Bump wire-server to 5.25.0 and fix background-worker PostgreSQL config by sghosh23 · Pull Request #867 · wireapp/wire-server-deploy

sghosh23 · 2026-02-10T10:49:49Z

Summary

Cherry-picks wire-builds bump to 5.25.0 from PR Update wire-builds #843 (commit aa181b84)
Adds missing background-worker PostgreSQL configuration and secret sync

Changes

1. `offline/tasks/proc_pull_charts.sh`

Cherry-picked from #843 — updates wire-builds reference to 5.25.0 (5a74084).

2. `bin/offline-helm.sh`

Adds .background-worker.secrets.pgPassword to sync_pg_secrets(). The function previously synced PostgreSQL passwords only to brig, galley, spar, and gundeck — but background-worker has required pgPassword since Chart 5.24.0.

3. `values/wire-server/prod-values.example.yaml`

background-worker: Adds postgresql connection config (host, port, user, dbname) and explicit postgresMigration.conversation: cassandra
galley: Adds explicit postgresMigration.conversation: cassandra

⚠️ Critical Note: background-worker default bug at 5.25.0

At Chart 5.25.0, the background-worker Helm chart incorrectly defaults postgresMigration.conversation to postgresql instead of cassandra (fixed in 5.26.0). Without the explicit override added in this PR:

User Group → Channel sync background jobs read conversations from PostgreSQL (where they don't exist yet)
Jobs get Nothing and silently skip member synchronization
No crash or error — just silent data inconsistency

This PR adds the explicit cassandra override as a workaround.

Wire Server: 5.25.0 Changed charts: - account-pages: 0.9.0-pre.1 → 0.9.0-pre.49 - wire-server: 5.23.0 → 5.25.0 - redis-ephemeral: 5.23.0 → 5.25.0 - rabbitmq: 5.23.0 → 5.25.0 - rabbitmq-external: 5.23.0 → 5.25.0 - databases-ephemeral: 5.23.0 → 5.25.0 - fake-aws: 5.23.0 → 5.25.0 - fake-aws-s3: 5.23.0 → 5.25.0 - fake-aws-sqs: 5.23.0 → 5.25.0 - aws-ingress: 5.23.0 → 5.25.0 - fluent-bit: 5.23.0 → 5.25.0 - kibana: 5.23.0 → 5.25.0 - backoffice: 5.23.0 → 5.25.0 - calling-test: 5.23.0 → 5.25.0 - demo-smtp: 5.23.0 → 5.25.0 - elasticsearch-curator: 5.23.0 → 5.25.0 - elasticsearch-external: 5.23.0 → 5.25.0 - elasticsearch-ephemeral: 5.23.0 → 5.25.0 - minio-external: 5.23.0 → 5.25.0 - cassandra-external: 5.23.0 → 5.25.0 - ingress-nginx-controller: 5.23.0 → 5.25.0 - nginx-ingress-services: 5.23.0 → 5.25.0 - reaper: 5.23.0 → 5.25.0 - restund: 5.23.0 → 5.25.0 - k8ssandra-test-cluster: 5.23.0 → 5.25.0 - webapp: 0.8.0-pre.1876 → 0.8.0-pre.1963 - ldap-scim-bridge: 5.23.0 → 5.25.0 - k8ssandra-operator: 1.16.0 → 1.18.0 - step-certificates: 1.25.0 → 1.28.6 - wire-server-enterprise: 5.23.0 → 5.25.0 - postgresql-external: 0.0.44 → 0.0.45 Build: https://raw.githubusercontent.com/wireapp/wire-builds/5a74084feeb1138925dcb671b333da0c76f88f08/build.json

…ync for wire-server 5.25.0 - Add .background-worker.secrets.pgPassword to sync_pg_secrets() in bin/offline-helm.sh so the PostgreSQL password is synced to background-worker values alongside brig/galley/spar/gundeck - Add postgresql connection config (host, port, user, dbname) to background-worker section in prod-values.example.yaml - Add explicit postgresMigration.conversation=cassandra for both galley and background-worker in prod-values.example.yaml - The background-worker override is critical at Chart 5.25.0 where the Helm chart incorrectly defaults this value to "postgresql" instead of "cassandra", causing User Group to Channel sync jobs to silently skip member synchronization

sghosh23 · 2026-02-17T09:08:15Z

Note on prod-values.example.yaml for 5.25.0: please keep the example.com placeholders (e.g., federationDomain, conversationCodeURI, deeplink endpoints) and do not replace them in this PR. These must be configured per deployment/host, so the file should remain a template with example values and guidance instead of hardcoding a specific domain.

Veki301

there is alot of context here that are specific to what is on your machine or the remote you worked on (/Users/sukanta.ghosh, /home/demo/new), without any specific disclaimers of it being so, lots of hardcoding, I didn't want to leave a comment on every single one I saw so Im writing it here
Our usual customer facing language (and perspective) was from inside what we usually call wire-server-deploy directory
Have the documentation explicitly state to get a new bundle, untar it in a new directory (you can even explicitly say mkdir new and then work your way through all the steps as if you/user is in that directory
I am all in favour of automating what has to be done here, and this will probably not be an issue for the customer this has been written for, but some might refuse to run python scripts and I trust you can do all this manually if needed

Veki301 · 2026-02-18T09:55:16Z

values/wire-server/prod-values.example.yaml

      host: elasticsearch-external
    rabbitmq:
-      host: rabbitmq # For k8s-based RabbitMQ (default). Use 'rabbitmq-external' for production external RabbitMQ VMs
+      host: rabbitmq-external # Use rabbitmq-external for production external RabbitMQ VMs


this is whats breaking the CI at the moment, Mohit has implemented rabbitmq-external deployment in our CI run in one of his PRs
Revert all rabbitmq-external changes so you guys don't step on each others toes and also the CI here will get a pass

I wont change rather wait when CI is actually using rabbitmq-external as the PR is ready to deploy thats what i understand, let me know if i am wrong!

sent you a DM

Veki301 · 2026-02-18T10:44:06Z

offline/upgrades/tools/WIRE_UPGRADE_CHANGES.md

+# Wire Server Upgrade Changes (5.5.0 -> 5.25.0)
+
+This document captures the concrete changes applied during the upgrade work so the setup can be reproduced reliably.
+


add the link to the bundle you used for the upgrade here
EDIT: considering my previous comments, we should build a new bundle with these in it, then reference that one here

considering I am in agreement with your reasoning on the tools and do we ship them, use just the bundle you performed the upgrade with

offline/upgrades/tools/cassandra_backup.py

offline/upgrades/tools/README.md

offline/upgrades/tools/WIRE_UPGRADE_CHANGES.md

offline/upgrades/tools/upgrade-all-charts.sh

sghosh23 · 2026-02-19T08:42:47Z

there is alot of context here that are specific to what is on your machine or the remote you worked on (/Users/sukanta.ghosh, /home/demo/new), without any specific disclaimers of it being so, lots of hardcoding, I didn't want to leave a comment on every single one I saw so Im writing it here Our usual customer facing language (and perspective) was from inside what we usually call wire-server-deploy directory Have the documentation explicitly state to get a new bundle, untar it in a new directory (you can even explicitly say mkdir new and then work your way through all the steps as if you/user is in that directory I am all in favour of automating what has to be done here, and this will probably not be an issue for the customer this has been written for, but some might refuse to run python scripts and I trust you can do all this manually if needed

Thanks for reviewing @Veki301,
Can someone run the migration manually? : Yes, first of all, one can run all the processes manually by following the phases, so its totally upto the user.
Hardcoded new bundle path: I added env var for WIRE_BUNDLE_ROOT and others to run the scripts. Totally agree that the README has to clean and. more precise.

- Replace all hardcoded /home/demo/new paths with WIRE_BUNDLE_ROOT - Update fallback defaults to /home/demo/wire-server-deploy-new - Add global Prerequisites section in README.md - Document kubeconfig.dec copy requirement from existing deployment - Fix kubeconfig path to use ${WIRE_BUNDLE_ROOT} - Add automatic script copying in cleanup-containerd-images-all.sh - Remove duplication in CASSANDRA_MIGRATIONS.md - Improve cross-references between documentation files - Standardize all example paths to /home/demo/wire-server-deploy-new Changed files: - README.md: Added Prerequisites, fixed paths, improved structure - CASSANDRA_MIGRATIONS.md: Removed duplication, fixed paths - WIRE_UPGRADE_CHANGES.md: Distinguished new vs existing deployment paths - wire_sync_lib.py: Updated BUNDLE_ROOT default - cassandra_backup.py: Updated inventory default path - cleanup-containerd-images-all.sh: Auto-copy script, updated paths - upgrade-all-charts.sh: Updated BUNDLE_ROOT default Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

sonarqubecloud · 2026-02-19T14:02:39Z

Quality Gate failed

Failed conditions
3.1% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

zebot and others added 2 commits February 10, 2026 11:48

sghosh23 requested review from a team and julialongtin as code owners February 10, 2026 10:49

sghosh23 added the build-default label Feb 10, 2026

sghosh23 added 7 commits February 17, 2026 10:18

feat: adjust prod defaults for federation/MLS

4f83df9

feat: add upgrade tools and fix redis host

048d6f3

fix: read cleanup nodes from inventory

aab8250

fix: derive cassandra hosts from inventory

e4b1cad

fix: quote node in cleanup ssh

648fec1

fix: avoid shellcheck warnings in cleanup script

a528f62

chore: suppress sonar cpd in sync tools

4dbba30

sghosh23 added build-default and removed build-default labels Feb 17, 2026

sghosh23 added 2 commits February 17, 2026 16:32

fix: centralize bundle root in tools

fdf7d97

fix: use demo-smtp in prod values

be1ffee

Veki301 requested changes Feb 19, 2026

View reviewed changes

sghosh23 removed the build-default label Feb 19, 2026

sghosh23 force-pushed the fix/bump-wire-server-5.25-pg-secrets branch from b81a1a6 to 12c12d4 Compare February 19, 2026 14:02

sghosh23 added the build-default label Feb 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Bump wire-server to 5.25.0 and fix background-worker PostgreSQL config#867

Bump wire-server to 5.25.0 and fix background-worker PostgreSQL config#867
sghosh23 wants to merge 12 commits intomasterfrom
fix/bump-wire-server-5.25-pg-secrets

sghosh23 commented Feb 10, 2026

Uh oh!

sghosh23 commented Feb 17, 2026

Uh oh!

Veki301 left a comment

Uh oh!

Veki301 Feb 18, 2026

Uh oh!

sghosh23 Feb 19, 2026

Uh oh!

Veki301 Feb 19, 2026

Uh oh!

Veki301 Feb 18, 2026

Uh oh!

sghosh23 Feb 19, 2026

Uh oh!

Veki301 Feb 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sghosh23 commented Feb 19, 2026

Uh oh!

sonarqubecloud bot commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		# Wire Server Upgrade Changes (5.5.0 -> 5.25.0)

		This document captures the concrete changes applied during the upgrade work so the setup can be reproduced reliably.

Comments

Conversation

sghosh23 commented Feb 10, 2026

Summary

Changes

1. offline/tasks/proc_pull_charts.sh

2. bin/offline-helm.sh

3. values/wire-server/prod-values.example.yaml

⚠️ Critical Note: background-worker default bug at 5.25.0

Related

Uh oh!

sghosh23 commented Feb 17, 2026

Uh oh!

Veki301 left a comment

Choose a reason for hiding this comment

Uh oh!

Veki301 Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

sghosh23 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Veki301 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Veki301 Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

sghosh23 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Veki301 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sghosh23 commented Feb 19, 2026

Uh oh!

sonarqubecloud bot commented Feb 19, 2026

Quality Gate failed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

1. `offline/tasks/proc_pull_charts.sh`

2. `bin/offline-helm.sh`

3. `values/wire-server/prod-values.example.yaml`