# wireapp/wire-server architecture

> Architecture diagram of the GitHub repository wireapp/wire-server, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/wireapp/wire-server
- Repository: https://github.com/wireapp/wire-server

## Overview

Wire Server is a self-hostable messaging backend. Clients enter through the public API reverse proxy; the repository README identifies the major service responsibilities, but does not document their runtime call graph, so service-to-service links are omitted. The sampled sources also expose an MLS performance client and a reusable ZAuth library; their internal links are shown where the excerpts or source index establish them. Other service capabilities are represented from README descriptions, not inspected implementation.

Main entry points: [`libs/libzauth/libzauth/src/lib.rs`](https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/lib.rs) (ZAuth Library), [`hack/bin/performance.py`](https://github.com/wireapp/wire-server/blob/develop/hack/bin/performance.py) (MLS Performance Tool), [`hack/python/wire/context.py`](https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/context.py) (Service Context), [`hack/python/wire/conversions.py`](https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/conversions.py) (ID Conversions)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_edge["API Edge"]
  node_nginz["API Proxy"]
end

subgraph group_services["Wire Services"]
  node_brig["Accounts"]
  node_galley["Teams & Chats"]
  node_gundeck["Push Hub"]
  node_cannon["WebSocket Push"]
  node_cargohold["Asset Storage"]
  node_proxy["API Integrations"]
  node_spar["SSO & SCIM"]
  node_federator["Federation"]
  node_worker["Background Jobs"]
end

subgraph group_auth["Authentication"]
  node_zauth["ZAuth Library<br/>[lib.rs]"]
  node_token["Token Verification<br/>[zauth.rs]"]
  node_oauth["OAuth Scopes<br/>[oauth.rs]"]
  node_acl["Access Rules<br/>[acl.rs]"]
  node_matcher["Rule Matching<br/>[matcher.rs]"]
end

subgraph group_clienttools["Client Utilities"]
  node_perf["MLS Performance Tool<br/>[performance.py]"]
  node_api["HTTP API Helpers<br/>[api.py]"]
  node_context["Service Context<br/>[context.py]"]
  node_mlscli["MLS CLI Wrapper<br/>[mlscli.py]"]
  node_conversion["ID Conversions<br/>[conversions.py]"]
  node_response["HTTP Responses<br/>[response.py]"]
  node_frozendict["Frozen Mapping<br/>[frozendict.py]"]
end

node_client(("Wire Client"))

node_client -->|"sends API requests"| node_nginz
node_zauth -->|"exports"| node_token
node_zauth -->|"exports"| node_oauth
node_zauth -->|"exports"| node_acl
node_zauth -->|"declares"| node_matcher
node_perf -->|"uses"| node_api
node_perf -->|"uses"| node_mlscli
node_perf -->|"uses"| node_conversion
node_context -->|"dispatches to"| node_api
node_context -->|"uses"| node_conversion
node_context -->|"wraps response"| node_response
node_conversion -->|"uses"| node_frozendict
node_response -->|"uses"| node_frozendict

click node_nginz "https://github.com/wireapp/wire-server/tree/develop/services/nginz"
click node_brig "https://github.com/wireapp/wire-server/tree/develop/services/brig"
click node_galley "https://github.com/wireapp/wire-server/tree/develop/services/galley"
click node_gundeck "https://github.com/wireapp/wire-server/tree/develop/services/gundeck"
click node_cannon "https://github.com/wireapp/wire-server/tree/develop/services/cannon"
click node_cargohold "https://github.com/wireapp/wire-server/tree/develop/services/cargohold"
click node_proxy "https://github.com/wireapp/wire-server/tree/develop/services/proxy"
click node_spar "https://github.com/wireapp/wire-server/tree/develop/services/spar"
click node_federator "https://github.com/wireapp/wire-server/tree/develop/services/federator"
click node_worker "https://github.com/wireapp/wire-server/tree/develop/services/background-worker"
click node_zauth "https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/lib.rs"
click node_token "https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/zauth.rs"
click node_oauth "https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/oauth.rs"
click node_acl "https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/acl.rs"
click node_matcher "https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/matcher.rs"
click node_perf "https://github.com/wireapp/wire-server/blob/develop/hack/bin/performance.py"
click node_api "https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/api.py"
click node_context "https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/context.py"
click node_mlscli "https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/mlscli.py"
click node_conversion "https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/conversions.py"
click node_response "https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/response.py"
click node_frozendict "https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/frozendict.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_nginz,node_client toneBlue
class node_brig,node_galley,node_gundeck,node_cannon,node_cargohold,node_proxy,node_spar,node_federator,node_worker toneAmber
class node_zauth,node_token,node_oauth,node_acl,node_matcher toneMint
class node_perf,node_api,node_context,node_mlscli,node_conversion,node_response,node_frozendict toneRose
```

## Components

### API Edge

- [API Proxy](https://github.com/wireapp/wire-server/tree/develop/services/nginz): `services/nginz`

### Wire Services

- [Accounts](https://github.com/wireapp/wire-server/tree/develop/services/brig): `services/brig`
- [Teams & Chats](https://github.com/wireapp/wire-server/tree/develop/services/galley): `services/galley`
- [Push Hub](https://github.com/wireapp/wire-server/tree/develop/services/gundeck): `services/gundeck`
- [WebSocket Push](https://github.com/wireapp/wire-server/tree/develop/services/cannon): `services/cannon`
- [Asset Storage](https://github.com/wireapp/wire-server/tree/develop/services/cargohold): `services/cargohold`
- [API Integrations](https://github.com/wireapp/wire-server/tree/develop/services/proxy): `services/proxy`
- [SSO & SCIM](https://github.com/wireapp/wire-server/tree/develop/services/spar): `services/spar`
- [Federation](https://github.com/wireapp/wire-server/tree/develop/services/federator): `services/federator`
- [Background Jobs](https://github.com/wireapp/wire-server/tree/develop/services/background-worker): `services/background-worker`

### Authentication

- [ZAuth Library](https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/lib.rs): `libs/libzauth/libzauth/src/lib.rs`
- [Token Verification](https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/zauth.rs): `libs/libzauth/libzauth/src/zauth.rs`
- [OAuth Scopes](https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/oauth.rs): `libs/libzauth/libzauth/src/oauth.rs`
- [Access Rules](https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/acl.rs): `libs/libzauth/libzauth/src/acl.rs`
- [Rule Matching](https://github.com/wireapp/wire-server/blob/develop/libs/libzauth/libzauth/src/matcher.rs): `libs/libzauth/libzauth/src/matcher.rs`

### Client Utilities

- [MLS Performance Tool](https://github.com/wireapp/wire-server/blob/develop/hack/bin/performance.py): `hack/bin/performance.py`
- [HTTP API Helpers](https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/api.py): `hack/python/wire/api.py`
- [Service Context](https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/context.py): `hack/python/wire/context.py`
- [MLS CLI Wrapper](https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/mlscli.py): `hack/python/wire/mlscli.py`
- [ID Conversions](https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/conversions.py): `hack/python/wire/conversions.py`
- [HTTP Responses](https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/response.py): `hack/python/wire/response.py`
- [Frozen Mapping](https://github.com/wireapp/wire-server/blob/develop/hack/python/wire/frozendict.py): `hack/python/wire/frozendict.py`

### Other components

- **Wire Client**

## Connections

- Wire Client → API Proxy: sends API requests
- ZAuth Library → Token Verification: exports (evidence: `libs/libzauth/libzauth/src/lib.rs`)
- ZAuth Library → OAuth Scopes: exports (evidence: `libs/libzauth/libzauth/src/lib.rs`)
- ZAuth Library → Access Rules: exports (evidence: `libs/libzauth/libzauth/src/lib.rs`)
- ZAuth Library → Rule Matching: declares (evidence: `libs/libzauth/libzauth/src/lib.rs`)
- MLS Performance Tool → HTTP API Helpers: uses (evidence: `hack/bin/performance.py`)
- MLS Performance Tool → MLS CLI Wrapper: uses (evidence: `hack/bin/performance.py`)
- MLS Performance Tool → ID Conversions: uses (evidence: `hack/bin/performance.py`)
- Service Context → HTTP API Helpers: dispatches to (evidence: `hack/python/wire/context.py`)
- Service Context → ID Conversions: uses (evidence: `hack/python/wire/context.py`)
- Service Context → HTTP Responses: wraps response (evidence: `hack/python/wire/context.py`)
- ID Conversions → Frozen Mapping: uses (evidence: `hack/python/wire/conversions.py`)
- HTTP Responses → Frozen Mapping: uses (evidence: `hack/python/wire/response.py`)