fix: wpb-22590 add pages for ansible operations in production and intro by mohitrajain · Pull Request #106 · wireapp/wire-docs

mohitrajain · 2026-03-19T17:31:35Z

Change type

Documentation change
Build pipeline change
Submodule update
Deployment change

Basic information

THIS CHANGE REQUIRES A WIRE-DOCS RELEASE NOW

Testing

I ran/applied the changes myself, in a test environment.

Tracking

I mentioned this PR in Jira, OR I mentioned the Jira ticket in this PR.
I mentioned this PR in one of the issues attached to one of our repositories.

…roduction

sghosh23 · 2026-03-20T08:34:53Z

src/how-to/install/ansible-VMs.md

+Cassandra, Minio, PostgresSQL, RabbitMQ and Elasticsearch are running outside Kubernets cluster, make sure those machines have necessary ports open -
+
+On each of the machines running Cassandra, Minio, PostgresSQL, RabbitMQ and Elasticsearch, run the following commands to open the necessary ports, if needed:
+```bash


May be we can consider to automate this via ansible

Yes, we can automate it but by default we have noticed that VM firewalls are open. Here we are trying to say that these ports should open. let me rephrase it better.

sghosh23 · 2026-03-20T08:55:08Z

src/how-to/install/ansible-VMs.md

+- `./ansible/inventory/group_vars/all/secrets.yaml` - This file will be used by ansible playbooks to configure service secrets.
+- `values/wire-server/secrets.yaml` - This contains the secrets for Wire services and share some secrets from coturn and database services.
+- `values/coturn/secrets.yaml` - This contains a secret for the coturn service.



Both for wire-server and coturn, the secrets are created as prod-secrets.example.yaml last time i checked

src/how-to/install/ansible-VMs.md

sghosh23 · 2026-03-20T08:57:31Z

src/how-to/install/ansible-VMs.md

+[postgresql:vars]
+postgresql_network_interface=enp7s0
+wire_dbname=wire-server
+repmgr_node_config={"postgresql1":{"node_id":1,"priority":150,"role":"primary"},"postgresql2":{"node_id":2,"priority":100,"role":"standby"},"postgresql3":{"node_id":3,"priority":50,"role":"standby"}}


Can use some serialization for better readability

ini inventory doesn't support multiline value. We can pick yaml format for it but indentation can become tricky for end user. Will create an internal ticket to convert the default inventory format to yaml.

sghosh23 · 2026-03-20T08:58:39Z

src/how-to/install/ansible-VMs.md

-### Postgresql cluster
+[kube-node]
+call_kubenode1  ansible_host=10.1.1.33 etcd_member_name=call_kubenode1 ip=10.1.1.33 node_labels="{'wire.com/role': 'sftd'}" node_annotations="{'wire.com/external-ip': 'a.b.c.d'}"
+call_kubenode2 ansible_host=10.1.1.34 etcd_member_name=call_kubenode2 ip=10.1.1.34 node_labels="{'wire.com/role': 'coturn'}""


The quotation seems off

Is this config for a different calling cluster? If so, please mention it. The template we provide does not have this reference.

Yes, this is a new sample inventory, I am trying to add to provide for calling k8s cluster.

sghosh23 · 2026-03-20T09:26:03Z

src/how-to/install/ansible-VMs.md

+[k8s-cluster:vars]
+calico_mtu=1450
+calico_veth_mtu=1430
+```


Why the user needs to set mtu based on Hetzner's requirement here? I would recommend to read up the doc: https://github.com/kubernetes-sigs/kubespray/blob/master/docs/CNI/calico.md#configuring-interface-mtu before suggesting something really advanced. If there is an use case to set those configs, its upto the user

yes, these were carried on from our cd template. Taking them out.

Co-authored-by: Sukanta <amisukanta02@gmail.com>

julialongtin · 2026-03-30T11:29:30Z

src/how-to/install/ansible-VMs.md

+```bash
+$ cd ...  # you pick a good location!
+```
+Obtain the latest airgap artifact for wire-server-deploy. Please contact us to get it.


how does 'contact us' work?

julialongtin · 2026-03-30T11:29:56Z

src/how-to/install/ansible-VMs.md

+$ wget https://s3-eu-west-1.amazonaws.com/public.wire.com/artifacts/wire-server-deploy-static-<HASH>.tgz
+$ tar xvzf wire-server-deploy-static-<HASH>.tgz
+```
+Where `<HASH>` above is the hash of your deployment artifact, given to you by Wire, or acquired by looking at the above build job.


what build job?

julialongtin · 2026-03-30T11:31:16Z

src/how-to/install/ansible-VMs.md

-cd wire-server-deploy/ansible
+```bash
+cp ansible/inventory/offline/99-static ansible/inventory/offline/hosts.ini
+mv ansible/inventory/offline/99-static ansible/inventory/offline/orig.99-static


the move doesn't do anything productive.

julialongtin · 2026-03-30T11:31:53Z

src/how-to/install/ansible-VMs.md

+```

-There are more settings in this file that we will set in later steps.
+> Note: Make sure that `assethost` is present in the inventory file with the correct `ansible_host` (and `ip` values if required)


shouldn't this note hold for all entries in this file?

julialongtin · 2026-03-30T11:33:25Z

src/how-to/install/ansible-VMs.md

-e.g. attempt to run Cassandra and k8s on the same 3 machines, the
-hostnames will be overwritten by the second installation playbook,
-breaking the first.
+These sections can be divided into individual host groups, reflecting the architecture of the target infrastructure. Examples with individual nodes for Elastic, MinIO, PostgreSQL, RabbitMQ and Cassandra are commented out below.


Suggested change

These sections can be divided into individual host groups, reflecting the architecture of the target infrastructure. Examples with individual nodes for Elastic, MinIO, PostgreSQL, RabbitMQ and Cassandra are commented out below.

These sections are divided into individual host groups, reflecting the architecture of the target infrastructure. Examples with individual nodes for Elastic, MinIO, PostgreSQL, RabbitMQ and Cassandra are commented out below.

julialongtin · 2026-03-30T11:36:52Z

src/how-to/install/ansible-VMs.md

+repmgr_node_config = {"postgresql1": {"node_id": 1, "priority": 150, "role": "primary"}, "postgresql2": {"node_id": 2, "priority": 100, "role": "standby"}, "postgresql3": {"node_id": 3, "priority": 50, "role": "standby"}}
 ```
+- In an INI inventory, the `repmgr_node_config` keys must match the PostgreSQL inventory hostnames.
+- To read more about specific PostgreSQL configuration, reat at [PostgreSQL High Availability Cluster - Quick Setup](../administrate/postgresql-cluster.md).


Why is this here? we do not do this for the other backing services.

julialongtin · 2026-03-30T11:54:31Z

src/how-to/install/ansible-VMs.md

 ```

- Use ansible and deploy ElasticSearch:
+## Generating random secrets for the services


Suggested change

## Generating random secrets for the services

## Generating secrets for the services

julialongtin · 2026-03-30T13:31:27Z

src/how-to/install/ansible-VMs.md

+### Troubleshooting external services
+Cassandra, Minio, PostgresSQL, RabbitMQ and Elasticsearch are running outside Kubernets cluster, make sure those machines have necessary ports open -
+
+On each of the machines running Cassandra, Minio, PostgresSQL, RabbitMQ and Elasticsearch, run the following commands to open the necessary ports, if needed:


Suggested change

On each of the machines running Cassandra, Minio, PostgresSQL, RabbitMQ and Elasticsearch, run the following commands to open the necessary ports, if needed:

On each of the machines running Cassandra, Minio, PostgresSQL, RabbitMQ and Elasticsearch, run the following commands to open the necessary ports, if necessary:

julialongtin · 2026-03-30T13:32:47Z

src/how-to/install/ansible-VMs.md

-   ```bash
-   ansible-playbook -i hosts.ini minio.yml -vv
-   ```
+The SFT & Coturn Calling server should be running on a kubernetes nodes that are connected to the public internet. If not all kubernetes nodes match these criteria, you should specifically label the nodes that do match these criteria, so that you're sure SFT is deployed correctly.


This is not true.

julialongtin · 2026-03-30T13:41:53Z

src/how-to/install/ansible-VMs.md

+```

-For instructions on how to install Restund, see [this page](restund.md#install-restund).
+If the node does not know its onw public IP (e.g. becuase it's behind NAT) then you should also set the `wire.com/external-ip` annotation to the public IP of the node.


Suggested change

If the node does not know its onw public IP (e.g. becuase it's behind NAT) then you should also set the `wire.com/external-ip` annotation to the public IP of the node.

If the node is not bound to the public IP the users will see(e.g. becuase it's behind NAT) then you should also set the `wire.com/external-ip` annotation to the public IP of the node.

fix: wpb-22590 add pages for ansible operations in production and int…

9e147ec

…roduction

mohitrajain requested review from a team as code owners March 19, 2026 17:31

mohitrajain changed the title ~~fix: wpb-22590 add pages for ansible operations in production and int…~~ fix: wpb-22590 add pages for ansible operations in production and intro Mar 19, 2026

sghosh23 reviewed Mar 20, 2026

View reviewed changes

src/how-to/install/ansible-VMs.md Outdated Show resolved Hide resolved

sghosh23 reviewed Mar 20, 2026

View reviewed changes

Update src/how-to/install/ansible-VMs.md

62193be

Co-authored-by: Sukanta <amisukanta02@gmail.com>

julialongtin approved these changes Mar 30, 2026

View reviewed changes

	These sections can be divided into individual host groups, reflecting the architecture of the target infrastructure. Examples with individual nodes for Elastic, MinIO, PostgreSQL, RabbitMQ and Cassandra are commented out below.
	These sections are divided into individual host groups, reflecting the architecture of the target infrastructure. Examples with individual nodes for Elastic, MinIO, PostgreSQL, RabbitMQ and Cassandra are commented out below.

	## Generating random secrets for the services
	## Generating secrets for the services

	On each of the machines running Cassandra, Minio, PostgresSQL, RabbitMQ and Elasticsearch, run the following commands to open the necessary ports, if needed:
	On each of the machines running Cassandra, Minio, PostgresSQL, RabbitMQ and Elasticsearch, run the following commands to open the necessary ports, if necessary:

	If the node does not know its onw public IP (e.g. becuase it's behind NAT) then you should also set the `wire.com/external-ip` annotation to the public IP of the node.
	If the node is not bound to the public IP the users will see(e.g. becuase it's behind NAT) then you should also set the `wire.com/external-ip` annotation to the public IP of the node.

Conversation

mohitrajain commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change type

Basic information

Testing

Tracking

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sghosh23 Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sghosh23 Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mohitrajain commented Mar 19, 2026 •

edited

Loading

sghosh23 Mar 20, 2026 •

edited

Loading

sghosh23 Mar 20, 2026 •

edited

Loading