diff --git a/.github/workflows/deploy-wiab.yml b/.github/workflows/deploy-wiab.yml deleted file mode 100644 index ad4b0a17f..000000000 --- a/.github/workflows/deploy-wiab.yml +++ /dev/null @@ -1,39 +0,0 @@ -# This playbook is not-up-to-date, requires to be updated to match with current developments -# A new WIAB (wire in a box) dev solution has been created https://docs.wire.com/latest/how-to/install/demo-wiab.html and can be used until this (wiab-staging) gets updated -name: Deploy on Hetzner WIAB setup -on: - workflow_run: - workflows: ["Prepare custom offline package"] - types: - - completed - -jobs: - deploy: - runs-on: ubuntu-latest - concurrency: - group: autodeploy-script - cancel-in-progress: false - - steps: - # Step 1: Checkout the repository code - - name: Checkout code - uses: actions/checkout@v3 - - # Step 2: Set up SSH key for remote access - - name: Set up SSH key - uses: webfactory/ssh-agent@v0.5.3 - with: - ssh-private-key: ${{ secrets.WIAB_PRIVATE_SSH_KEY }} - - # Step 3: Get the latest commit SHA, for the artifact - - name: Get latest commit SHA - id: get_commit_sha - run: | - COMMIT_SHA=$(git rev-parse HEAD) - echo "commit_sha=$COMMIT_SHA" >> $GITHUB_ENV - - # Step 4: Run the autodeploy script - - name: Run Auto Deploy Script - run: | - cd bin - ./autodeploy.sh --artifact-hash ${{ env.COMMIT_SHA }} --target-domain wiab-test-box.wire.link --force-redeploy diff --git a/bin/autodeploy.sh b/bin/autodeploy.sh deleted file mode 100755 index d7506cf3b..000000000 --- a/bin/autodeploy.sh +++ /dev/null @@ -1,450 +0,0 @@ -#!/usr/bin/env bash -# This script is not-up-to-date, requires to be updated to match with current developments -# A new WIAB (wire in a box) dev solution has been created https://docs.wire.com/latest/how-to/install/demo-wiab.html and can be used until this (wiab-staging) gets updated - -# shellcheck disable=SC2087 - -# This script can be replaced with a simpler solution of wiab-demo installtion -# https://docs.wire.com/latest/how-to/install/demo-wiab.html - -set -Eeuo pipefail - -msg() { - echo >&2 -e "${1-}" -} - -trap cleanup SIGINT SIGTERM ERR EXIT - -usage() { - cat </dev/null 2>&1 ; then - msg "INFO: DNS A record exists: $SUBDOMAIN.$TARGET_SYSTEM" - else - die "ERROR: DNS A record for $SUBDOMAIN.$TARGET_SYSTEM does not exist. Exiting. Please check DNS record set." - fi -done - -if ssh -q -o StrictHostKeyChecking=no -o ConnectTimeout=5 -p "$SSH_PORT" "$SSH_USER"@webapp."$TARGET_SYSTEM" id | grep -q "$SSH_USER"; then - msg "" - msg "INFO: Successfully logged into $TARGET_SYSTEM as $SSH_USER" -else - die "ERROR: Can't log into $TARGET_SYSTEM via SSH, please check SSH connectivity." -fi - - -if curl --head --silent --fail https://s3-eu-west-1.amazonaws.com/public.wire.com/artifacts/wire-server-deploy-static-"$ARTIFACT_HASH".tgz >/dev/null 2>&1 ; then - msg "INFO: Artifact exists https://s3-eu-west-1.amazonaws.com/public.wire.com/artifacts/wire-server-deploy-static-$ARTIFACT_HASH.tgz" -else - die "ERROR: No artifact found via https://s3-eu-west-1.amazonaws.com/public.wire.com/artifacts/wire-server-deploy-static-$ARTIFACT_HASH.tgz" -fi - -system_cleanup_meta() { - msg "" - msg "INFO: Cleaning up all VMs, docker resources and wire-server-deploy files on $TARGET_SYSTEM." - msg "" - sleep 5 - ssh -p "$SSH_PORT" -o StrictHostKeyChecking=no "$SSH_USER"@webapp."$TARGET_SYSTEM" "bash -s" < /dev/null; then - for VM in $(virsh list --all --name); do virsh destroy "$VM"; virsh undefine "$VM" --remove-all-storage; done - fi - if which docker > /dev/null; then - docker system prune -a -f - fi - rm -f /home/$DEMO_USER/.ssh/known_hosts - rm -rf /home/$DEMO_USER/wire-server-deploy - rm -f /home/$DEMO_USER/wire-server-deploy-static-*.tgz -} - -preprovision_hetzner() { - msg "" - msg "INFO: running local ansible playbook for inital server deployment." - msg "INFO: This will setup up the Hetzner system with basic defaults, download and unpack the wire-server-deploy artifact." - sleep 5 - # on Mac devices C.UTF-8 is not available - if [[ $(uname) == "Darwin" ]]; then - export LC_ALL=en_US.UTF-8 - else - export LC_ALL=C.UTF-8 - fi - ansible-playbook ../ansible/hetzner-single-deploy.yml -e "artifact_hash=$ARTIFACT_HASH" -e "ansible_ssh_common_args='-o ServerAliveInterval=30 -o ServerAliveCountMax=10 -o ControlMaster=auto -o ControlPersist=180m'" -i $SSH_USER@webapp."$TARGET_SYSTEM", --diff -} - -remote_deployment() { - msg() { - echo >&2 -e "${1-}" - } - cd $SCRIPT_DIR &>/dev/null || exit 1 - - bash bin/offline-vm-setup.sh - msg "" - while sudo virsh list --all | grep -Fq running; do - sleep 20 - msg "INFO: VM deployment still in progress ..." - done - sleep 20 - msg "" - msg "INFO: VM deployment done. Starting all VMs:" - msg "" - for VM in $(sudo virsh list --all --name); do sudo virsh start "$VM"; done - sleep 60 - - msg "" - msg "INFO: Setting up offline environment (this will take a while)." - msg "" - # Rather than sourcing wire-server-deploy/bin/offline-env.sh, we invoke - # the relevant commands below, declaring "d" as a function instead of an alias. - ZAUTH_CONTAINER=$(sudo docker load -i "$SCRIPT_DIR"/containers-adminhost/quay.io_wire_zauth_*.tar | awk '{print $3}') - export ZAUTH_CONTAINER - WSD_CONTAINER=$(sudo docker load -i "$SCRIPT_DIR"/containers-adminhost/container-wire-server-deploy.tgz | awk '{print $3}') - d() { - sudo docker run --network=host -v "${SSH_AUTH_SOCK:-nonexistent}":/ssh-agent -e SSH_AUTH_SOCK=/ssh-agent -v "$HOME"/.ssh:/root/.ssh -v "$PWD":/wire-server-deploy "$WSD_CONTAINER" "$@" - } - export -f d - - bash bin/offline-secrets.sh - - HOST_IP=$(dig @resolver4.opendns.com myip.opendns.com +short) - - cat >ansible/inventory/offline/hosts.ini</dev/null) - if [[ $? -eq 0 && -n "$podCIDR" ]]; then - sed -i "s|RELAY_NETWORKS: \".*\"|RELAY_NETWORKS: \":${podCIDR}\"|" $SMTP_VALUES_FILE - else - echo "Failed to fetch podSubnet. Attention using the default value: $(grep -i RELAY_NETWORKS $SMTP_VALUES_FILE)" - fi - d helm install smtp ./charts/smtp --values $SMTP_VALUES_FILE - - d helm install reaper ./charts/reaper - - cp values/wire-server/prod-values.example.yaml values/wire-server/values.yaml - sed -i "s/example.com/$TARGET_SYSTEM/g" values/wire-server/values.yaml - sed -i "s/# - \"turn::3478\"/- \"turn:$HOST_IP:3478\"/g" values/wire-server/values.yaml - sed -i "s/# - \"turn::3478?transport=tcp\"/- \"turn:$HOST_IP:3478?transport=tcp\"/g" values/wire-server/values.yaml - - d helm install wire-server ./charts/wire-server --timeout=15m0s --values ./values/wire-server/values.yaml --values ./values/wire-server/secrets.yaml - - sed -i "s/example.com/$TARGET_SYSTEM/g" values/webapp/prod-values.example.yaml - d helm install webapp ./charts/webapp --values ./values/webapp/prod-values.example.yaml - - sed -i "s/example.com/$TARGET_SYSTEM/g" values/team-settings/prod-values.example.yaml - d helm install team-settings ./charts/team-settings --values ./values/team-settings/prod-values.example.yaml --values ./values/team-settings/prod-secrets.example.yaml - - sed -i "s/example.com/$TARGET_SYSTEM/g" values/account-pages/prod-values.example.yaml - d helm install account-pages ./charts/account-pages --values ./values/account-pages/prod-values.example.yaml - - cp values/ingress-nginx-controller/prod-values.example.yaml ./values/ingress-nginx-controller/values.yaml - d helm install ingress-nginx-controller ./charts/ingress-nginx-controller --values ./values/ingress-nginx-controller/values.yaml - - KUBENODEIP=$(d kubectl get pods -l app.kubernetes.io/name=ingress-nginx -o=custom-columns=IP:.status.hostIP --no-headers) - sudo sed -i "s/define KUBENODEIP.*/define KUBENODEIP = $KUBENODEIP/" /etc/nftables.conf - sudo systemctl restart nftables - - INGRESSNODE=$(d kubectl get pods -l app.kubernetes.io/name=ingress-nginx -o=custom-columns=NODE:.spec.nodeName --no-headers) - d kubectl cordon "$INGRESSNODE" - - cp ./values/nginx-ingress-services/prod-values.example.yaml ./values/nginx-ingress-services/values.yaml - cp ./values/nginx-ingress-services/prod-secrets.example.yaml ./values/nginx-ingress-services/secrets.yaml - sed -i 's/useCertManager: false/useCertManager: true/g' values/nginx-ingress-services/values.yaml - sed -i 's/certmasterEmail:/certmasterEmail: backend+wiabautodeploy@wire.com/g' values/nginx-ingress-services/values.yaml - sed -i "s/example.com/$TARGET_SYSTEM/" values/nginx-ingress-services/values.yaml - - d kubectl create namespace cert-manager-ns - d helm upgrade --install -n cert-manager-ns --set 'installCRDs=true' cert-manager charts/cert-manager --values values/cert-manager/prod-values.example.yaml - - d kubectl uncordon "$INGRESSNODE" - - d helm upgrade --install nginx-ingress-services charts/nginx-ingress-services -f values/nginx-ingress-services/values.yaml - - d kubectl get certificate - - cp values/sftd/prod-values.example.yaml values/sftd/values.yaml - sed -i "s/webapp.example.com/webapp.$TARGET_SYSTEM/" values/sftd/values.yaml - sed -i "s/sftd.example.com/sftd.$TARGET_SYSTEM/" values/sftd/values.yaml - sed -i 's/name: letsencrypt-prod/name: letsencrypt-http01/' values/sftd/values.yaml - sed -i "s/replicaCount: 3/replicaCount: 1/" values/sftd/values.yaml - d kubectl label node kubenode1 wire.com/role=sftd - d helm upgrade --install sftd ./charts/sftd --set 'nodeSelector.wire\.com/role=sftd' --set 'node_annotations="{'wire\.com/external-ip': '"$HOST_IP"'}"' --values values/sftd/values.yaml - - ZREST_SECRET=$(grep -A1 turn values/wire-server/secrets.yaml | grep secret | tr -d '"' | awk '{print $NF}') - - cat >values/coturn/values.yaml<values/coturn/secrets.yaml</dev/null" || echo "false") -EXISTING_VMS=$(ssh -p "$SSH_PORT" -o StrictHostKeyChecking=no "$SSH_USER"@webapp."$TARGET_SYSTEM" "virsh list --all --name" || echo "false") -EXISTING_CONTAINERS=$(ssh -p "$SSH_PORT" -o StrictHostKeyChecking=no "$SSH_USER"@webapp."$TARGET_SYSTEM" "docker ps -q --all" || echo "false") - -if [[ "$EXISTING_INSTALL" != "false" && -n "$EXISTING_INSTALL" ]]; then - msg "" - msg "WARNING: existing wire-server-deploy installation found: $EXISTING_INSTALL" - DO_SYSTEM_CLEANUP=true -fi -if [[ "$EXISTING_VMS" != "false" && -n "$EXISTING_VMS" ]]; then - msg "" - msg "WARNING: existing libvirt VMs found: $EXISTING_VMS" - DO_SYSTEM_CLEANUP=true -fi -if [[ "$EXISTING_CONTAINERS" != "false" && -n "$EXISTING_CONTAINERS" ]]; then - echo "$EXISTING_CONTAINERS" - msg "" - msg "WARNING: existing Docker containers found." - DO_SYSTEM_CLEANUP=true -fi - -if [ "$DO_SYSTEM_CLEANUP" = false ]; then - msg "" - msg "INFO: Target system clean, no previous wire-server-deploy installation found." -fi -if [ "$DO_SYSTEM_CLEANUP" = true ] && [ "$FORCE_REDEPLOY" = 0 ]; then - msg "" - IFS= read -r -p "Do you want to wipe all wire-server-deploy components from $TARGET_SYSTEM? (y/n) " PROMPT_CLEANUP - if [[ $PROMPT_CLEANUP == "n" || $PROMPT_CLEANUP == "N" ]]; then - msg "" - die "Aborting, not cleaning up $TARGET_SYSTEM" - fi - system_cleanup_meta -fi -if [ "$DO_SYSTEM_CLEANUP" = true ] && [ "$FORCE_REDEPLOY" = 1 ]; then - system_cleanup_meta -fi - -msg "INFO: Commencing Wire-in-a-box deployment on $TARGET_SYSTEM." -preprovision_hetzner -ssh -p "$SSH_PORT" -o StrictHostKeyChecking=no -o ServerAliveInterval=30 -o ServerAliveCountMax=10 "$DEMO_USER"@webapp."$TARGET_SYSTEM" "bash -s" <