DO NOT MERGE

.envrc

@@ -0,0 +1,13 @@
+nix-build $PWD/default.nix -A env --out-link .nix-env
+
+PATH_add ".nix-env/bin"
+
+export LOCALHOST_PYTHON="$PWD/.nix-env/bin/python"
+
+# source .profile from `$env`.
+# This is only used to set things interpolated by nix.
+# All *static* things should live inside .envrc.
+[[ -f ".nix-env/.profile" ]] && source_env ".nix-env/.profile"
+
+# allow local .envrc overrides
+[[ -f .envrc.local ]] && source_env .envrc.local

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# This file designates code owners for different parts of the repository
+
+# Define code owners for all files in the repository
+*     @wireapp/customerops @julialongtin

.github/ISSUE_TEMPLATE/bug-repport.md

@@ -0,0 +1,44 @@
+---
+name: Bug Report
+about: template to report a bug
+title: "Bug: [BUG TITLE]"
+labels: ''
+assignees: ''
+---
+
+### Basic information
+
+<!-- Depending on your use case some of the information might be omitted -->
+
+* On-premises: <!-- yes / no -->
+* Cloud-Provider: <!-- e.g. AWS, GCP, none, etc. -->
+* Installation type: <!-- demo / production -->
+* Kubernetes version: <!-- run 'kubectl version' -->
+* Helm version: <!-- run 'helm version' -->
+* Installed with Kubespray: <!-- no / yes (version?) --> 
+* (Helm) Charts version: <!-- run 'helm show chart wire/wire-server | grep -m 1 version' -->
+* List of installed top-level charts: <!-- e.g. database-ephemeral, demo-smtp --> 
+* Other related technologies + version: <!-- Ansible, Helm, Terraform -->
+
+
+### What is the expected result?
+
+<!--
+Please elaborate.
+-->
+
+
+### What is the actual result?
+
+<!--
+Please elaborate.
+Add logs, outputs, if necessary.
+-->
+
+
+### How to reproduce the issue?
+
+<!--
+Please describe the steps to reproduce the actual result.
+Add a minimal example, if possible.
+-->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature-request.md

@@ -0,0 +1,40 @@
+---
+name: Feature Request
+about: Template for a question around the topic of deploying wire-server 
+title: "Feature: [FEATURE TITLE]"
+labels: ''
+assignees: ''
+---
+
+
+### What kind of feature are you looking for?
+
+<!--
+Describe the feature.
+-->
+
+
+### In which scenario would this feature be helpful?
+
+<!--
+Please describe the use case in a comprehensible manner.
+The more context you give the better we can understand the underlying issue.  
+-->
+
+
+### How do you imagine that this feature is being used?
+
+<!--
+Explain the user perspective.
+Share some example code.  
+-->
+
+
+### How did you install Wire?
+
+<!--
+In context of the proposed feature, please explain your setup a little. 
+Which installation instructions did you follow on docs.wire.com (e.g. demo / production)?
+Where and how do you run Kubernetes (operating system version and cloud provider, if any)?
+How was Kubernetes installed (e.g. Kubespray, managed, etc.)?
+-->

.github/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,39 @@
+---
+name: Question
+about: template for a question around the topic of deploying wire-server 
+title: "Question: [QUESTION TITLE]"
+labels: ''
+assignees: ''
+---
+
+### Basic information
+
+<!-- Depending on your use case some of the information might be omitted -->
+
+* On-premises: <!-- yes / no -->
+* Cloud-Provider: <!-- e.g. AWS, GCP, none, etc. -->
+* Installation type: <!-- demo / production -->
+* Kubernetes version: <!-- run 'kubectl version' -->
+* Helm version: <!-- run 'helm version' -->
+* Installed with Kubespray: <!-- no / yes (version?) --> 
+* (Helm) Charts version: <!-- run 'helm show chart wire/wire-server | grep -m 1 version' -->
+* List of installed top-level charts: <!-- e.g. database-ephemeral, demo-smtp --> 
+* Other related technologies + version: <!-- Ansible, Helm, Terraform -->
+
+
+### How did you install Wire?
+
+<!--
+Did you deviate from the instructions one docs.wire.com at some point?
+Which operating system did you use and which version of it?  
+How did you set up TLS certificates and DNS records?
+Please explain your setup a little.
+-->
+
+
+### Question
+
+<!--
+I couldn't find an answer in the installation guide (https://docs.wire.com/how-to/install/index.html)
+nor somewhere else in the documentation (https://docs.wire.com/how-to/index.html)
+-->

.github/PULL_REQUEST_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/pull_request_template.md

@@ -0,0 +1,61 @@
+---
+name: Change (PR)
+about: template for a PR that introduces a change 
+title: "[TITLE]"
+labels: 
+assignees:
+---
+
+<!-- In case this addressed an existing issue 
+Fixes ${ISSUE_URL}
+-->
+
+### Change type
+
+<!-- choose the kind of change this PR introduces -->
+
+* [ ] Fix
+* [ ] Feature
+
+
+### Basic information 
+
+Technology: <!-- Ansible, Kubernetes, Helm, Terraform -->
+
+Version: <!-- Version of the technologies you just referred to -->
+
+* [ ] I ran/applied the changes myself
+* [ ] I can confirm that it was successful
+
+
+### Motivation
+
+<!--
+What is the motivation for introducing this change?
+Which scenario(s) is/are addressed by the change?
+What problem does the change try to solve? 
+-->
+
+
+### Objective
+
+<!--
+What kind behaviour does it change, add, or remove?
+How did it behave before? How does it behave now? 
+-->
+
+
+### Reason
+
+<!--
+How did you fix the issue?
+Why did you solve it this way? 
+-->
+
+
+### Use case
+
+<!--
+How is the change used? maybe share some example code.
+Does the change introduce any incompatibility?
+-->

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+on:
+  push:
+    branches: [master, develop]
+  pull_request:
+    branches: [master, develop]
+jobs:
+  build:
+    name: build
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os:
+          - ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: true
+      - uses: cachix/install-nix-action@v27
+      - uses: cachix/cachix-action@v15
+        with:
+          name: wire-server
+          signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
+
+      - name: Build the environment
+        run: nix-build -A env
+      - name: Install the environment
+        run: nix-env -f . -A env -i
+      - name: Install terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "^1.3.7"
+          terraform_wrapper: false
+      - name: Check terraform init
+        run: |
+          cd terraform/environment
+          terraform init --backend=false

.github/workflows/custom-artifact.yml

@@ -0,0 +1,72 @@
+on:
+  push:
+    branches: [master, develop]
+    tags: [ v* ]
+  workflow_dispatch:
+jobs:
+  offline:
+    name: Prepare custom offline package # Do not change this name, it is used to trigger deploy-wiab workflow
+    # Useful to skip expensive CI when writing docs
+    if: "!contains(github.event.head_commit.message, 'skip ci')"
+    runs-on:
+      group: wire-server-deploy
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: true
+      - uses: cachix/install-nix-action@v27
+      - uses: cachix/cachix-action@v15
+        with:
+          name: wire-server
+          signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
+
+      - name: Install nix environment
+        run: nix-env -f default.nix -iA env
+
+      - name: Run offline build
+        run: ./offline/ci.sh HELM_CHART_EXCLUDE_LIST=elasticsearch-curator,fluent-bit,kibana,redis-cluster,inbucket,aws-ingress,backoffice,calling-test,nginx-ingress-controller
+        env:
+          GPG_PRIVATE_KEY: '${{ secrets.GPG_PRIVATE_KEY }}'
+          DOCKER_LOGIN: '${{ secrets.DOCKER_LOGIN }}'
+
+      - name: Get upload name
+        id: upload_name
+        run: |
+          # FIXME: Tag with a nice release name using the github tag...
+          # SOURCE_TAG=${GITHUB_REF#refs/tags/}
+          echo ::set-output name=UPLOAD_NAME::$GITHUB_SHA-custom
+          # echo ::set-output name=UPLOAD_NAME::${SOURCE_TAG:-$GITHUB_SHA}
+      - name: Copy assets tarball to S3
+        run: |
+          aws s3 cp assets.tgz s3://public.wire.com/artifacts/wire-server-deploy-static-${{ steps.upload_name.outputs.UPLOAD_NAME }}.tgz
+          echo "Uploaded to: https://s3-$AWS_REGION.amazonaws.com/public.wire.com/artifacts/wire-server-deploy-static-${{ steps.upload_name.outputs.UPLOAD_NAME }}.tgz"
+        env:
+          AWS_ACCESS_KEY_ID: '${{ secrets.AWS_ACCESS_KEY_ID }}'
+          AWS_SECRET_ACCESS_KEY: '${{ secrets.AWS_SECRET_ACCESS_KEY }}'
+          AWS_REGION: "eu-west-1"
+
+      - name: Build and upload wire-server-deploy container
+        run: |
+          container_image=$(nix-build --no-out-link -A container)
+          skopeo copy --retry-times 10 --dest-creds "$DOCKER_LOGIN" \
+            docker-archive:"$container_image" \
+            "docker://quay.io/wire/wire-server-deploy:${{ steps.upload_name.outputs.UPLOAD_NAME }}"
+        env:
+          DOCKER_LOGIN: '${{ secrets.DOCKER_LOGIN }}'
+
+      # Set output for deploy-wiab workflow to start
+      - name: Set output to trigger dependent workflow
+        if: success()
+        run: echo "::set-output name=trigger_next_workflow::true"
+
+      - name: Deploy offline environment to hetzner
+        run: |
+          ./offline/cd.sh
+        env:
+          HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
+
+      - name: Clean up hetzner environment; just in case
+        if: always()
+        run: (cd terraform/examples/wire-server-deploy-offline-hetzner ; terraform init && terraform destroy -auto-approve)
+        env:
+          HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'

.github/workflows/deploy-wiab.yml

@@ -0,0 +1,37 @@
+name: Deploy on Hetzner WIAB setup
+on:
+  workflow_run:
+    workflows: ["Prepare custom offline package"]
+    types:
+      - completed
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: autodeploy-script
+      cancel-in-progress: false
+
+    steps:
+      # Step 1: Checkout the repository code
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      # Step 2: Set up SSH key for remote access
+      - name: Set up SSH key
+        uses: webfactory/ssh-agent@v0.5.3
+        with:
+          ssh-private-key: ${{ secrets.WIAB_PRIVATE_SSH_KEY }}
+
+      # Step 3: Get the latest commit SHA, for the artifact
+      - name: Get latest commit SHA
+        id: get_commit_sha
+        run: |
+          COMMIT_SHA=$(git rev-parse HEAD)
+          echo "commit_sha=$COMMIT_SHA" >> $GITHUB_ENV
+
+      # Step 4: Run the autodeploy script
+      - name: Run Auto Deploy Script
+        run: |
+          cd bin
+          ./autodeploy.sh --artifact-hash ${{ env.COMMIT_SHA }} --target-domain wiab-test-box.wire.link --force-redeploy

.github/workflows/lint.yml

@@ -0,0 +1,25 @@
+on:
+  push:
+    branches: [master, develop]
+  pull_request:
+    branches: [master, develop]
+jobs:
+  build:
+    name: build
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os:
+          - ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: true
+      - uses: cachix/install-nix-action@v27
+      - uses: cachix/cachix-action@v15
+        with:
+          name: wire-server
+          signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
+
+      - name: Lint
+        run: make shellcheck ENV="no-env"