fix: Attempt to fix wss listener issue and ess_cert_issuer moved to defaults

Author: Alan Christie

ansible/roles/app/defaults/main.yaml

@@ -19,6 +19,9 @@ ess_ws_hostname: SetMe
 ess_ampq_url: SetMe
 # What image tag do you want to deploy?
 ess_image_tag: SetMe
+# SSL certificate issuer?
+# One of 'production', 'staging' or blank (for no SSL).
+ess_cert_issuer:
 
 # Required with defaults ---------------------------------------------------------------
 

ansible/roles/app/vars/main.yaml

@@ -7,9 +7,6 @@ ess_ingress_class: nginx
 # and typically have 'letsencrypt-nginx-staging'
 # and 'letsencrypt-nginx-production'
 ess_cert_manager_issuer_base: letsencrypt-{{ ess_ingress_class }}
-# SSL certificate issuer?
-# One of 'production', 'staging' or blank (for no SSL).
-ess_cert_issuer:
 
 # memcached image tag
 ess_memcached_tag: 1.6.39-alpine3.22

ws_listener.py

@@ -5,7 +5,9 @@
 """
 import argparse
 import json
+import ssl
 
+import certifi
 from simple_websocket import Client, ConnectionClosed
 
 
@@ -19,12 +21,20 @@ def main(c_args: argparse.Namespace):
     elif c_args.ordinal_offset:
         params = f"?stream_from_ordinal={c_args.ordinal_offset}"
 
+    # Compensate for observed CERTIFICATE_VERIFY_FAILED errors
+    # when using secure web-sockets
+    context = (
+        ssl.create_default_context(cafile=certifi.where())
+        if c_args.location.startswith("wss:")
+        else None
+    )
+
     total_bytes = 0
     total_messages = 0
     min_bytes = 1_000_000
     max_bytes = 0
     url = f"{c_args.location}{params}"
-    ws = Client.connect(url)
+    ws = Client.connect(url, ssl_context=context)
     try:
         while True: