A few issues with the secure self-signed setup (at least)

[georgiosd]

Hey guys

I started working with this collection to install 7.1 and got stuck because of the version on Debian, so I created this issue: https://issues.hibernatingrhinos.com/issue/RavenDB-25055/Ansible-fails-to-download-package-on-Debian

Alas, since cloning the repo and trying to fix this so I can get moving, I am noticing more things so I thought I'd start a conversation:

1. .deb is not provided for Debian, only Ubuntu. Are these compatible? What is the mapping? Ubuntu 24.04 is good with Debian 13? Also, is there any benefit in using the .deb instead of just the tar.bz2?

2. Cert file location seems to be hardcoded - I would have preferred to be able to specify the full path to the cert

3. In the scenario of using our own domain/cert, it seems we either need to provide a setup package (secured playbook) or a CA cert (self signed playbook). I would have expected it's possible to define the certificate alone and have the CA optional.

4. Version seems to require either "latest" or "x.y" but "x.y" will result to "x.y.0", making it impossible to install e.g. 7.1.2

[TheGoldenPlatypus]

Hey,

1. Debian vs Ubuntu packages
   You’re right: we currently ship .deb built for Ubuntu. Compatibility with Debian isn’t guaranteed.
   We debated using the tarball for non-Ubuntu Debian-based distros, but we’re leaning toward installing the correct .deb automatically based on a Debian <->Ubuntu mapping.
   the role will handle internally (no changes on your side).
   As a rule of thumb we’ll follow this mapping reference and document exactly what we support: https://askubuntu.com/questions/445487/what-debian-version-are-the-different-ubuntu-versions-based-on
   I'll notify you here once we get it sorted:
   RavenDB-25055: choose and install correct ubuntu deb package for debi… #18

UPDATE : we went for tarball installation for non-ubuntu distros

2. Self-signed certificate file path
   Agreed. The hardcoded path is only relevant in the self-signed flow and it’s too rigid. We’ll expose a variable for a full absolute path
   in general - the self-signed setup should be restructured: RavenDB-25059

3. Using your own domain/cert without a CA file
   Also agreed. The self-signed flow needs refinement. It should be possible to provide just the server certificate (PFX/PEM) and keep the CA optional. The CA should only be required where a client (e.g., our Ansible modules / Python client) needs to validate the chain. RavenDB-25059

4. Please ensure you run the correct play:

latest stable:

tasks: 
  - name: "Include ravendb_node"
    include_role:
		name: ravendb.ravendb.ravendb_node
    vars:
		ravendb_state: present
		ravendb_version: latest
		ravendb_version_minor: 7.1
		ravendb_release_channel: stable

latest nightly:

tasks: 
  - name: "Include ravendb_node"
    include_role:
		name: ravendb.ravendb.ravendb_node
    vars:
		ravendb_state: present
		ravendb_version: latest
		ravendb_version_minor: 7.1
		ravendb_release_channel: nightly

specific stable:

tasks: 
  - name: "Include ravendb_node"
    include_role:
      name: ravendb.ravendb.ravendb_node
    vars:
      ravendb_state: present
      ravendb_version: 7.1.1
      ravendb_release_channel: stable

specific nightly:

tasks: 
  - name: "Include ravendb_node"
    include_role:
      name: ravendb.ravendb.ravendb_node
    vars:
      ravendb_state: present
      ravendb_version: 7.1.3-nightly-20250905-1218
      ravendb_release_channel: nightly

[georgiosd]

Ok, gotcha, glad I'm on the right track :)

I ended up creating my own task for this which also supports a rolling upgrade and makes all the optimizations mentioned in the docs (file limits etc).

If it's of interest I can send you my version - unfortunately it will need adaptation to support all the existing features from your version and I don't currently have the time to make these adjustments myself.

[TheGoldenPlatypus]

Great, sounds aligned.

Quick question: did you implement the rolling upgrade with serial: 1 to avoid taking the whole cluster down, or do you have something more sophisticated? If it’s the latter, I’d love to see it.

FYI, we’re finalizing a ravendb.ravendb.healthcheck module focused on safe rolling updates, it should land in the next releases.
https://issues.hibernatingrhinos.com/issue/RavenDB-24939/Ansible-add-health-checks-when-version-upgrades-are-being-done

No worries about gaps or adaptations, share what you have as-is. The approach itself would be valuable.

Thanks!

[georgiosd]

@TheGoldenPlatypus yes, using serial: 1 - do you think that's an issue?

Are you on the RDB discord? probably easier to send you a zip file.