The mobileapps service is currently running in the Beta Cluster on the [[ https://openstack-browser.toolforge.org/server/deployment-mcs01.deployment-prep.eqiad1.wikimedia.cloud | deployment-mcs01 ]] instance. We should create a new instance, using the `role::beta::docker_services` Puppet role, to host the Dockerized service using images from the deployment pipeline. The configuration will be similar to that used on [[ https://openstack-browser.toolforge.org/server/deployment-push-notifications01.deployment-prep.eqiad1.wikimedia.cloud | deployment-push-notifications01 ]].
To reduce confusion and match the configuration on k8s, I would suggest updating the naming convention to use the technical service name 'mobileapps' rather than the informal 'pcs', making this new instance deployment-mobileapps01 (or, for additional clarity, deployment-docker-mobileapps01).
**AC**
[x] Create new instance deployment-mobileapps01 (or deployment-docker-mobileapps01) from the latest Debian Buster image
[x] Update the Puppet SSL cert to get Puppet running successfully with the Beta Cluster puppetmaster (see P7162 for an example of the procedure)
[x] Add required hiera config, including the service configuration
[x] Apply the `role::beta::docker_services` and ensure Puppet still runs successfully
[x] Verify that the service is correctly serving internal requests
[x] Create a security group (if needed) to expose the service port (8888) to incoming traffic, and apply it to deployment-[docker-]mobileapps01
[] Migrate any existing references to deployment-mcs01 to deployment-[docker-]mobileapps01
[] Create a web proxy from mobileapps-beta.wmflabs.org to port 8888 on deployment-[docker-]mobileapps01
[] Ensure that mobileapps-beta.wmflabs.org correctly serves external requests
[] Destroy deployment-mcs01