antelope-cli 1.2.4 → 1.2.6

package/ansible/onboarding-ca/roles/onboard_ca/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 # Pinned published antelope-cli version that provides the `onboarding-ca` command.
-antelope_cli_version: "1.2.3"
+antelope_cli_version: "1.2.5"
 
 # Where web-client-area is cloned on the control node.
 work_dir: "/tmp/onboard-ca/web-client-area"
@@ -45,7 +45,7 @@ dest_branches: ""
 # Require a signed-in `op` CLI on the control node (op signin, or OP_SERVICE_ACCOUNT_TOKEN).
 # Service-account auth requires an explicit vault for `op item get` by name (op errors
 # with "a vault query must be provided" otherwise) — the items live in the DevOps vault.
-onepassword_vault: "DevOps"
+onepassword_vault: "jenkins"
 onepassword_bitbucket_item: "Bitbucket API - jenkins@xsites.co.il"
 onepassword_bitbucket_field: "credential"
 onepassword_consul_item: "New_Consul_Token"

package/ansible/onboarding-crm/Jenkinsfile

@@ -0,0 +1,211 @@
+// Self-service CRM onboarding — jenkins.xsites.xyz/job/self-service/job/onboarding/onboarding-crm
+//
+// Pipeline-as-Code (this file is the source of truth; the Jenkins job is just a
+// "Pipeline script from SCM" pointer at antelope-cli@master, path ansible/onboarding-crm/Jenkinsfile).
+//
+// Design (best practice, replacing the legacy freestyle+vault-pem+canRoam pattern):
+//  - ephemeral containerized agent via `agent { dockerfile }`: the pinned runner image
+//    (ansible, node/npx, op, git) is BUILT on the spot fleet from runner.Dockerfile — no
+//    registry/ECR needed. Runs on any agent (the whole fleet is docker-capable).
+//  - ONE secret: a 1Password service-account token (onepassword-service-account-token) —
+//    op fetches the bitbucket/consul/jira tokens from the `jenkins` vault (matches the role)
+//  - a Bitbucket SSH key (bitbucket-jenkins-ssh) for the git push to web-crm
+//  - parameters named exactly as the configs.ts fields, validated up front
+//  - DRY_RUN preview (generate + show configs.ts, no writes) + human approval before any push
+//
+// Provisioning prereqs:
+//  - fleet agents on the docker-enabled AMI (the whole fleet carries docker)
+//  - credential 'onepassword-service-account-token' : Secret text = OP_SERVICE_ACCOUNT_TOKEN
+//    (1Password service account, read-only on the `jenkins` vault)
+//  - credential 'bitbucket-jenkins-ssh'             : SSH key = jenkins Bitbucket push key
+//    (both folder-scoped to self-service/onboarding)
+
+pipeline {
+  agent {
+    dockerfile {
+      dir 'ansible/onboarding-crm'
+      filename 'runner.Dockerfile'
+      additionalBuildArgs '--pull'
+    }
+  }
+
+  options {
+    timestamps()
+    ansiColor('xterm')
+    disableConcurrentBuilds()
+    buildDiscarder(logRotator(numToKeepStr: '30'))
+  }
+
+  parameters {
+    // --- named exactly as configs.ts fields ---
+    string(name: 'brandAssetsFolder', defaultValue: '', trim: true,
+      description: 'Antelope ID (lowercase alphanumeric). configs.ts brandAssetsFolder / devBrandName / colorTheme / templateTheme / favicon all derive from this. e.g. uzumy')
+    string(name: 'title', defaultValue: '', trim: true,
+      description: 'Brand name. configs.ts title becomes "<title> CRM". e.g. Excelttra')
+    choice(name: 'type', choices: ['CORP_FL', 'IB_FL', 'CORP_AFF_FL'],
+      description: 'configs.ts type')
+    string(name: 'baseUrl', defaultValue: '', trim: true,
+      description: 'configs.ts baseUrl. e.g. https://apicrm.mteeks.com/SignalsCRM/')
+    string(name: 'affiliatesApiUrl', defaultValue: '', trim: true,
+      description: 'configs.ts affiliatesApiUrl (FE host). e.g. apife.excelttra.com')
+    booleanParam(name: 'isArcticBrand', defaultValue: false,
+      description: 'configs.ts isArcticBrand')
+    // --- onboarding inputs (not configs.ts fields) ---
+    string(name: 'languages', defaultValue: 'en', trim: true,
+      description: 'Comma-separated 2-letter language codes. e.g. en,ar')
+    string(name: 'logo_url', defaultValue: '', trim: true,
+      description: 'Logo URL. Must be https://logos-<brandAssetsFolder>.s3.eu-west-1.amazonaws.com/logo-<title>.<ext>. Blank => derived.')
+    string(name: 'favicon', defaultValue: '', trim: true,
+      description: 'Favicon URL (configs.ts favicon). Must be https://logos-<brandAssetsFolder>.s3.eu-west-1.amazonaws.com/favicon-<title>.<ext>. Blank => derived.')
+    string(name: 'jira_key_crm_branding', defaultValue: '', trim: true,
+      description: 'Jira key for the branding PRs. e.g. ATLP-47345')
+    // --- safety ---
+    booleanParam(name: 'DRY_RUN', defaultValue: true,
+      description: 'Preview only: generate + show configs.ts, NO branch push / PR / Consul / Jira write')
+  }
+
+  environment {
+    ANSIBLE_HOST_KEY_CHECKING = 'False'
+    ANSIBLE_FORCE_COLOR       = 'true'
+    WORK_DIR                  = '/tmp/onboard-crm/web-crm'
+    PLAYBOOK_DIR              = 'ansible/onboarding-crm'
+    // The dockerfile agent runs the container as the Jenkins UID, which has no home dir
+    // (HOME=/), so ansible (~/.ansible/tmp), npm (~/.npm) and git (~/.gitconfig) can't write
+    // their dotdirs. Point HOME at the writable, correctly-owned workspace.
+    HOME                      = "${env.WORKSPACE}"
+  }
+
+  stages {
+    stage('Validate parameters') {
+      steps {
+        script {
+          def CRM_TYPES = ['CORP_FL', 'IB_FL', 'CORP_AFF_FL']
+          def errs = []
+          def req  = { v, n -> if (!v?.trim()) errs << "${n} is required" }
+
+          req(params.brandAssetsFolder, 'brandAssetsFolder')
+          if (params.brandAssetsFolder && !(params.brandAssetsFolder ==~ /^[a-z0-9]+$/))
+            errs << "brandAssetsFolder must be lowercase alphanumeric (the Antelope ID); got '${params.brandAssetsFolder}'"
+
+          req(params.title, 'title')
+
+          if (!CRM_TYPES.contains(params.type))
+            errs << "type must be one of ${CRM_TYPES}; got '${params.type}'"
+
+          req(params.baseUrl, 'baseUrl')
+          if (params.baseUrl && !(params.baseUrl ==~ /^https:\/\/apicrm\.[^\/]+\/SignalsCRM\/$/))
+            errs << "baseUrl must look like https://apicrm.<domain>/SignalsCRM/ ; got '${params.baseUrl}'"
+
+          req(params.affiliatesApiUrl, 'affiliatesApiUrl')
+          if (params.affiliatesApiUrl && !(params.affiliatesApiUrl ==~ /^apife\.[a-z0-9.\-]+$/))
+            errs << "affiliatesApiUrl must look like apife.<ca-domain> (no scheme); got '${params.affiliatesApiUrl}'"
+
+          if (!(params.languages ==~ /^[a-z]{2}(,[a-z]{2})*$/))
+            errs << "languages must be comma-separated 2-letter codes; got '${params.languages}'"
+
+          // logo/favicon must follow logos-<antelope_id>/<kind>-<brand_name>.<ext> (when set; blank => derived)
+          def IMG_EXT = ['png', 'jpg', 'jpeg', 'svg', 'webp', 'ico', 'gif']
+          def checkImg = { url, kind ->
+            if (!url?.trim()) return null
+            def m = (url =~ /^https:\/\/logos-([a-z0-9]+)\.s3\.eu-west-1\.amazonaws\.com\/(logo|favicon)-(.+)\.([A-Za-z0-9]+)$/)
+            if (!m) return "${kind} must look like https://logos-<id>.s3.eu-west-1.amazonaws.com/${kind}-<brand>.<ext>; got '${url}'"
+            def (whole, bucketId, prefix, brand, ext) = m[0]
+            if (prefix != kind) return "${kind} filename must start with '${kind}-' (got '${prefix}-')"
+            if (bucketId != params.brandAssetsFolder) return "${kind} bucket must be logos-${params.brandAssetsFolder} (got logos-${bucketId})"
+            if (brand != params.title) return "${kind} filename brand must be '${params.title}' (got '${brand}')"
+            if (!IMG_EXT.contains(ext.toLowerCase())) return "${kind} extension '${ext}' not allowed (${IMG_EXT.join('/')})"
+            return null
+          }
+          [checkImg(params.logo_url, 'logo'), checkImg(params.favicon, 'favicon')].each { if (it) errs << it }
+
+          if (!(params.jira_key_crm_branding ==~ /^[A-Z][A-Z0-9]+-\d+$/))
+            errs << "jira_key_crm_branding must look like ATLP-12345; got '${params.jira_key_crm_branding}'"
+
+          if (errs) {
+            error("Parameter validation failed:\n  - " + errs.join("\n  - "))
+          }
+          echo "✅ Parameters valid — antelope_id=${params.brandAssetsFolder}, type=${params.type}, dry_run=${params.DRY_RUN}"
+          currentBuild.displayName = "#${env.BUILD_NUMBER} ${params.title}${params.DRY_RUN ? ' (dry-run)' : ''}"
+        }
+      }
+    }
+
+    stage('Onboard (dry-run preview)') {
+      when { expression { params.DRY_RUN } }
+      steps {
+        withCredentials([string(credentialsId: 'onepassword-service-account-token', variable: 'OP_SERVICE_ACCOUNT_TOKEN')]) {
+          sshagent(['bitbucket-jenkins-ssh']) {
+            sh label: 'ansible dry-run (no writes)', script: '''
+              cd "$PLAYBOOK_DIR"
+              ansible-playbook onboard-crm.yml \
+                -e antelope_id="$brandAssetsFolder" \
+                -e brand_name="$title" \
+                -e crm_type="$type" \
+                -e base_url="$baseUrl" \
+                -e affiliates_api_url="$affiliatesApiUrl" \
+                -e arctic_brand="$isArcticBrand" \
+                -e languages="$languages" \
+                ${logo_url:+-e logo_url=$logo_url} \
+                ${favicon:+-e favicon=$favicon} \
+                -e jira_key_crm_branding="$jira_key_crm_branding" \
+                -e dry_run=true \
+                < /dev/null
+            '''
+          }
+        }
+        script { archiveGeneratedConfigs() }
+      }
+    }
+
+    stage('Approve') {
+      when { expression { !params.DRY_RUN } }
+      steps {
+        script {
+          input message: "Open web-crm PR(s) + write Consul crm_env + stamp Jira for '${params.brandAssetsFolder}'?",
+                ok: 'Onboard'
+        }
+      }
+    }
+
+    stage('Onboard') {
+      when { expression { !params.DRY_RUN } }
+      steps {
+        withCredentials([string(credentialsId: 'onepassword-service-account-token', variable: 'OP_SERVICE_ACCOUNT_TOKEN')]) {
+          sshagent(['bitbucket-jenkins-ssh']) {
+            sh label: 'ansible onboard-crm', script: '''
+              cd "$PLAYBOOK_DIR"
+              ansible-playbook onboard-crm.yml \
+                -e antelope_id="$brandAssetsFolder" \
+                -e brand_name="$title" \
+                -e crm_type="$type" \
+                -e base_url="$baseUrl" \
+                -e affiliates_api_url="$affiliatesApiUrl" \
+                -e arctic_brand="$isArcticBrand" \
+                -e languages="$languages" \
+                ${logo_url:+-e logo_url=$logo_url} \
+                ${favicon:+-e favicon=$favicon} \
+                -e jira_key_crm_branding="$jira_key_crm_branding" \
+                < /dev/null
+            '''
+          }
+        }
+        script { archiveGeneratedConfigs() }
+      }
+    }
+  }
+
+  post {
+    always  { cleanWs() }
+    failure { echo 'Onboarding failed — see the validation/ansible output above.' }
+  }
+}
+
+// Archive the generated (gitignored) configs.ts so the operator can copy it into Consul.
+void archiveGeneratedConfigs() {
+  def cfg = "${env.WORK_DIR}/src/configs/configs.ts"
+  if (fileExists(cfg)) {
+    sh "mkdir -p out && cp '${cfg}' out/configs.ts"
+    archiveArtifacts artifacts: 'out/configs.ts', allowEmptyArchive: true
+    currentBuild.description = "configs.ts generated for ${params.brandAssetsFolder}"
+  }
+}

package/ansible/onboarding-crm/README.md

@@ -67,7 +67,7 @@ token with `$` — the shell would try to expand it and send an empty token.
 |-----|----------|---------|-------|
 | `antelope_id` | yes | `xyzxx` | Antelope ID → CLI `--brand_id`; keys every generated file + the branch name (normalized lowercase/no-spaces) |
 | `brand_name` | yes | `Zenith Horizon Group` | → CLI `--brand_name`, PR title, configs title |
-| `crm_type` | yes | `CORP_FL` | → CLI `--type`; one of `CORP_FL`, `IB_FL`, `CORP_AFF_FL`, `CORP_AFF_IB_PORTAL`, `CORP_AFF_MSQ` |
+| `crm_type` | yes | `CORP_FL` | → CLI `--type`; one of `CORP_FL`, `IB_FL`, `CORP_AFF_FL` |
 | `logo_url` | yes | *(url)* | → CLI `--logo_url` (black-background logo) |
 | `favicon_url` | yes | *(url)* | → CLI `--favicon_url` |
 | `languages` | yes | `en,ar` | → CLI `--languages`; CSV string **or** a YAML list (`[en, ar]`) |

package/ansible/onboarding-crm/onboard-crm.yml

@@ -44,14 +44,11 @@
       prompt: "Brand display name — recorded in BRAND_LOCATIONS.md / configs title (e.g. Zenith Horizon Group)"
       private: false
     - name: crm_type
-      prompt: "CRM type (one of: CORP_FL, IB_FL, CORP_AFF_FL, CORP_AFF_IB_PORTAL, CORP_AFF_MSQ)"
+      prompt: "CRM type (one of: CORP_FL, IB_FL, CORP_AFF_FL)"
       private: false
     - name: languages
       prompt: "Languages — 2-letter codes, comma-separated (e.g. en,ar)"
       private: false
-    - name: fcm_sender_id
-      prompt: "Firebase FCMSenderId"
-      private: false
     - name: jira_key_crm_branding
       prompt: "Jira key (e.g. ATLP-47067)"
       private: false

package/ansible/onboarding-crm/roles/onboard_crm/defaults/main.yml

@@ -1,36 +1,36 @@
 ---
 # Pinned published antelope-cli version that provides the `onboarding-crm` command.
-antelope_cli_version: "1.2.3"
+antelope_cli_version: "1.2.5"
 
 # Where web-crm is cloned on the control node.
 work_dir: "/tmp/onboard-crm/web-crm"
 
 # --- CRM brand inputs (map to the `onboarding-crm` CLI flags) ------------------------
-# antelope_id  => --brand_id  (Antelope unique ID / connectedBrandName; keys every file the CLI writes)
-# brand_name, languages, fcm_sender_id, crm_type are REQUIRED; logo_url/favicon_url/base_url derive.
-# color is optional (blank => the CLI's $corp palette).
-#
-# favicon_url and base_url default to the SAME derivations as the deployment config
-# (xsites-devops ansible-deployment-new/roles/consul/templates/crm.json.j2), so the values
-# match what gets seeded into Consul. They resolve from the brand vars (antelope_id,
-# brand_name, crm_server_url) in the create_brand context; the standalone playbook's prompts
-# override them. crm_type is a per-brand value (not defaulted anywhere — set it in brand_vars
-# or -e). logo_url has no derivation in that template — must be provided explicitly.
+# antelope_id => --brand_id (connectedBrandName; keys theme/folder/devBrandName/favicon in configs.ts).
+# REQUIRED: antelope_id, brand_name, crm_type, logo_url, languages. base_url + affiliates_api_url
+# derive from the brand vars in create_brand; pass -e for a standalone run. configs.ts favicon is
+# DERIVED by the CLI (logos-<id>/favicon-<name>.png) and FCMSenderId is always '' (both placeholders).
 antelope_id: ""
-color: ""                                   # --color   hex, e.g. "#1a2b3c"; blank => default palette
-logo_url: "https://logos-{{ antelope_id }}.s3.eu-west-1.amazonaws.com/logo-{{ brand_name }}.png"   # derived like favicon_url; override with -e
+color: ""                                   # --color hex; blank => default palette
+logo_url: "https://logos-{{ antelope_id }}.s3.eu-west-1.amazonaws.com/logo-{{ brand_name }}.png"   # brand-logos.json entry; override with -e
+favicon: "https://logos-{{ antelope_id }}.s3.eu-west-1.amazonaws.com/favicon-{{ brand_name }}.png"  # --favicon => configs.ts favicon; blank => CLI derives the same
 languages: ""                               # --languages: CSV "en,ar" or a YAML list [en, ar]
-fcm_sender_id: ""                           # --fcm_sender_id (Firebase) — blank in crm.json.j2 but the CLI requires it
-crm_type: ""                                # --type: one of allowed_crm_types below (per-brand; set in brand_vars)
-favicon_url: "https://logos-{{ antelope_id }}.s3.eu-west-1.amazonaws.com/favicon-{{ brand_name }}.png"
+crm_type: ""                                # --type: one of allowed_crm_types (per-brand; from group_vars derivation)
+# baseUrl uses the BE/CRM domain; affiliatesApiUrl uses the FE/CA domain (fe_server_url_list.0).
 base_url: "{{ ('https://' ~ crm_server_url ~ '/SignalsCRM/') if (crm_server_url | default('') | length > 0) else '' }}"
+affiliates_api_url: "{{ fe_server_url_list.0 | default('') }}"
+arctic_brand: false                          # --arctic_brand => configs.ts isArcticBrand
+# Consul KV key the generated configs.ts is PUT to (the env CRM config). Needs a consul_token
+# with write on this path. brand_name = the Consul namespace segment (e.g. Antelope/excelttra/crm_env).
+crm_env_consul_key: "Antelope/{{ brand_name }}/crm_env"
+manage_consul_crm_env: true
+# Preview mode: clone + generate configs.ts/brand-logos but SKIP commit/push/PR/Jira/Consul writes.
+dry_run: false
 # Kept in sync with ALLOWED_TYPES in antelope-cli/onboarding-crm/index.js.
 allowed_crm_types:
   - CORP_FL
   - IB_FL
   - CORP_AFF_FL
-  - CORP_AFF_IB_PORTAL
-  - CORP_AFF_MSQ
 
 # Reviewers for the PR. Empty => auto-fetched from the repo's Bitbucket "Default reviewers"
 # config (the authenticating account is excluded automatically). Override with an explicit
@@ -67,7 +67,7 @@ dest_branches: ""
 # Require a signed-in `op` CLI on the control node (op signin, or OP_SERVICE_ACCOUNT_TOKEN).
 # Service-account auth requires an explicit vault for `op item get` by name (op errors
 # with "a vault query must be provided" otherwise) — the items live in the DevOps vault.
-onepassword_vault: "DevOps"
+onepassword_vault: "jenkins"
 onepassword_bitbucket_item: "Bitbucket API - jenkins@xsites.co.il"
 onepassword_bitbucket_field: "credential"
 onepassword_consul_item: "New_Consul_Token"

package/ansible/onboarding-crm/roles/onboard_crm/tasks/main.yml

@@ -75,16 +75,13 @@
       - brand_name is defined and (brand_name | length) > 0
       - jira_key_crm_branding is defined and (jira_key_crm_branding | length) > 0
       - logo_url is defined and (logo_url | length) > 0
-      - favicon_url is defined and (favicon_url | length) > 0
       - languages is defined and (languages | length) > 0
-      - fcm_sender_id is defined and (fcm_sender_id | length) > 0
       - crm_type is defined and (crm_type | length) > 0
       - crm_type in allowed_crm_types
       - bitbucket_token is defined and (bitbucket_token | length) > 0
       - bitbucket_email is defined and (bitbucket_email | length) > 0
     fail_msg: >-
-      Required: antelope_id, brand_name, jira_key_crm_branding, logo_url, favicon_url, languages,
-      fcm_sender_id, crm_type (one of {{ allowed_crm_types | join(', ') }}), bitbucket_email.
+      Required: antelope_id, brand_name, jira_key_crm_branding, logo_url, languages, crm_type (one of {{ allowed_crm_types | join(', ') }}), bitbucket_email.
       bitbucket_token must be provided (via --extra-vars / prompt) or resolvable from 1Password
       item '{{ onepassword_bitbucket_item }}' field '{{ onepassword_bitbucket_field }}' (op signin).
 
@@ -153,7 +150,7 @@
 # Fix Version, so stamp the release version (V<version/prod>) on the ticket BEFORE the
 # branches are pushed. Non-fatal — a missing token / unmatched version warns and skips.
 - name: Set the Jira Fix Version on the branding ticket
-  when: manage_jira_fix_version | bool
+  when: manage_jira_fix_version | bool and not (dry_run | default(false) | bool)
   block:
     - name: Fetch the Jira token from 1Password
       when: (jira_token | default('') | length) == 0
@@ -322,3 +319,40 @@
 - name: Summary of pull requests
   ansible.builtin.debug:
     msg: "{{ pr_results | default([]) }}"
+
+# --- Consul: publish the generated configs.ts to the brand's crm_env KV --------------
+# configs.ts is gitignored (not committed) — it is the env's CRM config, so push it to Consul
+# (Antelope/<brand>/crm_env) in addition to the PR body. Non-fatal: warns if the token lacks write.
+- name: Read generated configs.ts for Consul crm_env
+  when: manage_consul_crm_env | default(true) | bool
+  ansible.builtin.slurp:
+    src: "{{ work_dir }}/src/configs/configs.ts"
+  register: crm_configs_ts_final
+  failed_when: false
+
+- name: Update Consul crm_env with the generated configs.ts
+  when:
+    - manage_consul_crm_env | default(true) | bool
+    - crm_configs_ts_final is not skipped
+    - (crm_configs_ts_final.content | default('') | length) > 0
+    - (consul_token | default('') | length) > 0
+    - not (dry_run | default(false) | bool)
+  ansible.builtin.uri:
+    url: "{{ consul_url }}/v1/kv/{{ crm_env_consul_key }}"
+    method: PUT
+    headers:
+      X-Consul-Token: "{{ consul_token }}"
+    body: "{{ crm_configs_ts_final.content | b64decode }}"
+    status_code: [200]
+  register: consul_crm_env_put
+  failed_when: false
+  no_log: false
+
+- name: Confirm the Consul crm_env update
+  when: manage_consul_crm_env | default(true) | bool and (consul_crm_env_put is defined)
+  ansible.builtin.debug:
+    msg: >-
+      {{ 'Updated Consul ' ~ crm_env_consul_key
+         if (consul_crm_env_put.status | default(0)) == 200
+         else 'Consul crm_env NOT updated (HTTP ' ~ (consul_crm_env_put.status | default('n/a'))
+              ~ ') - token may lack write on ' ~ crm_env_consul_key }}

package/ansible/onboarding-crm/roles/onboard_crm/tasks/per_branch.yml

@@ -48,17 +48,35 @@
           '--brand_id', antelope_id_norm,
           '--brand_name', brand_name,
           '--logo_url', logo_url,
-          '--favicon_url', favicon_url,
           '--languages', languages_csv,
-          '--fcm_sender_id', (fcm_sender_id | string),
-          '--type', crm_type]
+          '--type', crm_type,
+          '--affiliates_api_url', affiliates_api_url,
+          '--arctic_brand', (arctic_brand | default(false) | string | lower)]
          + (['--color', color] if (color | default('') | length) > 0 else [])
-         + (['--base_url', base_url] if (base_url | default('') | length) > 0 else []) }}
+         + (['--base_url', base_url] if (base_url | default('') | length) > 0 else [])
+         + (['--favicon', favicon] if (favicon | default('') | length) > 0 else []) }}
     chdir: "{{ work_dir }}"
   environment:
     CI: "true"
   changed_when: true
 
+- name: "[{{ dest_branch }}] Read generated configs.ts (gitignored) for the PR body / Consul"
+  ansible.builtin.slurp:
+    src: "{{ work_dir }}/src/configs/configs.ts"
+  register: crm_configs_ts
+  failed_when: false
+
+- name: "[{{ dest_branch }}] Compose PR description (ticket + configs.ts for Consul copy-paste)"
+  ansible.builtin.set_fact:
+    pr_description: |-
+      {{ jira_key_crm_branding }}: On-Boarding {{ brand_name }} CRM Branding
+
+      configs.ts — copy into Consul `{{ crm_env_consul_key }}`:
+
+      ```ts
+      {{ crm_configs_ts.content | default('') | b64decode }}
+      ```
+
 - name: "[{{ dest_branch }}] Stage changes"
   ansible.builtin.command:
     cmd: git add -A
@@ -79,15 +97,20 @@
       git -c user.name="{{ git_user_name }}" -c user.email="{{ git_user_email }}"
       commit -m "{{ jira_key_crm_branding }}: On-Boarding {{ brand_name }} CRM Branding"
     chdir: "{{ work_dir }}"
-  when: staged.rc == 1
+  when:
+    - staged.rc == 1
+    - not (dry_run | default(false) | bool)
 
 - name: "[{{ dest_branch }}] Push source branch"
   ansible.builtin.command:
     cmd: "git push -u origin {{ source_branch }}"
     chdir: "{{ work_dir }}"
-  when: staged.rc == 1
+  when:
+    - staged.rc == 1
+    - not (dry_run | default(false) | bool)
 
 - name: "[{{ dest_branch }}] Open pull request"
+  when: not (dry_run | default(false) | bool)
   ansible.builtin.uri:
     url: "{{ api_base }}/repositories/{{ workspace }}/{{ repo_slug }}/pullrequests"
     method: POST
@@ -97,7 +120,7 @@
     body_format: json
     body:
       title: "{{ jira_key_crm_branding }}: On-Boarding {{ brand_name }} CRM Branding"
-      description: "{{ jira_key_crm_branding }}: On-Boarding {{ brand_name }} CRM Branding"
+      description: "{{ pr_description }}"
       source:
         branch:
           name: "{{ source_branch }}"
@@ -111,6 +134,7 @@
   register: pr_response
 
 - name: "[{{ dest_branch }}] Record PR result"
+  when: not (dry_run | default(false) | bool)
   ansible.builtin.set_fact:
     pr_results: >-
       {{ (pr_results | default([])) + [{

package/ansible/onboarding-crm/runner.Dockerfile

@@ -0,0 +1,47 @@
+# Onboarding runner image for the self-service/onboarding/onboarding-crm Jenkins pipeline.
+# Built on the fly by the declarative `agent { dockerfile { … } }` on a docker-capable fleet
+# agent (no registry/ECR). Bakes in the pinned toolchain the onboard_crm role needs:
+# ansible + community.general, node/npx (for `npx antelope-cli`), git + ssh (push to web-crm),
+# and the 1Password CLI (op, reads the bitbucket/consul/jira tokens from the `jenkins` vault
+# via the OP_SERVICE_ACCOUNT_TOKEN Jenkins credential).
+FROM python:3.12-slim
+
+ARG ANSIBLE_VERSION=10.3.0
+ARG OP_VERSION=2.31.1
+ARG NODE_MAJOR=20
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      git openssh-client curl ca-certificates gnupg unzip jq \
+ && rm -rf /var/lib/apt/lists/*
+
+# Node.js — provides npx for `npx antelope-cli@<ver> onboarding-crm`
+RUN curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - \
+ && apt-get update && apt-get install -y --no-install-recommends nodejs \
+ && rm -rf /var/lib/apt/lists/*
+
+# Ansible + community.general (dict_kv filter used by the role)
+RUN pip install --no-cache-dir "ansible==${ANSIBLE_VERSION}" \
+ && ansible-galaxy collection install community.general
+
+# 1Password CLI (op)
+RUN curl -fsSL "https://cache.agilebits.com/dist/1P/op2/pkg/v${OP_VERSION}/op_linux_amd64_v${OP_VERSION}.zip" -o /tmp/op.zip \
+ && unzip -o /tmp/op.zip op -d /usr/local/bin/ && rm -f /tmp/op.zip && chmod +x /usr/local/bin/op
+
+# AWS CLI v2 — used by the onboarding-logos pipeline to upload logo/favicon to the brand's
+# logos-<antelope_id> S3 bucket (creds fetched from the brand's Consul folder at runtime).
+RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip \
+ && unzip -q /tmp/awscliv2.zip -d /tmp && /tmp/aws/install && rm -rf /tmp/aws /tmp/awscliv2.zip
+
+# Pre-trust Bitbucket's host key so `git push` over SSH is non-interactive
+RUN mkdir -p /etc/ssh && ssh-keyscan bitbucket.org >> /etc/ssh/ssh_known_hosts 2>/dev/null || true
+
+# Jenkins runs this container as `-u 1000:1000`. `op` (and other tools) resolve "the current
+# user" via getpwuid(); with no /etc/passwd entry for uid 1000 it fails with
+# 'couldn't start daemon … not owned by the current user' and never enters service-account
+# mode. Bake a uid/gid 1000 user so getpwuid succeeds. Also make /etc/passwd group-writable
+# (root group) so a differently-numbered agent uid can self-register if ever needed.
+RUN groupadd -g 1000 jenkins 2>/dev/null || true \
+ && useradd -u 1000 -g 1000 -m -d /home/jenkins -s /bin/bash jenkins 2>/dev/null || true \
+ && chmod g+w /etc/passwd
+
+WORKDIR /work

package/ansible/onboarding-logos/Jenkinsfile

@@ -0,0 +1,105 @@
+// Self-service logo/favicon upload — jenkins.xsites.xyz/job/self-service/job/onboarding/job/onboarding-logos
+//
+// Pipeline-as-Code (this file is the source of truth; the Jenkins job is a "Pipeline script from SCM"
+// pointer at antelope-cli@master, path ansible/onboarding-logos/Jenkinsfile).
+//
+// Flow: operator uploads the logo + favicon image files -> the pipeline reads the brand's AWS creds
+// from its Consul folder (Antelope/<brand_name>/AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_DEFAULT_REGION)
+// -> uploads them to the brand's S3 bucket logos-<antelope_id> as logo-<brand_name>.<ext> /
+// favicon-<brand_name>.<ext> (the exact objects configs.ts / brand-logos.json reference).
+//
+// Reuses the onboarding-crm runner image (op + curl + jq + aws + uid-1000 user). Requires the
+// file-parameters plugin (base64File) and the onepassword-service-account-token credential
+// (op reads the Consul token from the `jenkins` vault).
+pipeline {
+  agent {
+    dockerfile {
+      dir 'ansible/onboarding-crm'
+      filename 'runner.Dockerfile'
+      additionalBuildArgs '--pull'
+    }
+  }
+
+  options {
+    timestamps()
+    ansiColor('xterm')
+    disableConcurrentBuilds()
+    buildDiscarder(logRotator(numToKeepStr: '30'))
+  }
+
+  parameters {
+    string(name: 'brandAssetsFolder', defaultValue: '', trim: true,
+      description: 'Antelope ID (lowercase alphanumeric). Target bucket = logos-<brandAssetsFolder>. e.g. uzumy')
+    string(name: 'brand_name', defaultValue: '', trim: true,
+      description: 'Brand name — the Consul folder Antelope/<brand_name>/ AND the filename token logo-<brand_name>/favicon-<brand_name>. e.g. excelttra')
+    base64File(name: 'logo_file', description: 'Logo image file (uploaded → logo-<brand_name>.<logo_type>)')
+    base64File(name: 'favicon_file', description: 'Favicon image file (uploaded → favicon-<brand_name>.<favicon_type>)')
+    choice(name: 'logo_type', choices: ['png', 'jpg', 'jpeg', 'svg', 'webp', 'gif'], description: 'Logo file extension')
+    choice(name: 'favicon_type', choices: ['png', 'ico', 'jpg', 'jpeg', 'svg', 'webp'], description: 'Favicon file extension')
+    booleanParam(name: 'DRY_RUN', defaultValue: true,
+      description: 'Preview only: resolve creds + validate + aws s3 cp --dryrun (no actual upload)')
+  }
+
+  environment {
+    HOME       = "${env.WORKSPACE}"
+    CONSUL_URL = 'https://consul.xsites.xyz'
+  }
+
+  stages {
+    stage('Validate parameters') {
+      steps {
+        script {
+          def IMG_EXT = ['png', 'jpg', 'jpeg', 'svg', 'webp', 'ico', 'gif']
+          def errs = []
+          if (!(params.brandAssetsFolder ==~ /^[a-z0-9]+$/))
+            errs << "brandAssetsFolder must be lowercase alphanumeric (the Antelope ID); got '${params.brandAssetsFolder}'"
+          // brand_name must be filename-safe so logo-<brand_name>.<ext> / favicon-<brand_name>.<ext> are valid keys
+          if (!(params.brand_name ==~ /^[A-Za-z0-9._-]+$/))
+            errs << "brand_name must be filename-safe (letters/digits/._-, no spaces); got '${params.brand_name}'"
+          if (!IMG_EXT.contains(params.logo_type)) errs << "logo_type '${params.logo_type}' not allowed"
+          if (!IMG_EXT.contains(params.favicon_type)) errs << "favicon_type '${params.favicon_type}' not allowed"
+          if (errs) error("Parameter validation failed:\n  - " + errs.join("\n  - "))
+          env.LOGO_KEY    = "logo-${params.brand_name}.${params.logo_type}"
+          env.FAVICON_KEY = "favicon-${params.brand_name}.${params.favicon_type}"
+          echo "✅ Valid — bucket=logos-${params.brandAssetsFolder}, ${env.LOGO_KEY}, ${env.FAVICON_KEY}, dry_run=${params.DRY_RUN}"
+          currentBuild.displayName = "#${env.BUILD_NUMBER} ${params.brand_name}${params.DRY_RUN ? ' (dry-run)' : ''}"
+        }
+      }
+    }
+
+    stage('Upload to S3') {
+      steps {
+        withCredentials([string(credentialsId: 'onepassword-service-account-token', variable: 'OP_SERVICE_ACCOUNT_TOKEN')]) {
+          withFileParameter('logo_file') {
+            withFileParameter('favicon_file') {
+              sh label: 'resolve Consul AWS creds + upload', script: '''
+                set -eu
+                CT=$(op read "op://jenkins/New_Consul_Token/password")
+                base="$CONSUL_URL/v1/kv/Antelope/$brand_name"
+                AWS_ACCESS_KEY_ID=$(curl -sf -H "X-Consul-Token: $CT" "$base/AWS_ACCESS_KEY_ID?raw")
+                AWS_SECRET_ACCESS_KEY=$(curl -sf -H "X-Consul-Token: $CT" "$base/AWS_SECRET_ACCESS_KEY?raw")
+                AWS_DEFAULT_REGION=$(curl -sf -H "X-Consul-Token: $CT" "$base/AWS_DEFAULT_REGION?raw" || echo eu-west-1)
+                export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGION
+                if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
+                  echo "ERROR: no AWS creds under Consul Antelope/$brand_name/ (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY)"; exit 1
+                fi
+                ct() { case "$1" in png) echo image/png;; jpg|jpeg) echo image/jpeg;; svg) echo image/svg+xml;; webp) echo image/webp;; gif) echo image/gif;; ico) echo image/x-icon;; *) echo application/octet-stream;; esac; }
+                DRY=""; [ "$DRY_RUN" = "true" ] && DRY="--dryrun"
+                echo "Uploading to s3://logos-$brandAssetsFolder/ (region $AWS_DEFAULT_REGION)${DRY:+  [DRY-RUN]}"
+                aws s3 cp "$logo_file"    "s3://logos-$brandAssetsFolder/$LOGO_KEY"    --content-type "$(ct $logo_type)"    $DRY
+                aws s3 cp "$favicon_file" "s3://logos-$brandAssetsFolder/$FAVICON_KEY" --content-type "$(ct $favicon_type)" $DRY
+                echo "Done: $LOGO_KEY, $FAVICON_KEY"
+              '''
+            }
+          }
+        }
+      }
+    }
+  }
+
+  post {
+    always  { cleanWs() }
+    success { echo "logos ${params.DRY_RUN ? 'previewed' : 'uploaded'} to logos-${params.brandAssetsFolder}: ${env.LOGO_KEY}, ${env.FAVICON_KEY}" }
+    failure { echo 'Logo upload failed — see the validation/aws output above.' }
+  }
+}

package/onboarding-crm/brand.js

@@ -5,10 +5,11 @@ let brand = {
   color: '',
   logo: '',
   languages: null,
-  favicon: '',
-  FCMSenderId: '',
+  affiliatesApiUrl: '',
+  isArcticBrand: false,
   type: '',
-  baseUrl: ''
+  baseUrl: '',
+  favicon: ''
 };
 
 function updateBrand(updatedBrand) {

package/onboarding-crm/createConfig.js

@@ -21,20 +21,27 @@ function start() {
 
 const updateConfigFile = () => {
   const brand = brandModule.getBrand();
+  const id = brand.connectedBrandName;
   return `export const configs: WebCrmConfig = {
-    baseUrl: '${brand.baseUrl}',
-    appId: 0,
-    type: '${brand.type}',
-    defaultLanguage: 'en',
-    gaTrackingID: 'UA-70456753-2',
-    colorTheme: 'theme-${brand.connectedBrandName}',
-    templateTheme: 'theme-template-${brand.connectedBrandName}',
-    title: '${brand.brandName}',
-    favicon: '${brand.favicon}',
-    logo: '${brand.logo}',
-    FCMSenderId: '${brand.FCMSenderId}',
-    brandAssetsFolder: '${brand.connectedBrandName}'
-  };`;
+  baseUrl: '${brand.baseUrl}',
+  affiliatesApiUrl: '${brand.affiliatesApiUrl}',
+  appId: 0,
+  type: '${brand.type}',
+  title: '${brand.brandName} CRM',
+  colorTheme: 'theme-${id}',
+  templateTheme: 'theme-template-${id}',
+  brandAssetsFolder: '${id}',
+  devBrandName: '${id}',
+  favicon: '${brand.favicon || `https://logos-${id}.s3.eu-west-1.amazonaws.com/favicon-${brand.brandName}.png`}',
+  gaTrackingID: 'UA-70456753-2',
+  FCMSenderId: '',
+  isFnsStatusActive: true,
+  showTradingInfo: true,
+  CrmAvailableCurrencies: ['USD'],
+  showNewClientCard: true,
+  newAppSubdomain: 'ant-crm',
+  isArcticBrand: ${brand.isArcticBrand ? 'true' : 'false'}
+};`;
 };
 
 module.exports = { start };

package/onboarding-crm/index.js

@@ -8,7 +8,7 @@ const createConfig = require('./createConfig.js');
 const brandLogos = require('./brandLogos.js');
 const brandLocations = require('./brandLocations.js');
 
-const ALLOWED_TYPES = ['CORP_FL', 'IB_FL', 'CORP_AFF_FL', 'CORP_AFF_IB_PORTAL', 'CORP_AFF_MSQ'];
+const ALLOWED_TYPES = ['CORP_FL', 'IB_FL', 'CORP_AFF_FL'];
 const DEFAULT_BASE_URL = 'https://dev-apicrm.antelopesystem.com/SignalsCRM/';
 
 const HELP = `
@@ -29,10 +29,15 @@ Options:
   --color <hex>         Brand hex color, e.g. "#1a2b3c". Empty => default palette ($corp)
   --logo_url <url>      Logo image URL (black background) (required)
   --languages <csv>     2-letter language codes, comma-separated, e.g. "en,ar" (required)
-  --favicon_url <url>   Favicon image URL → configs.ts favicon (required)
-  --fcm_sender_id <id>  Firebase FCMSenderId → configs.ts (required)
+  --affiliates_api_url  configs.ts affiliatesApiUrl — the FE host, e.g. "apife.<ca-domain>"
+                        (apife.excelttra.com). Not derivable from base_url (that's the BE domain).
+  --arctic_brand <t|f>  configs.ts isArcticBrand. Default: false
   --type <type>         One of: ${ALLOWED_TYPES.join(', ')} → configs.ts (required)
   --base_url <url>      configs.ts baseUrl. Default: ${DEFAULT_BASE_URL}
+  --favicon <url>       configs.ts favicon. Empty => derived (logos-<id>/favicon-<name>.png)
+
+Note: --favicon defaults to the derived logos-<id>/favicon-<name>.png; FCMSenderId is always '';
+both are placeholders that get hand-edited per brand. configs.ts is gitignored (Consul copy-paste).
   -h, --help            Show this help
 
 Run from the root of a web-crm checkout — files are written relative to the current directory.
@@ -44,10 +49,11 @@ const FLAGS = {
   '--color': 'color',
   '--logo_url': 'logo',
   '--languages': 'languages',
-  '--favicon_url': 'favicon',
-  '--fcm_sender_id': 'fcmSenderId',
+  '--affiliates_api_url': 'affiliatesApiUrl',
+  '--arctic_brand': 'arcticBrand',
   '--type': 'type',
-  '--base_url': 'baseUrl'
+  '--base_url': 'baseUrl',
+  '--favicon': 'favicon'
 };
 
 function parseArgs(argv) {
@@ -97,9 +103,7 @@ async function run() {
       : (interactive ? await ask(rl, `Please set a color for "${connectedBrandName}", use hex value, leave empty for default.\n`) : '');
 
     const logo = await resolve(opts, 'logo', 'Please enter the URL to the logo image suitable for a black background:\n', interactive, rl);
-    const favicon = await resolve(opts, 'favicon', 'Please provide the url to your favicon image:\n', interactive, rl);
     const languagesInput = await resolve(opts, 'languages', 'Enter the languages (2-letter codes) separated by commas:\n', interactive, rl);
-    const fcmSenderId = await resolve(opts, 'fcmSenderId', 'Enter the FCMSenderId value (see https://xsites.atlassian.net/wiki/spaces/IKB/pages/777650347/Onboarding+Branding+Manual+for+devs#Firebase): ', interactive, rl);
     const typeInput = await resolve(opts, 'type', `Enter the type value (allowed values: ${ALLOWED_TYPES.join(', ')}): `, interactive, rl);
 
     // baseUrl is optional (defaults to the dev URL).
@@ -107,14 +111,20 @@ async function run() {
       ? opts.baseUrl
       : (interactive ? (await ask(rl, `Enter the configs.ts baseUrl (leave empty for ${DEFAULT_BASE_URL}):\n`)) || DEFAULT_BASE_URL : DEFAULT_BASE_URL);
 
+    // affiliatesApiUrl (FE host, e.g. apife.<ca-domain>) → configs.ts. Explicit input; NOT
+    // derivable from baseUrl (baseUrl is the BE/CRM domain). configs.ts favicon is derived
+    // from the id + brand_name; FCMSenderId is always ''. isArcticBrand defaults false.
+    const affiliatesApiUrl = opts.affiliatesApiUrl || '';
+    const isArcticBrand = String(opts.arcticBrand).toLowerCase() === 'true';
+    // favicon: explicit override, else createConfig derives logos-<id>/favicon-<name>.png
+    const favicon = opts.favicon || '';
+
     // Validate required fields.
     const missing = [];
     if (!connectedBrandName) missing.push('--brand_id');
     if (!brandName) missing.push('--brand_name');
     if (!logo) missing.push('--logo_url');
-    if (!favicon) missing.push('--favicon_url');
     if (!languagesInput) missing.push('--languages');
-    if (!fcmSenderId) missing.push('--fcm_sender_id');
     if (!typeInput) missing.push('--type');
     if (missing.length) {
       console.error(chalk.red(`Error: missing required value(s): ${missing.join(', ')}`));
@@ -144,10 +154,11 @@ async function run() {
       color: color || '',
       logo,
       languages,
-      favicon,
-      FCMSenderId: fcmSenderId,
+      affiliatesApiUrl,
+      isArcticBrand,
       type,
-      baseUrl
+      baseUrl,
+      favicon
     });
 
     console.log(chalk.bold(chalk.yellow(`\nOnboarding "${brandName}" (id: ${connectedBrandName})`)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "antelope-cli",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "CLI-Tool for automating processes for Antelope-Systems ",
   "main": "index.js",
   "bin": {