release 5.25-R2 DO-NOT-MERGE

CHANGELOG.md

@@ -12,6 +12,12 @@
 
 -->
 
+# Relase 5.25 R2
+
+## Release notes
+
+* Changed: disabled the MLS by default in 5.25-R1 and release it as 5.25R2
+
 # Relase 5.25 R1
 
 ## Release notes

ansible/inventory/demo/host.yml

@@ -18,7 +18,7 @@ wiab:
     wire_ip: ""
 
     # artifact_hash
-    artifact_hash: "432712ada7e95e224f8e0e6c90b2873613ba7e45"
+    artifact_hash: "f1ae0bda603c10e789468b7da0d3316f709d3d5f"
 
     # docker vars
     docker_ce_version: "5:28.1.1-1~ubuntu.24.04~noble"

ansible/inventory/demo/wiab-staging.yml

@@ -6,6 +6,6 @@ wiab-staging:
       ansible_user: 'demo'
       ansible_ssh_private_key_file: "~/.ssh/id_ed25519"
   vars:
-    artifact_hash: 432712ada7e95e224f8e0e6c90b2873613ba7e45
+    artifact_hash: f1ae0bda603c10e789468b7da0d3316f709d3d5f
     # when enabled, disable WAN SNAT/masquerading for VMs on the private network
     private_deployment: true

ansible/inventory/offline/99-static.yml

@@ -0,0 +1,137 @@
+# yaml equivalent of 99-static ini file
+# for a full list of vars check 99-static file
+all:
+  vars:
+    ansible_user: "some_user"
+    ansible_ssh_common_args: >-
+      -o StrictHostKeyChecking=no
+      -o UserKnownHostsFile=/dev/null
+      -o ControlMaster=auto
+      -o ControlPersist=60s
+    # ssh private_key is stored in wire-server-deploy/ssh in case vms are created using bin/offline-vm-setup.sh
+    # in case of terraform automated-tests, it will be vailable via forwarded ssh agents
+    # ansible_ssh_private_key_file: "ssh/id_ed25519"
+
+assethost:
+  hosts:
+    assethost:
+      ansible_host: "assethost_ip"
+
+kube-node:
+  hosts:
+    kubenode1:
+      ansible_host: "kubenode1_ip"
+      etcd_member_name: kubenode1
+      ip: "kubenode1_ip"
+    kubenode2:
+      ansible_host: "kubenode2_ip"
+      etcd_member_name: kubenode2
+      ip: "kubenode2_ip"
+    kubenode3:
+      ansible_host: "kubenode3_ip"
+      etcd_member_name: kubenode3
+      ip: "kubenode3_ip"
+
+kube-master:
+  children:
+    kube-node: {}
+
+etcd:
+  children:
+    kube-node: {}
+
+k8s-cluster:
+  children:
+    kube-node: {}
+    kube-master: {}
+
+cassandra:
+  hosts:
+    cassandra1:
+      ansible_host: "cassandra1_ip"
+    cassandra2:
+      ansible_host: "cassandra2_ip"
+    cassandra3:
+      ansible_host: "cassandra3_ip"
+  vars:
+    cassandra_network_interface: enp1s0
+
+cassandra_seed:
+  hosts:
+    cassandra1: {}
+
+elasticsearch:
+  hosts:
+    elasticsearch1:
+      ansible_host: "elasticsearch1_ip"
+    elasticsearch2:
+      ansible_host: "elasticsearch2_ip"
+    elasticsearch3:
+      ansible_host: "elasticsearch3_ip"
+  vars:
+    elasticsearch_network_interface: enp1s0
+
+elasticsearch_master:
+  children:
+    elasticsearch: {}
+
+minio:
+  hosts:
+    minio1:
+      ansible_host: "minio1_ip"
+    minio2:
+      ansible_host: "minio2_ip"
+    minio3:
+      ansible_host: "minio3_ip"
+  vars:
+    minio_network_interface: enp1s0
+
+rmq-cluster:
+    # host names here must match each node's actual hostname
+    # its a requirement for rabbitmq
+  hosts:
+    rabbitmq1:
+      ansible_host: "rabbitmq1_ip"
+    rabbitmq2:
+      ansible_host: "rabbitmq2_ip"
+    rabbitmq3:
+      ansible_host: "rabbitmq3_ip"
+  vars:
+    rabbitmq_network_interface: enp1s0
+    # host name here must match each node's actual hostname
+    rabbitmq_cluster_master: rabbitmq1
+
+postgresql:
+  hosts:
+    postgresql1:
+      ansible_host: "postgresql1_ip"
+    postgresql2:
+      ansible_host: "postgresql2_ip"
+    postgresql3:
+      ansible_host: "postgresql3_ip"
+  vars:
+    wire_dbname: wire-server
+    postgresql_network_interface: enp1s0
+    repmgr_node_config:
+      # host names here must match each node's actual hostname
+      postgresql1:  # Maps to postgresql_rw group
+        node_id: 1
+        priority: 150
+        role: primary
+      postgresql2:  # Maps to first postgresql_ro
+        node_id: 2
+        priority: 100
+        role: standby
+      postgresql3:  # Maps to second postgresql_ro
+        node_id: 3
+        priority: 50
+        role: standby
+
+postgresql_rw:
+  hosts:
+    postgresql1: {}
+
+postgresql_ro:
+  hosts:
+    postgresql2: {}
+    postgresql3: {}

bin/helm-operations.sh

@@ -280,4 +280,4 @@ fi
 deploy_calling_services
 }
 
-main
+#main

changelog.d/2-wire-builds/5.25-mls-disabled

@@ -0,0 +1 @@
+Fixed: disabled the MLS by default for 5.25-R1

offline/cd_staging.sh

@@ -231,6 +231,10 @@ scp $SSH_OPTS "$TARGET" "demo@$adminhost":./ansible/inventory/offline/inventory.
 
 ssh $SSH_OPTS "demo@$adminhost" cat ./ansible/inventory/offline/inventory.yml || true
 
+ssh $SSH_OPTS "demo@$adminhost" 'printf "\nmain\n\n" >> ./bin/helm-operations.sh' || true
+
+ssh $SSH_OPTS "demo@$adminhost" cat ./bin/helm-operations.sh || true
+
 # NOTE: Agent is forwarded; so that the adminhost can provision the other boxes
 ssh $SSH_OPTS -A "demo@$adminhost" ./bin/offline-deploy.sh
 

offline/default-build/build.sh

@@ -59,6 +59,9 @@ cp -r "${ROOT_DIR}"/dashboards "${OUTPUT_DIR}"/
 # post_chart_process_1.sh
 # post_chart_process_2.sh
 
+# pulling one extra webapp image
+echo "quay.io/wire/webapp:2026-06-08-production.0" | create-container-dump "${OUTPUT_DIR}"/extra-images
+
 # --------------------------
 
 # Following tasks are independent from each other
@@ -91,6 +94,7 @@ ITEMS_TO_ARCHIVE=(
   "containers-adminhost"
   "containers-helm.tar"
   "containers-system.tar"
+  "extra-images"
   "charts"
   "values"
   "../../../ansible"

values/webapp/demo-values.example.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
-#  image:
-#    tag: some-tag (only override if you want a newer/different version than what is in the chart)
+image:
+  tag: 2026-06-08-production.0
 config:
   externalUrls:
     backendRest: nginz-https.example.com

values/webapp/prod-values.example.yaml

@@ -1,6 +1,6 @@
 replicaCount: 3
-#  image:
-#    tag: some-tag (only override if you want a newer/different version than what is in the chart)
+image:
+  tag: 2025-09-24-production.0
 config:
   externalUrls:
     backendRest: nginz-https.example.com
@@ -11,6 +11,8 @@ config:
 # See full list of available environment variables: https://github.com/wireapp/wire-web-config-default/blob/master/wire-webapp/.env.defaults
 envVars:
   APP_NAME: "Webapp"
+  FEATURE_USE_CORE_CRYPTO: "true"
+  MAX_API_VERSION: "12"
   ENFORCE_HTTPS: "true"
   FEATURE_CHECK_CONSENT: "false"
   # Note: disabling showing the user creation is not the same thing as user creation being disabled.

values/wire-server/demo-values.example.yaml

@@ -55,7 +55,7 @@ brig:
       teamMemberWelcome: https://wire.example.com/download # change this
     enableFederation: false # Keep false unless federation is explicitly configured
     optSettings:
-      setEnableMLS: true # Enable for MLS protocol use
+      setEnableMLS: false # Enable for MLS protocol use
       setFederationDomain: example.com # change this per host deployment
       # Sync the domain with the 'host' variable in the sftd chart
       # Comment the next line (by adding '#' before it) if conference calling is not used
@@ -199,7 +199,7 @@ galley:
             status: disabled
             config:
               protocolToggleUsers: []
-              defaultProtocol: mls
+              defaultProtocol: proteus
               allowedCipherSuites: [2]
               defaultCipherSuite: 2
               supportedProtocols: [proteus, mls]

values/wire-server/prod-values.example.yaml

@@ -55,7 +55,7 @@ brig:
       teamMemberWelcome: https://wire.example.com/download # change this
     enableFederation: false # Keep false unless federation is explicitly configured
     optSettings:
-      setEnableMLS: true # Enable for MLS protocol use
+      setEnableMLS: false # Enable for MLS protocol use
       setFederationDomain: example.com # change this per host deployment
       # Sync the domain with the 'host' variable in the sftd chart
       # Comment the next line (by adding '#' before it) if conference calling is not used
@@ -199,7 +199,7 @@ galley:
             status: disabled
             config:
               protocolToggleUsers: []
-              defaultProtocol: mls
+              defaultProtocol: proteus
               allowedCipherSuites: [2]
               defaultCipherSuite: 2
               supportedProtocols: [proteus, mls]