@ If you need to update your release, it could be required to update your helm cha
 helm dependency update
 ```
 
+#### Required password changing on the first startup
+
+One important action that must be done before using the deployment is changing password for the default user in owsec as described in [owsec docs](https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/tree/main#changing-default-password). Please use these docs to find the actions that must be done **after** the deployment in order to start using your deployment.
+
 ## Uninstalling the Chart
 
 To uninstall/delete the `my-release` deployment:

chart/docker/Dockerfile

@@ -0,0 +1,46 @@
+FROM alpine:latest AS base
+
+RUN apk add curl git jq bash
+
+WORKDIR /cli
+
+# OWGW
+ARG OWGW_VERSION=master
+RUN git clone https://github.com/Telecominfraproject/wlan-cloud-ucentralgw.git owgw \
+  && cd owgw \
+  && git checkout $OWGW_VERSION \
+  && cd /cli \
+  && cp owgw/test_scripts/curl/cli owgw_cli \
+  && rm -rf owgw
+
+# OWSEC
+ARG OWSEC_VERSION=main
+RUN git clone https://github.com/Telecominfraproject/wlan-cloud-ucentralsec.git owsec \
+  && cd owsec \
+  && git checkout $OWSEC_VERSION \
+  && cd /cli \
+  && cp owsec/test_scripts/curl/cli owsec_cli \
+  && rm -rf owsec
+
+# OWFMS
+ARG OWFMS_VERSION=main
+RUN git clone https://github.com/Telecominfraproject/wlan-cloud-ucentralfms.git owfms \
+  && cd owfms \
+  && git checkout $OWFMS_VERSION \
+  && cd /cli \
+  && cp owfms/test_scripts/curl/cli owfms_cli \
+  && rm -rf owfms
+
+# OWPROV
+ARG OWPROV_VERSION=main
+RUN git clone https://github.com/Telecominfraproject/wlan-cloud-owprov.git owprov \
+  && cd owprov \
+  && git checkout $OWPROV_VERSION \
+  && cd /cli \
+  && cp owprov/test_scripts/curl/cli owprov_cli \
+  && rm -rf owprov
+
+COPY clustersysteminfo clustersysteminfo
+COPY change_credentials change_credentials
+
+ENTRYPOINT ["/cli/clustersysteminfo"]

chart/docker/change_credentials

@@ -0,0 +1,68 @@
+#!/bin/bash
+# Constants
+export DEFAULT_CHECK_RETRIES=10
+
+# Usage function
+usage () {
+  echo;
+  echo "- OWSEC - owsec endpoint to make requests to (i.e. openwifi.wlan.local:16001)";
+  echo "- OWSEC_DEFAULT_USERNAME - default owsec username from properties";
+  echo "- OWSEC_DEFAULT_PASSWORD - default owsec password (in cleartext) from properties";
+  echo "- OWSEC_NEW_PASSWORD - new owsec password (in cleartext) that should be set for login";
+}
+
+# Check if required environment variables were passed
+## Login specifics
+[ -z ${OWSEC+x} ] && echo "OWSEC is unset" && usage && exit 1
+[ -z ${OWSEC_DEFAULT_USERNAME+x} ] && echo "OWSEC_DEFAULT_USERNAME is unset" && usage && exit 1
+[ -z ${OWSEC_DEFAULT_PASSWORD+x} ] && echo "OWSEC_DEFAULT_PASSWORD is unset" && usage && exit 1
+[ -z ${OWSEC_NEW_PASSWORD+x} ] && echo "OWSEC_NEW_PASSWORD is unset" && usage && exit 1
+
+# Check credentials
+export result_file=result.json
+
+# Try logging in with default credentials
+payload="{ \"userId\" : \"${OWSEC_DEFAULT_USERNAME}\" , \"password\" : \"${OWSEC_DEFAULT_PASSWORD}\" }"
+curl ${FLAGS} -X POST "https://${OWSEC}/api/v1/oauth2" \
+    -H "Content-Type: application/json" \
+    -d "$payload" > ${result_file}
+errorCode=$(cat ${result_file} | jq -r '.ErrorCode')
+# If ErrorCode == 1, we must change password
+if [[ "${errorCode}" == "1" ]]
+then
+    payload="{ \"userId\" : \"${OWSEC_DEFAULT_USERNAME}\" , \"password\" : \"${OWSEC_DEFAULT_PASSWORD}\", \"newPassword\" : \"${OWSEC_NEW_PASSWORD}\" }"
+    curl ${FLAGS} -X POST "https://${OWSEC}/api/v1/oauth2" \
+        -H "Content-Type: application/json" \
+        -d "$payload" > ${result_file}
+    # Check if password was changed correctly
+    token=$(cat ${result_file} | jq -r '.access_token')
+    if [[ "${token}" == "null" ]] || [[ "${token}" == "" ]] || [[ ! -s ${result_file} ]]
+    then
+        echo "Could not change credentials:"
+        jq < ${result_file}
+        exit 1
+    else
+        echo "Login credentials were changed:"
+    fi
+# If ErrorCode == 2 then new credentials were applied already OR user was deleted OR credentials are wrong
+elif [[ "${errorCode}" == "2" ]]
+then
+    # Let's try logging in using new credentials
+    payload="{ \"userId\" : \"${OWSEC_DEFAULT_USERNAME}\" , \"password\" : \"${OWSEC_NEW_PASSWORD}\" }"
+    curl ${FLAGS} -X POST "https://${OWSEC}/api/v1/oauth2" \
+            -H "Content-Type: application/json" \
+            -d "$payload" > ${result_file}
+    token=$(cat ${result_file} | jq -r '.access_token')
+    # TODO check if there are any response
+    if [[ "${token}" == "null" ]] || [[ "${token}" == "" ]] || [[ ! -s ${result_file} ]]
+    then
+        echo "Could not login with new credentials. Probably new login credentials are wrong OR user was deleted. Since we cannot check if user is really deleted, skipping this issue:"
+    else
+        echo "Logged in with new credentials:"
+    fi
+else
+    echo "Credentials check failed with unexpected ErrorCode, please review the responce body:"
+    jq < ${result_file}
+    exit 2
+fi
+jq < ${result_file}

chart/docker/clustersysteminfo

@@ -0,0 +1,106 @@
+#!/bin/bash
+
+# Constants
+export DEFAULT_CHECK_RETRIES=30
+
+# Check dependencies
+[[ "$(which jq)" == "" ]] && echo "You need the package jq installed to use this script." && exit 1
+[[ "$(which curl)" == "" ]] && echo "You need the package curl installed to use this script." && exit 1
+
+# Check if required environment variables were passed
+[[ -z ${OWSEC+x} ]] && echo "You must set the variable OWSEC in order to use this script. Something like" && echo "OWSEC=security.isp.com:16001" && exit 1
+[[ -z ${OWSEC_DEFAULT_USERNAME+x} ]] && echo "You must set the variable OWSEC_DEFAULT_USERNAME in order to use this script. Something like" && echo "OWSEC_DEFAULT_USERNAME=tip@ucentral.com" && exit 1
+[[ -z ${OWSEC_DEFAULT_PASSWORD+x} ]] && echo "You must set the variable OWSEC_DEFAULT_PASSWORD in order to use this script. Something like" && echo "OWSEC_DEFAULT_PASSWORD=openwifi" && exit 1
+[[ -z ${OWSEC_NEW_PASSWORD+x} ]] && echo "You must set the variable OWSEC_NEW_PASSWORD in order to use this script. Something like" && echo "OWSEC_NEW_PASSWORD=NewPass123%" && exit 1
+
+[[ "${CHECK_RETRIES}" == "" ]] && [[ "${CHECK_RETRIES}" -eq "${CHECK_RETRIES}" ]] && echo "Environment variable CHECK_RETRIES is not set or is not number, setting it to the default value (${DEFAULT_CHECK_RETRIES})" && export CHECK_RETRIES=$DEFAULT_CHECK_RETRIES
+
+# Make sure owsec is resolvable
+export OWSEC_FQDN=$(echo $OWSEC | awk -F ':' '{print $1}')
+echo "Waiting for OWSEC FQDN ($OWSEC_FQDN) to be resolvable"
+exit_code=1
+until [[ "$exit_code" -eq "0" ]]
+do
+  getent hosts $OWSEC_FQDN
+  exit_code=$?
+  sleep 1
+done
+echo
+
+# Change/check password for owsec AND set owsec credentials
+export CHANGE_CHECK_RETRIES=${CHECK_RETRIES}
+until ./change_credentials || [[ "${CHANGE_CHECK_RETRIES}" -eq "0" ]]
+do
+  echo "Change/check failed"
+  let "CHANGE_CHECK_RETRIES-=1"
+  echo "Retries left - $CHANGE_CHECK_RETRIES"
+  echo
+  sleep 5
+done
+
+if [[ "${CHANGE_CHECK_RETRIES}" -eq "0" ]]
+then
+  echo "Run out of retries to change/check login credentials"
+  exit 3
+fi
+
+# Adapt scripts for the security credentials
+# -> Username
+sed '/^username/s/username=.*/username="'$OWSEC_DEFAULT_USERNAME'"/' owsec_cli -i
+sed '/^username/s/username=.*/username="'$OWSEC_DEFAULT_USERNAME'"/' owgw_cli -i
+sed '/^username/s/username=.*/username="'$OWSEC_DEFAULT_USERNAME'"/' owfms_cli -i
+sed '/^username/s/username=.*/username="'$OWSEC_DEFAULT_USERNAME'"/' owprov_cli -i
+# -> Password
+sed '/^password/s/password=.*/password="'$OWSEC_NEW_PASSWORD'"/' owsec_cli -i
+sed '/^password/s/password=.*/password="'$OWSEC_NEW_PASSWORD'"/' owgw_cli  -i
+sed '/^password/s/password=.*/password="'$OWSEC_NEW_PASSWORD'"/' owfms_cli -i
+sed '/^password/s/password=.*/password="'$OWSEC_NEW_PASSWORD'"/' owprov_cli -i
+
+echo "Running systeminfo checks for all components until all of them are available OR check tries are exausted ($CHECK_RETRIES)"
+exit_code_sum=1
+until [[ "$exit_code_sum" -eq "0" ]] || [[ "${CHECK_RETRIES}" -eq "0" ]]
+do
+  exit_code_sum=0
+  ./owsec_cli systeminfo
+  let "exit_code_sum+=$?"
+  if [[ ! -s result.json ]]
+  then
+    let "exit_code_sum+=1"
+  fi
+  let "exit_code_sum+=$(grep ErrorCode result.json | wc -l)"
+  sleep 1
+
+  ./owgw_cli systeminfo
+  let "exit_code_sum+=$?"
+  if [[ ! -s result.json ]]
+  then
+    let "exit_code_sum+=1"
+  fi
+  let "exit_code_sum+=$(grep ErrorCode result.json | wc -l)"
+  sleep 1
+
+  ./owfms_cli systeminfo
+  let "exit_code_sum+=$?"
+  if [[ ! -s result.json ]]
+  then
+    let "exit_code_sum+=1"
+  fi
+  let "exit_code_sum+=$(grep ErrorCode result.json | wc -l)"
+  sleep 1
+
+  ./owprov_cli systeminfo
+  let "exit_code_sum+=$?"
+  if [[ ! -s result.json ]]
+  then
+    let "exit_code_sum+=1"
+  fi
+  let "exit_code_sum+=$(grep ErrorCode result.json | wc -l)"
+  sleep 1
+
+  let "CHECK_RETRIES-=1"
+  echo "Exit code sum: $exit_code_sum"
+  echo "Left retries: $CHECK_RETRIES"
+  sleep 5
+  echo
+done
+exit $exit_code_sum

chart/templates/job-clustersysteminfo.yaml

@@ -0,0 +1,82 @@
+{{- $root := . -}}
+{{- if .Values.clustersysteminfo.enabled }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "openwifi.fullname" . }}-clustersysteminfo-check
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "10"
+    "helm.sh/hook-delete-policy": before-hook-creation
+  labels:
+    app.kubernetes.io/name: {{ include "openwifi.name" . }}
+    helm.sh/chart: {{ include "openwifi.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  {{- with .Values.clustersysteminfo.activeDeadlineSeconds }}
+  activeDeadlineSeconds: {{ . }}
+  {{- end }}
+  {{- with .Values.clustersysteminfo.backoffLimit }}
+  backoffLimit: {{ . }}
+  {{- end }}
+  template:
+    metadata:
+      name: {{ include "openwifi.fullname" . }}-clustersysteminfo-check
+      labels:
+        app.kubernetes.io/name: {{ include "openwifi.name" . }}
+        helm.sh/chart: {{ include "openwifi.chart" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/managed-by: {{ .Release.Service }}
+    spec:
+      containers:
+        - name: clustersysteminfo-check
+          image: "{{ .Values.clustersysteminfo.images.clustersysteminfo.repository }}:{{ .Values.clustersysteminfo.images.clustersysteminfo.tag }}"
+          imagePullPolicy: {{ .Values.clustersysteminfo.images.clustersysteminfo.pullPolicy }}
+
+          env:
+            - name: KUBERNETES_DEPLOYED
+              value: "{{ now }}"
+          {{- range $key, $value := .Values.clustersysteminfo.public_env_variables }}
+            - name: {{ $key }}
+              value: {{ $value | quote }}
+          {{- end }}
+          {{- range $key, $value := .Values.clustersysteminfo.secret_env_variables }}
+            - name: {{ $key }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "openwifi.fullname" $root }}-clustersysteminfo-env
+                  key: {{ $key }}
+          {{- end }}
+
+          {{- with .Values.clustersysteminfo.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+
+      restartPolicy: {{ .Values.clustersysteminfo.restartPolicy }}
+
+      imagePullSecrets:
+      {{- range $image, $imageValue := .Values.clustersysteminfo.images }}
+        {{- if $imageValue.regcred }}
+      - name: {{ include "openwifi.fullname" $root }}-{{ $image }}-clustersysteminfo-regcred
+        {{- end }}
+      {{- end }}
+
+      {{- with .Values.clustersysteminfo.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
+      {{- with .Values.clustersysteminfo.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
+      {{- with .Values.clustersysteminfo.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
+{{- end }}

chart/templates/secret-clustersysteminfo-env.yaml

@@ -0,0 +1,19 @@
+{{- $root := . -}}
+{{- if .Values.clustersysteminfo.enabled }}
+---
+apiVersion: v1
+metadata:
+  labels:
+    app.kuberentes.io/name: {{ include "openwifi.name" . }}
+    helm.sh/chart: {{ include "openwifi.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  name: {{ include "openwifi.fullname" . }}-clustersysteminfo-env
+kind: Secret
+type: Opaque
+data:
+  # Secret env variables
+  {{- range $key, $value := .Values.clustersysteminfo.secret_env_variables }}
+  {{ $key }}: {{ $value | b64enc | quote }}
+  {{- end }}
+{{- end }}

chart/templates/secret-clustersysteminfo-regcred.yaml

@@ -0,0 +1,20 @@
+{{- $root := . -}}
+{{- if .Values.clustersysteminfo.enabled }}
+{{- range $image, $imageValue := .Values.clustersysteminfo.images }}
+{{- if $imageValue.regcred }}
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/dockerconfigjson
+metadata:
+  labels:
+    app.kuberentes.io/name: {{ include "openwifi.name" $root }}
+    helm.sh/chart: {{ include "openwifi.chart" $root }}
+    app.kubernetes.io/instance: {{ $root.Release.Name }}
+    app.kubernetes.io/managed-by: {{ $root.Release.Service }}
+  name: {{ include "openwifi.fullname" $root }}-{{ $image }}-clustersysteminfo-regcred
+data:
+  .dockerconfigjson: {{ $imageValue.regcred | quote }}
+{{- end }}
+{{- end }}
+{{- end }}

chart/values.yaml

@@ -22,6 +22,22 @@ owfms:
     openwifi.kafka.enable: "true"
     openwifi.kafka.brokerlist: kafka:9092
 
+# OpenWIFI Provisioning (https://github.com/Telecominfraproject/wlan-cloud-owprov/)
+owprov:
+  fullnameOverride: owprov
+
+  configProperties:
+    openwifi.kafka.enable: "true"
+    openwifi.kafka.brokerlist: kafka:9092
+
+# OpenWIFI Web UI (https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui/)
+owgwui:
+  fullnameOverride: owgwui
+
+# OpenWIFI Provisioning Web UI (https://github.com/Telecominfraproject/wlan-cloud-owprov-ui/)
+owprovui:
+  fullnameOverride: owprovui
+
 # rttys (https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-rtty)
 rttys:
   enabled: true
@@ -47,6 +63,51 @@ kafka:
   zookeeper:
     fullnameOverride: zookeeper
 
-# OpenWIFI Web UI (https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui/)
-owgwui:
-  fullnameOverride: owgwui
+# clustersysteminfo check
+clustersysteminfo:
+  enabled: false
+
+  fullnameOverride: clustersysteminfo
+
+  images:
+    clustersysteminfo:
+      repository: tip-tip-wlan-cloud-ucentral.jfrog.io/clustersysteminfo
+      tag: main
+      pullPolicy: Always
+#      regcred:
+#        registry: tip-tip-wlan-cloud-ucentral.jfrog.io
+#        username: username
+#        password: password
+
+  resources: {}
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    # requests:
+    #  cpu: 100m
+    #  memory: 128Mi
+    # limits:
+    #  cpu: 100m
+    #  memory: 128Mi
+
+  nodeSelector: {}
+
+  tolerations: []
+
+  affinity: {}
+
+  public_env_variables:
+    FLAGS: "-s --connect-timeout 3"
+    OWSEC: sec:16001
+    CHECK_RETRIES: 30
+
+  secret_env_variables:
+    OWSEC_DEFAULT_USERNAME: tip@ucentral.com
+    OWSEC_DEFAULT_PASSWORD: openwifi
+    #OWSEC_NEW_PASSWORD: "" # Set this value in order for the check to work. Password must comply https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/#authenticationvalidationexpression
+
+  activeDeadlineSeconds: 2400
+  backoffLimit: 5
+  restartPolicy: OnFailure
+

docker-compose/.env

@@ -0,0 +1,29 @@
+# Image tags
+COMPOSE_PROJECT_NAME=openwifi
+OWGW_TAG=v2.4.0-RC5
+OWGWUI_TAG=v2.4.0-RC2
+OWSEC_TAG=v2.4.0-RC4
+OWFMS_TAG=v2.4.0-RC4
+OWPROV_TAG=main
+OWPROVUI_TAG=main
+RTTYS_TAG=3.5.0
+KAFKA_TAG=latest
+ZOOKEEPER_TAG=latest
+ACMESH_TAG=latest
+TRAEFIK_TAG=latest
+
+# Microservice root/config directories
+OWGW_ROOT=/owgw-data
+OWGW_CONFIG=/owgw-data
+OWSEC_ROOT=/owsec-data
+OWSEC_CONFIG=/owsec-data
+OWFMS_ROOT=/owfms-data
+OWFMS_CONFIG=/owfms-data
+OWPROV_ROOT=/owprov-data
+OWPROV_CONFIG=/owprov-data
+
+# Microservice hostnames
+INTERNAL_OWGW_HOSTNAME=owgw.wlan.local
+INTERNAL_OWSEC_HOSTNAME=owsec.wlan.local
+INTERNAL_OWFMS_HOSTNAME=owfms.wlan.local
+INTERNAL_OWPROV_HOSTNAME=owprov.wlan.local

docker-compose/.env.letsencrypt

@@ -1,9 +1,11 @@
 # Image tags
 COMPOSE_PROJECT_NAME=openwifi
-OWGW_TAG=master
-OWGWUI_TAG=main
-OWSEC_TAG=main
-OWFMS_TAG=main
+OWGW_TAG=v2.4.0-RC5
+OWGWUI_TAG=v2.4.0-RC2
+OWSEC_TAG=v2.4.0-RC4
+OWFMS_TAG=v2.4.0-RC4
+OWPROV_TAG=main
+OWPROVUI_TAG=main
 RTTYS_TAG=3.5.0
 KAFKA_TAG=latest
 ZOOKEEPER_TAG=latest
@@ -17,17 +19,22 @@ OWSEC_ROOT=/owsec-data
 OWSEC_CONFIG=/owsec-data
 OWFMS_ROOT=/owfms-data
 OWFMS_CONFIG=/owfms-data
+OWPROV_ROOT=/owprov-data
+OWPROV_CONFIG=/owprov-data
 
 # Microservice hostnames
 INTERNAL_OWGW_HOSTNAME=owgw.wlan.local
 INTERNAL_OWGWUI_HOSTNAME=owgw-ui.wlan.local
 INTERNAL_OWSEC_HOSTNAME=owsec.wlan.local
 INTERNAL_OWFMS_HOSTNAME=owfms.wlan.local
+INTERNAL_OWPROV_HOSTNAME=owprov.wlan.local
+INTERNAL_OWPROVUI_HOSTNAME=owprov-ui.wlan.local
 INTERNAL_RTTYS_HOSTNAME=rttys.wlan.local
-SYSTEM_URI_UI=https://openwifi.wlan.local
 OWGW_HOSTNAME=
 OWGWUI_HOSTNAME=
 OWGWFILEUPLOAD_HOSTNAME=
 OWSEC_HOSTNAME=
 OWFMS_HOSTNAME=
+OWPROV_HOSTNAME=
+OWPROVUI_HOSTNAME=
 RTTYS_HOSTNAME=

docker-compose/.env.selfsigned

@@ -1,9 +1,11 @@
 # Image tags
 COMPOSE_PROJECT_NAME=openwifi
-OWGW_TAG=master
-OWGWUI_TAG=main
-OWSEC_TAG=main
-OWFMS_TAG=main
+OWGW_TAG=v2.4.0-RC5
+OWGWUI_TAG=v2.4.0-RC2
+OWSEC_TAG=v2.4.0-RC4
+OWFMS_TAG=v2.4.0-RC4
+OWPROV_TAG=main
+OWPROVUI_TAG=main
 RTTYS_TAG=3.5.0
 KAFKA_TAG=latest
 ZOOKEEPER_TAG=latest
@@ -17,11 +19,14 @@ OWSEC_ROOT=/owsec-data
 OWSEC_CONFIG=/owsec-data
 OWFMS_ROOT=/owfms-data
 OWFMS_CONFIG=/owfms-data
+OWPROV_ROOT=/owprov-data
+OWPROV_CONFIG=/owprov-data
 
 # Microservice hostnames
 INTERNAL_OWGW_HOSTNAME=owgw.wlan.local
 INTERNAL_OWGWUI_HOSTNAME=owgw-ui.wlan.local
 INTERNAL_OWSEC_HOSTNAME=owsec.wlan.local
 INTERNAL_OWFMS_HOSTNAME=owfms.wlan.local
+INTERNAL_OWPROV_HOSTNAME=owprov.wlan.local
+INTERNAL_OWPROVUI_HOSTNAME=owprov-ui.wlan.local
 INTERNAL_RTTYS_HOSTNAME=rttys.wlan.local
-SYSTEM_URI_UI=https://openwifi.wlan.local

docker-compose/README.md

@@ -1,17 +1,21 @@
 # Docker Compose
-With the provided Docker Compose files you can instantiate a deployment of the OpenWifi microservices and related components. The repository contains a self-signed certificate and a TIP-signed gateway certificate which are valid for the `*.wlan.local` domain. You also have the possibility to generate and use Letsencrypt certs instead of the provided self-signed cert for everything except the owgw websocket service.
-## Deployment with self-signed certificates
+### Overview
+With the provided Docker Compose files you can instantiate a deployment of the OpenWifi microservices and related components. The repository contains a self-signed certificate and a TIP-signed gateway certificate which are valid for the `*.wlan.local` domain. You also have the possibility to either generate and use Letsencrypt certs or provide your own certificates. Furthermore the deployments are split by whether Traefik is used as a reverse proxy/load balancer in front of the microservices or if they are exposed directly on the host. The advantage of using the deployments with Traefik is that you can use Letsencrypt certs (automatic certificate generation and renewal) and you have the ability to scale specific containers to multiple replicas.
+- [Non-LB deployment with self-signed certificates](#non-lb-deployment-with-self-signed-certificates)
+- [Non-LB deployment with own certificates](#non-lb-deployment-with-own-certificates)
+- [LB deployment with self-signed certificates](#lb-deployment-with-self-signed-certificates)
+- [LB deployment with Letsencrypt certificates](#lb-deployment-with-letsencrypt-certificates)
+### Configuration
+The configuration of the OpenWifi microservices is done via environment variables. For an overview of the supported configuration properties have a look into the microservice specific env files. For an explanation of the configuration properties please see the README in the respective microservice repository.
+#### Required password changing on the first startup
+One important action that must be done before using the deployment is changing password for the default user in owsec as described in [owsec docs](https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/tree/main#changing-default-password). Please use these docs to find the actions that must be done **after** the deployment in order to start using your deployment.
+## Non-LB deployment with self-signed certificates
 1. Switch into the project directory with `cd docker-compose/`.
 2. Add an entry for `openwifi.wlan.local` in your hosts file which points to `127.0.0.1` or whatever the IP of the host running the deployment is.
-3. Since the deployment is split into multiple Compose and .env files it makes sense to create an alias, for example:
-```
-alias docker-compose-selfsigned="docker-compose -f docker-compose.yml -f docker-compose.selfsigned.yml --env-file .env.selfsigned"
-```
-Spin up the deployment with `docker-compose-selfsigned up -d` and make sure to always use the alias when executing `docker-compose` commands. You also have the possibility to scale specific services to a specified number of instances with `docker-compose-selfsigned up -d --scale SERVICE=NUM`, where `SERVICE` is the service name as defined in the Compose file.
-
-4. Check if the containers are up and running with `docker-compose-selfsigned ps`.
-5. Add SSL certificate exceptions in your browser by visiting https://openwifi.wlan.local:16001, https://openwifi.wlan.local:16002 and https://openwifi.wlan.local:16004.
-6. Connect to your AP via SSH and add a static hosts entry in `/etc/hosts` for `openwifi.wlan.local` which points to the address of the host the Compose deployment runs on.
+3. Spin up the deployment with `docker-compose up -d`.
+4. Check if the containers are up and running with `docker-compose ps`.
+5. Add SSL certificate exceptions in your browser by visiting https://openwifi.wlan.local:16001, https://openwifi.wlan.local:16002, https://openwifi.wlan.local:16004 and https://openwifi.wlan.local:16005.
+6. Connect to your AP via SSH and add a static hosts entry in `/etc/hosts` for `openwifi.wlan.local`. This should point to the address of the host the Compose deployment runs on.
 7. Navigate to the UI `https://openwifi.wlan.local` and login with your OWSec authentication data.
 8. To use the curl test scripts included in the microservice repositories set the following environment variables:
 ```
@@ -19,56 +23,110 @@ export UCENTRALSEC="openwifi.wlan.local:16001"
 export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-compose/certs/restapi-ca.pem"
 ```
 ⚠️**Note**: When deploying with self-signed certificates you can not make use of the trace functionality in the UI since the AP will throw a TLS error when uploading the trace to OWGW. Please use the Letsencrypt deployment or provide your own valid certificates if you want to use this function.
-
-## Deployment with Letsencrypt certificates
+## Non-LB deployment with own certificates
+1. Switch into the project directory with `cd docker-compose/`. Copy your websocket and REST API certificates into the `certs/` directory. Make sure to reference the certificates accordingly in the service config if you use different file names or if you want to use different certificates for the respective microservices.
+2. Adapt the following hostname and URI variables according to your environment:
+### .env
+| Variable                   | Description                                                         |
+| -------------------------- | ------------------------------------------------------------------- |
+| `INTERNAL_OWGW_HOSTNAME`   | Set this to your OWGW hostname, for example `owgw.example.com`.     |
+| `INTERNAL_OWSEC_HOSTNAME`  | Set this to your OWSec hostname, for example `owsec.example.com`.   |
+| `INTERNAL_OWFMS_HOSTNAME`  | Set this to your OWFms hostname, for example `owfms.example.com`.   |
+| `INTERNAL_OWPROV_HOSTNAME` | Set this to your OWProv hostname, for example `owprov.example.com`. |
+### owgw.env
+| Variable                                 | Description                                                                         |
+| ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `FILEUPLOADER_HOST_NAME`                 | Set this to your OWGW fileupload hostname, for example `owgw.example.com`.          |
+| `FILEUPLOADER_URI`                       | Set this to your OWGW fileupload URL, for example `https://owgw.example.com:16003`. |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWGW REST API URL, for example `https://owgw.example.com:16002`.   |
+| `RTTY_SERVER`                            | Set this to your RTTY server hostname, for example `rttys.example.com`.             |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
+### owgw-ui.env
+| Variable                  | Description                                                                |
+| ------------------------- | -------------------------------------------------------------------------- |
+| `DEFAULT_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
+### owsec.env
+| Variable                                 | Description                                                                         |
+| ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWSec REST API URL, for example `https://owsec.example.com:16001`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
+### owfms.env
+| Variable                                 | Description                                                                         |
+| ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWFms REST API URL, for example `https://owfms.example.com:16004`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
+### owprov.env
+| Variable                                 | Description                                                                           |
+| ---------------------------------------- | ------------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWProv REST API URL, for example `https://owprov.example.com:16005`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.              |
+### owprov-ui.env
+| Variable                  | Description                                                                |
+| ------------------------- | -------------------------------------------------------------------------- |
+| `DEFAULT_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
+3. Spin up the deployment with `docker-compose up -d`.
+4. Check if the containers are up and running with `docker-compose ps`.
+5. Navigate to the UI and login with your OWSec authentication data.
+## LB deployment with self-signed certificates
+Follow the same instructions as for the self-signed deployment without Traefik. The only difference is that you have to spin up the deployment with `docker-compose -f docker-compose.lb.selfsigned.yml --env-file .env.selfsigned up -d`. Make sure to specify the Compose and the according .env file every time you're working with the deployment or create an alias, for example `alias docker-compose-lb-selfsigned="docker-compose -f docker-compose.lb.selfsigned.yml --env-file .env.selfsigned"`. You also have the possibility to scale specific services to a specified number of instances with `docker-compose-lb-selfsigned up -d --scale SERVICE=NUM`, where `SERVICE` is the service name as defined in the Compose file.
+## LB deployment with Letsencrypt certificates
+For the Letsencrypt challenge to work you need a public IP address. The hostnames which you set for the microservices have to resolve to this IP address to pass the HTTP-01 challenge (https://letsencrypt.org/docs/challenge-types/#http-01-challenge).
 1. Switch into the project directory with `cd docker-compose/`.
 2. Adapt the following hostname and URI variables according to your environment.
 ### .env.letsencrypt
-| Variable                  | Description                                         |
-| ------------------------- | --------------------------------------------------- |
-| `OWGW_HOSTNAME`           | This will be used as a hostname for OWGW REST API   |
-| `UCENTRALGWUI_HOSTNAME`   | This will be used as a hostname for uCentralGW-UI   |
-| `OWGWFILEUPLOAD_HOSTNAME` | This will be used as a hostname for OWGW fileupload |
-| `OWSEC_HOSTNAME`          | This will be used as a hostname for OWSec REST API  |
-| `OWFMS_HOSTNAME`          | This will be used as a hostname for OWFms REST API  |
-| `RTTYS_HOSTNAME`          | This will be used as a hostname for RTTYS           |
-| `SYSTEM_URI_UI`           | Set this to your uCentralGW-UI URL                  |
+| Variable                  | Description                                                                |
+| ------------------------- | -------------------------------------------------------------------------- |
+| `OWGW_HOSTNAME`           | Set this to your OWGW hostname, for example `owgw.example.com`.            |
+| `OWGWUI_HOSTNAME`         | Set this to your OWGW-UI hostname, for example `owgw-ui.example.com`.      |
+| `OWGWFILEUPLOAD_HOSTNAME` | Set this to your OWGW fileupload hostname, for example `owgw.example.com`. |
+| `OWSEC_HOSTNAME`          | Set this to your OWSec hostname, for example `owsec.example.com`.          |
+| `OWFMS_HOSTNAME`          | Set this to your OWFms hostname, for example `owfms.example.com`.          |
+| `OWPROV_HOSTNAME`         | Set this to your OWProv hostname, for example `owprov.example.com`.        |
+| `OWPROVUI_HOSTNAME`       | Set this to your OWProv-UI hostname, for example `owprov-ui.example.com`.  |
+| `RTTYS_HOSTNAME`          | Set this to your RTTYS hostname, for example `rttys.example.com`.          |
 
 ### owgw.env
-| Variable                 | Description                                  |
-| -----------------------  | -------------------------------------------- |
-| `FILEUPLOADER_HOST_NAME` | Set this to your OWGW fileupload hostname    |
-| `FILEUPLOADER_URI`       | Set this to your OWGW fileupload URL         |
-| `SYSTEM_URI_PUBLIC`      | Set this to your OWGW REST API public URL    |
-| `RTTY_SERVER`            | Set this to your public RTTY server hostname |
+| Variable                 | Description                                                                         |
+| -----------------------  | ----------------------------------------------------------------------------------- |
+| `FILEUPLOADER_HOST_NAME` | Set this to your OWGW fileupload hostname, for example `owgw.example.com`.          |
+| `FILEUPLOADER_URI`       | Set this to your OWGW fileupload URL, for example `https://owgw.example.com:16003`. |
+| `SYSTEM_URI_PUBLIC`      | Set this to your OWGW REST API URL, for example `https://owgw.example.com:16002`.   |
+| `RTTY_SERVER`            | Set this to your public RTTY server hostname, for example `rttys.example.com`.      |
+| `SYSTEM_URI_UI`          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
 
-### ucentralgw-ui.env
-| Variable            | Description                       |
-| ------------------- | --------------------------------- |
-| `DEFAULT_OWSEC_URL` | Set this to your public OWSec URL |
+### owgw-ui.env
+| Variable            | Description                                                                |
+| ------------------- | -------------------------------------------------------------------------- |
+| `DEFAULT_OWSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
 
 ### owsec.env
-| Variable            | Description                       |
-| ------------------- | --------------------------------- |
-| `SYSTEM_URI_PUBLIC` | Set this to your OWSec public URL |
+| Variable            | Description                                                                |
+| ------------------- | -------------------------------------------------------------------------- |
+| `SYSTEM_URI_PUBLIC` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
+| `SYSTEM_URI_UI`     | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.   |
 
 ### owfms.env
-| Variable             | Description                              |
-| -------------------- | ---------------------------------------- |
-| `SYSTEM_URI_PUBLIC`  | Set this to your OWFms public URL  |
-
+| Variable            | Description                                                                |
+| ------------------- | -------------------------------------------------------------------------- |
+| `SYSTEM_URI_PUBLIC` | Set this to your OWFms URL, for example `https://owfms.example.com:16004`. |
+| `SYSTEM_URI_UI`     | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.   |
+### owprov.env
+| Variable             | Description                                                                  |
+| -------------------- | ---------------------------------------------------------------------------- |
+| `SYSTEM_URI_PUBLIC`  | Set this to your OWProv URL, for example `https://owprov.example.com:16005`. |
+| `SYSTEM_URI_UI`      | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.     |
+### owprov-ui.env
+| Variable                  | Description                                                                |
+| ------------------------- | -------------------------------------------------------------------------- |
+| `DEFAULT_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
 ### traefik.env
 | Variable                                            | Description                               |
 | --------------------------------------------------- | ----------------------------------------- |
 | `TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_EMAIL` | Email address used for ACME registration. |
-
-3. Since the deployment is split into multiple Compose and .env files it makes sense to create an alias, for example:
-```
-alias docker-compose-letsencrypt="docker-compose -f docker-compose.yml -f docker-compose.letsencrypt.yml --env-file .env.letsencrypt"
-```
-Spin up the deployment with `docker-compose-letsencrypt up -d` and make sure to always use the alias when executing `docker-compose` commands. You also have the possibility to scale specific services to a specified number of instances with `docker-compose-letsencrypt up -d --scale SERVICE=NUM`, where `SERVICE` is the service name as defined in the Compose file.
-
-4. Check if the containers are up and running with `docker-compose-letsencrypt ps`.
+3. Spin up the deployment with `docker-compose -f docker-compose.lb.letsencrypt.yml --env-file .env.letsencrypt up -d`. Make sure to specify the Compose and the according .env file every time you're working with the deployment or create an alias, for example `alias docker-compose-lb-letsencrypt="docker-compose -f docker-compose.lb.letsencrypt.yml --env-file .env.letsencrypt"`. You also have the possibility to scale specific services to a specified number of instances with `docker-compose-lb-letsencrypt up -d --scale SERVICE=NUM`, where `SERVICE` is the service name as defined in the Compose file.
+4. Check if the containers are up and running with `docker-compose-lb-letsencrypt ps`.
 5. Navigate to the UI and login with your OWSec authentication data.
 
-**Note**: Both deployments create local volumes to persist mostly application, database and certificate data. In addition to that the `certs/` directory is bind mounted into the microservice containers. Be aware that for the bind mounts the host directories and files will be owned by the user in the container. Since the files are under version control, you may have to change the ownership to your user again before pulling changes.
+**Note**: The deployments create local volumes to persist mostly application, database and certificate data. In addition to that the `certs/` directory is bind mounted into the microservice containers. Be aware that for the bind mounts the host directories and files will be owned by the user in the container. Since the files are under version control, you may have to change the ownership to your user again before pulling changes.
+### owsec templates and wwwassets
+On the startup of owsec directories for wwwassets and mailer templates are created from the base files included in Docker image. After the initial startup you may edit those files as you wish in the [owsec-data/persist](./owsec-data/persist) directory.

docker-compose/docker-compose.lb.letsencrypt.yml

@@ -0,0 +1,187 @@
+version: '3'
+
+volumes:
+  owgw_data:
+    driver: local
+  owsec_data:
+    driver: local
+  owfms_data:
+    driver: local
+  owprov_data:
+    driver: local
+  zookeeper_data:
+    driver: local
+  zookeeper_datalog:
+    driver: local
+  kafka_data:
+    driver: local
+  letsencrypt_certs:
+    driver: local
+
+networks:
+  openwifi:
+
+services:
+  owgw:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owgw:${OWGW_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWGW_HOSTNAME}
+    env_file:
+      - .env.letsencrypt
+      - owgw.env
+    depends_on:
+      - kafka
+      - rttys
+    restart: unless-stopped
+    volumes:
+      - owgw_data:${OWGW_ROOT}/persist
+      - ./certs:/${OWGW_ROOT}/certs
+    sysctls:
+      - net.ipv4.tcp_keepalive_intvl=5
+      - net.ipv4.tcp_keepalive_probes=2
+      - net.ipv4.tcp_keepalive_time=45
+
+  owgw-ui:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owgw-ui:${OWGWUI_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWGWUI_HOSTNAME}
+    env_file:
+      - owgw-ui.env
+    depends_on:
+      - owsec
+      - owgw
+      - owfms
+      - owprov
+    restart: unless-stopped
+
+  owsec:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owsec:${OWSEC_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWSEC_HOSTNAME}
+    env_file:
+      - .env.letsencrypt
+      - owsec.env
+    depends_on:
+      - kafka
+    restart: unless-stopped
+    volumes:
+      - owsec_data:${OWSEC_ROOT}/persist
+      - ./certs:/${OWSEC_ROOT}/certs
+
+  owfms:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owfms:${OWFMS_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWFMS_HOSTNAME}
+    env_file:
+      - .env.letsencrypt
+      - owfms.env
+    depends_on:
+      - kafka
+    restart: unless-stopped
+    volumes:
+      - owfms_data:${OWFMS_ROOT}/persist
+      - ./certs:/${OWFMS_ROOT}/certs
+
+  owprov:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owprov:${OWPROV_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWPROV_HOSTNAME}
+    env_file:
+      - .env.letsencrypt
+      - owprov.env
+    depends_on:
+      - kafka
+    restart: unless-stopped
+    volumes:
+      - owprov_data:${OWPROV_ROOT}
+      - ./certs:/${OWPROV_ROOT}/certs
+
+  owprov-ui:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owprov-ui:${OWPROVUI_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWPROVUI_HOSTNAME}
+    env_file:
+      - owprov-ui.env
+    depends_on:
+      - owsec
+      - owgw
+      - owfms
+      - owprov
+    restart: unless-stopped
+
+  rttys:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/rttys:${RTTYS_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_RTTYS_HOSTNAME}
+    restart: unless-stopped
+    volumes:
+      - "./certs/restapi-cert.pem:/etc/rttys/restapi-cert.pem"
+      - "./certs/restapi-key.pem:/etc/rttys/restapi-key.pem"
+      - "./rttys/rttys_letsencrypt.conf:/rttys/rttys.conf"
+
+  zookeeper:
+    image: "zookeeper:${ZOOKEEPER_TAG}"
+    networks:
+      openwifi:
+    restart: unless-stopped
+    volumes:
+      - zookeeper_data:/data
+      - zookeeper_datalog:/datalog
+
+  kafka:
+    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    networks:
+      openwifi:
+    env_file:
+      - kafka.env
+    restart: unless-stopped
+    depends_on:
+      - zookeeper
+    volumes:
+      - kafka_data:/bitnami/kafka
+
+  traefik:
+    image: "traefik:${TRAEFIK_TAG}"
+    networks:
+      openwifi:
+    env_file:
+      - .env.letsencrypt
+      - traefik.env
+    depends_on:
+      - owsec
+      - owgw
+      - owgw-ui
+      - owfms
+      - owprov
+      - owprov-ui
+      - rttys
+    restart: unless-stopped
+    volumes:
+      - "./traefik/openwifi_letsencrypt.yaml:/etc/traefik/openwifi.yaml"
+      - "./certs/restapi-ca.pem:/certs/restapi-ca.pem"
+      - "letsencrypt_certs:/letsencrypt"
+    ports:
+      - "15002:15002"
+      - "16002:16002"
+      - "16003:16003"
+      - "80:80"
+      - "443:443"
+      - "16001:16001"
+      - "16004:16004"
+      - "16005:16005"
+      - "5912:5912"
+      - "5913:5913"

docker-compose/docker-compose.lb.selfsigned.yml

@@ -0,0 +1,189 @@
+version: '3'
+
+volumes:
+  owgw_data:
+    driver: local
+  owsec_data:
+    driver: local
+  owfms_data:
+    driver: local
+  owprov_data:
+    driver: local
+  zookeeper_data:
+    driver: local
+  zookeeper_datalog:
+    driver: local
+  kafka_data:
+    driver: local
+
+networks:
+  openwifi:
+
+services:
+  owgw:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owgw:${OWGW_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWGW_HOSTNAME}
+    env_file:
+      - .env.selfsigned
+      - owgw.env
+    depends_on:
+      - kafka
+      - rttys
+    restart: unless-stopped
+    volumes:
+      - owgw_data:${OWGW_ROOT}/persist
+      - ./certs:/${OWGW_ROOT}/certs
+    sysctls:
+      - net.ipv4.tcp_keepalive_intvl=5
+      - net.ipv4.tcp_keepalive_probes=2
+      - net.ipv4.tcp_keepalive_time=45
+
+  owgw-ui:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owgw-ui:${OWGWUI_TAG}"
+    env_file: 
+      - owgw-ui.env
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWGWUI_HOSTNAME}
+    env_file:
+      - owgw-ui.env
+    depends_on:
+      - owsec
+      - owgw
+      - owfms
+      - owprov
+    restart: unless-stopped
+
+  owsec:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owsec:${OWSEC_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWSEC_HOSTNAME}
+    env_file:
+      - .env.selfsigned
+      - owsec.env
+    depends_on:
+      - kafka
+    restart: unless-stopped
+    volumes:
+      - owsec_data:${OWSEC_ROOT}/persist
+      - ./certs:/${OWSEC_ROOT}/certs
+
+  owfms:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owfms:${OWFMS_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWFMS_HOSTNAME}
+    env_file:
+      - .env.selfsigned
+      - owfms.env
+    depends_on:
+      - kafka
+    restart: unless-stopped
+    volumes:
+      - owfms_data:${OWFMS_ROOT}/persist
+      - ./certs:/${OWFMS_ROOT}/certs
+
+  owprov:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owprov:${OWPROV_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWPROV_HOSTNAME}
+    env_file:
+      - .env.selfsigned
+      - owprov.env
+    depends_on:
+      - kafka
+    restart: unless-stopped
+    volumes:
+      - owprov_data:${OWPROV_ROOT}
+      - ./certs:/${OWPROV_ROOT}/certs
+
+  owprov-ui:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owprov-ui:${OWPROVUI_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWPROVUI_HOSTNAME}
+    env_file:
+      - owprov-ui.env
+    depends_on:
+      - owsec
+      - owgw
+      - owfms
+      - owprov
+    restart: unless-stopped
+
+  rttys:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/rttys:${RTTYS_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_RTTYS_HOSTNAME}
+    restart: unless-stopped
+    volumes:
+      - "./certs/restapi-cert.pem:/etc/rttys/restapi-cert.pem"
+      - "./certs/restapi-key.pem:/etc/rttys/restapi-key.pem"
+      - "./rttys/rttys.conf:/rttys/rttys.conf"
+
+  zookeeper:
+    image: "zookeeper:${ZOOKEEPER_TAG}"
+    networks:
+      openwifi:
+    restart: unless-stopped
+    volumes:
+      - zookeeper_data:/data
+      - zookeeper_datalog:/datalog
+
+  kafka:
+    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    networks:
+      openwifi:
+    env_file:
+      - kafka.env
+    restart: unless-stopped
+    depends_on:
+      - zookeeper
+    volumes:
+      - kafka_data:/bitnami/kafka
+
+  traefik:
+    image: "traefik:${TRAEFIK_TAG}"
+    networks:
+      openwifi:
+    env_file:
+      - traefik.env
+    depends_on:
+      - owsec
+      - owgw
+      - owgw-ui
+      - owfms
+      - owprov
+      - owprov-ui
+      - rttys
+    restart: unless-stopped
+    volumes:
+      - "./traefik/openwifi_selfsigned.yaml:/etc/traefik/openwifi.yaml"
+      - "./certs/restapi-ca.pem:/certs/restapi-ca.pem"
+      - "./certs/restapi-cert.pem:/certs/restapi-cert.pem"
+      - "./certs/restapi-key.pem:/certs/restapi-key.pem"
+    ports:
+      - "15002:15002"
+      - "16002:16002"
+      - "16003:16003"
+      - "80:80"
+      - "8080:8080"
+      - "443:443"
+      - "8443:8443"
+      - "16001:16001"
+      - "16004:16004"
+      - "16005:16005"
+      - "5912:5912"
+      - "5913:5913"

docker-compose/docker-compose.letsencrypt.yml

@@ -1,30 +0,0 @@
-version: '3'
-
-volumes:
-  letsencrypt_certs:
-    driver: local
-
-services:
-  owgw:
-    env_file:
-      - .env.letsencrypt
-
-  owsec:
-    env_file:
-      - .env.letsencrypt
-
-  owfms:
-    env_file:
-      - .env.letsencrypt
-
-  rttys:
-    volumes:
-      - "./rttys/rttys_letsencrypt.conf:/rttys/rttys.conf"
-
-  traefik:
-    env_file:
-      - .env.letsencrypt
-    volumes:
-      - "./traefik/openwifi_letsencrypt.yaml:/etc/traefik/openwifi.yaml"
-      - "./certs/restapi-ca.pem:/certs/restapi-ca.pem"
-      - "letsencrypt_certs:/letsencrypt"

docker-compose/docker-compose.selfsigned.yml

@@ -1,27 +0,0 @@
-version: '3'
-
-services:
-  owgw:
-    env_file:
-      - .env.selfsigned
-
-  owsec:
-    env_file:
-      - .env.selfsigned
-
-  owfms:
-    env_file:
-      - .env.selfsigned
-
-  rttys:
-    volumes:
-      - "./certs/restapi-cert.pem:/etc/rttys/restapi-cert.pem"
-      - "./certs/restapi-key.pem:/etc/rttys/restapi-key.pem"
-      - "./rttys/rttys_selfsigned.conf:/rttys/rttys.conf"
-
-  traefik:
-    volumes:
-      - "./traefik/openwifi_selfsigned.yaml:/etc/traefik/openwifi.yaml"
-      - "./certs/restapi-ca.pem:/certs/restapi-ca.pem"
-      - "./certs/restapi-cert.pem:/certs/restapi-cert.pem"
-      - "./certs/restapi-key.pem:/certs/restapi-key.pem"

docker-compose/docker-compose.yml

@@ -1,12 +1,6 @@
 version: '3'
 
 volumes:
-  owgw_data:
-    driver: local
-  owsec_data:
-    driver: local
-  owfms_data:
-    driver: local
   zookeeper_data:
     driver: local
   zookeeper_datalog:
@@ -31,22 +25,37 @@ services:
       - rttys
     restart: unless-stopped
     volumes:
-      - owgw_data:${OWGW_ROOT}/persist
-      - ./certs:/${OWGW_ROOT}/certs
+      - "./owgw_data:${OWGW_ROOT}"
+      - "./certs:/${OWGW_ROOT}/certs"
+    ports:
+      - "15002:15002"
+      - "16002:16002"
+      - "16102:16102"
+      - "16003:16003"
+    sysctls:
+      - net.ipv4.tcp_keepalive_intvl=5
+      - net.ipv4.tcp_keepalive_probes=2
+      - net.ipv4.tcp_keepalive_time=45
 
   owgw-ui:
     image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owgw-ui:${OWGWUI_TAG}"
     networks:
       openwifi:
-        aliases:
-          - ${INTERNAL_OWGWUI_HOSTNAME}
     env_file:
       - owgw-ui.env
     depends_on:
       - owsec
       - owgw
       - owfms
+      - owprov
     restart: unless-stopped
+    volumes:
+      - "./owgw-ui/default.conf:/etc/nginx/conf.d/default.conf"
+      - "./certs/restapi-cert.pem:/etc/nginx/restapi-cert.pem"
+      - "./certs/restapi-key.pem:/etc/nginx/restapi-key.pem"
+    ports:
+      - "80:80"
+      - "443:443"
 
   owsec:
     image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owsec:${OWSEC_TAG}"
@@ -60,8 +69,11 @@ services:
       - kafka
     restart: unless-stopped
     volumes:
-      - owsec_data:${OWSEC_ROOT}/persist
-      - ./certs:/${OWSEC_ROOT}/certs
+      - "./owsec_data:${OWSEC_ROOT}"
+      - "./certs:/${OWSEC_ROOT}/certs"
+    ports:
+      - "16001:16001"
+      - "16101:16101"
 
   owfms:
     image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owfms:${OWFMS_TAG}"
@@ -75,16 +87,62 @@ services:
       - kafka
     restart: unless-stopped
     volumes:
-      - owfms_data:${OWFMS_ROOT}/persist
-      - ./certs:/${OWFMS_ROOT}/certs
+      - "./owfms_data:${OWFMS_ROOT}"
+      - "./certs:/${OWFMS_ROOT}/certs"
+    ports:
+      - "16004:16004"
+      - "16104:16104"
 
-  rttys:
-    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/rttys:${RTTYS_TAG}"
+  owprov:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owprov:${OWPROV_TAG}"
     networks:
       openwifi:
         aliases:
-          - ${INTERNAL_RTTYS_HOSTNAME}
+          - ${INTERNAL_OWPROV_HOSTNAME}
+    env_file:
+      - owprov.env
+    depends_on:
+      - kafka
     restart: unless-stopped
+    volumes:
+      - "./owprov_data:${OWPROV_ROOT}"
+      - "./certs:/${OWPROV_ROOT}/certs"
+    ports:
+      - "16005:16005"
+      - "16105:16105"
+
+  owprov-ui:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owprov-ui:${OWPROVUI_TAG}"
+    networks:
+      openwifi:
+    env_file:
+      - owprov-ui.env
+    depends_on:
+      - owsec
+      - owgw
+      - owfms
+      - owprov
+    restart: unless-stopped
+    volumes:
+      - "./owprov-ui/default.conf:/etc/nginx/conf.d/default.conf"
+      - "./certs/restapi-cert.pem:/etc/nginx/restapi-cert.pem"
+      - "./certs/restapi-key.pem:/etc/nginx/restapi-key.pem"
+    ports:
+      - "8080:8080"
+      - "8443:8443"
+
+  rttys:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/rttys:${RTTYS_TAG}"
+    restart: unless-stopped
+    networks:
+      openwifi:
+    volumes:
+      - "./certs/restapi-cert.pem:/etc/rttys/restapi-cert.pem"
+      - "./certs/restapi-key.pem:/etc/rttys/restapi-key.pem"
+      - "./rttys/rttys.conf:/rttys/rttys.conf"
+    ports:
+      - "5912:5912"
+      - "5913:5913"
 
   zookeeper:
     image: "zookeeper:${ZOOKEEPER_TAG}"
@@ -106,27 +164,3 @@ services:
       - zookeeper
     volumes:
       - kafka_data:/bitnami/kafka
-
-  traefik:
-    image: "traefik:${TRAEFIK_TAG}"
-    networks:
-      openwifi:
-    env_file:
-      - traefik.env
-    depends_on:
-      - owsec
-      - owgw
-      - owgw-ui
-      - owfms
-      - rttys
-    restart: unless-stopped
-    ports:
-      - "15002:15002"
-      - "16002:16002"
-      - "16003:16003"
-      - "80:80"
-      - "443:443"
-      - "16001:16001"
-      - "16004:16004"
-      - "5912:5912"
-      - "5913:5913"

docker-compose/owfms.env

@@ -1,9 +1,38 @@
 RUN_CHOWN=true
 TEMPLATE_CONFIG=true
 SELFSIGNED_CERTS=true
+
+#RESTAPI_HOST_ROOTCA=$OWFMS_ROOT/certs/restapi-ca.pem
+#RESTAPI_HOST_PORT=16004
+#RESTAPI_HOST_CERT=$OWFMS_ROOT/certs/restapi-cert.pem
+#RESTAPI_HOST_KEY=$OWFMS_ROOT/certs/restapi-key.pem
+#RESTAPI_HOST_KEY_PASSWORD=mypassword
+#INTERNAL_RESTAPI_HOST_ROOTCA=$OWFMS_ROOT/certs/restapi-ca.pem
+#INTERNAL_RESTAPI_HOST_PORT=17004
+#INTERNAL_RESTAPI_HOST_CERT=$OWFMS_ROOT/certs/restapi-cert.pem
+#INTERNAL_RESTAPI_HOST_KEY=$OWFMS_ROOT/certs/restapi-key.pem
+#INTERNAL_RESTAPI_HOST_KEY_PASSWORD=mypassword
+#SERVICE_KEY=$OWFMS_ROOT/certs/restapi-key.pem
+#SERVICE_KEY_PASSWORD=mypassword
 SYSTEM_DATA=$OWFMS_ROOT/persist
 SYSTEM_URI_PRIVATE=https://owfms.wlan.local:17004
 SYSTEM_URI_PUBLIC=https://openwifi.wlan.local:16004
+SYSTEM_URI_UI=https://openwifi.wlan.local
+#S3_BUCKETNAME=ucentral-ap-firmware
+#S3_REGION=us-east-1
 S3_SECRET=b0S6EiR5RLIxoe7Xvz9YXPPdxQCoZ6ze37qunTAI
 S3_KEY=AKIAUG47UZG7R6SRLD7F
+#S3_BUCKET_URI=ucentral-ap-firmware.s3.amazonaws.com
+#KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owfms
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owfms
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owfms
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE_MYSQL_HOST=localhost
+#STORAGE_TYPE_MYSQL_USERNAME=owfms
+#STORAGE_TYPE_MYSQL_PASSWORD=owfms
+#STORAGE_TYPE_MYSQL_DATABASE=owfms
+#STORAGE_TYPE_MYSQL_PORT=3306

docker-compose/owgw-ui/default.conf

@@ -0,0 +1,32 @@
+server {
+    listen       80;
+    listen  [::]:80;
+
+    # Disable emitting nginx version
+    server_tokens off;
+
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+
+    # Disable emitting nginx version
+    server_tokens off;
+
+    ssl_certificate     /etc/nginx/restapi-cert.pem;
+    ssl_certificate_key /etc/nginx/restapi-key.pem;
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    # redirect server error pages to the static page /50x.html
+    #
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}

docker-compose/owgw.env

@@ -1,12 +1,55 @@
 RUN_CHOWN=true
 TEMPLATE_CONFIG=true
 SELFSIGNED_CERTS=true
+
+#WEBSOCKET_HOST_ROOTCA=$OWGW_ROOT/certs/root.pem
+#WEBSOCKET_HOST_ISSUER=$OWGW_ROOT/certs/issuer.pem
+#WEBSOCKET_HOST_CERT=$OWGW_ROOT/certs/websocket-cert.pem
+#WEBSOCKET_HOST_KEY=$OWGW_ROOT/certs/websocket-key.pem
+#WEBSOCKET_HOST_CLIENTCAS=$OWGW_ROOT/certs/clientcas.pem
+#WEBSOCKET_HOST_CAS=$OWGW_ROOT/certs/cas
+#WEBSOCKET_HOST_PORT=15002
+#WEBSOCKET_HOST_KEY_PASSWORD=mypassword
+#RESTAPI_HOST_ROOTCA=$OWGW_ROOT/certs/restapi-ca.pem
+#RESTAPI_HOST_PORT=16002
+#RESTAPI_HOST_CERT=$OWGW_ROOT/certs/restapi-cert.pem
+#RESTAPI_HOST_KEY=$OWGW_ROOT/certs/restapi-key.pem
+#RESTAPI_HOST_KEY_PASSWORD=mypassword
+#INTERNAL_RESTAPI_HOST_ROOTCA=$OWGW_ROOT/certs/restapi-ca.pem
+#INTERNAL_RESTAPI_HOST_PORT=17002
+#INTERNAL_RESTAPI_HOST_CERT=$OWGW_ROOT/certs/restapi-cert.pem
+#INTERNAL_RESTAPI_HOST_KEY=$OWGW_ROOT/certs/restapi-key.pem
+#INTERNAL_RESTAPI_HOST_KEY_PASSWORD=mypassword
+#FILEUPLOADER_HOST_ROOTCA=$OWGW_ROOT/certs/restapi-ca.pem
 FILEUPLOADER_HOST_NAME=openwifi.wlan.local
+#FILEUPLOADER_HOST_PORT=16003
+#FILEUPLOADER_HOST_CERT=$OWGW_ROOT/certs/restapi-cert.pem
+#FILEUPLOADER_HOST_KEY=$OWGW_ROOT/certs/restapi-key.pem
+#FILEUPLOADER_HOST_KEY_PASSWORD=mypassword
 FILEUPLOADER_PATH=$OWGW_ROOT/persist/uploads
 FILEUPLOADER_URI=https://openwifi.wlan.local:16003
+#SERVICE_KEY=$OWGW_ROOT/certs/restapi-key.pem
+#SERVICE_KEY_PASSWORD=mypassword
 SYSTEM_DATA=$OWGW_ROOT/persist
 SYSTEM_URI_PRIVATE=https://owgw.wlan.local:17002
 SYSTEM_URI_PUBLIC=https://openwifi.wlan.local:16002
+SYSTEM_URI_UI=https://openwifi.wlan.local
 RTTY_ENABLED=true
 RTTY_SERVER=openwifi.wlan.local
+#RTTY_PORT=5912
+#RTTY_TOKEN=96181c567b4d0d98c50f127230068fa8
+#RTTY_TIMEOUT=60
+#RTTY_VIEWPORT=5913
+#KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owgw
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owgw
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owgw
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE_MYSQL_HOST=localhost
+#STORAGE_TYPE_MYSQL_USERNAME=owgw
+#STORAGE_TYPE_MYSQL_PASSWORD=owgw
+#STORAGE_TYPE_MYSQL_DATABASE=owgw
+#STORAGE_TYPE_MYSQL_PORT=3306

docker-compose/owprov-ui.env

@@ -0,0 +1,2 @@
+DEFAULT_UCENTRALSEC_URL=https://openwifi.wlan.local:16001
+ALLOW_UCENTRALSEC_CHANGE=false

docker-compose/owprov-ui/default.conf

@@ -0,0 +1,32 @@
+server {
+    listen       8080;
+    listen  [::]:8080;
+
+    # Disable emitting nginx version
+    server_tokens off;
+
+    return 301 https://$host:8443$request_uri;
+}
+
+server {
+    listen       8443 ssl;
+    listen       [::]:8443 ssl;
+
+    # Disable emitting nginx version
+    server_tokens off;
+
+    ssl_certificate     /etc/nginx/restapi-cert.pem;
+    ssl_certificate_key /etc/nginx/restapi-key.pem;
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    # redirect server error pages to the static page /50x.html
+    #
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}

docker-compose/owprov.env

@@ -0,0 +1,35 @@
+RUN_CHOWN=true
+TEMPLATE_CONFIG=true
+SELFSIGNED_CERTS=true
+
+#RESTAPI_HOST_ROOTCA=$OWPROV_ROOT/certs/restapi-ca.pem
+#RESTAPI_HOST_PORT=16005
+#RESTAPI_HOST_CERT=$OWPROV_ROOT/certs/restapi-cert.pem
+#RESTAPI_HOST_KEY=$OWPROV_ROOT/certs/restapi-key.pem
+#RESTAPI_HOST_KEY_PASSWORD=mypassword
+#INTERNAL_RESTAPI_HOST_ROOTCA=$OWPROV_ROOT/certs/restapi-ca.pem
+#INTERNAL_RESTAPI_HOST_PORT=17005
+#INTERNAL_RESTAPI_HOST_CERT=$OWPROV_ROOT/certs/restapi-cert.pem
+#INTERNAL_RESTAPI_HOST_KEY=$OWPROV_ROOT/certs/restapi-key.pem
+#INTERNAL_RESTAPI_HOST_KEY_PASSWORD=mypassword
+#FIRMWARE_UPDATER_UPGRADE=yes
+#FIRMWARE_UPDATER_RCONLY=no
+#SERVICE_KEY=$OWPROV_ROOT/certs/restapi-key.pem
+#SERVICE_KEY_PASSWORD=mypassword
+SYSTEM_DATA=$OWPROV_ROOT/persist
+SYSTEM_URI_PRIVATE=https://owprov.wlan.local:17005
+SYSTEM_URI_PUBLIC=https://openwifi.wlan.local:16005
+SYSTEM_URI_UI=https://openwifi.wlan.local
+#KAFKA_ENABLE=true
+KAFKA_BROKERLIST=kafka:9092
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owprov
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owprov
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owprov
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE_MYSQL_HOST=localhost
+#STORAGE_TYPE_MYSQL_USERNAME=owprov
+#STORAGE_TYPE_MYSQL_PASSWORD=owprov
+#STORAGE_TYPE_MYSQL_DATABASE=owprov
+#STORAGE_TYPE_MYSQL_PORT=3306

docker-compose/owsec.env

@@ -1,7 +1,44 @@
 RUN_CHOWN=true
 TEMPLATE_CONFIG=true
 SELFSIGNED_CERTS=true
+
+#RESTAPI_HOST_ROOTCA=$OWSEC_ROOT/certs/restapi-ca.pem
+#RESTAPI_HOST_PORT=16001
+#RESTAPI_HOST_CERT=$OWSEC_ROOT/certs/restapi-cert.pem
+#RESTAPI_HOST_KEY=$OWSEC_ROOT/certs/restapi-key.pem
+#RESTAPI_HOST_KEY_PASSWORD=mypassword
+#RESTAPI_WWWASSETS=$OWSEC_ROOT/wwwassets
+#INTERNAL_RESTAPI_HOST_ROOTCA=$OWSEC_ROOT/certs/restapi-ca.pem
+#INTERNAL_RESTAPI_HOST_PORT=17001
+#INTERNAL_RESTAPI_HOST_CERT=$OWSEC_ROOT/certs/restapi-cert.pem
+#INTERNAL_RESTAPI_HOST_KEY=$OWSEC_ROOT/certs/restapi-key.pem
+#INTERNAL_RESTAPI_HOST_KEY_PASSWORD=mypassword
+#AUTHENTICATION_DEFAULT_USERNAME=tip@ucentral.com
+#AUTHENTICATION_DEFAULT_PASSWORD=13268b7daa751240369d125e79c873bd8dd3bef7981bdfd38ea03dbb1fbe7dcf
 SYSTEM_DATA=$OWSEC_ROOT/persist
 SYSTEM_URI_PRIVATE=https://owsec.wlan.local:17001
 SYSTEM_URI_PUBLIC=https://openwifi.wlan.local:16001
+SYSTEM_URI_UI=https://openwifi.wlan.local
+#SERVICE_KEY=$OWSEC_ROOT/certs/restapi-key.pem
+#SERVICE_KEY_PASSWORD=mypassword
+#MAILER_HOSTNAME=localhost
+#MAILER_USERNAME=************************
+#MAILER_PASSWORD=************************
+#MAILER_SENDER=OpenWIFI
+#MAILER_PORT=587
+#MAILER_TEMPLATES=$OWSEC_ROOT/templates
+#KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
+#DOCUMENT_POLICY_ACCESS=$OWSEC_ROOT/wwwassets/access_policy.html
+#DOCUMENT_POLICY_PASSWORD=$OWSEC_ROOT/wwwassets/password_policy.html
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owsec
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owsec
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owsec
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE_MYSQL_HOST=localhost
+#STORAGE_TYPE_MYSQL_USERNAME=owsec
+#STORAGE_TYPE_MYSQL_PASSWORD=owsec
+#STORAGE_TYPE_MYSQL_DATABASE=owsec
+#STORAGE_TYPE_MYSQL_PORT=3306

docker-compose/traefik.env

@@ -3,9 +3,13 @@ TRAEFIK_ENTRYPOINTS_OWGWRESTAPI_ADDRESS=:16002
 TRAEFIK_ENTRYPOINTS_OWGWFILEUPLOAD_ADDRESS=:16003
 TRAEFIK_ENTRYPOINTS_OWGWUIHTTP_ADDRESS=:80
 TRAEFIK_ENTRYPOINTS_OWGWUIHTTP_HTTP_REDIRECTIONS_ENTRYPOINT_TO=owgwuihttps
+TRAEFIK_ENTRYPOINTS_OWPROVUIHTTP_ADDRESS=:8080
+TRAEFIK_ENTRYPOINTS_OWPROVUIHTTP_HTTP_REDIRECTIONS_ENTRYPOINT_TO=owprovuihttps
 TRAEFIK_ENTRYPOINTS_OWGWUIHTTPS_ADDRESS=:443
+TRAEFIK_ENTRYPOINTS_OWPROVUIHTTPS_ADDRESS=:8443
 TRAEFIK_ENTRYPOINTS_OWSECRESTAPI_ADDRESS=:16001
 TRAEFIK_ENTRYPOINTS_OWFMSRESTAPI_ADDRESS=:16004
+TRAEFIK_ENTRYPOINTS_OWPROVRESTAPI_ADDRESS=:16005
 TRAEFIK_ENTRYPOINTS_RTTYSDEV_ADDRESS=:5912
 TRAEFIK_ENTRYPOINTS_RTTYSUSER_ADDRESS=:5913
 TRAEFIK_PROVIDERS_FILE_FILENAME=/etc/traefik/openwifi.yaml

docker-compose/traefik/openwifi_letsencrypt.yaml

@@ -20,6 +20,14 @@ http:
       loadBalancer:
         servers:
           - url: "https://owfms.wlan.local:16004/"
+    owprov-restapi:
+      loadBalancer:
+        servers:
+          - url: "https://owprov.wlan.local:16005/"
+    owprov-ui:
+      loadBalancer:
+        servers:
+          - url: "http://owprov-ui.wlan.local:80/"
     rttys-user:
       loadBalancer:
         servers:
@@ -60,6 +68,22 @@ http:
       rule: "Host(`{{env "OWFMS_HOSTNAME"}}`)"
       tls:
         certResolver: "openwifi"
+    owprov-restapi:
+      entryPoints: "owprovrestapi"
+      service: "owprov-restapi"
+      rule: "Host(`{{env "OWPROV_HOSTNAME"}}`)"
+      tls:
+        certResolver: "openwifi"
+    owprov-ui-http:
+      entryPoints: "owgwuihttp"
+      service: "owprov-ui"
+      rule: "Host(`{{ env "OWPROVUI_HOSTNAME" }}`)"
+    owprov-ui-https:
+      entryPoints: "owgwuihttps"
+      service: "owprov-ui"
+      rule: "Host(`{{ env "OWPROVUI_HOSTNAME" }}`)"
+      tls:
+        certResolver: "openwifi"
     rttys-user:
       entryPoints: "rttysuser"
       service: "rttys-user"

docker-compose/traefik/openwifi_selfsigned.yaml

@@ -10,6 +10,11 @@ http:
         servers:
           - url: "http://owgw-ui.wlan.local:80/"
 
+    owprov-ui:
+      loadBalancer:
+        servers:
+          - url: "http://owprov-ui.wlan.local:80/"
+
   routers:
     owgw-ui-http:
       entryPoints: "owgwuihttp"
@@ -22,6 +27,17 @@ http:
       rule: "PathPrefix(`/`)"
       tls: {}
 
+    owprov-ui-http:
+      entryPoints: "owprovuihttp"
+      service: "owprov-ui"
+      rule: "PathPrefix(`/`)"
+
+    owprov-ui-https:
+      entryPoints: "owprovuihttps"
+      service: "owprov-ui"
+      rule: "PathPrefix(`/`)"
+      tls: {}
+
 tcp:
   services:
     owgw-websocket:
@@ -44,6 +60,10 @@ tcp:
       loadBalancer:
         servers:
           - address: "owfms.wlan.local:16004"
+    owprov-restapi:
+      loadBalancer:
+        servers:
+          - address: "owprov.wlan.local:16005"
     rttys-dev:
       loadBalancer:
         servers:
@@ -84,6 +104,12 @@ tcp:
       rule: "HostSNI(`*`)"
       tls:
         passthrough: true
+    owprov-restapi:
+      entryPoints: "owprovrestapi"
+      service: "owprov-restapi"
+      rule: "HostSNI(`*`)"
+      tls:
+        passthrough: true
     rttys-dev:
       entryPoints: "rttysdev"
       service: "rttys-dev"