diff --git a/REUSE.toml b/REUSE.toml index bcc3a3cb..21edc7f2 100644 --- a/REUSE.toml +++ b/REUSE.toml @@ -3,11 +3,6 @@ version = 1 -[[annotations]] -path = "helmfile/files/theme/*" -SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH" -SPDX-License-Identifier = "Apache-2.0" - [[annotations]] path = "cspell.json" SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH" @@ -17,3 +12,13 @@ SPDX-License-Identifier = "Apache-2.0" path = "helmfile/files/gpg-pubkeys/*" SPDX-FileCopyrightText = "2023 Bundesministerium des Innern und für Heimat, PG ZenDiS \"Projektgruppe für Aufbau ZenDiS\"" SPDX-License-Identifier = "CC0-1.0" + +[[annotations]] +path = "helmfile/files/theme/*" +SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH" +SPDX-License-Identifier = "Apache-2.0" + +[[annotations]] +path = "helmfile/files/portal-tiles/*" +SPDX-FileCopyrightText = "2024 Google LLC" +SPDX-License-Identifier = "Apache-2.0" diff --git a/docs/debugging.md b/docs/debugging.md index f39b5fb6..1001a242 100644 --- a/docs/debugging.md +++ b/docs/debugging.md @@ -36,6 +36,9 @@ component's log level to debug and it get some features like: - An ingress for `http://minio-console.` is configured. and set the log level for components to "Debug". +**Note**: When enabling debug and running upgrades you must manually delete all jobs before the upgrade. As with debug +we keep the jobs and some job fields are immutable it could otherwise lead into an upgrade failure. + **Note:** All containers should write their log output to STDOUT, if you find (valuable) logs inside a container, please let us know! # Adding containers to a pod for debugging purposes diff --git a/docs/migrations.md b/docs/migrations.md index 19b8c796..0fe346ae 100644 --- a/docs/migrations.md +++ b/docs/migrations.md @@ -13,6 +13,8 @@ SPDX-License-Identifier: Apache-2.0 * [File-share configurability](#file-share-configurability) * [Updated default subdomains in `global.hosts`](#updated-default-subdomains-in-globalhosts) * [Updated `global.imagePullSecrets`](#updated-globalimagepullsecrets) + * [Removal of unnecessary OX-Profiles in Nubus](#removal-of-unnecessary-ox-profiles-in-nubus) + * [Dedicated group for access of the UDM REST API](#dedicated-group-for-access-of-the-udm-rest-api) * [Automated migrations](#automated-migrations) * [Local Postfix as Relay](#local-postfix-as-relay) * [Updated IAM component Nubus](#updated-iam-component-nubus) @@ -163,6 +165,49 @@ global: - "external-registry" ``` +#### Removal of unnecessary OX-Profiles in Nubus + +The update will remove unnecessary OX-Profiles in Nubus, but can't as long as these profiles are in use. + +So please ensure that only the following two supported profiles are assigned to your users: +- `opendesk_standard`: "opendesk Standard" +- `none`: "Login disabled" + +You can check and update the profiles as follows: +- Login as IAM admin. +- Open the user module. +- Open the extended search by clicking the funnel (Trichter) icon next to the search input field. +- Open the "Property" (Eigenschaft) list and select "OX Access" (OX-Berechtigung). +- In the input field right next to the list enter an asterisk (*). +- Start the search by clicking once more on the funnel icon. +- Sort the result list for the "OX Access" column +- Edit every user that has a value different to `opendesk_standard` or `none`: + - Open the user. + - Go to section "OX App Suite". + - Change the value in the dropdown "OX Access" to either: + - "openDesk Standard" if the user should be able to use the Groupware module or + - "Login disabled" if the user should not user the Groupware module. + - Update the user account with the green "SAVE" button on top of the page. + +#### Dedicated group for access of the UDM REST API + +Prerequisite: You allow the use of the [IAM's API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html) +with the following settings: + +``` +functional: + externalServices: + nubus: + udmRestApi: + enabled: true +``` + +With 0.9.0 all members of the group "Domain Admins" were able to successfully authenticate with the API. + +This has been changed and there is now a dedicated group required for using the API: `IAM API - Full Access` + +If you need specific accounts to make use of the API, please go ahead and assign them to the aforementioned group. + ### Automated migrations #### Local Postfix as Relay diff --git a/helmfile/apps/nubus/values-nubus.yaml.gotmpl b/helmfile/apps/nubus/values-nubus.yaml.gotmpl index 606f45fc..7b38feb1 100644 --- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl +++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl @@ -82,23 +82,27 @@ global: configUcr: directory: manager: + rest: + authorized-groups: + domain-admins: __DELETE_KEY__ + iam-api-full-access: "cn=IAM API - Full Access,cn=groups,{{ .Values.ldap.baseDn }}" web: modules: users: user: add: - default: cn=openDesk User,cn=templates,cn=univention,{{ .Values.ldap.baseDn }} + default: "cn=openDesk User,cn=templates,cn=univention,{{ .Values.ldap.baseDn }}" properties: description: - syntax: TextArea + syntax: "TextArea" firstname: required: "true" mailPrimaryAddress: required: "true" username: - syntax: uid + syntax: "uid" search: - autosearch: "False" + autosearch: "True" wizard: property: invite: @@ -114,7 +118,7 @@ global: ucs: web: - theme: light + theme: "light" umc: cookie-banner: @@ -132,8 +136,12 @@ global: all: disabled: "True" self-service: + account-registration: + usertemplate: __DELETE_KEY__ passwordreset: token_validity_period: 172800 + blacklist: + groups: __DELETE_KEY__ ingress: certManager: @@ -417,6 +425,10 @@ nubusStackDataUms: smtpStartTls: false ldapBase: {{ .Values.ldap.baseDn }} templateContext: + # creates the default.user and default.admin + loadDevData: true + portalHeaderLogo: {{ toYaml .Values.theme.imagery.logoHeaderSvgB64 | quote }} + portalTiles: {{ toYaml .Values.theme.portalTiles | nindent 6 }} portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }} portalRealtimeVideoconferenceLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.jitsi .Values.global.domain }} portalManagementProjectLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openproject .Values.global.domain }} @@ -455,12 +467,11 @@ nubusStackDataUms: portaltileGroupLiveCollaboration: - 'cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}' systemInformation: - enabled: true releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}" - {{- if .Values.functional.admin.portal.deploymentInformation.enabled }} + {{- if .Values.functional.admin.portal.deploymentTimestamp.enabled }} deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}" {{- else }} - deployDate: "not available" + deployDate: false {{- end }} # In openDesk the external memcache does not expect a username to be set. Overwriting # the default username of `selfservice` is part of the customizing: diff --git a/helmfile/environments/default/functional.yaml b/helmfile/environments/default/functional.yaml index d5d1323e..51d55d1b 100644 --- a/helmfile/environments/default/functional.yaml +++ b/helmfile/environments/default/functional.yaml @@ -4,8 +4,9 @@ functional: admin: portal: - deploymentInformation: - # Disable to not provide and update openDesk release version and deployment timestamp for admins in the portal. + deploymentTimestamp: + # Set to `false` to disable to not provide and update openDesk deployment timestamp for admins in the portal. + # This is helpful in GitOps deployments as with the timestamp there will always be a change detected. enabled: true authentication: diff --git a/helmfile/environments/default/images.yaml b/helmfile/environments/default/images.yaml index a16ba3e9..a10980bc 100644 --- a/helmfile/environments/default/images.yaml +++ b/helmfile/environments/default/images.yaml @@ -369,7 +369,7 @@ images: # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nubus" registry: "registry.opencode.de" repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus" - tag: "1.5.1@sha256:d4b97a6438e89e747ab38d975895347eec5ecd771af4d35dd0865d98fd585029" + tag: "1.6.8@sha256:cb93cab805aee16b6a1c6dea2442173ce87fe1241731926ac231f7eb27550a1b" nubusOpenPolicyAgent: # providerCategory: "Supplier" # providerResponsible: "Univention" diff --git a/helmfile/environments/default/theme.gotmpl b/helmfile/environments/default/theme.gotmpl index e5f42ea3..56969f1e 100644 --- a/helmfile/environments/default/theme.gotmpl +++ b/helmfile/environments/default/theme.gotmpl @@ -53,4 +53,29 @@ theme: logoPortalBackgroundSvgB64: {{ readFile "./../../files/theme/logoPortalBackground.svg" | b64enc | quote }} portalCss: {{ readFile "./../../files/theme/portal.css" | b64enc }} + portalTiles: + adminAnnouncement: {{ readFile "./../../files/portal-tiles/admin_announcement.svg" | b64enc | quote }} + adminContext: {{ readFile "./../../files/portal-tiles/admin_context.svg" | b64enc | quote }} + adminFunctionalmailbox: {{ readFile "./../../files/portal-tiles/admin_functionalmailbox.svg" | b64enc | quote }} + adminGroup: {{ readFile "./../../files/portal-tiles/admin_group.svg" | b64enc | quote }} + adminResource: {{ readFile "./../../files/portal-tiles/admin_resource.svg" | b64enc | quote }} + adminUser: {{ readFile "./../../files/portal-tiles/admin_user.svg" | b64enc | quote }} + anonymousLogin: {{ readFile "./../../files/portal-tiles/anonymous_login.svg" | b64enc | quote }} + dummyCircle: {{ readFile "./../../files/portal-tiles/dummy_circle.svg" | b64enc | quote }} + fileshareActivity: {{ readFile "./../../files/portal-tiles/fileshare_activity.svg" | b64enc | quote }} + fileshareDirectdocOdp: {{ readFile "./../../files/portal-tiles/fileshare_directdoc_odp.svg" | b64enc | quote }} + fileshareDirectdocOds: {{ readFile "./../../files/portal-tiles/fileshare_directdoc_ods.svg" | b64enc | quote }} + fileshareDirectdocOdt: {{ readFile "./../../files/portal-tiles/fileshare_directdoc_odt.svg" | b64enc | quote }} + fileshareFiles: {{ readFile "./../../files/portal-tiles/fileshare_files.svg" | b64enc | quote }} + groupwareCalendar: {{ readFile "./../../files/portal-tiles/groupware_calendar.svg" | b64enc | quote }} + groupwareContacts: {{ readFile "./../../files/portal-tiles/groupware_contacts.svg" | b64enc | quote }} + groupwareMail: {{ readFile "./../../files/portal-tiles/groupware_mail.svg" | b64enc | quote }} + groupwareTasks: {{ readFile "./../../files/portal-tiles/groupware_tasks.svg" | b64enc | quote }} + managementKnowledge: {{ readFile "./../../files/portal-tiles/management_knowledge.svg" | b64enc | quote }} + managementProject: {{ readFile "./../../files/portal-tiles/management_project.svg" | b64enc | quote }} + realtimeCollaboration: {{ readFile "./../../files/portal-tiles/realtime_collaboration.svg" | b64enc | quote }} + realtimeVideoconference: {{ readFile "./../../files/portal-tiles/realtime_videoconference.svg" | b64enc | quote }} + selfserviceChangepassword: {{ readFile "./../../files/portal-tiles/selfservice_changepassword.svg" | b64enc | quote }} + selfserviceEditprofile: {{ readFile "./../../files/portal-tiles/selfservice_editprofile.svg" | b64enc | quote }} + selfserviceProtectaccount: {{ readFile "./../../files/portal-tiles/selfservice_protectaccount.svg" | b64enc | quote }} ... diff --git a/helmfile/files/portal-tiles/admin_announcement.svg b/helmfile/files/portal-tiles/admin_announcement.svg new file mode 100644 index 00000000..24e77079 --- /dev/null +++ b/helmfile/files/portal-tiles/admin_announcement.svg @@ -0,0 +1 @@ + diff --git a/helmfile/files/portal-tiles/admin_context.svg b/helmfile/files/portal-tiles/admin_context.svg new file mode 100644 index 00000000..d1df2396 --- /dev/null +++ b/helmfile/files/portal-tiles/admin_context.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/admin_functionalmailbox.svg b/helmfile/files/portal-tiles/admin_functionalmailbox.svg new file mode 100644 index 00000000..ef0c4ebe --- /dev/null +++ b/helmfile/files/portal-tiles/admin_functionalmailbox.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/admin_group.svg b/helmfile/files/portal-tiles/admin_group.svg new file mode 100644 index 00000000..3f2f96ca --- /dev/null +++ b/helmfile/files/portal-tiles/admin_group.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/admin_resource.svg b/helmfile/files/portal-tiles/admin_resource.svg new file mode 100644 index 00000000..0e450ac3 --- /dev/null +++ b/helmfile/files/portal-tiles/admin_resource.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/admin_user.svg b/helmfile/files/portal-tiles/admin_user.svg new file mode 100644 index 00000000..e6a6cde8 --- /dev/null +++ b/helmfile/files/portal-tiles/admin_user.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/anonymous_login.svg b/helmfile/files/portal-tiles/anonymous_login.svg new file mode 100644 index 00000000..74e578b1 --- /dev/null +++ b/helmfile/files/portal-tiles/anonymous_login.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/dummy_circle.svg b/helmfile/files/portal-tiles/dummy_circle.svg new file mode 100644 index 00000000..e69de29b diff --git a/helmfile/files/portal-tiles/fileshare_activity.svg b/helmfile/files/portal-tiles/fileshare_activity.svg new file mode 100644 index 00000000..7d8424ba --- /dev/null +++ b/helmfile/files/portal-tiles/fileshare_activity.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/fileshare_directdoc_odp.svg b/helmfile/files/portal-tiles/fileshare_directdoc_odp.svg new file mode 100644 index 00000000..e8ec1901 --- /dev/null +++ b/helmfile/files/portal-tiles/fileshare_directdoc_odp.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/fileshare_directdoc_ods.svg b/helmfile/files/portal-tiles/fileshare_directdoc_ods.svg new file mode 100644 index 00000000..f3706510 --- /dev/null +++ b/helmfile/files/portal-tiles/fileshare_directdoc_ods.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/fileshare_directdoc_odt.svg b/helmfile/files/portal-tiles/fileshare_directdoc_odt.svg new file mode 100644 index 00000000..be423005 --- /dev/null +++ b/helmfile/files/portal-tiles/fileshare_directdoc_odt.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/fileshare_files.svg b/helmfile/files/portal-tiles/fileshare_files.svg new file mode 100644 index 00000000..c8674949 --- /dev/null +++ b/helmfile/files/portal-tiles/fileshare_files.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/groupware_calendar.svg b/helmfile/files/portal-tiles/groupware_calendar.svg new file mode 100644 index 00000000..73811028 --- /dev/null +++ b/helmfile/files/portal-tiles/groupware_calendar.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/groupware_contacts.svg b/helmfile/files/portal-tiles/groupware_contacts.svg new file mode 100644 index 00000000..9cff53bd --- /dev/null +++ b/helmfile/files/portal-tiles/groupware_contacts.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/groupware_mail.svg b/helmfile/files/portal-tiles/groupware_mail.svg new file mode 100644 index 00000000..0008ebc4 --- /dev/null +++ b/helmfile/files/portal-tiles/groupware_mail.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/groupware_tasks.svg b/helmfile/files/portal-tiles/groupware_tasks.svg new file mode 100644 index 00000000..80a809cf --- /dev/null +++ b/helmfile/files/portal-tiles/groupware_tasks.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/management_knowledge.svg b/helmfile/files/portal-tiles/management_knowledge.svg new file mode 100644 index 00000000..01811595 --- /dev/null +++ b/helmfile/files/portal-tiles/management_knowledge.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/management_project.svg b/helmfile/files/portal-tiles/management_project.svg new file mode 100644 index 00000000..01a0c736 --- /dev/null +++ b/helmfile/files/portal-tiles/management_project.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/realtime_collaboration.svg b/helmfile/files/portal-tiles/realtime_collaboration.svg new file mode 100644 index 00000000..56e4d385 --- /dev/null +++ b/helmfile/files/portal-tiles/realtime_collaboration.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/realtime_videoconference.svg b/helmfile/files/portal-tiles/realtime_videoconference.svg new file mode 100644 index 00000000..1e6aa4a4 --- /dev/null +++ b/helmfile/files/portal-tiles/realtime_videoconference.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/selfservice_changepassword.svg b/helmfile/files/portal-tiles/selfservice_changepassword.svg new file mode 100644 index 00000000..f70c68eb --- /dev/null +++ b/helmfile/files/portal-tiles/selfservice_changepassword.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/selfservice_editprofile.svg b/helmfile/files/portal-tiles/selfservice_editprofile.svg new file mode 100644 index 00000000..a4805463 --- /dev/null +++ b/helmfile/files/portal-tiles/selfservice_editprofile.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/helmfile/files/portal-tiles/selfservice_protectaccount.svg b/helmfile/files/portal-tiles/selfservice_protectaccount.svg new file mode 100644 index 00000000..12439bfd --- /dev/null +++ b/helmfile/files/portal-tiles/selfservice_protectaccount.svg @@ -0,0 +1 @@ + \ No newline at end of file