From 1e8bb29d831d4c661dbfc4c332274ea94e6283e6 Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Fri, 24 Jul 2026 13:17:11 +0100
Subject: [PATCH 1/9] add a script to migrate secrets, without manual
 intervention, during an upgrade.

---
 bin/migrate_secrets.sh | 68 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 bin/migrate_secrets.sh

diff --git a/bin/migrate_secrets.sh b/bin/migrate_secrets.sh
new file mode 100644
index 000000000..cf1fc9bc7
--- /dev/null
+++ b/bin/migrate_secrets.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# migrate secrets from an old wire-server-deploy directory.
+
+# Usage:
+#
+# If your secrets are in ../wire-server-deploy/values/wire-server/prod-secrets.example.yaml,
+# and you are CD'd into a directory containing a wire-server-deploy package, you can just run this.
+#
+# Otherwise, set OLD to point to your old values file, NEW to point to your file you want to import into, and run.
+
+set -euo pipefail
+
+OLD="${OLD:-../wire-server-deploy/values/wire-server/prod-secrets.example.yaml}"
+NEW="${NEW:-values/wire-server/prod-secrets.example.yaml}"
+OUT="${NEW}.migrated"
+
+if [ ! -f $OLD ]; then
+    {
+	echo "could not find OLD YAML file: $OLD"
+	echo "please set OLD and NEW to point to your secrets files manually (see usage at top of script)."
+	exit 1
+    }
+fi
+
+if [ ! -f $NEW ]; then
+    {
+	echo "could not find NEW YAML file: $NEW"
+	echo "please set OLD and NEW to point to your secrets files manually (see usage at top of script)."
+	exit 1
+    }
+fi
+
+cp "$NEW" "$OUT"
+
+# Use YQ for reading.
+PUB=$(yq -r '.brig.secrets.zAuth.publicKeys' "$OLD")
+PRIV=$(yq -r '.brig.secrets.zAuth.privateKeys' "$OLD")
+TURN=$(yq -r '.brig.secrets.turn.secret' "$OLD")
+CH_AWS_ID=$(yq -r '.cargohold.secrets.awsKeyId' "$OLD")
+CH_AWS_SECRET=$(yq -r '.cargohold.secrets.awsSecretKey' "$OLD")
+
+ED25519=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ed25519' "$OLD")
+P256=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp256r1_sha256' "$OLD")
+P384=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp384r1_sha384' "$OLD")
+P521=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp521r1_sha512' "$OLD")
+
+# Use perl for writing into the new file. This is to prevent YQ from eating our empty lines, in the yaml.
+PUB="$PUB" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+publicKeys:[ \t]*)[^\n]+}{$1.qq{"$ENV{PUB}"}}me' "$OUT"
+PRIV="$PRIV" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+privateKeys:[ \t]*)[^\n]+}{$1.qq{"$ENV{PRIV}"}}me' "$OUT"
+TURN="$TURN" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+turn:\n(?:.*\n)*?^[ \t]+secret:[ \t]*)[^\n]+}{$1.qq{"$ENV{TURN}"}}me' "$OUT"
+
+CH_AWS_ID="$CH_AWS_ID" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsKeyId:[ \t]*)[^ \n]+}{$1.qq{"$ENV{CH_AWS_ID}"}}me' "$OUT"
+CH_AWS_SECRET="$CH_AWS_SECRET" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsSecretKey:[ \t]*)[^ \n]+}{$1.qq{"$ENV{CH_AWS_SECRET}"}}me' "$OUT"
+
+ED25519="$ED25519" perl -0pi -e 's{(^[ \t]*ed25519:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{ED25519}))=~s/\n$//r}mse' "$OUT"
+
+P256="$P256" perl -0pi -e 's{(^[ \t]*ecdsa_secp256r1_sha256:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P256}))=~s/\n$//r}mse' "$OUT"
+
+P384="$P384" perl -0pi -e 's{(^[ \t]*ecdsa_secp384r1_sha384:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P384}))=~s/\n$//r}mse' "$OUT"
+
+P521="$P521" perl -0pi -e 's{(^[ \t]*ecdsa_secp521r1_sha512:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P521}))=~s/\n$//r}mse' "$OUT"
+
+PUB="$PUB" perl -0pi -e 's{(nginz:\n.*?zAuth:\n(?:.*\n)*?^[ \t]*publicKeys:[ \t]*)[^\n]+}{$1 . qq{"$ENV{PUB}"}}me' "$OUT"
+
+diff -u "$NEW" "$OUT" || true
+
+read -rp "Replace $NEW? [y/N] " answer
+[[ "$answer" =~ ^[Yy]$ ]] && mv "$OUT" "$NEW" || echo "Kept: $OUT"

From c0df7c52c826c37af659eae81053858dca9b01f0 Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Tue, 28 Jul 2026 18:09:52 +0100
Subject: [PATCH 2/9] do not leave around .migrated files, handle postgres
 secrets, and polinate coturn secret to coturn.

---
 ansible/setup-offline-sources.yml |  8 +++++
 bin/helm-operations.sh            | 26 +++++++++++++---
 bin/migrate_secrets.sh            | 51 +++++++++++++++++++++++++------
 3 files changed, 70 insertions(+), 15 deletions(-)

diff --git a/ansible/setup-offline-sources.yml b/ansible/setup-offline-sources.yml
index b1fb61d5a..762e8a125 100644
--- a/ansible/setup-offline-sources.yml
+++ b/ansible/setup-offline-sources.yml
@@ -74,10 +74,14 @@
         file:
           path: /etc/apt/sources.list
           state: absent
+        tags:
+          - aptconfig
       - name: Remove /etc/apt/sources.list.d/ to remove all online debian package repos
         file:
           path: /etc/apt/sources.list.d/
           state: absent
+        tags:
+          - aptconfig
 
 #######################################################################
 # If your offline repo's debian key has expired, uncomment this block.
@@ -103,11 +107,15 @@
         apt_key:
           url: "{{ ubuntu_repo_gpgkey }}"
           state: present
+        tags:
+          - aptconfig
 
       - name: Register offline repo
         apt_repository:
           repo: "deb {{ ubuntu_repo_base_url }} {{ ansible_distribution_release }} main"
           state: present
+        tags:
+          - aptconfig
       - name: Apt update
         apt:
           update_cache: yes
diff --git a/bin/helm-operations.sh b/bin/helm-operations.sh
index 164aac3ac..2ba943887 100755
--- a/bin/helm-operations.sh
+++ b/bin/helm-operations.sh
@@ -35,7 +35,6 @@ function dump_debug_logs {
 trap dump_debug_logs ERR
 
 configure_calling_environment() {
-
   if [[ "$DEPLOY_CALLING_SERVICES" != "TRUE" ]]; then
     return 0
   fi
@@ -54,6 +53,14 @@ configure_calling_environment() {
   if [[ -z "$CALLING_NODE" ]]; then
     echo "Error: could not determine the last kube worker node via kubectl"
     exit 1
+  else
+    echo "Selecting calling node: $CALLING_NODE"
+    # export this, in the case that we are being sourced.  
+    if [[ ! "${BASH_SOURCE[0]}" == "$0" ]] ; then  
+	export CALLING_NODE
+    else
+	echo "export CALLING_NODE=\"$CALLING_NODE\""
+    fi
   fi
 }
 
@@ -117,7 +124,7 @@ configure_values() {
 
   TEMP_DIR=$(mktemp -d)
   trap 'rm -rf $TEMP_DIR' EXIT
-
+  
   # Fixing the hosts with TARGET_SYSTEM and setting the turn server
   sed -e "s/example.com/$TARGET_SYSTEM/g" \
       "$BASE_DIR/values/wire-server/values.yaml" > "$TEMP_DIR/wire-server-values.yaml"
@@ -140,6 +147,11 @@ configure_values() {
   fi
 
   if [[ "$DEPLOY_CALLING_SERVICES" == "TRUE" ]]; then
+
+    if [ ! -v $CALLING_NODE ] ; then
+        echo "Refusing to deploy calling services; CALLING_NODE is not set."
+        return 1
+    fi
     # to find IP address of calling NODE
     CALLING_NODE_IP=$(kubectl get node "$CALLING_NODE" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')
 
@@ -169,7 +181,9 @@ configure_values() {
   for file in "${files[@]}"; do
     if ! cmp -s "$TEMP_DIR/$file" "$BASE_DIR/values/${file%-values.yaml}/values.yaml"; then
       cp "$TEMP_DIR/$file" "$BASE_DIR/values/${file%-values.yaml}/values.yaml"
-      echo "Updating  $BASE_DIR/values/${file%-values.yaml}/values.yaml"
+      echo "Updating $BASE_DIR/values/${file%-values.yaml}/values.yaml"
+    else
+      echo "no differences found; not updating $BASE_DIR/values/${file%-values.yaml}/values.yaml"
     fi
   done
 
@@ -250,8 +264,9 @@ main() {
 # initialize calling-service specific values only when enabled
 configure_calling_environment
 
-# Create prod-values.example.yaml to values.yaml and take backup
+# Create prod-values.example.yaml to values.yaml and take backup. Note: does not template anything.
 process_values "prod" "values"
+
 # Create prod-secrets.example.yaml to secrets.yaml and take backup
 process_values "prod" "secrets"
 
@@ -280,4 +295,5 @@ fi
 deploy_calling_services
 }
 
-main
+# only execute main when this script is executed, not when it is sourced.
+[[ "${BASH_SOURCE[0]}" == "$0" ]] && main "$@"
diff --git a/bin/migrate_secrets.sh b/bin/migrate_secrets.sh
index cf1fc9bc7..9c9be129d 100644
--- a/bin/migrate_secrets.sh
+++ b/bin/migrate_secrets.sh
@@ -10,14 +10,14 @@
 
 set -euo pipefail
 
-OLD="${OLD:-../wire-server-deploy/values/wire-server/prod-secrets.example.yaml}"
+OLD="${OLD:-../wire-server-deploy/values/wire-server/secrets.yaml}"
 NEW="${NEW:-values/wire-server/prod-secrets.example.yaml}"
-OUT="${NEW}.migrated"
+NEWCOTURN="${NEWCOTURN:-values/coturn/prod-secrets.example.yaml}"
 
 if [ ! -f $OLD ]; then
     {
 	echo "could not find OLD YAML file: $OLD"
-	echo "please set OLD and NEW to point to your secrets files manually (see usage at top of script)."
+	echo "please set OLD to point to your in-use wire-server secrets file manually (see usage at top of script)."
 	exit 1
     }
 fi
@@ -25,20 +25,37 @@ fi
 if [ ! -f $NEW ]; then
     {
 	echo "could not find NEW YAML file: $NEW"
-	echo "please set OLD and NEW to point to your secrets files manually (see usage at top of script)."
+	echo "please set NEW to point to your new wire-server secrets files manually (see usage at top of script)."
+	exit 1
+    }
+fi
+OUT="${NEW}.migrated"
+
+if [ ! -f $NEWCOTURN ]; then
+    {
+	echo "could not find NEWCOTURN YAML file: $NEW"
+	echo "please set NEWCOTURN to point to your new coturn secrets files manually (see usage at top of script)."
 	exit 1
     }
 fi
+OUTCOTURN="${NEWCOTURN}.migrated"
 
 cp "$NEW" "$OUT"
+cp "$NEWCOTURN" "$OUTCOTURN"
 
 # Use YQ for reading.
 PUB=$(yq -r '.brig.secrets.zAuth.publicKeys' "$OLD")
 PRIV=$(yq -r '.brig.secrets.zAuth.privateKeys' "$OLD")
 TURN=$(yq -r '.brig.secrets.turn.secret' "$OLD")
+
+# Cargohold AWS access.
 CH_AWS_ID=$(yq -r '.cargohold.secrets.awsKeyId' "$OLD")
 CH_AWS_SECRET=$(yq -r '.cargohold.secrets.awsSecretKey' "$OLD")
 
+# The Postgres secret.
+PG_PASSWORD=$(yq -r '.brig.secrets.pgPassword' "$OLD")
+
+# Whole keys.
 ED25519=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ed25519' "$OLD")
 P256=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp256r1_sha256' "$OLD")
 P384=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp384r1_sha384' "$OLD")
@@ -52,17 +69,31 @@ TURN="$TURN" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+turn:\n(?:.*\n)*?^[ \t]+sec
 CH_AWS_ID="$CH_AWS_ID" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsKeyId:[ \t]*)[^ \n]+}{$1.qq{"$ENV{CH_AWS_ID}"}}me' "$OUT"
 CH_AWS_SECRET="$CH_AWS_SECRET" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsSecretKey:[ \t]*)[^ \n]+}{$1.qq{"$ENV{CH_AWS_SECRET}"}}me' "$OUT"
 
-ED25519="$ED25519" perl -0pi -e 's{(^[ \t]*ed25519:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{ED25519}))=~s/\n$//r}mse' "$OUT"
+PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(brig:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]*)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
+PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(galley:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]*)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
+PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(background-worker:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]*)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
 
+ED25519="$ED25519" perl -0pi -e 's{(^[ \t]*ed25519:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{ED25519}))=~s/\n$//r}mse' "$OUT"
 P256="$P256" perl -0pi -e 's{(^[ \t]*ecdsa_secp256r1_sha256:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P256}))=~s/\n$//r}mse' "$OUT"
-
 P384="$P384" perl -0pi -e 's{(^[ \t]*ecdsa_secp384r1_sha384:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P384}))=~s/\n$//r}mse' "$OUT"
-
 P521="$P521" perl -0pi -e 's{(^[ \t]*ecdsa_secp521r1_sha512:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P521}))=~s/\n$//r}mse' "$OUT"
 
 PUB="$PUB" perl -0pi -e 's{(nginz:\n.*?zAuth:\n(?:.*\n)*?^[ \t]*publicKeys:[ \t]*)[^\n]+}{$1 . qq{"$ENV{PUB}"}}me' "$OUT"
 
-diff -u "$NEW" "$OUT" || true
+if diff -u "$NEW" "$OUT" ; then
+    echo "no difference found in wire-server configuration."
+    rm -f "$OUT"
+else
+    read -rp "Replace $NEW? [y/N] " answer
+    [[ "$answer" =~ ^[Yy]$ ]] && mv "$OUT" "$NEW" || echo "Kept: $OUT"
+fi
+
+TURN="$TURN" perl -0pi -e 's{(^[ \t]*zrestSecrets:\n[ \t]*-[ \t]*)"[^"]*"}{$1.qq{"$ENV{TURN}"}}me' "$OUTCOTURN"
 
-read -rp "Replace $NEW? [y/N] " answer
-[[ "$answer" =~ ^[Yy]$ ]] && mv "$OUT" "$NEW" || echo "Kept: $OUT"
+if diff -u "$NEWCOTURN" "$OUTCOTURN"; then
+    echo "no difference found in coturn configuration."
+    rm -f "$OUTCOTURN"
+else
+    read -rp "Replace $NEWCOTURN? [y/N] " answer
+    [[ "$answer" =~ ^[Yy]$ ]] && mv "$OUTCOTURN" "$NEWCOTURN" || echo "Kept: $OUTCOTURN"
+fi

From e00ab011d79dc729196425d8df066263ffac012f Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Wed, 29 Jul 2026 11:20:13 +0100
Subject: [PATCH 3/9] add useful status message.

---
 bin/helm-operations.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bin/helm-operations.sh b/bin/helm-operations.sh
index 2ba943887..29d003b60 100755
--- a/bin/helm-operations.sh
+++ b/bin/helm-operations.sh
@@ -101,6 +101,8 @@ process_values() {
   fi
   timestp=$(date +"%Y%m%d_%H%M%S")
 
+  echo "templating $ENV $TYPE with domain: $TARGET_SYSTEM, and cert manager email: $CERT_MANAGER_EMAIL"
+
   for chart in "${charts[@]}"; do
     chart_dir="$BASE_DIR/values/$chart"
     if [[ -d "$chart_dir" ]]; then

From 9fd9ba5a7ef533d9e9ddadbf2c00c0a44eb0efad Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Wed, 29 Jul 2026 11:21:00 +0100
Subject: [PATCH 4/9] populate zAuth secret correctly, and tighten regexes.

---
 bin/migrate_secrets.sh | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/bin/migrate_secrets.sh b/bin/migrate_secrets.sh
index 9c9be129d..1a62584a8 100644
--- a/bin/migrate_secrets.sh
+++ b/bin/migrate_secrets.sh
@@ -62,23 +62,22 @@ P384=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp384r1_sha384' "$O
 P521=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp521r1_sha512' "$OLD")
 
 # Use perl for writing into the new file. This is to prevent YQ from eating our empty lines, in the yaml.
-PUB="$PUB" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+publicKeys:[ \t]*)[^\n]+}{$1.qq{"$ENV{PUB}"}}me' "$OUT"
-PRIV="$PRIV" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+privateKeys:[ \t]*)[^\n]+}{$1.qq{"$ENV{PRIV}"}}me' "$OUT"
-TURN="$TURN" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+turn:\n(?:.*\n)*?^[ \t]+secret:[ \t]*)[^\n]+}{$1.qq{"$ENV{TURN}"}}me' "$OUT"
+PUB="$PUB" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+publicKeys:[ \t]+)[^\n]+}{$1.qq{"$ENV{PUB}"}}me' "$OUT"
+PRIV="$PRIV" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+privateKeys:[ \t]+)[^\n]+}{$1.qq{"$ENV{PRIV}"}}me' "$OUT"
+TURN="$TURN" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+turn:\n(?:.*\n)*?^[ \t]+secret:[ \t]+)[^\n]+}{$1.qq{"$ENV{TURN}"}}me' "$OUT"
 
-CH_AWS_ID="$CH_AWS_ID" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsKeyId:[ \t]*)[^ \n]+}{$1.qq{"$ENV{CH_AWS_ID}"}}me' "$OUT"
-CH_AWS_SECRET="$CH_AWS_SECRET" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsSecretKey:[ \t]*)[^ \n]+}{$1.qq{"$ENV{CH_AWS_SECRET}"}}me' "$OUT"
+CH_AWS_ID="$CH_AWS_ID" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsKeyId:[ \t]+)[^ \n]+}{$1.qq{"$ENV{CH_AWS_ID}"}}me' "$OUT"
+CH_AWS_SECRET="$CH_AWS_SECRET" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsSecretKey:[ \t]+)[^ \n]+}{$1.qq{"$ENV{CH_AWS_SECRET}"}}me' "$OUT"
 
-PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(brig:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]*)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
-PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(galley:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]*)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
-PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(background-worker:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]*)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
+PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(brig:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]+)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
+PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(galley:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]+)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
+PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(background-worker:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]+)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
 
-ED25519="$ED25519" perl -0pi -e 's{(^[ \t]*ed25519:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{ED25519}))=~s/\n$//r}mse' "$OUT"
-P256="$P256" perl -0pi -e 's{(^[ \t]*ecdsa_secp256r1_sha256:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P256}))=~s/\n$//r}mse' "$OUT"
-P384="$P384" perl -0pi -e 's{(^[ \t]*ecdsa_secp384r1_sha384:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P384}))=~s/\n$//r}mse' "$OUT"
-P521="$P521" perl -0pi -e 's{(^[ \t]*ecdsa_secp521r1_sha512:[ \t]*\|\n)([ \t]*)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P521}))=~s/\n$//r}mse' "$OUT"
-
-PUB="$PUB" perl -0pi -e 's{(nginz:\n.*?zAuth:\n(?:.*\n)*?^[ \t]*publicKeys:[ \t]*)[^\n]+}{$1 . qq{"$ENV{PUB}"}}me' "$OUT"
+ED25519="$ED25519" perl -0pi -e 's{(^[ \t]+ed25519:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{ED25519}))=~s/\n$//r}mse' "$OUT"
+P256="$P256" perl -0pi -e 's{(^[ \t]+ecdsa_secp256r1_sha256:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P256}))=~s/\n$//r}mse' "$OUT"
+P384="$P384" perl -0pi -e 's{(^[ \t]+ecdsa_secp384r1_sha384:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P384}))=~s/\n$//r}mse' "$OUT"
+P521="$P521" perl -0pi -e 's{(^[ \t]+ecdsa_secp521r1_sha512:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P521}))=~s/\n$//r}mse' "$OUT"
+PUB="$PUB" perl -0pi -e 's{(^nginz:\n*?[ \t]+secrets:\n*?[ \t]+zAuth:\n(?:[ \t]+\#[^\n]*\n)[ \t]+publicKeys:[ \t]+)[^\n]+}{$1 . qq{"$ENV{PUB}"}}mex' "$OUT"
 
 if diff -u "$NEW" "$OUT" ; then
     echo "no difference found in wire-server configuration."
@@ -88,7 +87,7 @@ else
     [[ "$answer" =~ ^[Yy]$ ]] && mv "$OUT" "$NEW" || echo "Kept: $OUT"
 fi
 
-TURN="$TURN" perl -0pi -e 's{(^[ \t]*zrestSecrets:\n[ \t]*-[ \t]*)"[^"]*"}{$1.qq{"$ENV{TURN}"}}me' "$OUTCOTURN"
+TURN="$TURN" perl -0pi -e 's{(^[ \t]+zrestSecrets:\n[ \t]+-[ \t]+)"[^"]*"}{$1.qq{"$ENV{TURN}"}}me' "$OUTCOTURN"
 
 if diff -u "$NEWCOTURN" "$OUTCOTURN"; then
     echo "no difference found in coturn configuration."

From 22bf9f28a8889f0db2d03cd8f9f92d85ff710904 Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Wed, 29 Jul 2026 11:27:47 +0100
Subject: [PATCH 5/9] extend comments, and perform minor spacing fixes.

---
 bin/helm-operations.sh | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/bin/helm-operations.sh b/bin/helm-operations.sh
index 29d003b60..40ba1e2e0 100755
--- a/bin/helm-operations.sh
+++ b/bin/helm-operations.sh
@@ -57,9 +57,9 @@ configure_calling_environment() {
     echo "Selecting calling node: $CALLING_NODE"
     # export this, in the case that we are being sourced.  
     if [[ ! "${BASH_SOURCE[0]}" == "$0" ]] ; then  
-	export CALLING_NODE
+        export CALLING_NODE
     else
-	echo "export CALLING_NODE=\"$CALLING_NODE\""
+        echo "export CALLING_NODE=\"$CALLING_NODE\""
     fi
   fi
 }
@@ -82,7 +82,6 @@ sync_pg_secrets() {
 # Creates values.yaml from prod-values.example.yaml and secrets.yaml from prod-secrets.example.yaml
 # Works on all chart directories in $BASE_DIR/values/
 process_values() {
-
   ENV=$1
   TYPE=$2
   charts=(fake-aws smtp rabbitmq databases-ephemeral reaper wire-server webapp account-pages team-settings ingress-nginx-controller)
@@ -123,10 +122,9 @@ process_values() {
 # selectively setting values of following charts which requires additional values
 # wire-server, webapp, team-settings, account-pages, nginx-ingress-services, sftd and coturn
 configure_values() {
-
   TEMP_DIR=$(mktemp -d)
   trap 'rm -rf $TEMP_DIR' EXIT
-  
+
   # Fixing the hosts with TARGET_SYSTEM and setting the turn server
   sed -e "s/example.com/$TARGET_SYSTEM/g" \
       "$BASE_DIR/values/wire-server/values.yaml" > "$TEMP_DIR/wire-server-values.yaml"
@@ -149,7 +147,6 @@ configure_values() {
   fi
 
   if [[ "$DEPLOY_CALLING_SERVICES" == "TRUE" ]]; then
-
     if [ ! -v $CALLING_NODE ] ; then
         echo "Refusing to deploy calling services; CALLING_NODE is not set."
         return 1
@@ -188,11 +185,9 @@ configure_values() {
       echo "no differences found; not updating $BASE_DIR/values/${file%-values.yaml}/values.yaml"
     fi
   done
-
 }
 
 deploy_charts() {
-
   local charts=("$@")
   echo "Following charts will be deployed: ${charts[*]}"
 
@@ -234,7 +229,6 @@ deploy_charts() {
 }
 
 deploy_cert_manager() {
-
   kubectl get namespace cert-manager-ns || kubectl create namespace cert-manager-ns
   helm upgrade --install --wait --timeout=5m0s -n cert-manager-ns cert-manager  "$BASE_DIR/charts/cert-manager" --values "$BASE_DIR/values/cert-manager/values.yaml"
 
@@ -243,7 +237,6 @@ deploy_cert_manager() {
 }
 
 deploy_calling_services() {
-
   if [[ "$DEPLOY_CALLING_SERVICES" != "TRUE" ]]; then
     echo "Skipping sftd and coturn deployment because DEPLOY_CALLING_SERVICES=$DEPLOY_CALLING_SERVICES"
     return 0
@@ -269,13 +262,13 @@ configure_calling_environment
 # Create prod-values.example.yaml to values.yaml and take backup. Note: does not template anything.
 process_values "prod" "values"
 
-# Create prod-secrets.example.yaml to secrets.yaml and take backup
+# Create prod-secrets.example.yaml to secrets.yaml and take backup.
 process_values "prod" "secrets"
 
-# Sync postgresql secret
+# Sync postgresql secret.
 sync_pg_secrets
 
-# configure chart specific variables for each chart in values.yaml file
+# configure the chart specific variables for each chart in values.yaml file. This is where templating happens.
 configure_values
 
 # deploying with external datastores, useful for prod setup

From 18c93f58733ba8b0c33fe7e1aaf28507be64414b Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Wed, 29 Jul 2026 11:37:46 +0100
Subject: [PATCH 6/9] add missing quotes.

---
 bin/helm-operations.sh | 2 +-
 bin/migrate_secrets.sh | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/bin/helm-operations.sh b/bin/helm-operations.sh
index 40ba1e2e0..b25bd216b 100755
--- a/bin/helm-operations.sh
+++ b/bin/helm-operations.sh
@@ -147,7 +147,7 @@ configure_values() {
   fi
 
   if [[ "$DEPLOY_CALLING_SERVICES" == "TRUE" ]]; then
-    if [ ! -v $CALLING_NODE ] ; then
+    if [ ! -v "$CALLING_NODE" ] ; then
         echo "Refusing to deploy calling services; CALLING_NODE is not set."
         return 1
     fi
diff --git a/bin/migrate_secrets.sh b/bin/migrate_secrets.sh
index 1a62584a8..aff9fd98f 100644
--- a/bin/migrate_secrets.sh
+++ b/bin/migrate_secrets.sh
@@ -14,7 +14,7 @@ OLD="${OLD:-../wire-server-deploy/values/wire-server/secrets.yaml}"
 NEW="${NEW:-values/wire-server/prod-secrets.example.yaml}"
 NEWCOTURN="${NEWCOTURN:-values/coturn/prod-secrets.example.yaml}"
 
-if [ ! -f $OLD ]; then
+if [ ! -f "$OLD" ]; then
     {
 	echo "could not find OLD YAML file: $OLD"
 	echo "please set OLD to point to your in-use wire-server secrets file manually (see usage at top of script)."
@@ -22,7 +22,7 @@ if [ ! -f $OLD ]; then
     }
 fi
 
-if [ ! -f $NEW ]; then
+if [ ! -f "$NEW" ]; then
     {
 	echo "could not find NEW YAML file: $NEW"
 	echo "please set NEW to point to your new wire-server secrets files manually (see usage at top of script)."
@@ -31,7 +31,7 @@ if [ ! -f $NEW ]; then
 fi
 OUT="${NEW}.migrated"
 
-if [ ! -f $NEWCOTURN ]; then
+if [ ! -f "$NEWCOTURN" ]; then
     {
 	echo "could not find NEWCOTURN YAML file: $NEW"
 	echo "please set NEWCOTURN to point to your new coturn secrets files manually (see usage at top of script)."

From 05ce7ef93f9eb1cbe58a23301f54e953c7962e11 Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Wed, 29 Jul 2026 11:56:22 +0100
Subject: [PATCH 7/9] add changelog.

---
 changelog.d/3-deploy-builds/upgrade_wiab_staging | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 changelog.d/3-deploy-builds/upgrade_wiab_staging

diff --git a/changelog.d/3-deploy-builds/upgrade_wiab_staging b/changelog.d/3-deploy-builds/upgrade_wiab_staging
new file mode 100644
index 000000000..deb06e78e
--- /dev/null
+++ b/changelog.d/3-deploy-builds/upgrade_wiab_staging
@@ -0,0 +1,3 @@
+ * Added: bin/migrate_secrets.sh to migrate secrets from an old deploy directory to a new one.
+ * Modified: bin/helm-operations.sh to allow it's use during an upgrade.
+ * Modified: ansible/setup-offline-sources.yml to allow running it without touching APT configurations during an upgrade.

From abd2000a5227af44bbf23badf9e918975351a0c6 Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Wed, 29 Jul 2026 12:03:21 +0100
Subject: [PATCH 8/9] change format.

---
 changelog.d/3-deploy-builds/upgrade_wiab_staging | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/changelog.d/3-deploy-builds/upgrade_wiab_staging b/changelog.d/3-deploy-builds/upgrade_wiab_staging
index deb06e78e..30e21cdf6 100644
--- a/changelog.d/3-deploy-builds/upgrade_wiab_staging
+++ b/changelog.d/3-deploy-builds/upgrade_wiab_staging
@@ -1,3 +1,3 @@
- * Added: bin/migrate_secrets.sh to migrate secrets from an old deploy directory to a new one.
- * Modified: bin/helm-operations.sh to allow it's use during an upgrade.
- * Modified: ansible/setup-offline-sources.yml to allow running it without touching APT configurations during an upgrade.
+Added: bin/migrate_secrets.sh to migrate secrets from an old deploy directory to a new one.
+Modified: bin/helm-operations.sh to allow it's use during an upgrade.
+Modified: ansible/setup-offline-sources.yml to allow running it without touching APT configurations during an upgrade.

From 88276413bd4b788e3c836574cfa71d2eb3753713 Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Wed, 29 Jul 2026 12:04:39 +0100
Subject: [PATCH 9/9] change format.

---
 changelog.d/3-deploy-builds/upgrade_wiab_staging | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/changelog.d/3-deploy-builds/upgrade_wiab_staging b/changelog.d/3-deploy-builds/upgrade_wiab_staging
index 30e21cdf6..d52885bde 100644
--- a/changelog.d/3-deploy-builds/upgrade_wiab_staging
+++ b/changelog.d/3-deploy-builds/upgrade_wiab_staging
@@ -1,3 +1,3 @@
 Added: bin/migrate_secrets.sh to migrate secrets from an old deploy directory to a new one.
-Modified: bin/helm-operations.sh to allow it's use during an upgrade.
-Modified: ansible/setup-offline-sources.yml to allow running it without touching APT configurations during an upgrade.
+Changed: bin/helm-operations.sh to allow it's use during an upgrade.
+Changed: ansible/setup-offline-sources.yml to allow running it without touching APT configurations during an upgrade.