From b0ef7ae39e6972ef44c37ac1acd8358eab5af6f5 Mon Sep 17 00:00:00 2001 From: Julia Longtin Date: Thu, 30 Jul 2026 12:22:32 +0100 Subject: [PATCH 1/7] remove unnecessary section. --- .../config-references/wire-server-5.32.0.md | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 src/how-to/upgrade/config-references/wire-server-5.32.0.md diff --git a/src/how-to/upgrade/config-references/wire-server-5.32.0.md b/src/how-to/upgrade/config-references/wire-server-5.32.0.md new file mode 100644 index 0000000..0ab354f --- /dev/null +++ b/src/how-to/upgrade/config-references/wire-server-5.32.0.md @@ -0,0 +1,37 @@ +# Wire-Server `5.32.0` release + +For details, see the [release changelog](https://github.com/wireapp/wire-server/releases) on the wire-server repo. + +Artifact: +[`wire-server-deploy-static-682349dc9df15ca1db6dd1e93d3c4a02d9152502.tgz`](https://s3-eu-west-1.amazonaws.com/public.wire.com/artifacts/wire-server-deploy-static-682349dc9df15ca1db6dd1e93d3c4a02d9152502.tgz) + +## Heads up + +Coming from `5.30.0`. In practice most deploys will be coming from `5.30` because `5.31` is broken and gets skipped. The changes below cover both paths. + +No known bugs at this release. + +## What must change + +No changes are required for this release. + +## Recommended cleanup (not strictly required) + +postgresMigration now has a single source of truth in the Galley chart values. Galley, Brig, and background-worker all read their PostgreSQL migration settings from there. + +The duplicates to drop: + +* `background-worker.config.postgresMigration` +* `brig.config.postgresMigration` + +## For users of the full wire-server-deploy-static deployment package + +1NOTE: Each upgrade in this series re-runs `setup-offline-sources`, which copies the new release's binaries, container images, and debs into `/opt/assets` on the assethost. After a few versions, the assethost runs out of space and the playbook fails with `no space left on device`. + +When that happens, SSH into the **assethost** (not the adminhost) and clear it: + +```bash +sudo rm -rvf /opt/assets +``` + +Then re-run `setup-offline-sources` from the adminhost. From 4c4727f57df3f83eabf02663852253d3b240c800 Mon Sep 17 00:00:00 2001 From: Julia Longtin Date: Thu, 30 Jul 2026 13:43:24 +0100 Subject: [PATCH 2/7] minor cleanups. capitalize Wire. --- src/understand/overview.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/src/understand/overview.md b/src/understand/overview.md index 4ef92df..b3d4430 100644 --- a/src/understand/overview.md +++ b/src/understand/overview.md @@ -163,15 +163,19 @@ Brig uses Elasticsearch Cassandra, Postgres and RabbitMQ. Additionally, it will Cargohold only needs to speak to your S3 hosting service. -### Calling in your main cluster: +### Calling in your Wire Messaging Cluster: ![image](img/calling-in_cluster.svg) -Placing calling in your main kubernetes cluster is heavily discouraged by wire. If a calling component is broken into in the above scenario, other critical databases your wire cluster uses would be at risk. For this reason, Wire always recommends using a separate kubernetes cluster for calling services. +The above diagram shows calling deployed in the Wire Messaging cluster, along side your Wire services. Not shown are the Wire services themselves. + +Depending on customer resources, security stance, and threat models, some customers will opt to place calling into the same kubernetes cluster as their messaging components. + +Placing calling in your main kubernetes cluster is heavily discouraged by Wire. If a calling component is broken into in the above scenario, other critical databases your Wire cluster uses would be at risk. For this reason, Wire always recommends using a separate kubernetes cluster for calling services. ### Calling in your DMZ: ![image](img/calling-DMZ.svg) -In the above diagram, we have routed and labeled the calling traffic into a non-federated Wire calling cluster. As you can see, placing calling in it's own kubernetes cluster is much safer, as the cluster does not have access to any of the wire databases. For most configurations, the calling cluster and the wire backend do not need to speak at all. +In the above diagram, we have routed and labeled the calling traffic into a non-federated Wire calling cluster. A Wire Calling Cluster is typically placed in an DMZ, where the users can reach it, but the Mire Messaging Cluster cannot. Wire As you can see, placing calling in it's own kubernetes cluster is much safer, as the cluster does not have access to any of the Wire databases. For most configurations, the calling cluster and the Wire backend do not need to speak at all. ### Federated Calling ![image](img/federated_calling.svg) @@ -179,7 +183,7 @@ In the above diagram, we have routed and labeled the calling traffic into a non- In a calling environment that also has federation, many different styles of calling may be happening. #### Normal Calling -Users such as Alice and Bob may are participating in a one-to-one call by their wire clients connecting directly to each other across a flat corporate network. No interaction with the calling servers is necessary for this to occur. +Users such as Alice and Bob may are participating in a one-to-one call by their Wire clients connecting directly to each other across a flat corporate network. No interaction with the calling servers is necessary for this to occur. Users like Charlie and David may be at home, or otherwise on separate networks, that do not allow them to connect to each other. In this case, for a one-to-one call, they use the Coturn server to relay their conversation back and forth. @@ -194,7 +198,7 @@ In the above diagram, Edith, Fred, Gary, and Henry are all in the same conferenc For Gary, the call is "remote", so not held on any calling infrastructure on his end. He uses the local Coturn server on his network to connect across the DTLS connection, to the Coturn that handles the DTLS connection in the remote datacenter. That remone Coturn then connects Gary to the conference on the SFT server. ##### Henry -Henry has a different thing happening. For Henry, the call is on the SFT server in his datacenter, but for some reason, the network he is on cannot connect to the conference call on it's UDP port. Henry's wire client uses coturn to relay.. into the SFT call! This is yet another nice fallover capability of the wire clients when networks are 'adverse'. +Henry has a different thing happening. For Henry, the call is on the SFT server in his datacenter, but for some reason, the network he is on cannot connect to the conference call on it's UDP port. Henry's Wire client uses coturn to relay.. into the SFT call! This is yet another nice fallover capability of the Wire clients when networks are 'adverse'. ### Focus on internet protocols From 70d26556b6b2a12ffebff78f87dd7a320d0c9bba Mon Sep 17 00:00:00 2001 From: Julia Longtin Date: Thu, 30 Jul 2026 13:58:09 +0100 Subject: [PATCH 3/7] add entries for 5.30 and 5.32 --- src/how-to/upgrade/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/how-to/upgrade/README.md b/src/how-to/upgrade/README.md index b6b8128..5003bd6 100644 --- a/src/how-to/upgrade/README.md +++ b/src/how-to/upgrade/README.md @@ -17,3 +17,5 @@ Complete documentation for upgrading `wire-server` deployments. - [Wire Server 5.27.0](config-references/wire-server-5.27.0.md) - [Wire Server 5.28.0](config-references/wire-server-5.28.0.md) - [Wire Server 5.29.0](config-references/wire-server-5.29.0.md) + - [Wire Server 5.30.0](config-references/wire-server-5.30.0.md) + - [Wire Server 5.32.0](config-references/wire-server-5.32.0.md) From 053102f1e7d0f87b749348cfd66fba778d6b9e74 Mon Sep 17 00:00:00 2001 From: Julia Longtin Date: Thu, 30 Jul 2026 13:58:44 +0100 Subject: [PATCH 4/7] add a dropdown entry --- mkdocs.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/mkdocs.yml b/mkdocs.yml index 88346cd..1f848e6 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -48,6 +48,7 @@ nav: - Wire Server 5.28: how-to/upgrade/config-references/wire-server-5.28.0.md - Wire Server 5.29: how-to/upgrade/config-references/wire-server-5.29.0.md - Wire Server 5.30: how-to/upgrade/config-references/wire-server-5.30.0.md + - Wire Server 5.30: how-to/upgrade/config-references/wire-server-5.32.0.md - Administration: - Overview: how-to/administrate/README.md - kubernetes: how-to/administrate/kubernetes/README.md From 17959610408342d719717376e7caea4ffac7fedc Mon Sep 17 00:00:00 2001 From: Julia Longtin Date: Thu, 30 Jul 2026 14:46:17 +0100 Subject: [PATCH 5/7] Apply suggestion from @julialongtin --- src/how-to/upgrade/config-references/wire-server-5.32.0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/how-to/upgrade/config-references/wire-server-5.32.0.md b/src/how-to/upgrade/config-references/wire-server-5.32.0.md index 0ab354f..37dc54f 100644 --- a/src/how-to/upgrade/config-references/wire-server-5.32.0.md +++ b/src/how-to/upgrade/config-references/wire-server-5.32.0.md @@ -26,7 +26,7 @@ The duplicates to drop: ## For users of the full wire-server-deploy-static deployment package -1NOTE: Each upgrade in this series re-runs `setup-offline-sources`, which copies the new release's binaries, container images, and debs into `/opt/assets` on the assethost. After a few versions, the assethost runs out of space and the playbook fails with `no space left on device`. +NOTE: Each upgrade in this series re-runs `setup-offline-sources`, which copies the new release's binaries, container images, and debs into `/opt/assets` on the assethost. After a few versions, the assethost runs out of space and the playbook fails with `no space left on device`. When that happens, SSH into the **assethost** (not the adminhost) and clear it: From f1813b25b4c14b58c15d50dc931b6a68f99a3341 Mon Sep 17 00:00:00 2001 From: Julia Longtin Date: Thu, 30 Jul 2026 14:59:22 +0100 Subject: [PATCH 6/7] add to yet another place. --- src/how-to/upgrade/05-config-reference.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/how-to/upgrade/05-config-reference.md b/src/how-to/upgrade/05-config-reference.md index 26757d3..935c268 100644 --- a/src/how-to/upgrade/05-config-reference.md +++ b/src/how-to/upgrade/05-config-reference.md @@ -39,6 +39,8 @@ Apply each configuration change to your templates as applicable to your model. - [Wire Server 5.27.0](config-references/wire-server-5.27.0.md) - [Wire Server 5.28.0](config-references/wire-server-5.28.0.md) - [Wire Server 5.29.0](config-references/wire-server-5.29.0.md) +- [Wire Server 5.29.0](config-references/wire-server-5.30.0.md) +- [Wire Server 5.29.0](config-references/wire-server-5.32.0.md) ## Contributing From 7f0682f378362308ff41c96387c72871c15971f6 Mon Sep 17 00:00:00 2001 From: Julia Longtin Date: Thu, 30 Jul 2026 15:08:32 +0100 Subject: [PATCH 7/7] fix typo. --- src/understand/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/understand/overview.md b/src/understand/overview.md index b3d4430..6268cc9 100644 --- a/src/understand/overview.md +++ b/src/understand/overview.md @@ -175,7 +175,7 @@ Placing calling in your main kubernetes cluster is heavily discouraged by Wire. ### Calling in your DMZ: ![image](img/calling-DMZ.svg) -In the above diagram, we have routed and labeled the calling traffic into a non-federated Wire calling cluster. A Wire Calling Cluster is typically placed in an DMZ, where the users can reach it, but the Mire Messaging Cluster cannot. Wire As you can see, placing calling in it's own kubernetes cluster is much safer, as the cluster does not have access to any of the Wire databases. For most configurations, the calling cluster and the Wire backend do not need to speak at all. +In the above diagram, we have routed and labeled the calling traffic into a non-federated Wire calling cluster. A Wire Calling Cluster is typically placed in an DMZ, where the users can reach it, but the Wire Messaging Cluster cannot. Wire As you can see, placing calling in it's own kubernetes cluster is much safer, as the cluster does not have access to any of the Wire databases. For most configurations, the calling cluster and the Wire backend do not need to speak at all. ### Federated Calling ![image](img/federated_calling.svg)