Chg: update image tag in helm values to v4.0.0

Merge pull request #294 from Telecominfraproject/main
WIFI-14521: Sync-up with main
2026-03-20 03:40:49 +00:00 · 2025-05-02 15:40:46 +00:00 · 2025-04-25 11:39:04 -04:00 · 2025-04-25 11:32:49 -04:00 · 2025-04-25 11:25:45 -04:00 · 2025-04-25 11:22:11 -04:00
24 changed files with 720 additions and 64 deletions
--- a/.github/workflows/clustersysteminfo_image_ci.yml
+++ b/.github/workflows/clustersysteminfo_image_ci.yml
@@ -17,7 +17,7 @@ defaults:

 jobs:
  docker:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    env:
      DOCKER_REGISTRY_URL: tip-tip-wlan-cloud-ucentral.jfrog.io
      DOCKER_REGISTRY_USERNAME: ucentral
--- a/cgw/README.md
+++ b/cgw/README.md
@@ -22,12 +22,9 @@ certs:
  websocket-cert.pem: 5c0lvd0RRWUpLb1pJa...
  websocket-key.pem: V6WEFqWEhNVFk3RGda...
 ```
-To generate (with the two websocket pem files available):
+To generate this file manually (with the two websocket pem files available):
 ```
-echo "certs:" > values/certs.device.yaml
-kubectl create secret generic certs --dry-run=client -o yaml \
-    --from-file=websocket-key.pem --from-file=websocket-cert.pem \
-    | grep websocket- >> values/certs.device.yaml
+./mkcertconfig websocket-cert.pem websocket-key.pem > values/certs.device.yaml
 ```

 ## Installation
--- a/cgw/helmfile.yaml
+++ b/cgw/helmfile.yaml
@@ -19,7 +19,9 @@ environments:
          password: 123
    - cgw:
        enabled: true
-        tag: main
+        tag: next
+    - cgw2:
+        enabled: true
  cgw01:
    values:
    - global:
@@ -40,7 +42,9 @@ environments:
          password: openlancgw
    - cgw:
        enabled: true
-        tag: main
+        tag: next
+    - cgw2:
+        enabled: true

 ---

@@ -192,35 +196,51 @@ releases:
    - values/certs.tip.yaml
    # this one is generated from GH secrets:
    - values/certs.device.yaml
+    - values/cgw.yaml
+    - values/cgw-{{ .Environment.Values.global.name }}-1.yaml
    - images:
        cgw:
          tag: {{ .Environment.Values.cgw.tag }}
    - public_env_variables:
-        CGW_DB_HOST: pgsql
-        CGW_DB_PORT: "5432"
+        CGW_ID: 0
        CGW_DB_USERNAME: "{{ .Environment.Values.postgres.cgwUser.name }}"
-        CGW_KAFKA_HOST: kafka
-        CGW_KAFKA_PORT: "9092"
-        CGW_REDIS_HOST: redis-master
-        CGW_REDIS_PORT: "6379"
-        CGW_ALLOW_CERT_MISMATCH: "yes"
-        # use (#cpus * 2) - 2
-        DEFAULT_WSS_THREAD_NUM: "4"
-        # Useful for debugging:
-        #CGW_LOG_LEVEL: "debug"
-        #RUST_BACKTRACE: "full"
+        CGW_GRPC_PUBLIC_HOST: cgw-cgw
+        CGW_GRPC_PUBLIC_PORT: 50051
    - secret_env_variables:
        CGW_DB_PASSWORD: "{{ .Environment.Values.postgres.cgwUser.password }}"
    - services:
        cgw:
-          type: LoadBalancer
          annotations:
            external-dns.alpha.kubernetes.io/hostname: cgw-{{ .Environment.Values.global.name }}.{{ .Environment.Values.global.domain }}
-            #service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
-            service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-            service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
            service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {{ .Environment.Values.global.certificateARN }}
-            service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "15003"
-            service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true
-            service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002"
-            alb.ingress.kubernetes.io/healthcheck-path: /health
+
+- name: cgw2
+  namespace: {{ .Environment.Values.global.namespace }}
+  chart: ../../openlan-cgw/helm
+  #chart: "git+https://github.com/Telecominfraproject/openlan-cgw@helm?ref=main"
+  version: 0.1.0
+  condition: cgw2.enabled
+  labels:
+    group: apps
+    app: cgw2
+  values:
+    - values/certs.tip.yaml
+    # this one is generated from GH secrets:
+    - values/certs.device.yaml
+    - values/cgw.yaml
+    - values/cgw-{{ .Environment.Values.global.name }}-2.yaml
+    - images:
+        cgw:
+          tag: {{ .Environment.Values.cgw.tag }}
+    - public_env_variables:
+        CGW_ID: 1
+        CGW_DB_USERNAME: "{{ .Environment.Values.postgres.cgwUser.name }}"
+        CGW_GRPC_PUBLIC_HOST: cgw2-cgw2
+        CGW_GRPC_PUBLIC_PORT: 50051
+    - secret_env_variables:
+        CGW_DB_PASSWORD: "{{ .Environment.Values.postgres.cgwUser.password }}"
+    - services:
+        cgw:
+          annotations:
+            external-dns.alpha.kubernetes.io/hostname: cgw2-{{ .Environment.Values.global.name }}.{{ .Environment.Values.global.domain }}
+            service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {{ .Environment.Values.global.certificateARN }}
--- a/cgw/values/cgw-cgw01-1.yaml
+++ b/cgw/values/cgw-cgw01-1.yaml
@@ -0,0 +1 @@
+# set the node affinity and tolerations here
--- a/cgw/values/cgw-cgw01-2.yaml
+++ b/cgw/values/cgw-cgw01-2.yaml
@@ -0,0 +1 @@
+# set the node affinity and tolerations here
--- a/cgw/values/cgw-devcgw-1.yaml
+++ b/cgw/values/cgw-devcgw-1.yaml
@@ -0,0 +1,16 @@
+# set the node affinity and tolerations here
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: alpha.eksctl.io/nodegroup-name
+          operator: In
+          values:
+          - gwm5lrg
+
+tolerations:
+- effect: NoSchedule
+  key: type
+  operator: Equal
+  value: onlygwm5lrg
--- a/cgw/values/cgw-devcgw-2.yaml
+++ b/cgw/values/cgw-devcgw-2.yaml
@@ -0,0 +1,16 @@
+# set the node affinity and tolerations here
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: alpha.eksctl.io/nodegroup-name
+          operator: In
+          values:
+          - gwmed
+
+tolerations:
+- effect: NoSchedule
+  key: type
+  operator: Equal
+  value: onlygwmed
--- a/cgw/values/cgw.yaml
+++ b/cgw/values/cgw.yaml
@@ -0,0 +1,24 @@
+public_env_variables:
+  CGW_DB_HOST: pgsql
+  CGW_DB_PORT: "5432"
+  CGW_KAFKA_HOST: kafka
+  CGW_KAFKA_PORT: "9092"
+  CGW_REDIS_HOST: redis-master
+  CGW_REDIS_PORT: "6379"
+  CGW_ALLOW_CERT_MISMATCH: "yes"
+  # use (#cpus * 2) - 2
+  DEFAULT_WSS_THREAD_NUM: "4"
+  # Useful for debugging:
+  #CGW_LOG_LEVEL: "debug"
+  #RUST_BACKTRACE: "full"
+services:
+  cgw:
+    type: LoadBalancer
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: metrics
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /health
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: http
+      service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002"
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -2,31 +2,31 @@ apiVersion: v2
 name: openwifi
 appVersion: "1.0"
 description: A Helm chart for Kubernetes
-version: 0.1.0
+version: 4.0.0
 dependencies:
 - name: owgw
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=master"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=v4.0.0"
  version: 0.1.0
 - name: owsec
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=v4.0.0"
  version: 0.1.0
 - name: owfms
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=v3.2.0"
  version: 0.1.0
 - name: owprov
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=v4.0.0"
  version: 0.1.0
 - name: owanalytics
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-analytics@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-analytics@helm?ref=v3.2.0"
  version: 0.1.0
 - name: owgwui
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=v4.0.0"
  version: 0.1.0
 - name: owprovui
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=v4.0.0"
  version: 0.1.0
 - name: owsub
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-userportal@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-userportal@helm?ref=v3.2.0"
  version: 0.1.0
 - name: owls
  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owls@helm?ref=main"
--- a/chart/environment-values/values.openwifi-qa.yaml
+++ b/chart/environment-values/values.openwifi-qa.yaml
@@ -106,6 +106,100 @@ owgw:
      L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
      5IOM7ItsRmen6u3qu+JXros54e4juQ==
      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIFbzCCA1egAwIBAgICIjUwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+      bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+      WjAlMSMwIQYDVQQDExpPcGVuTEFOIERlbW8gQ29udHJvbGxlciBDQTCCAiIwDQYJ
+      KoZIhvcNAQEBBQADggIPADCCAgoCggIBAJauwpN+LAd/VubBpX3O3u/E5CXkmxLZ
+      di/F9zOTimAOPqfWP7K046TfbNj4twPYSzVzjawkenRkEK0yZQ1DOXmzkGWVnsih
+      gR/CA+IUUY1yCnmg6t9Dx9l5K0ZnAox90HO/ybIymcoSfRXhotuhle//eDNmGccd
+      XFsndvGdmxshaV1zN1h2POw7biCBZuypCzwvRitFfcpv3pdIk5xTt2G/yMbHPCNo
+      dUJHYHLWotridJIJ7DdhYoir5q+iSqWIqjKfDBlqCsvO7e+KidcW9ctljWspAHvl
+      B3/yHdJwJz816YTZ7r37I/DsXk9gmjj317gWRkGLMTx9fk6SiMfGW4kfUvClfg1v
+      0aRrDGPEcCagHM6ViqbW2+Tc5K38fySgNZKSTBPPI+59iAHd5RADEJDGankEYvzN
+      Le0sgB90RDjhTMleOpp5agtd2Yk/ZVjHtKfCnq13OLJfcgX76iY1Ko6AmKqiaxiE
+      V2zi9/UFVTIURT8S7JgiwF4ZNIZzHmcr4R4n5O7aSgYUlVjwFp/IEMC3ylTAX8cP
+      d4VW0p1f4D3HK7TRcaaqsERuxNh2KVtR48Au2MPGC/8YRKsz/qzH2GfsfFgjKxfF
+      z/mZYOA7913DvgVbDQoR9/6odGXZH0XDwH1e1w59dqbXBnIv2VVzElgZsPimIr+M
+      UxlZXZHMYtL3AgMBAAGjga4wgaswHwYDVR0jBBgwFoAUPMiDx7JMjfFzgDZHrR/w
+      dqeEFkMwHQYDVR0OBBYEFKqr/2rLqvEtxLDRsPCJ1L8WMr7VMA4GA1UdDwEB/wQE
+      AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6
+      Ly9kZW1vLmNlcnRpZmljYXRlLmZpL2NybC9PcGVuTEFORGVtb1Jvb3RDQS5jcmww
+      DQYJKoZIhvcNAQELBQADggIBAEyp07YjNm3WsMQo85OUcKp8kA5TJPKPxw0WgXBR
+      5RqfEV8u4b5FPJ1GjvHQqEXNxi0hlNit6oQpMafHrDSsnXR0rSquYeRBZWGig0PU
+      n8XHN8IlwsE8orGs7HkJTkQ/5Os7eGYhKCnMUyehoDHQPCPgsCawp6HnKAkntG6F
+      0AiOrhmh+ng0+9nKl6Vj11OSh9nw54G3HtQqnhWrDw8JRYp6kkzRIPcrlq/AavjW
+      g5aWBcyUSH7PscyIMGW5ICRM/5J1DXMcl/jXQhvSjv1Z6fUCrbpGyUiJ4mjmAOo+
+      M11ln5dedBRyRXEBg+0dKxe6758wWkJF2el44pgNx+xO00eKUY60lWRxkDExa6nh
+      rVRfEyvcCMfoFKBWreTyAcPyEJ0XR8wu+lfkerhYupE+m+YxUxhYywClfPdv/+m9
+      70/gKFR3IyBW+9aYl7xUapyuEYfMFA2iGD73HGqA3QcxCwxB8RFuHuVh7WUyMvJK
+      xd8qUNxVXGFzyY5qUUjt+D/OeDIHKn4uQWKpaSNdkumrTvj6/QhsstF2H0XoQv+v
+      fuI4IdnzoVVkPbf+Cyg7ZkW0Wu+sutyhsuN4eDOsiy8NxPkbRjnDQxUiNAK96Bkx
+      tDpSJgwSP4sPHfNgq6zv/Wu9IaBGIYmNsJBoKpOOITUl7n6DcsEvkcsRMJpuK60b
+      rHa2
+      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIFIDCCAwigAwIBAgICDnkwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+      bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+      WjAfMR0wGwYDVQQDDBRPcGVuTEFOIERlbW8gUm9vdCBDQTCCAiIwDQYJKoZIhvcN
+      AQEBBQADggIPADCCAgoCggIBAMjExylKdJWoJu9mOHPJ6yZFXKe1lE467G65acpS
+      2FKIWnPVFjNCmATMpkMOIFzEFwyFdbQjzOidtiL+73zlE52lOJpXCfOcxDFqDYDJ
+      J8//J1/gQWsBaKpSvgLiHU/0awkQg+yJYZpj8YZa4NkFe+zTjQScSfOsqPPb3rZ7
+      DOQ2BKAhjVShKmVbtNil0iO0zm8vE8DNkktTNMREp2pzb8MbCAgfOkwlrby6T+rV
+      3TvmjThGdFUb5lWDFxWtlF8W0SUII9qj7p5TdGpryeLsO0nZTBtS4HxZNdvmKOHf
+      gcRHmSZIJigB2NzKLNrXF9JBW0WnUSwZJZAG2C1RTx6lADILPueuusyfR/hZ3koK
+      i4PHnSiTwQghzia9K9QjNHq5z9R9ZoCnhBg1VyU4LKmp862L0sIp2vgnOYunEIi9
+      aCYBaDwo+0FuVjZuXyDIatwVuA7TN5IWPHA6XLdOt1mmkeYy1Ldr4XHjdondhtOy
+      eei1UFXmyyLm2+kmRYfTm91TqYmNzRgbRV2NHO50AmsnBknX4Rv3gishGe0+dV5y
+      FcUwZud0z2rSCkuoai5tKrPT+6Y6NqkT9u9HFifIBXnLwEzVUqHRtW6SuWj2DClV
+      QIXIUZtFnhY4GuTuf6DlzgnXO58oDVCZmCW4ULIpbqGeRsvBHR8Sw5JXP/1+TMUY
+      hE8TAgMBAAGjZjBkMB8GA1UdIwQYMBaAFDzIg8eyTI3xc4A2R60f8HanhBZDMB0G
+      A1UdDgQWBBQ8yIPHskyN8XOANketH/B2p4QWQzAOBgNVHQ8BAf8EBAMCAQYwEgYD
+      VR0TAQH/BAgwBgEB/wIBATANBgkqhkiG9w0BAQsFAAOCAgEAkHZ5KR8IOrdfMFy+
+      iOvauvZxfQ84LL6TpB2FQKDjneJUdd7c29UJJFNW/0mp4Gc6jKZab6J8Dx/pNnbH
+      0RqFjGjeRGtJ4Sk0G7gf9zw1S7qut5WJDcisM9l/wXC+zy/KSKKPQmbt0grWOtU7
+      +NNPh1YU76hIrInq/u2sVZyKH8SXQ957fbJk6BX6JTKyNEn05AB6rNSrbOWo8sy2
+      MlcJ7bBsrWYI1t6GcWFh4b36bLu7/dKJWpyFNXXIkKJsgMEDpEQae56+fSSDo0KR
+      NtYB82fNZDIQlGK81rGJWNzAahM+3GD1tgk/3ZVugfaJhcBpoHHKNOGqZAvtirLA
+      IDocno7AzqoeIz974Rh2Olsl2/arApYPyyfi8PMYuFe/d4h+Wie8n+jh5n48lZ2V
+      e4PK+j+QHD6tTZS4f0bGnPL1puMxzQloltuQWgLDeVfEgrc3snLvjOg8aDzWm/es
+      85lP8XcyW54U4t3JmrNUC2C7v+Uafx7cL7eDeunhs+BRhtGV+IUmjub2IrpqZp3z
+      Zqn+LVRdYJIy/qHhjS5+ImckXkFojOmeWhfmEmYSuNP8Oa6cGuXp829qnbxLh9Qz
+      i3TfXV883KLse4kL5Zl7gBA/4hz2hVMyGJ8fY+VvzbaTuOXyvKJ+rGZCTcRSeotB
+      LnIevVMiL7SqOEwN0j4Mfbznfq8=
+      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIFbjCCA1agAwIBAgICMJ0wDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+      bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+      WjAkMSIwIAYDVQQDExlPcGVuTEFOIERlbW8gT3BlcmF0aW5nIENBMIICIjANBgkq
+      hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4Q5dx+CWyaPxOlAGUC462FgnO4umYEqF
+      LQCuK31kgg0tBbbfaq0XApUnjH5IOMI1IGtYgZmm48q1noHaRwk4WFxxvr/dyS51
+      hAEa2GFb2S3pkG7VXAF/XYv33yyfM+1K0tyZPRm9tbBShUIfflGFjnrSwxkNhoOH
+      IIOVXxCHLBD/Aor74JAkEGtkIo30FPx2vQ+fg4rnQsm9aSffgWwWua7T590tnSMG
+      ljDMm++nCQIgONFQC7RQXeL0Ruu14FxB639oJxPmwDQhD/R5zQz/wFBhinjHuzYl
+      i0bmxHevdDQluNUxf2lHwJRy6eC/TzdRFOgDUre9kzu929skgNouM0q0y/Rpz7QU
+      bd5s1i8JnKebAqADqMT8Yz1Hph0oCvOT0Dc2joxmjGh3loolWRKufKTVe431pvdv
+      iV/rAooOSnm5Htmd8ClOADudhrheX886cSd9Z5JKucHhW34Lf1ze7uj1LjxoTh3O
+      eo7XedhjmJYcQavpQlVRLTbbY/LJHegPtqJAIvQkrwtOpe05rShl06MxO9wj0BPJ
+      0PFp/MxJd0ESDV0EM9dxWIWgXwZftowPzfj3ai5OQEazpTr1IMRehsbCn3JEJ77N
+      hCqKPaZmRtKRD9e5cu0YiGfRddr7xaXiwtPGId/ZHsNUASbv7NMDdemRv3TiFwv4
+      z8OKCm8QeisCAwEAAaOBrjCBqzAfBgNVHSMEGDAWgBQ8yIPHskyN8XOANketH/B2
+      p4QWQzAdBgNVHQ4EFgQUe/uhewyjB6GNj5Dbq9s+I5mWexMwDgYDVR0PAQH/BAQD
+      AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwRQYDVR0fBD4wPDA6oDigNoY0aHR0cDov
+      L2RlbW8uY2VydGlmaWNhdGUuZmkvY3JsL09wZW5MQU5EZW1vUm9vdENBLmNybDAN
+      BgkqhkiG9w0BAQsFAAOCAgEAoj6D9yZIbWEP3MobeV5c3KpNyH4k2Ho2keIE0nT1
+      kc2sb1pfHzcZC7qDX1QWdcuKYUctmVEw5xhIWZhOLOy4QONUSx1E5WOHvGKMPfAt
+      l5pS8C2XjiC+SP/8KvbcpYM+iopsoJx2qDLX927OaqP0J+XSMikqaOhP4LW9Fb+Z
+      aRci9Kfd5WeA76mE3b1/9RSE1xxDNv88R6I2gFiLQeDqvdwaYUdYeCWYjg6mx3GD
+      Fc3vf2j/jj606vnbUDrI8uLfL4SDvCdtlmP6IvJGRAS3e48Eao4/C72uCW4LJBxA
+      G9sP7yvFCZhBo6+xIAbU2rhZeqiJQi7uK4LjPCck4QK6N32qEVyGpksuA3GXlJGC
+      fNDQ7PNA+r4AhCKs1b5xMUJH9O40Oq3vVfH1HhcGt5Pyl0LHFg0ml5PmCpTSPLBP
+      x26EizoF7vQmCdZ7HvPPY/L4DkiY//jhp4yBLWFP5MQm9TLjZ6uEj07S/oFCa3vW
+      dScZDtJ/AuojDMoDPvrSGuDHPBg1NBvs4mICx90DKjEZNHo5l7nMT7/KF8D6v2Rt
+      dRU8vfmPo6R0wbGV6suItRPUG5qpnHL4wc/iK0hRBl4nIgH1SwE4YHlx42FJTJej
+      EGAlrLr3LG0BxQaB3JEx82lGDlxz7Y3pCk2uiaVUnqWY5HglOdxdtAaox3HBgMa9
+      tHk=
+      -----END CERTIFICATE-----
    issuer.pem: |
      -----BEGIN CERTIFICATE-----
      MIIEnDCCA4SgAwIBAgIUVpyCUx1MUeUwxg+7I1BvGFTz7HkwDQYJKoZIhvcNAQEL
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -60,7 +60,7 @@ clustersysteminfo:
  images:
    clustersysteminfo:
      repository: tip-tip-wlan-cloud-ucentral.jfrog.io/clustersysteminfo
-      tag: main
+      tag: v4.0.0
      pullPolicy: Always
 #      regcred:
 #        registry: tip-tip-wlan-cloud-ucentral.jfrog.io
--- a/docker-compose/.env
+++ b/docker-compose/.env
@@ -3,14 +3,14 @@ COMPOSE_PROJECT_NAME=openwifi
 DEPLOY_TYPE=default

 # Image tags
-OWGW_TAG=master
-OWGWUI_TAG=main
-OWSEC_TAG=main
-OWFMS_TAG=main
-OWPROV_TAG=main
-OWPROVUI_TAG=main
-OWANALYTICS_TAG=main
-OWSUB_TAG=main
+OWGW_TAG=v4.0.0
+OWGWUI_TAG=v4.0.0
+OWSEC_TAG=v4.0.0
+OWFMS_TAG=v3.2.0
+OWPROV_TAG=v4.0.0
+OWPROVUI_TAG=v4.0.0
+OWANALYTICS_TAG=v3.2.0
+OWSUB_TAG=v3.2.0

 KAFKA_TAG=3.7-debian-12
 POSTGRESQL_TAG=15.0
--- a/docker-compose/.env.letsencrypt
+++ b/docker-compose/.env.letsencrypt
@@ -1,14 +1,14 @@
 COMPOSE_PROJECT_NAME=openwifi

 # Image tags
-OWGW_TAG=master
-OWGWUI_TAG=main
-OWSEC_TAG=main
-OWFMS_TAG=main
-OWPROV_TAG=main
-OWPROVUI_TAG=main
-OWANALYTICS_TAG=main
-OWSUB_TAG=main
+OWGW_TAG=v4.0.0
+OWGWUI_TAG=v4.0.0
+OWSEC_TAG=v4.0.0
+OWFMS_TAG=v3.2.0
+OWPROV_TAG=v4.0.0
+OWPROVUI_TAG=v4.0.0
+OWANALYTICS_TAG=v3.2.0
+OWSUB_TAG=v3.2.0

 KAFKA_TAG=3.7-debian-12
 POSTGRESQL_TAG=15.0
--- a/docker-compose/.env.selfsigned
+++ b/docker-compose/.env.selfsigned
@@ -1,14 +1,14 @@
 COMPOSE_PROJECT_NAME=openwifi

 # Image tags
-OWGW_TAG=master
-OWGWUI_TAG=main
-OWSEC_TAG=main
-OWFMS_TAG=main
-OWPROV_TAG=main
-OWPROVUI_TAG=main
-OWANALYTICS_TAG=main
-OWSUB_TAG=main
+OWGW_TAG=v4.0.0
+OWGWUI_TAG=v4.0.0
+OWSEC_TAG=v4.0.0
+OWFMS_TAG=v3.2.0
+OWPROV_TAG=v4.0.0
+OWPROVUI_TAG=v4.0.0
+OWANALYTICS_TAG=v3.2.0
+OWSUB_TAG=v3.2.0

 KAFKA_TAG=3.7-debian-12
 POSTGRESQL_TAG=15.0
--- a/docker-compose/certs/clientcas.pem
+++ b/docker-compose/certs/clientcas.pem
@@ -47,3 +47,97 @@ PSNHL2emogy1bl1lLTAoj8nxg2wVKPDSHBGviQ5LR9fsWUIJDv9Bs5k0qWugWYSj
 L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
 5IOM7ItsRmen6u3qu+JXros54e4juQ==
 -----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFbzCCA1egAwIBAgICIjUwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+WjAlMSMwIQYDVQQDExpPcGVuTEFOIERlbW8gQ29udHJvbGxlciBDQTCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAJauwpN+LAd/VubBpX3O3u/E5CXkmxLZ
+di/F9zOTimAOPqfWP7K046TfbNj4twPYSzVzjawkenRkEK0yZQ1DOXmzkGWVnsih
+gR/CA+IUUY1yCnmg6t9Dx9l5K0ZnAox90HO/ybIymcoSfRXhotuhle//eDNmGccd
+XFsndvGdmxshaV1zN1h2POw7biCBZuypCzwvRitFfcpv3pdIk5xTt2G/yMbHPCNo
+dUJHYHLWotridJIJ7DdhYoir5q+iSqWIqjKfDBlqCsvO7e+KidcW9ctljWspAHvl
+B3/yHdJwJz816YTZ7r37I/DsXk9gmjj317gWRkGLMTx9fk6SiMfGW4kfUvClfg1v
+0aRrDGPEcCagHM6ViqbW2+Tc5K38fySgNZKSTBPPI+59iAHd5RADEJDGankEYvzN
+Le0sgB90RDjhTMleOpp5agtd2Yk/ZVjHtKfCnq13OLJfcgX76iY1Ko6AmKqiaxiE
+V2zi9/UFVTIURT8S7JgiwF4ZNIZzHmcr4R4n5O7aSgYUlVjwFp/IEMC3ylTAX8cP
+d4VW0p1f4D3HK7TRcaaqsERuxNh2KVtR48Au2MPGC/8YRKsz/qzH2GfsfFgjKxfF
+z/mZYOA7913DvgVbDQoR9/6odGXZH0XDwH1e1w59dqbXBnIv2VVzElgZsPimIr+M
+UxlZXZHMYtL3AgMBAAGjga4wgaswHwYDVR0jBBgwFoAUPMiDx7JMjfFzgDZHrR/w
+dqeEFkMwHQYDVR0OBBYEFKqr/2rLqvEtxLDRsPCJ1L8WMr7VMA4GA1UdDwEB/wQE
+AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6
+Ly9kZW1vLmNlcnRpZmljYXRlLmZpL2NybC9PcGVuTEFORGVtb1Jvb3RDQS5jcmww
+DQYJKoZIhvcNAQELBQADggIBAEyp07YjNm3WsMQo85OUcKp8kA5TJPKPxw0WgXBR
+5RqfEV8u4b5FPJ1GjvHQqEXNxi0hlNit6oQpMafHrDSsnXR0rSquYeRBZWGig0PU
+n8XHN8IlwsE8orGs7HkJTkQ/5Os7eGYhKCnMUyehoDHQPCPgsCawp6HnKAkntG6F
+0AiOrhmh+ng0+9nKl6Vj11OSh9nw54G3HtQqnhWrDw8JRYp6kkzRIPcrlq/AavjW
+g5aWBcyUSH7PscyIMGW5ICRM/5J1DXMcl/jXQhvSjv1Z6fUCrbpGyUiJ4mjmAOo+
+M11ln5dedBRyRXEBg+0dKxe6758wWkJF2el44pgNx+xO00eKUY60lWRxkDExa6nh
+rVRfEyvcCMfoFKBWreTyAcPyEJ0XR8wu+lfkerhYupE+m+YxUxhYywClfPdv/+m9
+70/gKFR3IyBW+9aYl7xUapyuEYfMFA2iGD73HGqA3QcxCwxB8RFuHuVh7WUyMvJK
+xd8qUNxVXGFzyY5qUUjt+D/OeDIHKn4uQWKpaSNdkumrTvj6/QhsstF2H0XoQv+v
+fuI4IdnzoVVkPbf+Cyg7ZkW0Wu+sutyhsuN4eDOsiy8NxPkbRjnDQxUiNAK96Bkx
+tDpSJgwSP4sPHfNgq6zv/Wu9IaBGIYmNsJBoKpOOITUl7n6DcsEvkcsRMJpuK60b
+rHa2
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFIDCCAwigAwIBAgICDnkwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+WjAfMR0wGwYDVQQDDBRPcGVuTEFOIERlbW8gUm9vdCBDQTCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAMjExylKdJWoJu9mOHPJ6yZFXKe1lE467G65acpS
+2FKIWnPVFjNCmATMpkMOIFzEFwyFdbQjzOidtiL+73zlE52lOJpXCfOcxDFqDYDJ
+J8//J1/gQWsBaKpSvgLiHU/0awkQg+yJYZpj8YZa4NkFe+zTjQScSfOsqPPb3rZ7
+DOQ2BKAhjVShKmVbtNil0iO0zm8vE8DNkktTNMREp2pzb8MbCAgfOkwlrby6T+rV
+3TvmjThGdFUb5lWDFxWtlF8W0SUII9qj7p5TdGpryeLsO0nZTBtS4HxZNdvmKOHf
+gcRHmSZIJigB2NzKLNrXF9JBW0WnUSwZJZAG2C1RTx6lADILPueuusyfR/hZ3koK
+i4PHnSiTwQghzia9K9QjNHq5z9R9ZoCnhBg1VyU4LKmp862L0sIp2vgnOYunEIi9
+aCYBaDwo+0FuVjZuXyDIatwVuA7TN5IWPHA6XLdOt1mmkeYy1Ldr4XHjdondhtOy
+eei1UFXmyyLm2+kmRYfTm91TqYmNzRgbRV2NHO50AmsnBknX4Rv3gishGe0+dV5y
+FcUwZud0z2rSCkuoai5tKrPT+6Y6NqkT9u9HFifIBXnLwEzVUqHRtW6SuWj2DClV
+QIXIUZtFnhY4GuTuf6DlzgnXO58oDVCZmCW4ULIpbqGeRsvBHR8Sw5JXP/1+TMUY
+hE8TAgMBAAGjZjBkMB8GA1UdIwQYMBaAFDzIg8eyTI3xc4A2R60f8HanhBZDMB0G
+A1UdDgQWBBQ8yIPHskyN8XOANketH/B2p4QWQzAOBgNVHQ8BAf8EBAMCAQYwEgYD
+VR0TAQH/BAgwBgEB/wIBATANBgkqhkiG9w0BAQsFAAOCAgEAkHZ5KR8IOrdfMFy+
+iOvauvZxfQ84LL6TpB2FQKDjneJUdd7c29UJJFNW/0mp4Gc6jKZab6J8Dx/pNnbH
+0RqFjGjeRGtJ4Sk0G7gf9zw1S7qut5WJDcisM9l/wXC+zy/KSKKPQmbt0grWOtU7
+NNPh1YU76hIrInq/u2sVZyKH8SXQ957fbJk6BX6JTKyNEn05AB6rNSrbOWo8sy2
+MlcJ7bBsrWYI1t6GcWFh4b36bLu7/dKJWpyFNXXIkKJsgMEDpEQae56+fSSDo0KR
+NtYB82fNZDIQlGK81rGJWNzAahM+3GD1tgk/3ZVugfaJhcBpoHHKNOGqZAvtirLA
+IDocno7AzqoeIz974Rh2Olsl2/arApYPyyfi8PMYuFe/d4h+Wie8n+jh5n48lZ2V
+e4PK+j+QHD6tTZS4f0bGnPL1puMxzQloltuQWgLDeVfEgrc3snLvjOg8aDzWm/es
+85lP8XcyW54U4t3JmrNUC2C7v+Uafx7cL7eDeunhs+BRhtGV+IUmjub2IrpqZp3z
+Zqn+LVRdYJIy/qHhjS5+ImckXkFojOmeWhfmEmYSuNP8Oa6cGuXp829qnbxLh9Qz
+i3TfXV883KLse4kL5Zl7gBA/4hz2hVMyGJ8fY+VvzbaTuOXyvKJ+rGZCTcRSeotB
+LnIevVMiL7SqOEwN0j4Mfbznfq8=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFbjCCA1agAwIBAgICMJ0wDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUT3Bl
+bkxBTiBEZW1vIFJvb3QgQ0EwHhcNMjUwMjIxMTUwMDAwWhcNMjYwMjIxMTUwMDAw
+WjAkMSIwIAYDVQQDExlPcGVuTEFOIERlbW8gT3BlcmF0aW5nIENBMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4Q5dx+CWyaPxOlAGUC462FgnO4umYEqF
+LQCuK31kgg0tBbbfaq0XApUnjH5IOMI1IGtYgZmm48q1noHaRwk4WFxxvr/dyS51
+hAEa2GFb2S3pkG7VXAF/XYv33yyfM+1K0tyZPRm9tbBShUIfflGFjnrSwxkNhoOH
+IIOVXxCHLBD/Aor74JAkEGtkIo30FPx2vQ+fg4rnQsm9aSffgWwWua7T590tnSMG
+ljDMm++nCQIgONFQC7RQXeL0Ruu14FxB639oJxPmwDQhD/R5zQz/wFBhinjHuzYl
+i0bmxHevdDQluNUxf2lHwJRy6eC/TzdRFOgDUre9kzu929skgNouM0q0y/Rpz7QU
+bd5s1i8JnKebAqADqMT8Yz1Hph0oCvOT0Dc2joxmjGh3loolWRKufKTVe431pvdv
+iV/rAooOSnm5Htmd8ClOADudhrheX886cSd9Z5JKucHhW34Lf1ze7uj1LjxoTh3O
+eo7XedhjmJYcQavpQlVRLTbbY/LJHegPtqJAIvQkrwtOpe05rShl06MxO9wj0BPJ
+0PFp/MxJd0ESDV0EM9dxWIWgXwZftowPzfj3ai5OQEazpTr1IMRehsbCn3JEJ77N
+hCqKPaZmRtKRD9e5cu0YiGfRddr7xaXiwtPGId/ZHsNUASbv7NMDdemRv3TiFwv4
+z8OKCm8QeisCAwEAAaOBrjCBqzAfBgNVHSMEGDAWgBQ8yIPHskyN8XOANketH/B2
+p4QWQzAdBgNVHQ4EFgQUe/uhewyjB6GNj5Dbq9s+I5mWexMwDgYDVR0PAQH/BAQD
+AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwRQYDVR0fBD4wPDA6oDigNoY0aHR0cDov
+L2RlbW8uY2VydGlmaWNhdGUuZmkvY3JsL09wZW5MQU5EZW1vUm9vdENBLmNybDAN
+BgkqhkiG9w0BAQsFAAOCAgEAoj6D9yZIbWEP3MobeV5c3KpNyH4k2Ho2keIE0nT1
+kc2sb1pfHzcZC7qDX1QWdcuKYUctmVEw5xhIWZhOLOy4QONUSx1E5WOHvGKMPfAt
+l5pS8C2XjiC+SP/8KvbcpYM+iopsoJx2qDLX927OaqP0J+XSMikqaOhP4LW9Fb+Z
+aRci9Kfd5WeA76mE3b1/9RSE1xxDNv88R6I2gFiLQeDqvdwaYUdYeCWYjg6mx3GD
+Fc3vf2j/jj606vnbUDrI8uLfL4SDvCdtlmP6IvJGRAS3e48Eao4/C72uCW4LJBxA
+G9sP7yvFCZhBo6+xIAbU2rhZeqiJQi7uK4LjPCck4QK6N32qEVyGpksuA3GXlJGC
+fNDQ7PNA+r4AhCKs1b5xMUJH9O40Oq3vVfH1HhcGt5Pyl0LHFg0ml5PmCpTSPLBP
+x26EizoF7vQmCdZ7HvPPY/L4DkiY//jhp4yBLWFP5MQm9TLjZ6uEj07S/oFCa3vW
+dScZDtJ/AuojDMoDPvrSGuDHPBg1NBvs4mICx90DKjEZNHo5l7nMT7/KF8D6v2Rt
+dRU8vfmPo6R0wbGV6suItRPUG5qpnHL4wc/iK0hRBl4nIgH1SwE4YHlx42FJTJej
+EGAlrLr3LG0BxQaB3JEx82lGDlxz7Y3pCk2uiaVUnqWY5HglOdxdtAaox3HBgMa9
+tHk=
+-----END CERTIFICATE-----
--- a/docker-compose/owls/.env
+++ b/docker-compose/owls/.env
@@ -3,19 +3,26 @@ COMPOSE_PROJECT_NAME=owls
 # Image tags
 # Currently main branches don't work - owlsui is not compatible with owls.
 #OWSEC_TAG=main
-#OWLS_TAG=main
 #OWLSUI_TAG=master
 OWSEC_TAG=v2.9.0
-OWLS_TAG=v2.9.0
+OWFMS_TAG=v2.9.0
 OWLSUI_TAG=v2.9.0
+OWLS_TAG=main
+
 KAFKA_TAG=3.7-debian-12
+ACMESH_TAG=latest
+TRAEFIK_TAG=v3.1.2

 # Microservice root/config directories
 OWSEC_ROOT=/owsec-data
 OWSEC_CONFIG=/owsec-data
+OWFMS_ROOT=/owfms-data
+OWFMS_CONFIG=/owfms-data
 OWLS_ROOT=/owls-data
 OWLS_CONFIG=/owls-data

 # Microservice hostnames
 INTERNAL_OWSEC_HOSTNAME=owsec.wlan.local
 INTERNAL_OWLS_HOSTNAME=owls.wlan.local
+INTERNAL_OWFMS_HOSTNAME=owfms.wlan.local
+INTERNAL_OWLSUI_HOSTNAME=owls-ui.wlan.local
--- a/docker-compose/owls/README.md
+++ b/docker-compose/owls/README.md
@@ -14,3 +14,22 @@ Be aware that since the OWLS deployment partly exposes the same ports on the hos
 10. In the Simulation tab, click on the + sign on the right side to add a load simulation.
 11. Fill out the required fields. MAC prefix is used for the MAC addresses of the simulated devices, so you can use any six-digit hexadecimal number. Specify the remote address of your OpenWifi gateway in the Gateway field, for example `https://openwifi.wlan.local:15002`. Adapt the rest of the settings according to your needs.
 12. Click on the floppy disk icon to save your load simulation. You can run it by clicking the play symbol in the table view.
+
+## Deployment with Let's Encrypt certificates
+To run a load simulation you need to generate a specific Digicert-signed AP certificate which will be used to connect to the gateway. The certificate serial number has to start with the digits `53494d` since otherwise the gateway won't allow a load simulation. The rest of the serial number and the specified redirector URL can be chosen randomly. You only need to generate one AP certificate for your simulations.  Be aware that since the OWLS deployment partly exposes the same ports on the host as the OpenWifi deployment, it is not intended that both run on the same host.
+1. Copy or move your AP load simulation certificate into the `docker-compose/certs` directory. Don't forget to name the files `device-cert.pem` and `device-key.pem` or adapt the path names in the OWLS configuration if you're using different file names.
+2. To be able to run load simulation tests against your OpenWifi SDK deployment, you'll have to [add the serial number of your generated AP certificate to the gateway configuration](https://github.com/Telecominfraproject/wlan-cloud-owls#prepare-your-openwifi-gateway). You can do that by either editing [owgw.env](../owgw.env) or doing the changes directly in your OWGW configuration file if it is exposed on your Docker host.
+3. Switch into the project directory with `cd docker-compose/owls`.
+4. Add an entry for `openwifi-owls.wlan.local` in your hosts file which points to `127.0.0.1` or whatever the IP of the host running the OWLS deployment is.
+5. Create an alias `alias dcowls='docker-compose -f docker-compose.lb.letsencrypt.yml`.
+6. Change SDKHOSTNAME in .env to the desired externally reachable host name. This name must resolve to the IP of the host. ie. SDKHOSTNAME=owls.example.com
+7. Change in owls-ui.env: `REACT_APP_UCENTRALSEC_URL=https://owls.example.com:16001`
+8. Change SYSTEM_URI_PUBLIC in owsec.env, owfms.env and owls.env.
+ie. for owls.env: `SYSTEM_URI_PUBLIC=https://owls.example.com:16007 SYSTEM_URI_UI=https://owls.example.com`. Make sure you maintain the correct port for each service in SYSTEM_URI_PUBLIC.
+9. Make sure the following ports are open: 80, 443, 16001, 16004, 16007 (80 is required by the initial Let's Encrypt challenge.)
+10. Spin up the deployment with `dcowls up -d`.
+11. Check if the containers are up and running with `dcowls ps`.
+12. Login to the UI by visiting ie. https://owls.example.com and follow the instructions to change your default password.
+13. In the Simulation tab, click on the + sign on the right side to add a load simulation.
+14. Fill out the required fields. MAC prefix is used for the MAC addresses of the simulated devices, so you can use any six-digit hexadecimal number. Specify the remote address of your OpenWifi gateway in the Gateway field, for example `https://gw.sdk.example.com:15002`. Adapt the rest of the settings according to your needs.
+15. Click on the floppy disk icon to save your load simulation. You can run it by clicking the play symbol in the table view.
--- a/docker-compose/owls/docker-compose.lb.letsencrypt.yml
+++ b/docker-compose/owls/docker-compose.lb.letsencrypt.yml
@@ -0,0 +1,136 @@
+volumes:
+  kafka_data:
+    driver: local
+
+networks:
+  owls:
+
+services:
+  owsec:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owsec:${OWSEC_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWSEC_HOSTNAME}
+    env_file:
+      - owsec.env
+    depends_on:
+      init-kafka:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    volumes:
+      - "./owsec_data:${OWSEC_ROOT}"
+      - "../certs:/${OWSEC_ROOT}/certs"
+
+  owfms:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owfms:${OWFMS_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWFMS_HOSTNAME}
+    env_file:
+      - owfms.env
+    depends_on:
+      init-kafka:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    volumes:
+      - "./owfms_data:${OWFMS_ROOT}"
+      - "../certs:/${OWFMS_ROOT}/certs"
+
+  owls:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owls:${OWLS_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWLS_HOSTNAME}
+    env_file:
+      - owls.env
+    depends_on:
+      owsec:
+        condition: service_started
+      init-kafka:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    volumes:
+      - "./owls_data:${OWLS_ROOT}"
+      - "../certs:/${OWLS_ROOT}/certs"
+
+  owls-ui:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owls-ui:${OWLSUI_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWLSUI_HOSTNAME}
+    env_file:
+      - owls-ui.env
+    depends_on:
+      - owsec
+      - owfms
+      - owls
+    restart: unless-stopped
+    volumes:
+      - "./owls-ui/default.conf:/etc/nginx/conf.d/default.conf"
+      - "../certs/restapi-cert.pem:/etc/nginx/restapi-cert.pem"
+      - "../certs/restapi-key.pem:/etc/nginx/restapi-key.pem"
+
+  traefik:
+    image: "traefik:${TRAEFIK_TAG}"
+    networks:
+      owls:
+    env_file:
+      - traefik.env
+    depends_on:
+      - owsec
+      - owfms
+      - owls
+      - owls-ui
+    restart: unless-stopped
+    volumes:
+      - "./traefik/openwifi_letsencrypt.yaml:/etc/traefik/openwifi.yaml"
+      - "../certs/restapi-ca.pem:/certs/restapi-ca.pem"
+      - "./letsencrypt_certs:/letsencrypt"
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        timeout 10m sh -c 'until [[ "$$(getent hosts $SDKHOSTNAME)" ]]; do echo "Waiting until DNS record for $SDKHOSTNAME is resolvable"; sleep 5; done' \
+        && ./entrypoint.sh traefik
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8080:8080"
+      - "16001:16001"
+      - "16004:16004"
+      - "16007:16007"
+
+  kafka:
+    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    networks:
+      owls:
+    env_file:
+      - kafka.env
+    restart: unless-stopped
+    volumes:
+      - kafka_data:/bitnami/kafka
+
+  init-kafka:
+    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
+    networks:
+      owls:
+    depends_on:
+      - kafka
+    env_file:
+      - kafka.env
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        echo "Sleeping to allow kafka to start up..."
+        sleep 10
+        echo "Creating all required Kafka topics..."
+        for topic in $$TOPICS; do
+          /opt/bitnami/kafka/bin/kafka-topics.sh \
+          --create --if-not-exists --topic $$topic --replication-factor 1 \
+          --partitions 1 --bootstrap-server kafka:9092
+        done && echo "Successfully created Kafka topics, exiting." && exit 0
--- a/docker-compose/owls/docker-compose.yml
+++ b/docker-compose/owls/docker-compose.yml
@@ -25,6 +25,25 @@ services:
      - "16001:16001"
      - "16101:16101"

+  owfms:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owfms:${OWFMS_TAG}"
+    networks:
+      owls:
+        aliases:
+          - ${INTERNAL_OWFMS_HOSTNAME}
+    env_file:
+      - owfms.env
+    depends_on:
+      init-kafka:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    volumes:
+      - "./owfms_data:${OWFMS_ROOT}"
+      - "../certs:/${OWFMS_ROOT}/certs"
+    ports:
+      - "16004:16004"
+      - "16104:16104"
+
  owls:
    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owls:${OWLS_TAG}"
    networks:
@@ -55,6 +74,7 @@ services:
    depends_on:
      - owsec
      - owls
+      - owfms
    restart: unless-stopped
    volumes:
      - "./owls-ui/default.conf:/etc/nginx/conf.d/default.conf"
--- a/docker-compose/owls/environments/create_tip_deploy.sh
+++ b/docker-compose/owls/environments/create_tip_deploy.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+# Create a deploy directory for a particular environment.
+# Only support the letsencrypt setup here!
+# Optionally copy it over.
+
+set -e
+USAGE="$0 environment"
+
+env="$1"
+if [ -z "$env" ] ; then
+    echo $USAGE
+    exit 1
+fi
+dir="$env"
+dhost=""
+if [[ "$env" == "owls1" ]] ; then
+    hostname="owls1.lab.wlan.tip.build"
+    dhost="tipowlsls"
+    destdir="deploy-owls"
+elif [[ "$env" == "owls2" ]] ; then
+    hostname="owls2.lab.wlan.tip.build"
+    dhost="tipowlsgw"
+    destdir="deploy-owls"
+else
+    echo "Unknown environment: $env"
+    exit 1
+fi
+
+# need newer GNU sed (mac one isn't compatible) [on mac install sed using homebrew]
+sed=$(command -v gsed)
+[ -z "$sed" ] && sed="sed"
+
+set -x
+
+
+echo
+echo "Make sure you have created/updated the device-cert.pem and device-key.pem files!"
+echo
+url="https://$hostname"
+[ -d "$dir" ] || mkdir "$dir"
+cd "$dir"
+mkdir -p owls-ui traefik certs/cas || true
+cp ../../.env ../../*.env .
+cp ../../docker-compose.lb.letsencrypt.yml docker-compose.yml
+cp ../../owls-ui/default-lb.conf owls-ui/default.conf
+cp ../../traefik/* traefik
+cp ../../../certs/cas/* certs/cas 2>/dev/null || true
+cp ../../../certs/*.pem certs
+echo "SDKHOSTNAME=$hostname" >> .env
+$sed -i "s~REACT_APP_UCENTRALSEC_URL=.*~REACT_APP_UCENTRALSEC_URL=$url:16001~" owls-ui.env
+$sed -i "s~SYSTEM_URI_PUBLIC=.*~SYSTEM_URI_PUBLIC=$url:16001~" owsec.env
+$sed -i "s~SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$url~" owsec.env
+$sed -i "s~SYSTEM_URI_PUBLIC=.*~SYSTEM_URI_PUBLIC=$url:16004~" owfms.env
+$sed -i "s~SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$url~" owfms.env
+$sed -i "s~SYSTEM_URI_PUBLIC=.*~SYSTEM_URI_PUBLIC=$url:16007~" owls.env
+$sed -i "s~SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$url~" owls.env
+$sed -i "s~../certs:~./certs:~" docker-compose.yml
+
+
+if [[ -n "$dhost" && -n "$destdir" ]] ; then
+    rsync -avh --progress ./ $dhost:$destdir
+fi
--- a/docker-compose/owls/owfms.env
+++ b/docker-compose/owls/owfms.env
@@ -0,0 +1,43 @@
+RUN_CHOWN=true
+TEMPLATE_CONFIG=true
+SELFSIGNED_CERTS=true
+
+OWFMS_ROOT=/owfms-data
+OWFMS_CONFIG=/owfms-data
+
+#RESTAPI_HOST_ROOTCA=$OWFMS_ROOT/certs/restapi-ca.pem
+#RESTAPI_HOST_PORT=16004
+#RESTAPI_HOST_CERT=$OWFMS_ROOT/certs/restapi-cert.pem
+#RESTAPI_HOST_KEY=$OWFMS_ROOT/certs/restapi-key.pem
+#RESTAPI_HOST_KEY_PASSWORD=mypassword
+#INTERNAL_RESTAPI_HOST_ROOTCA=$OWFMS_ROOT/certs/restapi-ca.pem
+#INTERNAL_RESTAPI_HOST_PORT=17004
+#INTERNAL_RESTAPI_HOST_CERT=$OWFMS_ROOT/certs/restapi-cert.pem
+#INTERNAL_RESTAPI_HOST_KEY=$OWFMS_ROOT/certs/restapi-key.pem
+#INTERNAL_RESTAPI_HOST_KEY_PASSWORD=mypassword
+#SERVICE_KEY=$OWFMS_ROOT/certs/restapi-key.pem
+#SERVICE_KEY_PASSWORD=mypassword
+SYSTEM_DATA=$OWFMS_ROOT/persist
+SYSTEM_URI_PRIVATE=https://owfms.wlan.local:17004
+SYSTEM_URI_PUBLIC=https://openwifi.wlan.local:16004
+SYSTEM_URI_UI=https://openwifi.wlan.local
+#SECURITY_RESTAPI_DISABLE=false
+#S3_BUCKETNAME=ucentral-ap-firmware
+#S3_REGION=us-east-1
+S3_SECRET=b0S6EiR5RLIxoe7Xvz9YXPPdxQCoZ6ze37qunTAI
+S3_KEY=AKIAUG47UZG7R6SRLD7F
+#S3_BUCKET_URI=ucentral-ap-firmware.s3.amazonaws.com
+#KAFKA_ENABLE=true
+KAFKA_BROKERLIST=kafka:9092
+#STORAGE_TYPE=postgresql
+#STORAGE_TYPE_POSTGRESQL_HOST=postgresql
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owfms
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owfms
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owfms
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE_MYSQL_HOST=localhost
+#STORAGE_TYPE_MYSQL_USERNAME=owfms
+#STORAGE_TYPE_MYSQL_PASSWORD=owfms
+#STORAGE_TYPE_MYSQL_DATABASE=owfms
+#STORAGE_TYPE_MYSQL_PORT=3306
+STORAGE_TYPE=sqlite
--- a/docker-compose/owls/owls-ui/default-lb.conf
+++ b/docker-compose/owls/owls-ui/default-lb.conf
@@ -0,0 +1,41 @@
+server {
+    listen       80;
+    listen  [::]:80;
+
+    # Disable emitting nginx version
+    server_tokens off;
+
+    #return 301 https://$host$request_uri;
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    # redirect server error pages to the static page /50x.html
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}
+
+server {
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+
+    # Disable emitting nginx version
+    server_tokens off;
+
+    ssl_certificate     /etc/nginx/restapi-cert.pem;
+    ssl_certificate_key /etc/nginx/restapi-key.pem;
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    # redirect server error pages to the static page /50x.html
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}
--- a/docker-compose/owls/traefik.env
+++ b/docker-compose/owls/traefik.env
@@ -0,0 +1,15 @@
+TRAEFIK_ENTRYPOINTS_OWLSUIHTTP_ADDRESS=:80
+TRAEFIK_ENTRYPOINTS_OWLSUIHTTP_HTTP_REDIRECTIONS_ENTRYPOINT_TO=owlsuihttps
+TRAEFIK_ENTRYPOINTS_OWLSUIHTTPS_ADDRESS=:443
+TRAEFIK_ENTRYPOINTS_OWSECRESTAPI_ADDRESS=:16001
+TRAEFIK_ENTRYPOINTS_OWLSRESTAPI_ADDRESS=:16007
+TRAEFIK_ENTRYPOINTS_OWFMSRESTAPI_ADDRESS=:16004
+TRAEFIK_PROVIDERS_FILE_FILENAME=/etc/traefik/openwifi.yaml
+TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_EMAIL=
+TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_HTTPCHALLENGE=true
+TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_HTTPCHALLENGE_ENTRYPOINT=owlsuihttp
+TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_STORAGE=/letsencrypt/acme.json
+TRAEFIK_SERVERSTRANSPORT_ROOTCAS=/certs/restapi-ca.pem
+SDKHOSTNAME=owls2.lab.wlan.tip.build
+TRAEFIK_LOG=true
+TRAEFIK_LOG_LEVEL=DEBUG
--- a/docker-compose/owls/traefik/openwifi_letsencrypt.yaml
+++ b/docker-compose/owls/traefik/openwifi_letsencrypt.yaml
@@ -0,0 +1,50 @@
+log:
+  level: DEBUG
+http:
+  services:
+    owls-ui:
+      loadBalancer:
+        servers:
+          - url: "http://owls-ui.wlan.local:80/"
+    owsec-restapi:
+      loadBalancer:
+        servers:
+          - url: "https://owsec.wlan.local:16001/"
+    owfms-restapi:
+      loadBalancer:
+        servers:
+          - url: "https://owfms.wlan.local:16004/"
+    owls-restapi:
+      loadBalancer:
+        servers:
+          - url: "https://owls.wlan.local:16007/"
+
+  routers:
+    owls-ui-http:
+      entryPoints: "owlsuihttp"
+      service: "owls-ui"
+      rule: "Host(`{{ env "SDKHOSTNAME" }}`)"
+    owls-ui-https:
+      entryPoints: "owlsuihttps"
+      service: "owls-ui"
+      rule: "Host(`{{ env "SDKHOSTNAME" }}`)"
+      tls:
+        certResolver: "openwifi"
+    owls-restapi:
+      entryPoints: "owlsrestapi"
+      service: "owls-restapi"
+      rule: "Host(`{{ env "SDKHOSTNAME" }}`)"
+      tls:
+        certResolver: "openwifi"
+    owsec-restapi:
+      entryPoints: "owsecrestapi"
+      service: "owsec-restapi"
+      rule: "Host(`{{ env "SDKHOSTNAME" }}`)"
+      tls:
+        certResolver: "openwifi"
+    owfms-restapi:
+      entryPoints: "owfmsrestapi"
+      service: "owfms-restapi"
+      rule: "Host(`{{env "SDKHOSTNAME"}}`)"
+      tls:
+        certResolver: "openwifi"
Author	SHA1	Message	Date
TIP Automation User	169a41e950	Chg: update image tag in helm values to v4.0.0	2025-05-02 15:40:46 +00:00
jaspreetsachdev	67ee142716	Merge pull request #294 from Telecominfraproject/main WIFI-14521: Sync-up with main	2025-04-25 11:39:04 -04:00
i-chvets	a54fc0cf6a	Merge pull request #292 from Telecominfraproject/openlan_cas_in_clientcas feat: PKI 2.0: Added OpenLAN CAS to clientcas in docker-compose deploment	2025-04-25 11:32:49 -04:00
Carsten Schafer	841886869e	Merge pull request #293 from Telecominfraproject/WIFI-14521-fix-old-ubuntu WIFI-14521 Update to newer GH runner version	2025-04-25 11:25:45 -04:00
Carsten Schafer	2d0e42ec9f	Update to newer GH runner version Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2025-04-25 11:22:11 -04:00
TIP Automation User	00c80a2154	Chg: update image tag in helm values to v4.0.0-RC1	2025-04-24 21:02:58 +00:00
Ivan Chvets	72f0fd28a4	feat: PKI 2.0: Added OpenLAN CAS to clientcas in docker-compose deployment. Signed-off-by: Ivan Chvets <ivan.chvets@kinarasystems.com>	2025-04-24 12:38:33 -04:00
jaspreetsachdev	c853e252c1	Merge pull request #291 from Telecominfraproject/openlan_cas_in_clientcas feat: PKI 2.0: Added OpenLAN CAS to clientcas	2025-04-09 15:19:55 -04:00
Ivan Chvets	820f4d0925	feat: PKI 2.0: Added OpenLAN CAS to clientcas Signed-off-by: Ivan Chvets <ivan.chvets@kinarasystems.com>	2025-04-09 15:12:52 -04:00
jaspreetsachdev	6f9a4ac7c5	Merge pull request #290 from Telecominfraproject/rever-certs-update Rever certs update	2025-04-08 21:47:34 -04:00
Ivan Chvets	a5413d0c36	Revert "Update values.openwifi-qa.yaml" This reverts commit `5e87e15cc0`. Signed-off-by: Ivan Chvets <ivan.chvets@kinarasystems.com>	2025-04-08 21:25:21 -04:00
Ivan Chvets	c682a7f070	Revert "Update values.openwifi-qa.yaml" This reverts commit `8a84f2e86f`. Signed-off-by: Ivan Chvets <ivan.chvets@kinarasystems.com>	2025-04-08 21:24:29 -04:00
jaspreetsachdev	8a84f2e86f	Update values.openwifi-qa.yaml Added demo chains	2025-04-08 20:25:48 -04:00
jaspreetsachdev	5e87e15cc0	Update values.openwifi-qa.yaml Added trust chain for insta openlan demo	2025-04-08 18:50:13 -04:00
Carsten Schafer	02b0863abd	Merge pull request #289 from Telecominfraproject/WIFI-13821-fix-alb-health-checks WIFI-13821 - Load balancer started acting up: change annotations	2024-09-27 11:50:47 -04:00
Carsten Schafer	0ac8f8c29b	WIFI-13821 - Load balancer started acting up: change annotations Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-27 11:42:56 -04:00
Carsten Schafer	6e8eb3a26c	Merge pull request #287 from Telecominfraproject/WIFI-14148-multiple-cgw-4 WIFI-13821: Change pinning targets for cgw hosts, set grpc endpoint n…	2024-09-20 15:46:19 -04:00
Carsten Schafer	9143143351	WIFI-13821: Change pinning targets for cgw hosts, set grpc endpoint names Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-20 15:33:36 -04:00
Carsten Schafer	448c7319df	Merge pull request #286 from Telecominfraproject/WIFI-14148-multiple-cgw-2 WIFI-14148 Adapt to the idiosyncrasies of each cluster env	2024-09-19 13:43:22 -04:00
Carsten Schafer	7399215578	WIFI-14148 Adapt to the idiosyncrasies of each cluster env Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-19 11:55:29 -04:00
Carsten Schafer	03525b8a8f	Merge pull request #285 from Telecominfraproject/WIFI-14148-multiple-cgw WIFI-14148 add 2nd cgw	2024-09-19 11:16:00 -04:00
Carsten Schafer	91f1f2446a	WIFI-14148 add 2nd cgw Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-19 09:56:04 -04:00
Carsten Schafer	423d25b14c	Merge pull request #284 from Telecominfraproject/WIFI-13871-add-owls-envs WIFI-13871: Be able to generate owls environments, fix device type an…	2024-09-18 16:19:30 -04:00
Carsten Schafer	5e07d2570a	WIFI-13871: Be able to generate owls environments, fix device type and add ability to use letsencrypt Signed-off-by: Carsten Schafer <Carsten.Schafer@kinarasystems.com>	2024-09-18 15:15:13 -04:00
				`@@ -0,0 +1 @@`
				`# set the node affinity and tolerations here`