From 935a6222f45e8cf100c3d092e6a892750b9d03ff Mon Sep 17 00:00:00 2001 From: Sven Tennie Date: Thu, 13 Aug 2026 11:35:35 +0200 Subject: [PATCH 1/2] multi-ingress: Document to disable public account creation Team settings is not multi-ingress ready, so this won't work anyways. Also, allowing everyone to create accounts is certainly not what on-prems want. --- src/how-to/install/multi-ingress.md | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/src/how-to/install/multi-ingress.md b/src/how-to/install/multi-ingress.md index 6bbe089..6aa43fb 100644 --- a/src/how-to/install/multi-ingress.md +++ b/src/how-to/install/multi-ingress.md @@ -94,6 +94,25 @@ Multi-ingress configuration settings are discussed in detail in the Apart from already configured values for domain `green.example.org`, the following changes will be required: +### Brig (optional) + +```yaml +brig: + config: + optSettings: + setRestrictUserCreation: true +``` + +This complements the `FEATURE_ENABLE_ACCOUNT_REGISTRATION: false` setting for +the webapp (see [Instructions for required changes in webapp +values](#instructions-for-required-changes-in-webapp-values)). +`setRestrictUserCreation` prohibits public account creation via API. Creating +users via SCIM or team invitations still works. + +N.B. *team owners* are users as well. So, initial team owners must be created +before this setting is activated or these users need to be created via internal +endpoints. + ### Galley ```yaml @@ -298,7 +317,7 @@ envVars: ENFORCE_HTTPS: "true" ENABLE_DYNAMIC_HOSTNAME: "true" FEATURE_CHECK_CONSENT: "false" - FEATURE_ENABLE_ACCOUNT_REGISTRATION: "true" + FEATURE_ENABLE_ACCOUNT_REGISTRATION: "false" FEATURE_ENABLE_DEBUG: "false" FEATURE_ENABLE_FEDERATION: "false" # multi-ingress is not compatible with federation FEATURE_ENABLE_SSO: "true" # set to "false" if SSO is not used @@ -326,6 +345,12 @@ envVars: Also ensure that the above environment variables are in sync with [https://github.com/wireapp/wire-server-deploy/blob/master/values/webapp/prod-values.example.yaml](https://github.com/wireapp/wire-server-deploy/blob/master/values/webapp/prod-values.example.yaml) in terms of names. +`FEATURE_ENABLE_ACCOUNT_REGISTRATION` would allow public account registration +for *everyone*. This is usually not desirable for on-prems. Also, this feature +depends on the team settings app, which isn't capable to be used via multiple +ingresses, yet. (It's fine to use it to manage teams via the main-ingress, +though.) + ### Deploy webapp helm chart **Re-deploy** the webapp helm chart as following: From 4c3759291b41cef640bed386c2d59bb6099e0652 Mon Sep 17 00:00:00 2001 From: Sven Tennie Date: Wed, 7 Oct 2026 15:14:35 +0200 Subject: [PATCH 2/2] Correct description of account registration feature Fix typo and clarify usage of team settings app. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/how-to/install/multi-ingress.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/how-to/install/multi-ingress.md b/src/how-to/install/multi-ingress.md index 6aa43fb..90a3bf0 100644 --- a/src/how-to/install/multi-ingress.md +++ b/src/how-to/install/multi-ingress.md @@ -347,7 +347,7 @@ Also ensure that the above environment variables are in sync with [https://githu `FEATURE_ENABLE_ACCOUNT_REGISTRATION` would allow public account registration for *everyone*. This is usually not desirable for on-prems. Also, this feature -depends on the team settings app, which isn't capable to be used via multiple +depends on the team settings app, which isn't capable of being used via multiple ingresses, yet. (It's fine to use it to manage teams via the main-ingress, though.)