Wire server 5.27 by sghosh23 · Pull Request #876 · wireapp/wire-server-deploy

sghosh23 · 2026-03-09T09:12:34Z

Change type

Fix
Feature
Documentation
Security / Upgrade

Basic information

THIS CHANGE REQUIRES A DEPLOYMENT PACKAGE RELEASE
THIS CHANGE REQUIRES A WIRE-DOCS RELEASE

Testing

I ran/applied the changes myself, in a test environment.
The CI job attached to this repo will test it for me.

Offline Build CI (label-based)

Add one or more labels to trigger offline builds:

build-default - Full production build (ansible, terraform, all packages)
build-demo - Demo/WIAB build
build-wiab-staging - WIAB-staging build
build-min - Minimal build (fastest, essential charts only)
build-all - Run all three builds

Note: No builds run by default. Add a label to trigger CI.

Tracking

I added a new entry in an appropriate subdirectory of changelog.d
I mentioned this PR in Jira, OR I mentioned the Jira ticket in this PR.
I mentioned this PR in one of the issues attached to one of our repositories.

Knowledge Transfer

An Asciinema session is attached to the Jira ticket.

Motivation

Objective

Reason

Use case

Wire Server: 5.27.0 Changed charts: - account-pages: 0.9.0-pre.1 → 0.9.0-pre.49 - sftd: 0.130.0 → 0.135.0 - wire-server: 5.23.0 → 5.27.0 - redis-ephemeral: 5.23.0 → 5.27.0 - rabbitmq: 5.23.0 → 5.27.0 - rabbitmq-external: 5.23.0 → 5.27.0 - databases-ephemeral: 5.23.0 → 5.27.0 - fake-aws: 5.23.0 → 5.27.0 - fake-aws-s3: 5.23.0 → 5.27.0 - fake-aws-sqs: 5.23.0 → 5.27.0 - aws-ingress: 5.23.0 → 5.27.0 - fluent-bit: 5.23.0 → 5.27.0 - kibana: 5.23.0 → 5.27.0 - backoffice: 5.23.0 → 5.27.0 - calling-test: 5.23.0 → 5.27.0 - demo-smtp: 5.23.0 → 5.27.0 - elasticsearch-curator: 5.23.0 → 5.27.0 - elasticsearch-external: 5.23.0 → 5.27.0 - elasticsearch-ephemeral: 5.23.0 → 5.27.0 - minio-external: 5.23.0 → 5.27.0 - cassandra-external: 5.23.0 → 5.27.0 - ingress-nginx-controller: 5.23.0 → 5.27.0 - nginx-ingress-services: 5.23.0 → 5.27.0 - reaper: 5.23.0 → 5.27.0 - restund: 5.23.0 → 5.27.0 - coturn: 4.6.2-federation-wireapp.43 → 4.6.2-federation-wireapp.47 - k8ssandra-test-cluster: 5.23.0 → 5.27.0 - webapp: 0.8.0-pre.1876 → 0.8.0-pre.2142 - ldap-scim-bridge: 5.23.0 → 5.27.0 - k8ssandra-operator: 1.16.0 → 1.18.0 - step-certificates: 1.25.0 → 1.28.6 - wire-server-enterprise: 5.23.0 → 5.27.0 Build: https://raw.githubusercontent.com/wireapp/wire-builds/ecd204f07540e79fc1febe2483a42111129a5d0d/build.json

…loy into wire-server-5.27

sghosh23 · 2026-03-25T07:51:27Z

values/wire-server/demo-secrets.example.yaml

    rabbitmq:
      username: wire-server
      password: verysecurepassword
+    mlsPrivateKeys:


regarding this key, I needed to comment it out as there was a key parsing error for this empty key. It will parse correctly when there is a value.

Please go ahead.

julialongtin · 2026-03-25T12:42:39Z

values/wire-server/demo-secrets.example.yaml

@@ -96,6 +110,7 @@ nginz:
 # RabbitMQ credentials for background-worker.


Suggested change

# RabbitMQ credentials for background-worker.

# RabbitMQ and PostgreSQL credentials for background-worker.

julialongtin · 2026-03-25T12:45:09Z

values/wire-server/prod-values.example.yaml

      user: wire-server
      dbname: wire-server
+    postgresqlPool:
+      size: 10 # adjust pool size as needed based on expected load and available resources


This comment is a cop out. Do we have guidance for this? If so, link!

Guidance pr is still in Review state

julialongtin · 2026-03-25T12:45:44Z

values/wire-server/prod-values.example.yaml

    optSettings:
      setEnableMLS: false # Enable for MLS protocol use
-      setFederationDomain: example.com # change this
+      setFederationDomain: example.com # change this per host deployment


I don't get what you mean by this change.

You will get an error if this remain as example.com from background worker pod

julialongtin · 2026-03-25T12:46:41Z

values/wire-server/prod-values.example.yaml

    smtp:
-      host: smtp # change this if you want to use your own SMTP server
+      # Default: smtp (for CI/demo environments with demo-smtp chart)
+      # Production: Change to your actual SMTP server hostname


again, we should link to a document on how to do this (secrets go here, values go there,), not just say "do it"

Guidance pr is still in Review state.

julialongtin · 2026-03-25T12:48:51Z

values/wire-server/prod-values.example.yaml

+      user: wire-server
+      dbname: wire-server
+    postgresqlPool:
+      size: 5 # Background worker has fewer connections to DB, so smaller pool size is fine


oof. inline magic number guidance. bad.

Guidance pr is still in Review state

julialongtin · 2026-03-25T12:49:33Z

.envrc

+  echo ""
+  echo " Git Hooks has been configured in your current environment."
+  echo " Read more about them here: https://github.com/wireapp/wire-server-deploy?tab=readme-ov-file#optional-git-commit-message-verification"
+  echo " If you don't want to use it, then set NO_GIT_HOOKS=FALSE in file .envrc.local and re-laod the envionment by running:"


Suggested change

echo " If you don't want to use it, then set NO_GIT_HOOKS=FALSE in file .envrc.local and re-laod the envionment by running:"

echo " If you don't want to use it, then set NO_GIT_HOOKS=FALSE in file .envrc.local and re-load the envionment by running:"

julialongtin · 2026-03-26T14:10:25Z

.git-hooks/commit-msg

    echo "  chore!: WPB-1234 drop support for k8s 1.16 - add a 'BREAKING CHANGE:' statement"
-    echo "Read more about it here: https://www.conventionalcommits.org/en/v1.0.0/"
+    echo " Read more about it here: https://www.conventionalcommits.org/en/v1.0.0/"
+    echo " If you don't want to use it, then set NO_GIT_HOOKS=FALSE in file .envrc.local and re-laod the envionment by running:"


Suggested change

echo " If you don't want to use it, then set NO_GIT_HOOKS=FALSE in file .envrc.local and re-laod the envionment by running:"

echo " If you don't want to use it, then set NO_GIT_HOOKS=FALSE in file .envrc.local and re-load the envionment by running:"

…loy into wire-server-5.27

sonarqubecloud · 2026-04-01T08:08:47Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

zebot and others added 3 commits March 9, 2026 09:19

Adjust wire-server values for 5.27 deployment

83a9488

Add the changelog

9c00b6f

sghosh23 requested review from a team and julialongtin as code owners March 9, 2026 09:12

sghosh23 added the build-default label Mar 9, 2026

sghosh23 and others added 8 commits March 11, 2026 16:14

configure custom pool size for postgresql

49e11ec

sanitize values for prod

b1b25f2

Adjust wire-server values for 5.27 deployment

dc8575b

Add the changelog

74b049e

configure custom pool size for postgresql

041683e

sanitize values for prod

ebbc1f2

Merge branch 'wire-server-5.27' of github.com:wireapp/wire-server-dep…

45eadcd

…loy into wire-server-5.27

mohitrajain added the build-wiab-staging label Mar 24, 2026

sghosh23 commented Mar 25, 2026

View reviewed changes

fix WPB-00000: comment out mlsprivatekeys from demo-secrets

7b4f288

julialongtin approved these changes Mar 25, 2026

View reviewed changes

julialongtin reviewed Mar 26, 2026

View reviewed changes

This was referenced Mar 30, 2026

build 5.27 #886

Open

No merge 5 26 #887

Open

sghosh23 added 2 commits April 1, 2026 10:07

add available pg migration domain

0efc6df

Merge branch 'wire-server-5.27' of github.com:wireapp/wire-server-dep…

4267280

…loy into wire-server-5.27

		@@ -96,6 +110,7 @@ nginz:
		# RabbitMQ credentials for background-worker.

	# RabbitMQ credentials for background-worker.
	# RabbitMQ and PostgreSQL credentials for background-worker.

	echo " If you don't want to use it, then set NO_GIT_HOOKS=FALSE in file .envrc.local and re-laod the envionment by running:"
	echo " If you don't want to use it, then set NO_GIT_HOOKS=FALSE in file .envrc.local and re-load the envionment by running:"

Conversation

sghosh23 commented Mar 9, 2026

Change type

Basic information

Testing

Offline Build CI (label-based)

Tracking

Knowledge Transfer

Motivation

Objective

Reason

Use case

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Apr 1, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants