Skip to content

fix: WPB-25750 update multi-ingress documentation #117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mohitrajain wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix: WPB-25750 update multi-ingress documentation #117

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
220f663
fix: WPB-25750 update multi-ingress documentation
mohitrajain May 20, 2026
40049b7
fix: WPB-25750 update multi-ingress documentation
mohitrajain May 20, 2026
53eb7f1
fix: WPB-25750 update multi-ingress documentation
mohitrajain Jun 5, 2026
0f8e21d
fix: WPB-25750 blacklist URLs for deeplink config
mohitrajain Jul 9, 2026
b2194f6
fix: WPB-25750 blacklist URLs for deeplink config
mohitrajain Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 30 additions & 32 deletions src/how-to/install/multi-ingress.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,11 +93,12 @@ Wire-server backend values can be found at: [https://github.com/wireapp/wire-ser
galley:
config:
settings:
conversationCodeURI: https://accounts.green.example.org/conversation-join/
conversationCodeURI: https://account.green.example.org/conversation-join/
multiIngress:
red.example.com: https://accounts.red.example.com/conversation-join/
blue.example.net: https://accounts.blue.example.net/conversation-join/
red.example.com: https://account.red.example.com/conversation-join/
blue.example.net: https://account.blue.example.net/conversation-join/
```
Note: `settings.multiIngress` and `settings.conversationCodeURI` are mutually exclusive.
Comment on lines 95 to +101

@supersven supersven Sep 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The indentation of multiIngress doesn't seem to be correct. See https://github.com/wireapp/wire-server/blob/de23b558e4130d111c96ce2d5bf9529cafdb5b02/charts/wire-server/values.yaml#L99-L112

The Note is correct, so this is probably working by accident, because multiIngress defaults to null.


### Cargohold

Expand Down Expand Up @@ -136,7 +137,7 @@ nginz:
endpoints:
backendURL: "https://nginz-https.green.example.org"
backendWSURL: "https://nginz-ssl.green.example.org"
blackListURL: "https://clientblacklist.green.example.org/prod"
blackListURL: "https://clientblacklist.wire.com/prod"
teamsURL: "https://teams.green.example.org"
accountsURL: "https://account.green.example.org"
websiteURL: "https://green.example.org"
Expand All @@ -146,7 +147,7 @@ nginz:
endpoints:
backendURL: "https://nginz-https.red.example.com"
backendWSURL: "https://nginz-ssl.red.example.com"
blackListURL: "https://clientblacklist.red.example.com/prod"
blackListURL: "https://clientblacklist.wire.com/prod"
teamsURL: "https://teams.red.example.com"
accountsURL: "https://account.red.example.com"
websiteURL: "https://red.example.com"
Expand All @@ -155,7 +156,7 @@ nginz:
endpoints:
backendURL: "https://nginz-https.blue.example.net"
backendWSURL: "https://nginz-ssl.blue.example.net"
blackListURL: "https://clientblacklist.blue.example.net/prod"
blackListURL: "https://clientblacklist.wire.com/prod"
teamsURL: "https://teams.blue.example.net"
accountsURL: "https://account.blue.example.net"
websiteURL: "https://blue.example.net"
Expand All @@ -177,7 +178,7 @@ Webapp values can be found at: [https://github.com/wireapp/wire-server-deploy/bl
Override the whole file with following:

```yaml
replicaCount: 1
replicaCount: 3
config:
externalUrls:
backendRest: "nginz-https.[[hostname]]"
Expand Down Expand Up @@ -245,6 +246,7 @@ For each additional domain (e.g., `red.example.com`, `blue.example.net`), you mu

- **Unique release names** (e.g., `nginx-ingress-services-red`, `nginx-ingress-services-blue`)
- **Domain-specific values files** with distinct configurations
- **Separate TLS certificates** (e.g., `values/nginx-ingress-services/red-key.pem`, `values/nginx-ingress-services/red-cert.pem`)

### Prepare values for red domain

Expand All @@ -259,23 +261,13 @@ accountPages:
enabled: true
tls:
enabled: true
# NOTE: enable to automate certificate issuing with jetstack/cert-manager instead of
Comment thread
supersven marked this conversation as resolved.
# providing your own certs in secrets.yaml. Cert-manager is not installed automatically,
# it needs to be installed beforehand (see ./../../charts/certificate-manager/README.md)
useCertManager: false
issuer:
kind: ClusterIssuer
certManager:
inTestMode: false
# CHANGEME-PROD: required, if certificate manager is used; set to receive cert expiration
# notice and other Letsencrypt related notification
certmasterEmail: email@red.example.com

# CHANGEME-PROD: These values are suggested for deployments on bare metal and
# should be adjusted on a per installation basis

config:
dns:
base: red.example.com
https: nginz-https.red.example.com
ssl: nginz-ssl.red.example.com
webapp: webapp.red.example.com
Expand All @@ -300,7 +292,7 @@ service:
Deploy this chart as following:

```bash
helm upgrade --install nginx-ingress-services-red charts/nginx-ingress-services -f values/nginx-ingress-services/red-values.yaml
helm upgrade --install nginx-ingress-services-red charts/nginx-ingress-services -f values/nginx-ingress-services/red-values.yaml --set-file secrets.tlsWildcardCert=values/nginx-ingress-services/red-cert.pem --set-file secrets.tlsWildcardKey=values/nginx-ingress-services/red-key.pem
```

### Prepare values for blue domain
Expand All @@ -318,23 +310,13 @@ accountPages:
enabled: true
tls:
enabled: true
# NOTE: enable to automate certificate issuing with jetstack/cert-manager instead of
# providing your own certs in secrets.yaml. Cert-manager is not installed automatically,
# it needs to be installed beforehand (see ./../../charts/certificate-manager/README.md)
useCertManager: false
issuer:
kind: ClusterIssuer
certManager:
inTestMode: false
# CHANGEME-PROD: required, if certificate manager is used; set to receive cert expiration
# notice and other Letsencrypt related notification
certmasterEmail: email@blue.example.net

# CHANGEME-PROD: These values are suggested for deployments on bare metal and
# should be adjusted on a per installation basis

config:
dns:
base: blue.example.net
https: nginz-https.blue.example.net
ssl: nginz-ssl.blue.example.net
webapp: webapp.blue.example.net
Expand All @@ -359,7 +341,23 @@ service:
It will be deployed as:

```bash
helm upgrade --install nginx-ingress-services-blue charts/nginx-ingress-services -f values/nginx-ingress-services/blue-values.yaml
helm upgrade --install nginx-ingress-services-blue charts/nginx-ingress-services -f values/nginx-ingress-services/blue-values.yaml --set-file secrets.tlsWildcardCert=values/nginx-ingress-services/blue-cert.pem --set-file secrets.tlsWildcardKey=values/nginx-ingress-services/blue-key.pem
```

### Patch the CSP (Content security policy) for each multi-ingress domain

When the Webapp is used with multi-ingress calling, the ingress CSP configuration must explicitly allow the corresponding Calling endpoint (SFT_DOMAIN).
This update ensures that the browser accepts resources and connections required for calling functionality. The same need to be repeated for each multi-ingress domain. To find out which `SFT_DOMAIN` can be used, continue reading the [Calling](#calling) section.

```bash
d bash
Comment thread
supersven marked this conversation as resolved.
kubectl get ingress nginx-ingress-red -o yaml > nginx-ingress-red.yaml
MULTI_DOMAIN="red.example.com"
SFT_DOMAIN="sft.example-calling.com"
sed -i "s|} https://\\*\\.${MULTI_DOMAIN};|} https://*.${MULTI_DOMAIN} https://${SFT_DOMAIN};|" nginx-ingress-red.yaml
# debug command to verify
kubectl diff -f nginx-ingress-red.yaml
kubectl apply -f nginx-ingress-red.yaml
Comment on lines +347 to +360

@supersven supersven Sep 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is too much duct-tape hacking:

  • The sed statement is brittle (imagine the ingress slightly changes ...).
  • It's confusing to first install and then patch to have it correctly installed.

The way to go is certainly outlines by this PR: github.com/wireapp/wire-server/pull/5236

Though, I'm not sure if it adjusts all CSP parts to get remote SFT working.

@mohitrajain mohitrajain Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that this is a pure hack but we had to patch it before the PR 5236 was created. The PR is sill waiting for approval since long time. Once I merge the PR and it has been released - I will update the documentation.

@supersven supersven Sep 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see. Yeah, that's probably a misunderstanding: The backend team probably considered an approval by @smatting as good enough.

I've now reviewed and approved as well.

```

### Verify the deployment
Expand Down Expand Up @@ -522,7 +520,7 @@ Response:
"accountsURL": "https://account.red.example.com",
"backendURL": "https://nginz-https.red.example.com",
"backendWSURL": "https://nginz-ssl.red.example.com",
"blackListURL": "https://clientblacklist.red.example.com/prod",
"blackListURL": "https://clientblacklist.wire.com/prod",
"teamsURL": "https://teams.red.example.com",
"websiteURL": "https://red.example.com"
},
Expand Down
Loading