1- # CHANGEME-DEMO: All values here should be changed/reviewed
1+ # CHANGEME-DEV: All values here should be changed/reviewed
2+ # check the ansible playbook ansible/wiab-demo/wire_secrets.yml on how these secrets are being randomly generated and rotated
3+ # make sure that any secrets related to external services like AWS, giphy, youtube, spotify etc are being updated before running the random secret generation (ansible/wiab-demo/wire_secrets.yml) at demo-secrets.example.yaml and before deploying the helm charts using the playbook (ansible/wiab-demo/helm_install.yml)
4+
5+ # The secrets for services like elasticsearch, postgresql, rabbitmq and AWS (fake) secretID and key are configured in their helm charts. The values passed to these charts can be modified at wire-server-deploy/service-name/demo-[values|secrets].example.yaml
6+ # postgresql - https://github.com/wireapp/helm-charts/tree/dev/charts/postgresql
7+ # elasticsearch - https://github.com/wireapp/wire-server/blob/develop/charts/elasticsearch-ephemeral
8+ # rabbitMQ - https://github.com/wireapp/wire-server/tree/develop/charts/rabbitmq
9+ # fake-aws - https://github.com/wireapp/wire-server/tree/develop/charts/fake-aws
10+ # AWS - this needs to be checked with wire support if needs to use real AWS services
11+
212elasticsearch-index :
313 secrets :
414 elasticsearch :
5- username : elastic
6- password : changeme
15+ username : " elastic"
16+ password : " changeme"
17+
718brig :
819 secrets :
20+ pgPassword : verysecurepassword
921 smtpPassword : dummyPassword
1022 zAuth :
1123 # generate zauth public/private keys with the 'zauth' executable from wire-server:
12- # ./dist/zauth -m gen-keypair -i 1
24+ # sudo docker run $ZAUTH_CONTAINER -m gen-keypair
1325 publicKeys : " <public key>"
1426 privateKeys : " <private key>"
1527 turn :
1628 # generate a high-entropy random string, e.g. using
17- # openssl rand -base64 64 | env LC_CTYPE=C tr -dc a-zA-Z0-9 | head -c 42
29+ # openssl rand -base64 64 | env LC_CTYPE=C tr -dc a-zA-Z0-9 | head -c 64
1830 secret : CHANGEMEE6KHMJU1uDhhgvsVWoIyzmn3u3GHRoWjTp
19- # these only need to be changed if using real AWS services
2031 awsKeyId : dummykey
2132 awsSecretKey : dummysecret
22- # These are only necessary if you wish to support sign up via SMS/calls
23- # And require accounts at twilio.com / nexmo.com
2433 rabbitmq :
2534 username : wire-server
2635 password : verysecurepassword
27- # PostgreSQL password is synced with the wire-postgresql-secret from k8s cluster
28- # To extract the secret from an existing Kubernetes cluster:
29- # kubectl get secret wire-postgresql-secret -n postgresql -o jsonpath='{.data.password}' | base64 -d
30- pgPassword : dummyPassword # gets replaced by the actual secret
3136 elasticsearch :
3237 username : " elastic"
3338 password : " changeme"
3439 elasticsearchAdditional :
3540 username : " elastic"
3641 password : " changeme"
37- cannon :
42+
43+ cargohold :
3844 secrets :
45+ awsKeyId : dummykey
46+ awsSecretKey : dummysecret
3947 rabbitmq :
4048 username : wire-server
4149 password : verysecurepassword
4250
43- cargohold :
51+ cannon :
4452 secrets :
45- # these only need to be changed if using real AWS services
46- awsKeyId : dummykey
47- awsSecretKey : dummysecret
4853 rabbitmq :
4954 username : wire-server
5055 password : verysecurepassword
5156
5257galley :
5358 secrets :
54- # these only need to be changed if using real AWS services
55- awsKeyId : dummykey
56- awsSecretKey : dummysecret
57- # PostgreSQL password is synced with the wire-postgresql-secret from k8s cluster
58- # To extract the secret from an existing Kubernetes cluster:
59- # kubectl get secret wire-postgresql-secret -n postgresql -o jsonpath='{.data.password}' | base64 -d
60- pgPassword : dummyPassword # gets replaced by the actual secret
6159 rabbitmq :
6260 username : wire-server
6361 password : verysecurepassword
62+ pgPassword : verysecurepassword
63+ # these only need to be changed if using real AWS services
64+ awsKeyId : dummykey
65+ awsSecretKey : dummysecret
66+
67+ # Generate MLS private keys using openssl
68+ # readonly MLS_KEY_INDENT=" "
69+ # Keys need 10 spaces indent (5 levels deep: galley.secrets.mlsPrivateKeys.removal.keyname)
70+ # generate_mls_key() { openssl genpkey "$@" 2>/dev/null | awk -v indent="$MLS_KEY_INDENT" '{printf "%s%s\n", indent, $0}'}
71+ # mls_ed25519_key="$(generate_mls_key -algorithm ed25519)"
72+ # mls_ecdsa_p256_key="$(generate_mls_key -algorithm ec -pkeyopt ec_paramgen_curve:P-256)"
73+ # mls_ecdsa_p384_key="$(generate_mls_key -algorithm ec -pkeyopt ec_paramgen_curve:P-384)"
74+ # mls_ecdsa_p521_key="$(generate_mls_key -algorithm ec -pkeyopt ec_paramgen_curve:P-521)"
75+
76+ # this will get initialized from wire_secrets.yml playbook or can be generated using above logic
77+ # mlsPrivateKeys:
78+ # removal:
79+ # ed25519: |
80+ # -----BEGIN PRIVATE KEY-----
81+ # -----END PRIVATE KEY-----
82+ # ecdsa_secp256r1_sha256: |
83+ # -----BEGIN PRIVATE KEY-----
84+ # -----END PRIVATE KEY-----
85+ # ecdsa_secp384r1_sha384: |
86+ # -----BEGIN PRIVATE KEY-----
87+ # -----END PRIVATE KEY-----
88+ # ecdsa_secp521r1_sha512: |
89+ # -----BEGIN PRIVATE KEY-----
90+ # -----END PRIVATE KEY-----
6491
6592gundeck :
6693 secrets :
@@ -71,19 +98,19 @@ gundeck:
7198 username : wire-server
7299 password : verysecurepassword
73100
74- proxy :
75- secrets :
76- # If you desire proxying/previews for the following services,
77- # set 'tags.proxy: true' in demo-values.yaml,
78- # create accounts with them and fill in these values:
79- proxy_config : |-
80- secrets {
81- youtube = "..."
82- googlemaps = "..."
83- soundcloud = "..."
84- giphy = "..."
85- spotify = "Basic ..."
86- }
101+ # proxy:
102+ # secrets:
103+ # # If you desire proxying/previews for the following services,
104+ # # set 'tags.proxy: true' in demo-values.yaml,
105+ # # create accounts with them and fill in these values:
106+ # proxy_config: |-
107+ # secrets {
108+ # youtube = "..."
109+ # googlemaps = "..."
110+ # soundcloud = "..."
111+ # giphy = "..."
112+ # spotify = "Basic ..."
113+ # }
87114
88115nginz :
89116 secrets :
@@ -93,9 +120,11 @@ nginz:
93120 # only necessary in test environments (env="staging"). See charts/nginz/README.md
94121 basicAuth : " <username>:<htpasswd-hashed-password>"
95122
123+
96124# RabbitMQ credentials for background-worker.
97125background-worker :
98126 secrets :
127+ pgPassword : verysecurepassword
99128 rabbitmq :
100129 username : wire-server
101130 password : verysecurepassword
0 commit comments