feat(size-profiles): Size profile overrides via helmfile selectable

# [1.10.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.9.0...v1.10.0) (2025-11-24)

### Bug Fixes

* **collabora:** Update Controller to 1.1.6 incl. Helm chart update to 1.1.10 ([d25c95f](d25c95f06b))
* **collabora:** Update from 25.04.5 to 25.04.6 ([8de0f5d](8de0f5de72))
* **external-services:** Create `nubus_authsession` database ([ec72602](ec72602cdd))
* **helmfile:** Enable verification for XWiki Helm chart ([5104793](51047936de))
* **helmfile:** Streamline annotations ([7aa717c](7aa717c050))
* **nubus:** Remove legacy `UMC` Keycloak client that was used for SAML connection with the Nubus portal ([152221f](152221fa79))
* **open-xchange:** Only enable `smtpSASLAuthEnable` when `relayHost` is set ([70bbbf3](70bbbf311f))
* **open-xchange:** Optimize Dovecot Pro full-text search caches; review `migrations.md` for required upgrade steps ([f3f707c](f3f707c9ee))
* **open-xchange:** Template SASL security options ([684c6d4](684c6d4f29))
* **open-xchange:** Update Dovecot configuration based on supplier's best practise review ([850761e](850761e047))
* **opendesk-static-files:** [[#260](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/260)] Fix doublette creation of configmap `data` keys when the same file is referenced multiple times for a component ([b5a76be](b5a76bea57))
* **openproject:** Update from 16.1.0 to 16.1.1 ([62fae99](62fae9976a))
* **xwiki:** Update XWiki from 17.4.4 to 17.4.7 ([02a3b77](02a3b77114))

### Features

* **jitsi:** Update from 2.0.10431 to 2.0.10590 ([f5aad1f](f5aad1fa47))
* **nubus:** Update from v1.14.0 to v1.15.2 ([12379d6](12379d67e0))
* **open-xchange:** Support for LDAP group based mailing lists ([cc94f0c](cc94f0c66d))
* **openproject:** Update OpenProject from 16.5.1 to 16.6.0 ([19438c0](19438c0281))

.gitlab-ci.yml

@@ -4,7 +4,7 @@
 ---
 include:
   - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "v2.4.10"
+    ref: "v2.4.17"
     file:
       - "ci/common/lint.yml"
       - "ci/release-automation/semantic-release.yml"
@@ -762,22 +762,38 @@ import-default-accounts:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $CREATE_DEFAULT_ACCOUNTS == "yes"
       when: "on_success"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.4.1"
   script:
     - "echo \"Starting default account import for ${DOMAIN}\""
     - "cd /app"
     - |
-      ./user_import_udm_rest_api.py \
+      set +e
-        --import_domain ${DOMAIN} \
+      success=0
-        --udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
+      for i in {1..5}; do
-        --set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
+        echo "Attempt $i/5..."
-        --import_filename ./template.ods \
+        ./user_import_udm_rest_api.py \
-        --admin_enable_fileshare True \
+          --import_domain ${DOMAIN} \
-        --admin_enable_knowledgemanagement True \
+          --udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
-        --admin_enable_projectmanagement True \
+          --set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
-        --create_admin_accounts True \
+          --import_filename ./template.ods \
-        --create_maildomains True \
+          --admin_enable_fileshare True \
-        --verify_certificate False
+          --admin_enable_knowledgemanagement True \
+          --admin_enable_projectmanagement True \
+          --create_admin_accounts True \
+          --create_maildomains True \
+          --verify_certificate False
+        if [ $? -eq 0 ]; then
+          echo "Script succeeded on attempt $i."
+          success=1
+          break
+        fi
+        echo "Script failed. Waiting 60 seconds before retry..."
+        sleep 60
+      done
+      if [ "$success" -ne 1 ]; then
+        echo "Script failed after 5 attempts."
+        exit 1
+      fi
 
 run-tests:
   stage: "post-execute"

.gitlab/issue_templates/Default.md

@@ -0,0 +1,59 @@
+## 🐛 Issue Report Template
+
+Thank you for reporting an issue!
+Please provide the details below to help us investigate and resolve it efficiently.
+If you have a feature request, please select the "Feature Request" template.
+
+### 📦 Deployment Details
+- **Release version deployed**:
+  _(e.g. v1.4.2, commit hash, or branch name)_
+
+- **Deployment type**:
+  - [ ] Fresh installation
+  - [ ] Upgrade (from version: ___ )
+
+### ☸️ Kubernetes Environment
+- **Kubernetes distribution** (select one):
+  - [ ] Rancher RKE / RKE2
+  - [ ] OpenShift
+  - [ ] k3s
+  - [ ] kind / minikube
+  - [ ] Other: ___________
+
+- **Kubernetes version**:
+  _(e.g. v1.27.3)_
+
+### 🌐 Ingress & Certificates
+- **Ingress controller in use**:
+  - [ ] Ingress NGINX Controller version: ___
+  - [ ] Other: Currently only Ingress NGINX is supported
+
+- **Certificate status**:
+  - [ ] Let’s Encrypt
+  - [ ] Other publicly verifiable certificate (issuer: ___ )
+  - [ ] Self-signed certificate (see [`self-signed-certificated.md`](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/enhanced-configuration/self-signed-certificates.md))
+    - [ ] Option 1
+    - [ ] Option 2a
+    - [ ] Option 2b
+
+### 🔧 Tooling Versions
+- **Helm version (`helm version`)**: ___________
+- **Helmfile version (`helmfile --version`)**: ___________
+
+### 🔍 Problem Description
+- **Expected behavior**:
+
+- **Observed behavior / error message**:
+
+- **Steps to reproduce**:
+  1.
+  2.
+  3.
+
+### 📄 Additional context
+
+- Relevant logs (please redact sensitive info):
+- Screenshots (if applicable):
+- Other notes that might help:
+
+## 🙌 Thank you for contributing to the project!

.gitlab/issue_templates/Feature_Request.md

@@ -0,0 +1,37 @@
+## 💡 Feature Request Template
+
+Thank you for suggesting an improvement!
+To help us understand and evaluate your idea, please provide the details below.
+
+### 📝 Summary
+
+- **Short description of the feature**:
+  _(One or two sentences that capture the core idea)_
+
+### 🎯 Use Case / Motivation
+
+- **Who would benefit from this feature?**
+  - [ ] Operators / Administrators
+  - [ ] Developers
+  - [ ] End users
+  - [ ] Other: ___________
+
+- **Why is this feature needed?**
+  _(Describe the problem, pain point, or gap this would address)_
+
+### 🔧 Proposed Solution
+
+- **How should it work?**
+  _(Describe the desired functionality. If relevant, provide examples, CLI flags, configuration snippets, or workflows.)_
+
+### 📊 Alternatives Considered
+
+- **Other approaches you’ve tried or thought of**:
+  _(What’s possible now, and why is it not sufficient?)_
+
+### 📄 Additional Context
+
+- Links to related issues, merge requests, or external references:
+- Screenshots, diagrams, or mockups (if available):
+
+## 🙌 Thank you for helping improve the project!

.gitlab/merge_request_templates/Bugfix.md

@@ -14,16 +14,19 @@ Explain for the reviewer how the change addresses the issue, providing some insi
 
 Provida a link to the issue or document the required details below.
 In case it is a GitLab issue, reference it at the end of the commit message in square brackets, like `[#123]`
+Provide steps for QA or reviewers to test the fix and mention anything reviewers should be aware of.
 
-### Before the Fix
+### Steps to reproduce
 
 1. ...
 
-### After the Fix
+### Actual behaviour
 
-Provide steps for QA or reviewers to test the fix and mention anything reviewers should be aware of:
+*Based on the "Steps to reproduce" explain what the user sees while the bug isn't fixed.*
 
-1. ...
+### Expected behaviour
+
+*Based on the "Steps to reproduce" explain what the user gets to see with the bug fix merged.*
 
 ## 🔄 Requirements for migrations
 
@@ -39,19 +42,20 @@ Set labels:
 ```
 /label ~"MR-Type::Bugfix"
 /label ~"PO::👀"
-/label ~"Tech Lead::👀"
 /label ~"QA::👀"
 /label ~"Testautomation::👀"
 ```
 
-# 👷 Developer Checklist
+ # 👷 Developer Checklist
 
-- Does the MR include new bits and pieces (e.g. new secrets) that require documentation?
+**Documentation:**
-  - [ ] No.
-  - [ ] Yes, and the documentation was updated accordingly.
 
-Document in an extra comment and link to that comment:
+Does this MR introduce changes (e.g., new secrets, configuration options) that require documentation?
-- [ ] How you verified the fix is working as expected, also in upgrade scenarios.
+- [ ] No
-- [ ] Any regression testing done.
+- [ ] Yes, and the documentation has been updated accordingly
 
---> Link to comment:
+**Quality Assurance:**
+- [ ] Verified that the feature works as expected, including upgrade scenarios
+- [ ] Performed regression testing
+- Link to internal comment(s) with detailed QA results (to avoid exposing infrastructure details):
+  - ...

.gitlab/merge_request_templates/Default.md

@@ -2,7 +2,12 @@ Thank you for your contribution!
 
 Please follow these simple guidelines to continue:
 
+- Select a MR template in case you contribution is covers more than simple documentation/non functional changes:
+  - `Update`: Major/minor updates of openDesk core applications, the ones listed on the [README.md](../../README.md). Main commit should be `feat(component): ...`
+  - `Bugfix`: For (bug)fixes in the platform or non-update/feature releases of the openDesk core applications. Main commit should be `fix(component): ...`
+  - `Feature`: An update in the platform providing support for a specific feature. Main commit should be `feat(component): ...`
+  - `Other`: All other changes.
+  - In case you just do a `chore`/`docs` commit, you can skip the templates from above.
 - Create MRs early and use the "draft" state to show that this MR isn't ready for review and merge.
-- Flag the MR "ready" as soon as it can be reviewed and QA'd.
 - Always assign the MR to yourself and set somebody from the development team as reviewer. If you do not know whom to chose leave the reviewer empty.
-- Select one of the templates in case your contribution contains more than simple documentation updates and follow the templates instructions.
+- Flag the MR "ready" as soon as it can be reviewed and QA'd.

.gitlab/merge_request_templates/Feature.md

@@ -29,19 +29,20 @@ Set labels:
 ```
 /label ~"MR-Type::Feature"
 /label ~"PO::👀"
-/label ~"Tech Lead::👀"
 /label ~"QA::👀"
 /label ~"Testautomation::👀"
 ```
 
 # 👷 Developer Checklist
 
-- Does the MR include new bits and pieces (e.g. new secrets) that require documentation?
+**Documentation:**
-  - [ ] No.
-  - [ ] Yes, and the documentation was updated accordingly.
 
-Document in an extra comment and link to that comment:
+Does this MR introduce changes (e.g., new secrets, configuration options) that require documentation?
-- [ ] How you verified the feature is working as expected, also in upgrade scenarios.
+- [ ] No
-- [ ] Any regression testing done.
+- [ ] Yes, and the documentation has been updated accordingly
 
---> Link to comment:
+**Quality Assurance:**
+- [ ] Verified that the feature works as expected, including upgrade scenarios
+- [ ] Performed regression testing
+- Link to internal comment(s) with detailed QA results (to avoid exposing infrastructure details):
+  - ...

.gitlab/merge_request_templates/Other.md

@@ -23,19 +23,20 @@ Set labels:
 ```
 /label ~"MR-Type::Other"
 /label ~"PO::👀"
-/label ~"Tech Lead::👀"
 /label ~"QA::👀"
 /label ~"Testautomation::👀"
 ```
 
 # 👷 Developer Checklist
 
-- Does the MR include new bits and pieces (e.g. new secrets) that require documentation?
+**Documentation:**
-  - [ ] No.
-  - [ ] Yes, and the documentation was updated accordingly.
 
-Document in an extra comment and link to that comment:
+Does this MR introduce changes (e.g., new secrets, configuration options) that require documentation?
-- [ ] How you verified the change is working as expected, also in upgrade scenarios.
+- [ ] No
-- [ ] Any regression testing done.
+- [ ] Yes, and the documentation has been updated accordingly
 
---> Link to comment:
+**Quality Assurance:**
+- [ ] Verified that the feature works as expected, including upgrade scenarios
+- [ ] Performed regression testing
+- Link to internal comment(s) with detailed QA results (to avoid exposing infrastructure details):
+  - ...

.gitlab/merge_request_templates/Update.md

@@ -5,12 +5,12 @@
 
 ## 📋 Changelog/Release Notes
 
-- [ ] [README.md](../../README.md) component table updated including the link to the related release notes
+- [ ] [README.md](../../README.md) component table updated including the link to the related release notes of the updated application.
-- [ ] Provide significant improvements you'd like to see in the openDesk release notes. If you have a lot of details to provide or someone else is providing the details, please use a comment on the MR and link the comment in here.
+- [ ] Provide significant improvements you would like to see in the [openDesk release notes](https://www.opendesk.eu/en/blog/opendesk-1-6). If you have a lot of details to provide or someone else is providing the details, you can use a comment on this MR and provide a link here.
 
 ## 🔄 Requirements for migrations
 
-- [ ] Minimum version of the application required in existing depoyments to update/upgrade:
+- [ ] Minimum version of the application required in existing deployments to update/upgrade:
 - [ ] Describe manual steps required to update existing deployments. This especially applies if the upgrade includes any breaking changes:
 - [ ] Any other considerations in context of the update:
 
@@ -23,19 +23,20 @@ Set labels:
 ```
 /label ~"MR-Type::AppUpdate"
 /label ~"PO::👀"
-/label ~"Tech Lead::👀"
 /label ~"QA::👀"
 /label ~"Testautomation::👀"
 ```
 
-## 👷 Developer Checklist
+# 👷 Developer Checklist
 
-- Does the MR include new bits and pieces (e.g. new secrets) that require documentation?
+**Documentation:**
-  - [ ] No.
-  - [ ] Yes, and the documentation was updated accordingly.
 
-Document in an extra comment and link to that comment:
+Does this MR introduce changes (e.g., new secrets, configuration options) that require documentation?
-- [ ] How you verified the update is working as expected, also in upgrade scenarios.
+- [ ] No
-- [ ] Any regression testing done.
+- [ ] Yes, and the documentation has been updated accordingly
 
---> Link to comment:
+**Quality Assurance:**
+- [ ] Verified that the feature works as expected, including upgrade scenarios
+- [ ] Performed regression testing
+- Link to internal comment(s) with detailed QA results (to avoid exposing infrastructure details):
+  - ...

CHANGELOG.md

@@ -1,3 +1,122 @@
+# [1.10.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.9.0...v1.10.0) (2025-11-24)
+
+
+### Bug Fixes
+
+* **collabora:** Update Controller to 1.1.6 incl. Helm chart update to 1.1.10 ([d25c95f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d25c95f06bc199d09aa6ea4dc09c10e95153de38))
+* **collabora:** Update from 25.04.5 to 25.04.6 ([8de0f5d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8de0f5de7277ad726588d7de2d06cb3e9376c993))
+* **external-services:** Create `nubus_authsession` database ([ec72602](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ec72602cdd3207f73ff806a26bfe7b9fd32b8634))
+* **helmfile:** Enable verification for XWiki Helm chart ([5104793](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/51047936de102c610adc00f4dff12d2eb8e945b0))
+* **helmfile:** Streamline annotations ([7aa717c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7aa717c0509a731c060c58a1b5877e1d9899406f))
+* **nubus:** Remove legacy `UMC` Keycloak client that was used for SAML connection with the Nubus portal ([152221f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/152221fa7976bfa942d5e9e9b8f78cc8e65765c0))
+* **open-xchange:** Only enable `smtpSASLAuthEnable` when `relayHost` is set ([70bbbf3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/70bbbf311fcba57c31f535be7d0d453f4a945cee))
+* **open-xchange:** Optimize Dovecot Pro full-text search caches; review `migrations.md` for required upgrade steps ([f3f707c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f3f707c9eee8edf3ad61834d87b5c059f31b0e26))
+* **open-xchange:** Template SASL security options ([684c6d4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/684c6d4f29dd447872ebe582eef43c04034896f7))
+* **open-xchange:** Update Dovecot configuration based on supplier's best practise review ([850761e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/850761e0475b2f281fb23f6972d5c74fbdaa3a61))
+* **opendesk-static-files:** [[#260](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/260)] Fix doublette creation of configmap `data` keys when the same file is referenced multiple times for a component ([b5a76be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b5a76bea57ef7b136c54d1bc95c40f0a0c3f9716))
+* **openproject:** Update from 16.6.0 to 16.6.1 ([62fae99](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/62fae9976a731c00700d56ce8fab198bb2531d20))
+* **xwiki:** Update XWiki from 17.4.4 to 17.4.7 ([02a3b77](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02a3b7711490394690df70ca92bab58b253e34f5))
+
+
+### Features
+
+* **jitsi:** Update from 2.0.10431 to 2.0.10590 ([f5aad1f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f5aad1fa47559f0d3941c233c7d40029a9e83281))
+* **nubus:** Update from v1.14.0 to v1.15.2 ([12379d6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/12379d67e07936496fe31276b2052406e0137db6))
+* **open-xchange:** Support for LDAP group based mailing lists ([cc94f0c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cc94f0c66df098d0a20f7f0d4a6af5e791557981))
+* **openproject:** Update OpenProject from 16.5.1 to 16.6.0 ([19438c0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/19438c02817875bd408c5d6cf423d7bfb61f907f))
+
+# [1.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.8.0...v1.9.0) (2025-11-07)
+
+
+### Bug Fixes
+
+* **collabora:** Update from 25.04.4.3.1 to 25.04.5.3.1 ([e0128e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e0128e6ccf02eaaa68fe53f5629150f0e0863ba0))
+* **element:** Increase message and media rate limits ([13968a8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13968a8133174024dc97c5cf73e6b1e7883ce0a0))
+* **element:** Update favicon to use PNG version ([f8104f6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f8104f635862ce6c80b66c6d7fa82df7cde9d446))
+* **element:** Update Synapse from v1.137.0 to v1.141.0; fixes https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr which applies to all openDesk deployments using Element/Matrix with federation enabled ([02d3021](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02d3021c4ba97f81165e286d1ee53b7c199f5dbb))
+* **element:** Update widgets primary color theme settings ([94394a1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/94394a1e3e3da304138263de73121a62aabbee11))
+* **gitlab:** Add issue templates ([26da7e3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/26da7e366709b3888f6786b574e3b3b11f1a6fab))
+* **helmfile:** Support setting the `defaultLanguage` - relevant for OX App Suite and XWiki - in `functional.yaml.gotmpl` ([24065db](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/24065dbc7043d09dbad0d272128cfe2f33f22e48))
+* **helmfile:** Use passwords defined in `database.yaml.gotmpl` for Cassandra when available ([0268219](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/026821996a4e42ac9ef25dd62c34d1697547962c))
+* **notes:** Fix python path for self signed certs ([c4279d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c4279d11bb46c9fe65b2ccd54dc0789d11c0d0d8))
+* **notes:** Fix repeated redirects on expired session; Remove fetching of external assets ([c1012f4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c1012f4e656222750dda0668d8f81e5d1fbe02fd))
+* **open-xchange:** Don't enable sasl auth when no relay host is set ([ff3b221](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ff3b2218706a98b854c072de62105aa8352e3949))
+* **open-xchange:** Enable and configure defaults for ContactCollector, remove legacy config artifacts ([465f60d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/465f60d4a28ead7d7a715db71dad9d9992e8b89a))
+* **open-xchange:** Use masterpassword for mailfilter in migration Pods; use PLAIN instead of OAuth for SASL ([484dfaf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/484dfafe643e04a717e6bc3a8e6e6e6f5011c1c1))
+* **ox-connector:** Use FQDN for internal service URLs ([8593d5f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8593d5f2bdea685a836edc9d9034ce1976cf2e96))
+
+
+### Features
+
+* **helmfile:** Add toggle for external mail client onboarding and allow non-default FQDNs for IMAP and SMTP endpoints ([25a97ab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/25a97abba69b34c6b65a08ca7af979f3897d218b))
+* **open-xchange:** Enable XRechnung in Viewer ([08e6ec5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/08e6ec59d2abac36a8f6e5ab10fec6a5643de282))
+* **openproject:** Update from 16.4.1 to 16.5.1 ([74cf2ee](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/74cf2ee0d818b5e017b3c97f6fbedb05ab764d67))
+
+# [1.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.7.1...v1.8.0) (2025-09-25)
+
+
+### Bug Fixes
+
+* **clamav:** [bmi/opendesk/deployment/opendesk[#234](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/234)] Update Helm chart to support conditional proxy credentials ([dee7525](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dee75256492577c7b2ab6bafd741e06f98acfccd))
+* **element:** Let Synapse create room `v12` by default; review `migrations.md` for details ([af9d4cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/af9d4cda6cf641e65fe49054e1397159272f3bd1))
+* **helmfile:** Add more detailed descriptions on `functional.authentication.realmSettings` and provide two `accessCodeLifespan*` options ([0314a70](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0314a7076ae7d377d86c3ff3acda691966a36635))
+* **helmfile:** Do not set portal "Support" link by default ([776fe92](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/776fe92ae18963b11503d4d7e20bbf298902ad9b))
+* **intercom-service:** Update from v2.19.0 to v2.19.5 ([3305dfa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3305dfa5fb4a22bd5354dec1f65eb0e95eed678d))
+* **jitsi:** [bmi/opendesk/deployment/opendesk[#228](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/228)] Turn off Gravatar option, by default this still keeps the input field in the Jitsi UI, but does not longer issue requests to gravatar.com; check `migrations.md` in case the option should be enabled ([083fa98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/083fa9842d6bd9c27eabac28f49668e5bee02a42))
+* **nextcloud:** App "Spreed" and core app "Comments" not enabled by default; review `migrations.md` for potential upgrade steps ([31d35b2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31d35b25c6cf0e4a18cf6f33b01a6dd0fd10545e))
+* **nextcloud:** Update from 31.0.6 to 31.0.7 including the latest app versions ([f848b9a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f848b9a0f4d6f65babb983b6527bfc63776b455a))
+* **open-xchange:** Add client onboarding for mail ([d8fc3e0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d8fc3e04f584da23bfd0590676f26cbac65bf4cf))
+* **open-xchange:** Set guest mode to inherit theming and set theme for notification mail button ([f2ce251](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f2ce25193a78eee3f103aabb368bf8457900fa1c))
+* **open-xchange:** Switch off Element integration when `apps.element.enabled: [secure]` ([7a2dbc5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7a2dbc5f8cca5981ffc171f2be1b72c40877ac2c))
+* **open-xchange:** Update Dovecot charts with improved auth cache defaults ([836d8a4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/836d8a494dcd2e8ab8ea95684742cd143cac6074))
+* **opendesk-certificates:** [bmi/opendesk/deployment/opendesk[#236](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/236)] Update Helm chart to add `commonName` to certificate ([2e708a7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2e708a75b6abdb987925333714c99d1e09bbc5a2))
+* **openproject:** [bmi/opendesk/deployment/opendesk[#228](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/228)] Turn off Gravatar option by default; check `migrations.md` in case the option should be enabled ([628e914](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/628e91435c37a615a421a48c2a9a0639840d9a78))
+* **ox-connector:** Update from v0.27.7 to v0.27.9 ([ba77f2b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ba77f2b11c0eb649891a5375258e6649686333fb))
+* **postfix:** Relax TLS settings to `TLSv1.2`/`medium` for broader SMTP relay compatibility ([31cbd9a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31cbd9af1a9afb177b70bccd329829f75bceab03))
+* **xwiki:** Update image to set new default for user self-registration; review migrations.md for required actions on existing deployments ([c75abaf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c75abaf1e660fe8daeeb09ee3d41e14ea67e9a25))
+
+
+### Features
+
+* **collabora:** Support for macro execution controlled by `functional.weboffice.macros.enabled` (default: `[secure]`) ([38f2bdd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/38f2bdd2b98e4248972363db73c03373db71f433))
+* **cryptpad:** Update from 2024.6.1 to 2025.6.0 ([23dfe0a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/23dfe0aaa6012f5695fc026d06920bd4b0a63f66))
+* **element:** Update Element-Web from 1.11.89 or 1.12.0 and Synapse from 1.129.0 to 1.137.0 ([f895bcc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f895bcc2b8a7d4010b19c7ffb6712c4813231f9d))
+* **element:** Update NeoBoard widget to v2.3.1, NeoChoice widget to v1.6.0, NeoDateFix widget to v1.7.2 and NeoDateFix bot to 2.8.5 ([b377a5e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b377a5e0e25e317c64c2d30b44370beb211e23fd))
+* **jitsi:** Upgrade from stable-9955 to stable-10431 ([e138610](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e138610d2941f6c3a93eef3764f252bd4eab9987))
+* **nextcloud:** Expose `forbiddenChars` in `functional.yaml.gotmpl`; review `migrations.md` for required upgrade steps ([5a2c1fc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5a2c1fcf98d3773deef8292773962d5f70832a0f))
+* **notes:** Update from 3.2.1 to 3.4.0 ([c636650](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c63665040cf3c985dc9878992785a893d261c420))
+* **nubus:** Update from 1.12.0 to 1.13.1 ([35424b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/35424b88d652a1e8a4c37fee4355636badba22b6))
+* **nubus:** Update from v1.13.1 to v1.14.0 using OIDC instead of SAML for portal SSO; review `migrations.md` for required upgrade steps ([d3b1f57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d3b1f575cc2deab70ca262ab301c6b67f9c1b393))
+* **open-xchange:** Add options to `functional.groupware`; review `migrations.md` for details on new defaults/required upgrade steps ([8a7cc3b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8a7cc3b8c7199f8c15f01e1b2d55d630431ddf9c))
+* **open-xchange:** Enable mail categories ([4da1c5d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4da1c5d9e3b1f66419a5e19ba683cff5681315bd))
+* **open-xchange:** Update from 8.39 to 8.40 ([c70a0bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c70a0bdc4c1564032982a2967788e0b78db74c00))
+* **open-xchange:** Update from 8.40 to 8.41 ([c50b817](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c50b81779539186f3885d6bdb64d348fbe7bda67))
+* **openproject:** Update OpenProject from 16.2.1 to 16.3.2 ([f77f329](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f77f3291caf778274c23f89bde3661e586447f5a))
+* **openproject:** Update OpenProject from 16.3.2 to 16.4.1 ([f5483d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f5483d1a3b4cb8fddff38bb9fc29439cd6c4fc40))
+* **xwiki:** Update from 16.10.5 to 17.4.4 and configure openDesk's Collabora for `.odt`, `.rtf` and `.docx` export of wiki pages ([813e92c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/813e92c1b05f806bff8022d71d8cd25f475b0b8f))
+
+## [1.7.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.7.0...v1.7.1) (2025-08-26)
+
+
+### Bug Fixes
+
+* **collabora:** Update from 25.04.3 to 25.04.4 ([84d6b50](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/84d6b504d21e687de3fb4cdabafc9cff6fe1f1d7))
+* **helmfile:** When optional mail domain is set, use it as sender domain for system generated (noreply) mails ([bd4c997](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bd4c997950750e36168434e82daf48f20d0a42df))
+* **jitsi:** Increase `patchJVB` job `backoffLimit` to avoid deployment failures on infrastructure where LoadBalancer services take longer to become available ([eb2a181](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/eb2a1811fb1d11b0dd0ea0e9987f96846a855ac7))
+* **nextcloud:** Fetch central navigation from cluster internal service ([dd0e516](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd0e516778104c47ef990d95d01bdec6b33d9bab))
+* **nextcloud:** Stop browser from caching server-generated files ([410a1ad](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/410a1ade6907f676d3c4cbc68b33754e0e41e9fb))
+* **nextcloud:** Work around a bug that breaks the `nextcloud-management` job in case the theming `primary_color` was set in Nextcloud's web UI ([4aebe22](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4aebe22f22dc9e679563a46687ebdc8793c281e8))
+* **notes:** Explicitly template security contexts; add missing ingress classes and pull secrets ([834c847](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/834c84768a3a6537990e27377acb170b6269dfb0))
+* **nubus:** Remove temporary `nubusUdmListener` `livenessProbe` as recommended by supplier ([688a505](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/688a505ef780e7c81006a73db6465ef75dea1404))
+* **open-xchange:** Click on top bar logo to point to portal instead of mail inbox ([9f762a7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9f762a7c2ea3f8e4d3207d8d2aae44597a366ee0))
+* **open-xchange:** Configure correct autoreply addresses and enable FTS in Dovecot EE ([997c083](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/997c083335b79aa7446894b6ebbb6ed1d5950a3d))
+* **open-xchange:** Explicitly deactivate DAV support if not enabled in `functional.yaml.gotmpl` ([62ba5ab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/62ba5aba496af40208a13abeb6c8f1de62e98e35))
+* **open-xchange:** Fix FTS bulk delete in Dovecot EE ([cd2a356](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cd2a356b89249b8a163f2becc57832164bc6c8e5))
+* **open-xchange:** Set mail quota using `functional.groupware.quota.default` ([67fe50e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/67fe50e53c7477016efe3b3d90c63214928f165c))
+* **opendesk-static-files:** Serve missing `.png` favicons for Notes and the Nextcloud topbar logo ([42b1105](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/42b11059d29d6445e1e4e3309ad7a9a026b56c92))
+* **ox-connector:** Update OX Connector and OX Extension to v0.27.7 ([57c96af](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/57c96af5a545a6a6851926b85bca0dc24263b55e))
+* **xwiki:** Templating of `imagePullSecrets` ([bbbcd68](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bbbcd6807e972c6120d90df52b8ffe9da03ebce3))
+
 # [1.7.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.6.0...v1.7.0) (2025-08-11)
 
 

README-EE.md

@@ -86,7 +86,7 @@ When a repository path starts with `/zendis`, the artifact is only available in
 ###  Collabora
 
 - Collabora Online (COOL) container image: Is build from the same public source code as Collabora Development Edition (CODE), only the build configurations might differ. COOL includes a brand package that is not public and its license is not open source.
-- COOL Controller container image and Helm chart: Source code and chart are using Mozilla Public License Version 2.0, but the source code is not public. It is provided to customers upon request.
+- [COOL Controller](https://www.collaboraonline.com/cool-controller-release-notes/) container image and Helm chart: Source code and chart are using Mozilla Public License Version 2.0, but the source code is not public. It is provided to customers upon request.
 
 openDesk updates Collabora once a COOL image based on the version pattern `<major>.<minor>.<patch>.3+.<build>` was made available. This happens usually at the same time the CODE image with `<major>.<minor>.<patch>.2+.<build>` is made available.
 

README.md

@@ -16,7 +16,7 @@ SPDX-License-Identifier: Apache-2.0
 * [Testing](#testing)
 * [Permissions](#permissions)
 * [Releases](#releases)
-* [Data Storage](#data-storage)
+* [Data storage](#data-storage)
 * [Feedback](#feedback)
 * [Development](#development)
 * [License](#license)
@@ -32,18 +32,18 @@ For production use, the [openDesk Enterprise Edition](./README-EE.md) is recomme
 
 openDesk currently features the following functional main components:
 
-| Function             | Functional Component        | License                                                                                | Component<br/>Version                                                                                                        | Upstream Documentation                                                                                                                |
+| Function             | Functional component        | License                                                                                | Component<br/>version                                                                         | Upstream documentation                                                                                                                |
-|----------------------|-----------------------------|----------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
+|----------------------|-----------------------------|----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
-| Chat & collaboration | Element ft. Nordeck widgets | AGPL-3.0-or-later (Element Web), AGPL-3.0-only (Synapse), Apache-2.0 (Nordeck widgets) | [1.11.89](https://github.com/element-hq/element-web/releases/tag/v1.11.89)                                                   | [For the most recent release](https://element.io/user-guide)                                                                          |
+| Chat & collaboration | Element ft. Nordeck widgets | AGPL-3.0-or-later (Element Web), AGPL-3.0-only (Synapse), Apache-2.0 (Nordeck widgets) | [1.12.0](https://github.com/element-hq/element-web/releases/tag/v1.12.0)                      | [For the most recent release](https://element.io/user-guide)                                                                          |
-| Collaborative notes  | Notes (aka Docs)            | MIT                                                                                    | [3.2.1](https://github.com/suitenumerique/docs/releases/tag/v3.2.1)                                                          | Online documentation/welcome document available in installed application                                                              |
+| Collaborative notes  | Notes (aka Docs)            | MIT                                                                                    | [3.4.0](https://github.com/suitenumerique/docs/releases/tag/v3.4.0)                           | Online documentation/welcome document available in installed application                                                              |
-| Diagram editor       | CryptPad ft. diagrams.net   | AGPL-3.0-only                                                                          | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                                                       | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
+| Diagram editor       | CryptPad ft. diagrams.net   | AGPL-3.0-only                                                                          | [2025.6.0](https://github.com/cryptpad/cryptpad/releases/tag/2025.6.0)                        | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | AGPL-3.0-or-later                                                                      | [31.0.6](https://nextcloud.com/de/changelog/#31-0-6)                                                                         | [Nextcloud 31](https://docs.nextcloud.com/)                                                                                           |
+| File management      | Nextcloud                   | AGPL-3.0-or-later                                                                      | [31.0.7](https://nextcloud.com/de/changelog/#31-0-7)                                          | [Nextcloud 31](https://docs.nextcloud.com/)                                                                                           |
-| Groupware            | OX App Suite                | GPL-2.0-only (backend), AGPL-3.0-or-later (frontend)                                   | [8.39](https://documentation.open-xchange.com/appsuite/releases/8.39/)                                                       | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Groupware            | OX App Suite                | GPL-2.0-only (backend), AGPL-3.0-or-later (frontend)                                   | [8.41](https://documentation.open-xchange.com/appsuite/releases/8.41/)                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
-| Knowledge management | XWiki                       | LGPL-2.1-or-later                                                                      | [16.10.5](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.5/)                                             | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
+| Knowledge management | XWiki                       | LGPL-2.1-or-later                                                                      | [17.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.4.4/)                | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
-| Portal & IAM         | Nubus                       | AGPL-3.0-or-later                                                                      | [1.12.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/1.12.html#version-1-12-0-2025-07-31)      | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
+| Portal & IAM         | Nubus                       | AGPL-3.0-or-later                                                                      | [1.15.2](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/1.15.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | GPL-3.0-only                                                                           | [16.2.1](https://www.openproject.org/docs/release-notes/16-2-1/)                                                             | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Project management   | OpenProject                 | GPL-3.0-only                                                                           | [16.6.1](https://www.openproject.org/docs/release-notes/16-6-1/)                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
-| Videoconferencing    | Jitsi                       | Apache-2.0                                                                             | [2.0.9955](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9955)                                        | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
+| Videoconferencing    | Jitsi                       | Apache-2.0                                                                             | [2.0.10590](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_10590)       | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
-| Weboffice            | Collabora                   | MPL-2.0                                                                                | [25.04.3](https://www.collaboraoffice.com/code-25-04-release-notes/)                                                         | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
+| Weboffice            | Collabora                   | MPL-2.0                                                                                | [25.04.6](https://www.collaboraoffice.com/code-25-04-release-notes/)                          | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
 
 While not all components are perfectly designed for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
@@ -108,7 +108,7 @@ in the files from the release's git-tag:
 
 Find more information in our [Workflow documentation](./docs/developer/workflow.md).
 
-# Data Storage
+# Data storage
 
 More information about different data storages used within openDesk are described in the
 [Data Storage documentation](./docs/data-storage.md).

REUSE.toml

@@ -37,3 +37,8 @@ SPDX-License-Identifier = "CC-BY-SA-4.0"
 path = ".gitlab/merge_request_templates/*.md"
 SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
 SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = ".gitlab/issue_templates/*.md"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"

dev/charts-local.py

@@ -129,7 +129,7 @@ def grep_yaml(file):
     with open(file, 'r') as file:
         content = ''
         for line in file.readlines():
-            if not ': {{' in line and not '- {{' in line:
+            if not '{{' in line:
                 content += line
     return yaml.safe_load(content)
 

docs/architecture.md

@@ -129,7 +129,7 @@ An overview of
 - components that consume the LDAP service.
   - The components access the LDAP using a component-specific LDAP search account.
 - components using Univention Keycloak as an identity provider (IdP).
-  - The components should use OAuth2 / OIDC flows if not otherwise denoted.
+  - All components use OAuth2 / OIDC flows.
   - All components have a client configured in Keycloak.
 
 Some components trust others to handle authentication for them.
@@ -148,7 +148,7 @@ flowchart TD
  D-->K
  O-->K
  X-->K
- P-->|SAML|K
+ P-->K
  E[Element]-->K
  J[Jitsi]-->K
  I[IntercomService]-->K
@@ -184,9 +184,6 @@ sequenceDiagram
     Note over Browser: User is authenticated
 ```
 
-> **Note:**<br>
-> Nubus' Portal and UMC still use [SAML 2.0](https://www.oasis-open.org/standard/saml/) to authenticate users. However, Nubus will switch to OIDC in an upcoming release, eliminating the use of SAML in openDesk altogether.
-
 ## Keycloak
 
 [Keycloak](https://www.keycloak.org/) is an open-source identity and access management solution for web based applications and services. It provides features such as single sign-on, multi-factor authentication, user federation, and centralized user management.
@@ -245,7 +242,7 @@ To find out more, see [Roles & Permissions](./docs/permissions.md).
 
 In openDesk, SCIM will be used in the future to automate the process of creating, updating, and deactivating user accounts across the applications. This ensures that user data is consistent across all applications, reducing the administrative overhead and potential for errors.
 
-> **Note:**<br>
+> [!note]
 > SCIM support is planned in openDesk for 2025.
 
 # Component integration
@@ -449,4 +446,4 @@ While the IAM manages users centrally, some applications come with local account
 
 # Footnotes
 
-[^1]: We are working on a new approach to provision the OpenProject filestore, therefore the accounts are planned to be deactivated/removed with openDesk 1.2.
+[^1]: We are working on a new approach to provision the OpenProject filestore, therefore the accounts are planned to be deactivated/removed in the future.

docs/architecture/apis.md

@@ -295,8 +295,10 @@ The following are the APIs used by the Groupware application:
 | Supported standards            | SOAP                                                                                         |
 | Documentation                  | https://software.open-xchange.com/products/appsuite/doc/SOAP/admin/OX-Admin-SOAP.html        |
 
-> **Note**:
+> [!note]
-> You will find a catalogue of the available services including links to the respective URLs at `/webservices/` within the AppSuite host of your openDesk installation, e.g. https://webmail.myopendesk.tld/webservices/
+> You will find a catalogue of the available services including links to the respective URLs at
+> `/webservices/` within the AppSuite host of your openDesk installation,
+> e.g. https://webmail.myopendesk.tld/webservices/
 
 ## REST API
 
@@ -648,7 +650,7 @@ The following are the APIs used by the Project management application:
 
 ## Jitsi Meet React SDK
 
-> **Note**<br>
+> [!note]
 > Additional SDKs can be found at https://jitsi.github.io/handbook/docs/category/sdks/
 
 | Name                           | Meet React SDK                                                      |

docs/baseline-requirements.md

@@ -38,7 +38,7 @@ As this is a comprehensive set of requirements most new components will not adhe
 
 This document can be used to assess the status and possible gaps for a component which might itself be the basis for a decision if a component should be integrated into openDesk by working on closing the identified gaps.
 
-> **Note**<br>
+> [!note]
 > Even an already integrated application might not adhere to all aspects of the documented requirements yet.
 > Closing the gaps for existing applications therefore is an openDesk priority.
 
@@ -147,8 +147,9 @@ Please find more context about the topic on the [website of the German CIO](http
 
 Each vendor must provide a certificate that their product - or the parts of the product relevant for openDesk - complies with at least WCAG 2.1 AA or [BITV 2.0](https://www.bundesfachstelle-barrierefreiheit.de/DE/Fachwissen/Informationstechnik/EU-Webseitenrichtlinie/BGG-und-BITV-2-0/Die-neue-BITV-2-0/die-neue-bitv-2-0_node.html). As the certification and related product improvements are time-consuming the focus of openDesk is that a supplier provides a plan and certification partner (contract) that shows the supplier is working towards the certification. While the aforementioned standard states the priority is the "A" level requirements, the "AA" level must be met at the end of the process.
 
-> **Note**<br>
+> [!note]
-> Please keep in mind that WCAG 2.2 and 3.0 are work in progress. If you already work on accessibility improvements you might want to take these standards already into consideration.
+> Please keep in mind that WCAG 2.2 and 3.0 are work in progress. If you already work on accessibility
+> improvements you might want to take these standards already into consideration.
 
 **Reference:** In the past the [accessibility evaluations](https://gitlab.opencode.de/bmi/opendesk/info/-/tree/main/24.03/Barrierefreiheit) have been executed by Dataport. But they do not do certifications.
 
@@ -185,7 +186,7 @@ With a central Identity- and Access Management (IAM) also the user lifecycle (UL
 
 The focus is to have all the account information in all applications including the account's state, profile picture ([reference](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues/27)) and - where required - the user's group memberships. This cannot be done purely by pushing that data through OIDC claims when a user logs in to an application therefore two ways of managing an account are applicable and described in the following subchapters.
 
-> **Note**<br>
+> [!note]
 > Allowing ad hoc updates of account data through OIDC claims during login is still encouraged.
 
 ### Pull: LDAP
@@ -194,8 +195,9 @@ Applications can access the IAM's LDAP to access all data necessary for managing
 
 **Reference:** Most applications use LDAP access as per https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/components.md?ref_type=heads#identity-data-flows
 
-> **Note**<br>
+> [!note]
-> The direct access to LDAP is going to be deprecated for most use cases. openDesk is looking into active provisioning of the user/group data into the applications using [SCIM](https://scim.cloud/).
+> The direct access to LDAP is going to be deprecated for most use cases. openDesk is looking into active
+> provisioning of the user/group data into the applications using [SCIM](https://scim.cloud/).
 
 ### Push: Provisioning
 

docs/data-storage.md

@@ -31,8 +31,6 @@ sankey-beta
 
 ClamAV,PersistentVolume,1
 
-Dovecot,PersistentVolume,1
-
 Element/Synapse,PostgreSQL,1
 Element/Synapse,PersistentVolume,1
 
@@ -54,9 +52,15 @@ OpenProject,S3,1
 OpenProject,PersistentVolume,1
 OpenProject,Memcached,1
 
-Open-Xchange,MariaDB,1
+OX App Suite,MariaDB,1
-Open-Xchange,PersistentVolume,1
+OX App Suite,Redis,1
-Open-Xchange,Redis,1
+OX App Suite,S3,1
+
+OX Connector,PersistentVolume,1
+
+OX Dovecot,Cassandra,1
+OX Dovecot,PersistentVolume,1
+OX Dovecot,S3,1
 
 Postfix,PersistentVolume,1
 
@@ -67,11 +71,12 @@ XWiki,PersistentVolume,1
 # Details
 
 | Application          | Data Storage | Backup   | Content                                                                           | (Default) Identifier                           | Details                                                                                                   |
-|----------------------|--------------|----------|-----------------------------------------------------------------------------------|------------------------------------------------|-----------------------------------------------------------------------------------------------------------|
+| -------------------- | ------------ | -------- | --------------------------------------------------------------------------------- | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
 | **ClamAV**           | PVC          | No       | ClamAV Database                                                                   | `clamav-database-clamav-simple-0`              | `/var/lib/clamav`                                                                                         |
 | **Dovecot**          | PVC          | Yes      | openDesk CE only: User mail directories                                           | `dovecot`                                      | `/srv/mail`                                                                                               |
+|                      | PVC          | Yes       | openDesk EE only: Metacache directory                                             | `var-lib-dovecot-dovecot-0`                    | `/var/lib/dovecot`                                                                                        |
 |                      | S3           | Yes      | openDesk EE only: User mail                                                       | `dovecot`                                      | `dovecot`                                                                                                 |
-|                      | Cassandra    | Yes      | openDesk EE only: Metadata and ACLs                                               | `dovecot_dictmap`, `dovecot_acl`               |
+|                      | Cassandra    | Yes      | openDesk EE only: Metadata and ACLs                                               | `dovecot_dictmap`, `dovecot_acl`               |                                                                                                           |
 | **Element/Synapse**  | PostgreSQL   | Yes      | Application's main database                                                       | `matrix`                                       |                                                                                                           |
 |                      | PVC          | Yes      | Attachments                                                                       | `media-opendesk-synapse-0`                     | `/media`                                                                                                  |
 |                      |              | Yes      | Sync and state data                                                               | `matrix-neodatefix-bot`                        | `/app/storage`                                                                                            |
@@ -83,8 +88,9 @@ XWiki,PersistentVolume,1
 | **Nubus**            | PostgreSQL   | Yes      | Main database for Nubus' IdP Keycloak                                             | `keycloak`                                     |                                                                                                           |
 |                      |              | Yes      | Login actions and device-fingerprints                                             | `keycloak_extensions`                          |                                                                                                           |
 |                      |              | Optional | Store of the temporary password reset token                                       | `selfservice`                                  |                                                                                                           |
-|                      |              | No       | Notification features are not used in openDesk 1.1                                | `notificationsapi`                             |                                                                                                           |
+|                      |              | Optional | OIDC session storage                                                              | `umsAuthSession`                               |                                                                                                           |
-|                      |              | No       | Guardian features are currently not used in openDesk 1.1                          | `guardianmanagementapi`                        |                                                                                                           |
+|                      |              | No       | At the moment the notification feature not enabled in openDesk                    | `notificationsapi`                             |                                                                                                           |
+|                      |              | No       | At the moment the Guardian features are currently not enabled in openDesk         | `guardianmanagementapi`                        |                                                                                                           |
 |                      | S3           | No       | Static files for Portal                                                           | `ums`                                          |                                                                                                           |
 |                      | PVC          | Yes      | openLDAP database (primary R/W Pods), when restore select the one from the leader | `shared-data-ums-ldap-server-primary-0`        | `/var/lib/univention-ldap`                                                                                |
 |                      |              | Yes      | openLDAP process data                                                             | `shared-run-ums-ldap-server-primary-0`         | `/var/run/slapd`                                                                                          |
@@ -99,13 +105,17 @@ XWiki,PersistentVolume,1
 |                      | Memcached    | No       | Cache                                                                             |                                                |                                                                                                           |
 |                      | PVC          | No       | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs      | `openproject-<web/worker>-*-tmp`               | `/tmp`                                                                                                    |
 |                      |              | No       | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs      | `openproject-<web/worker>-app-*-tmp`           | `/app/tmp`                                                                                                |
-| **Open-Xchange**     | MariaDB      | Yes      | Application's control database to coordiate dynamically created ones              | `configdb`                                     |                                                                                                           |
+| **OX App Suite**     | MariaDB      | Yes      | Application's control database to coordiate dynamically created ones              | `configdb`                                     |                                                                                                           |
 |                      |              | Yes      | Dynamically creates databases of schema `PRIMARYDB_n`containing multiple contexts | `PRIMARYDB_*`                                  |                                                                                                           |
 |                      |              | Yes      | OX Guard related settings                                                         | `oxguard*`                                     |                                                                                                           |
 |                      | S3           | Yes      | Attachments of meetings, contacts and tasks                                       | `openxchange`                                  |                                                                                                           |
 |                      | Redis        | Optional | Cache, session related data, distributed maps                                     |                                                |                                                                                                           |
-|                      | PVC          | Yes      | OX Connector: OXAPI access details                                                | `ox-connector-appcenter-ox-connector-0`        | `/var/lib/univention-appcenter/apps/ox-connector`                                                         |
+| **OX Connector**     | PVC          | Optional | OX Connector: Caching of OX object data                                           | for backup                                     | `/var/lib/univention-appcenter/apps/ox-connector`                                                         |
-|                      |              | Yes      | OX Connector: Application's meta data                                             | `ox-connector-ox-contexts-ox-connector-0`      | `/etc/ox-secrets`                                                                                         |
+|                      |              | Yes      | OX Connector: OX SOAP API credentials                                             | `ox-connector-ox-contexts-ox-connector-0`      | `/etc/ox-secrets`                                                                                         |
+| **OX Dovecot**       | PVC          | Yes      | openDesk CE only: User mail directories                                           | `dovecot`                                      | `/srv/mail`                                                                                               |
+|                      | PVC          | Yes      | openDesk EE only: Various meta data and caches                                    | `var-lib-dovecot`                              | `/var/lib/dovecot`                                                                                        |
+|                      | S3           | Yes      | Dovecot Pro/openDesk EE only: User mail                                           | `dovecot`                                      | `dovecot`                                                                                                 |
+|                      | Cassandra    | Yes      | Dovecot Pro/openDesk EE only: Metadata and ACLs                                   | `dovecot_dictmap`, `dovecot_acl`               |                                                                                                           |
 | **Postfix**          | PVC          | Yes      | Mail spool                                                                        | `postfix`                                      | `/var/spool/postfix`                                                                                      |
 | **XWiki**            | PostgreSQL   | Yes      | Application's main database                                                       | `xwiki`                                        |                                                                                                           |
 |                      | PVC          | Yes      | Attachments                                                                       | `xwiki-data-xwiki-0`                           | `/usr/local/xwiki/data`                                                                                   |

docs/debugging.md

@@ -31,10 +31,10 @@ It will be extended over time as we deal with debugging cases.
 We for sure do not want to reinvent the wheel, so we might link to external sources that contain helpful
 information where available.
 
-> **Warning**<br>
+> [!warning]
-> You should never enable the debug option in production environments! By looking up `debug.enabled` in the deployment, you
+> You should never enable the debug option in production environments! By looking up `debug.enabled` in the
-will find the various places changes are applied when enabling debugging. So, outside of development and test
+> deployment, you will find the various places changes are applied when enabling debugging. So, outside of
-environments, you should use them thoughtfully and carefully if needed.
+> development and test environments, you should use them thoughtfully and carefully if needed.
 
 # Enable debugging
 
@@ -49,11 +49,13 @@ This will result in:
 - making the Keycloak admin console available by default at `https://id.<your_domain>/admin/`
 - ingress for `http://minio-console.<your_domain>` being configured
 
-> **Note**<br>
+> [!note]
-> When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.
+> When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In
+> debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.
 
-> **Note**<br>
+> [!note]
-> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container which were not in STDOUT, please let us know!
+> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container which
+> were not in STDOUT, please let us know!
 
 # Adding containers to a pod for debugging purposes
 
@@ -168,7 +170,7 @@ While you will find all the details for the CLI tool in the [MariaDB documentati
 
 ## Nextcloud
 
-`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
+`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/stable/admin_manual/occ_command.html).
 
 You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`
 
@@ -215,8 +217,16 @@ kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"dat
 
 2. Restart the Keycloak Pod(s).
 
-> **Note**<br>
+> [!note]
-> Because the `ums-keycloak-extensions-handler` is sending frequent requests (one per second) to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.
+> Because the `ums-keycloak-extensions-handler` is sending frequent requests (one per second) to Keycloak for
+> retrieval of the Keycloak event history, you might want to stop/remove the deployment while
+> debugging/analysing Keycloak to not get your debug output spammed by these requests.
+
+> [!note]
+> While you can set the standard log levels like `INFO`, `DEBUG`, `TRACE` etc. you can also set class specific
+> logs by comma separating the details in the `KC_LOG_LEVEL` environment variable like
+> e.g. `INFO,org.keycloak.protocol.oidc.endpoints:TRACE`. The example sets the overall loglevel to `INFO` but
+> provides trace logs for `org.keycloak.protocol.oidc.endpoints`.
 
 ### Accessing the Keycloak admin console
 

docs/developer/development.md

@@ -84,9 +84,9 @@ In the project's CI, there is a step dedicated to lint the two yaml files, as we
 In the linting step, the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
 aforementioned sorting, and the result is compared with the unsorted version. If there is a delta, the linting fails, and you can fix it by running the CLI tool locally, verifying and applying the result to your branch.
 
-> **Note**<br>
+> [!note]
-> Please ensure that in component blocks, you use comments only at the beginning of the block or at its end. Ideally, you stick
+> Please ensure that in component blocks, you use comments only at the beginning of the block or at its
-with the many available examples in the yaml files.
+> end. Ideally, you stick with the many available examples in the yaml files.
 
 Example:
 ```yaml
@@ -108,9 +108,9 @@ If you follow the "push early, push often" paradigm to save your work to the cen
 existing documentation, you can avoid the CI and its linting being executed, as it might not offer additional value.
 
 GitLab offers two options to skip the CI on a commit/push:
-- Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
+1. Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
 **Note:** The string has to be removed before merging your feature branch into `develop`.
-- Use the related git push option `git push -o ci.skip` ([details](https://docs.gitlab.com/ee/user/project/push_options.html#push-options-for-gitlab-cicd)).
+2. Use the related git push option `git push -o ci.skip` ([details](https://docs.gitlab.com/topics/git/commit/#push-options)).
 
 ## Renovate
 
@@ -126,7 +126,7 @@ Checks for newer versions of the given artifact and creates an MR containing the
 
 - See also: https://gitlab.opencode.de/bmi/opendesk/tooling/oci-pull-mirror
 
-> **Note:**<br>
+> [!note]
 > The mirror is scheduled to run every hour at 42 minutes past the hour.
 
 openDesk strives to make all relevant artifacts available on openCode so there is a mirroring process

docs/developer/workflow.md

@@ -85,7 +85,7 @@ The below rendering in [class diagram](https://en.wikipedia.org/wiki/Class_diagr
 - the first section below the name of the class shows the required **characteristics** of each component of the given class
 - the second section shows the **methods** like linting that must be applied to that class's artifacts
 
-> **Note**<br>
+> [!note]
 > The methods prefixed with '-' are not yet available in `gitlab-config`. You will learn about them later.
 
 ```mermaid
@@ -148,11 +148,14 @@ openDesk uses Apache 2.0 as the license for their work. A typical reuse copyrigh
 ```
 The way to mark the license header as a comment differs between the various file types. Please find matching examples for all types across the [deployment automation repository](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk).
 
-> **Note**<br>
+> [!note]
-> If a `SPDX-FileCopyrightText` already exists with the copyright owner described above but with a past year (e.g. 2024), please update this copyright header line to cover (up to and including) the current year, e.g. `2024-2025`.
+> If a `SPDX-FileCopyrightText` already exists with the copyright owner described above but with a past year
+> (e.g. 2024), please update this copyright header line to cover (up to and including) the current year,
+> e.g. `2024-2025`.
 
-> **Note**<br>
+> [!note]
-> If line(s) with `SPDX-FileCopyrightText` containing a different copyright owner exist in the file you are working on, do not replace existing one(s), but rather add another header above these.
+> If line(s) with `SPDX-FileCopyrightText` containing a different copyright owner exist in the file you are
+> working on, do not replace existing one(s), but rather add another header above these.
 
 ## Development workflow
 
@@ -348,14 +351,14 @@ Branches created from the `develop` branch have to adhere to the following notat
 
 Example: `tmueller/fix_jitsi_theming`.
 
-> **Note**<br>
+> [!note]
 > The above naming convention has yet to be enforced, but please ensure you use it.
 
 #### Commit messages / Conventional Commits
 
 Commit messages must adhere to the [Conventional Commit standard](https://www.conventionalcommits.org/en/v1.0.0/#summary). Commits that do not adhere to the standard get rejected by either [Gitlab push rules](https://docs.gitlab.com/ee/user/project/repository/push_rules.html) or the CI.
 
-> **Note**<br>
+> [!note]
 > The first letter after the `: ` must be uppercase.
 
 ```text
@@ -372,7 +375,7 @@ Commit messages must adhere to the [Conventional Commit standard](https://www.co
 
 Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`
 
-> **Note**<br>
+> [!note]
 > The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases) as the release notes are generated from these messages.
 
 #### Verified commits

docs/enhanced-configuration/gitops.md

@@ -31,6 +31,11 @@ There are two options to deploy openDesk via Argo CD described in the following
 
 ## Option 1: Use YAML manifests
 
+> [!warning]
+> Pre-rendering the YAML files will also embed all referenced secrets into the resulting outputs.
+> You must ensure that these files are accessible solely to individuals who are expressly authorized
+> to view the corresponding secrets, as well as the infrastructure and data protected by them.
+
 This option requires a preprocessing step before using Argo CD. This step requires you to compile the Helmfile based
 deployment into Kubernetes YAML manifest, to do so you need to execute the helmfile binary:
 
@@ -44,9 +49,10 @@ References:
 
 Afterwards, you can use the resulting manifests within a standard Argo CD workflow.
 
-> **Note**<br>
+> [!note]
-> When creating the Argo CD application based on the resulting manifests, you must not use the `Automated Sync Policy`
+> When creating the Argo CD application based on the resulting manifests, you must not use the `Automated Sync
-> offered by Argo CD, as you have to manually ensure the applications are updated in the required sequence.
+> Policy` offered by Argo CD, as you have to manually ensure the applications are updated in the required
+> sequence.
 
 ## Option 2: Helmfile plugin
 

docs/enhanced-configuration/groupware-migration.md

@@ -41,8 +41,9 @@ You will have to select an existing user account that will be used as a service
 
 Please note that the account that shall serve as the service account requires a Microsoft 365/Exchange online license (mailbox).
 
-> **Note**<br>
+> [!note]
-> If you want to designate your admin account as a service account, you have to provide the admin with a license.
+> If you want to designate your admin account as a service account, you have to provide the admin with a
+> license.
 
 ***2. Register the audriga app in your tenant***
 
@@ -53,7 +54,7 @@ To register the audriga app in your tenant, log into your admin account and acce
 - Accept the App "audriga CloudMovr migration"
 - You will be redirected to an audriga page, which you can close - it does not require additional interaction.
 
-> **Note**<br>
+> [!note]
 > The audriga application is created under the "Enterprise application" tab in the AzureAD console.
 
 ***3. Create a "secret" group in the M365 tenant***
@@ -91,11 +92,15 @@ To validate the master authentication mode please read the appendix section at t
 
 Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppSuite.migrationsMasterPassword` and need to turn off the migration mode by setting `functional.migration.oxAppSuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
 
-> **Note**<br>
+> [!note]
-> For the changes to take effect, it is sufficient to re-deploy the `open-xchange` component alone. But you have to restart the Dovecot Pod(s) manually when switching to/from the master authentication mode for the changes to take effect.
+> For the changes to take effect, it is sufficient to re-deploy the `open-xchange` component alone. But you
+> have to restart the Dovecot Pod(s) manually when switching to/from the master authentication mode for the
+> changes to take effect.
 
-> **Note**<br>
+> [!note]
-> While in master authentication mode, regular users cannot log in to the webmail module of openDesk or access the mail using IMAP, as it is not recommended that users interact with the target mail infrastructure during the migration scenario described in this document.
+> While in master authentication mode, regular users cannot log in to the webmail module of openDesk or access
+> the mail using IMAP, as it is not recommended that users interact with the target mail infrastructure during
+> the migration scenario described in this document.
 
 # Migration configuration
 
@@ -107,7 +112,7 @@ Ensure you meet the prerequisites. For example, this document does not support u
 
 Choose [Microsoft 365 / Exchange Online (Admin)](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware#src=onmicrosoft.com) as your current provider.
 
-> **Note**<br>
+> [!note]
 > You may need to start typing in "Microsoft Office 365/Exchange Online" for it to appear in the list.
 
 Configure openDesk as your destination server:

docs/enhanced-configuration/idp-federation.md

@@ -152,7 +152,7 @@ If you just created the `fed-test-idp-realm`, you are already in the admin scree
 
 ## openDesk IdP
 
-> **Note**
+> [!note]
 > While manual configuration is possible, an SSO federation can also be configured as part of the deployment.
 > Check `functional.authentication.ssoFederation` section from the `functional.yaml.gotmpl` for details.
 

docs/enhanced-configuration/self-signed-certificates.md

@@ -38,6 +38,8 @@ access openDesk.
     ```yaml
     certificate:
       selfSigned: true
+      caCertificate:
+        create: false
     ```
 
 3. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
@@ -50,6 +52,10 @@ CA certificate as X.509 encoded (`ca.crt`) and as jks trust store (`truststore.j
 5. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
 trust store password.
 
+> [!note]
+> XWiki does not support the use of an existing secret to access the keystore. Therefore you have to set the
+> password from step 5 also as `secrets.certificates.password`.
+
 ## Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate
 
 This option is useful when you do not have a trusted certificate available and can't fetch a certificate from

docs/external-services.md

@@ -19,8 +19,10 @@ This document will cover the additional configuration for external services like
 When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.
 
-> **Note**<br>
+> [!note]
-> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely to become the preferred option/default in the future should MariaDB become deprecated. This would cause migration[^1] to be necessary if you do not select PostgreSQL for new installations.
+> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely
+> to become the preferred option/default in the future should MariaDB become deprecated. This would cause
+> migration[^1] to be necessary if you do not select PostgreSQL for new installations.
 
 | Component          | Name               | Parameter | Key                                           | Default                      |
 | ------------------ | ------------------ | --------- | --------------------------------------------- | ---------------------------- |

docs/functional.md

@@ -32,5 +32,9 @@ The following categories are available. Each category contains a set of options
 
 In case the options from [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl) are not sufficient, you might want to look into [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl). The customizations give you control over all templating that is being done in openDesk, but be aware it is an unsupported approach, so in case you have a strong need for customizations, please let us know by opening a ticket. We will check if it is a use case that can be supported by implementing it as part of the aforementioned [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl).
 
-> **Note<br>**
+> [!note]
-> You can not directly template your own values in the structure found in [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl), rather, you need to reference your custom value files to overwrite the openDesk defaults. In the app specific `helmfile-child.yaml.gotmpl` files, the openDesk value files are referenced first, then afterwards, the files you define in the customizations are read.
+> You can not directly template your own values in the structure found in
+> [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl), rather, you need
+> to reference your custom value files to overwrite the openDesk defaults. In the app specific
+> `helmfile-child.yaml.gotmpl` files, the openDesk value files are referenced first, then afterwards, the
+> files you define in the customizations are read.

docs/getting-started.md

@@ -32,8 +32,10 @@ This documentation lets you create an openDesk evaluation instance on your Kuber
   * [Install](#install)
   * [Install single app](#install-single-app)
   * [Install single release/chart](#install-single-releasechart)
-* [Access deployment](#access-deployment)
   * [Using from external repository](#using-from-external-repository)
+* [Access deployment](#access-deployment)
+  * [Login](#login)
+  * [Credentials](#credentials)
 * [Uninstall](#uninstall)
 <!-- TOC -->
 
@@ -63,7 +65,7 @@ For your convenience, we recommend creating a `*.domain.tld` A-Record for your c
 | Record name                   | Type | Value                                              | Additional information                                            |
 |-------------------------------|------|----------------------------------------------------|-------------------------------------------------------------------|
 | *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                   |
-| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                   |
+| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            | Optional                                                          |
 | mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
 | mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
 | domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                   |
@@ -77,6 +79,8 @@ For your convenience, we recommend creating a `*.domain.tld` A-Record for your c
 
 ## Domain
 
+As example base domain for your deployment we use `domain.tld` in this document.
+
 A list of all subdomains can be found in `helmfile/environments/default/global.yaml.gotmpl`.
 
 All subdomains can be customized. For example, _Nextcloud_ can be changed to `files.domain.tld` in `dev` environment:
@@ -100,6 +104,11 @@ or alternatively via environment variable:
 export DOMAIN=domain.tld
 ```
 
+> [!warning]
+> Due to a limitation caused by a [bug in the SSSD subcomponent](https://github.com/SSSD/sssd/issues/7246), there
+> is an upper bound on the total domain length used by openDesk. To avoid issues, we recommend keeping the openDesk
+> base domain length below 94 characters.
+
 ### Apps
 
 Depending on your ideal openDesk deployment, you may wish to disable or enable certain apps.
@@ -236,9 +245,9 @@ ingress:
   ingressClassName: "nginx"
 ```
 
-> **Note**<br>
+> [!note]
-> Currently, the only supported ingress controller is `ingress-nginx`
+> Currently, the only supported ingress controller is `ingress-nginx` (see
-> (see [requirements.md](./docs/requirements.md) for reference).
+> [requirements.md](./docs/requirements.md) for reference).
 
 ### Container runtime
 
@@ -279,8 +288,9 @@ While openDesk configures the applications with meaningful defaults, you can che
 
 ### Ports
 
-> **Note**<br>
+> [!note]
-> If you use `NodePort` for service exposure, you must check your deployment for the actual ports and ensure they are opened where necessary.
+> If you use `NodePort` for service exposure, you must check your deployment for the actual ports and ensure
+> they are opened where necessary.
 
 #### Web-based user interface
 
@@ -305,18 +315,8 @@ To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), t
 
 ### Mail/SMTP configuration
 
-To use the full potential of the openDesk, you need to set up an SMTP relay that allows sending emails from
+Enabling DKIM signing for outgoing emails helps reduce the risk of messages being marked as spam and improves recipient trust.
-the whole subdomain. The following attribute can be set:
+openDesk includes `dkimpy-milter` as a Postfix milter for signing emails. You can configure the following attributes:
-
-```yaml
-smtp:
-  host: "mail.open.desk"
-  username: "openDesk"
-  password: "secret"
-```
-
-Enabling DKIM signing of emails helps to reduce spam and increases trust.
-openDesk ships dkimpy-milter as Postfix milter for signing emails. The following attributes can be set:
 
 ```yaml
 apps:
@@ -330,6 +330,17 @@ smtp:
     useED25519: true # when false, RSA is used
 ```
 
+A common scenario for outgoing mail is to send it through a smarthost or mail relay, which often handles DKIM signing as well.
+
+If you prefer to use a smarthost, you can configure it as follows:
+
+```yaml
+smtp:
+  host: "smarthost.domain.tld"
+  username: "smarthost-auth-username"
+  password: "secret"
+```
+
 ### TURN configuration
 
 Some components (Jitsi, Element) use a TURN server for direct communication. You can configure your own TURN server with
@@ -340,10 +351,10 @@ turn:
   transport: "udp" # or tcp
   credentials: "secret"
   server:
-    host: "turn.open.desk"
+    host: "turn.domain.tld"
     port: "3478"
   tls:
-    host: "turns.open.desk"
+    host: "turns.domain.tld"
     port: "5349"
 ```
 
@@ -384,10 +395,15 @@ To prevent others from using your openDesk instance, you must set your individua
 export MASTER_PASSWORD="your_individual_master_password"
 ```
 
-> **Note**<br>
+> [!important]
-> Currently a [documented](https://docs.software-univention.de/nubus-kubernetes-operation/1.x/en/configuration/nats.html#configure-the-secrets) upstream [bug](https://forge.univention.org/bugzilla/show_bug.cgi?id=58357) causes a failure when passwords/secrets beginning with certain numbers are using for the Nubus subcomponent NATS.
+> Currently a
-> With openDesk 1.6.0 an update-aware workaround was implemented that prefixes the affected secrets in the openDesk included `secrets.yaml.gotmpl` that derives all secrets from the previously mentioned `MASTER_PASSWORD`.
+> [documented](https://docs.software-univention.de/nubus-kubernetes-operation/1.x/en/configuration/nats.html#configure-the-secrets)
-> If you are using externally provided passwords/secrets make sure that none of the ones listed below are starting with a number:
+> upstream [bug](https://forge.univention.org/bugzilla/show_bug.cgi?id=58357) causes a failure when
+> passwords/secrets beginning with certain numbers are using for the Nubus subcomponent NATS. With openDesk
+> 1.6.0 an update-aware workaround was implemented that prefixes the affected secrets in the openDesk included
+> `secrets.yaml.gotmpl` that derives all secrets from the previously mentioned `MASTER_PASSWORD`. If you are
+> using externally provided passwords/secrets make sure that none of the ones listed below are starting with a
+> number:
 >
 > - `secrets.nubus.provisioning.api.natsPassword`
 > - `secrets.nubus.provisioning.dispatcherNatsPassword`
@@ -434,17 +450,37 @@ Instead of iterating through all services, you can also deploy a single release
 helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
 ```
 
+## Using from external repository
+
+Referring to `./helmfile_generic.yaml.gotmpl` from an external
+directory or repository is possible. The `helmfile.yaml.gotmpl` that refers to
+`./helmfile_generic.yaml.gotmpl` may define custom environments. These custom
+environments may overwrite specific configuration values. These
+configuration values are:
+
+* `global.domain`
+* `global.helmRegistry`
+* `global.master_password`
+
 # Access deployment
 
+## Login
+
 When all apps are successfully deployed, and their Pod status is `Running` or `Succeeded`, you can navigate to
 
+```text
+https://domain.tld
+```
+
+which will redirect you to the actual URL of the openDesk portal:
+
 ```text
 https://portal.domain.tld
 ```
 
-If you change the subdomain of `nubus`, you must replace the subdomain of `portal` with the same subdomain.
+By default the portal will send you to openDesk's login screen.
 
-**Credentials:**
+## Credentials
 
 openDesk deploys with the standard user account `Administrator`, the password for which can be retrieved as follows:
 
@@ -476,18 +512,6 @@ docker run --rm registry.opencode.de/bmi/opendesk/components/platform-developmen
     --create_admin_accounts True
 ```
 
-## Using from external repository
-
-Referring to `./helmfile_generic.yaml.gotmpl` from an external
-directory or repository is possible. The `helmfile.yaml.gotmpl` that refers to
-`./helmfile_generic.yaml.gotmpl` may define custom environments. These custom
-environments may overwrite specific configuration values. These
-configuration values are:
-
-* `global.domain`
-* `global.helmRegistry`
-* `global.master_password`
-
 # Uninstall
 
 You can uninstall the deployment by executing the following:
@@ -496,7 +520,7 @@ You can uninstall the deployment by executing the following:
 helmfile destroy -n <NAMESPACE>
 ```
 
-> **Note**<br>
+> [!note]
 > Not all Jobs, PersistentVolumeClaims, or Certificates are deleted; you have to delete them manually
 
 **'Sledgehammer destroy'** - for fast development turn-around times (at your own risk):
@@ -515,5 +539,5 @@ kubectl delete jobs --all --namespace ${NAMESPACE};
 kubectl delete configmaps --all --namespace ${NAMESPACE};
 ```
 
-> **Warning**<br>
+> [!warning]
 > Without specifying a `--namespace` flag, or by leaving it empty, cluster-wide components will get deleted!

docs/migrations.md

@@ -8,39 +8,68 @@ SPDX-License-Identifier: Apache-2.0
 <!-- TOC -->
 * [Disclaimer](#disclaimer)
 * [Deprecation warnings](#deprecation-warnings)
-* [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
+* [Overview and mandatory upgrade path](#overview-and-mandatory-upgrade-path)
 * [Manual checks/actions](#manual-checksactions)
-  * [v1.7.0+](#v170)
+  * [Versions ≥ v1.11.0](#versions--v1110)
-    * [Pre-upgrade to v1.7.0+](#pre-upgrade-to-v170)
+    * [Pre-upgrade to versions ≥ v1.11.0](#pre-upgrade-to-versions--v1110)
-    * [Helmfile fix: Ensure enterprise overrides apply when deploying from project root](#helmfile-fix-ensure-enterprise-overrides-apply-when-deploying-from-project-root)
+      * [Helmfile new option: Annotations for external services (Dovecot, Jitsi JVB, Postfix)](#helmfile-new-option-annotations-for-external-services-dovecot-jitsi-jvb-postfix)
+  * [Versions ≥ v1.10.0](#versions--v1100)
+    * [Pre-upgrade to versions ≥ v1.10.0](#pre-upgrade-to-versions--v1100)
+      * [Deployment cleanup: Collabora Controller](#deployment-cleanup-collabora-controller)
+      * [Helmfile new secret: `secrets.nubus.ldapSearch.postfix`](#helmfile-new-secret-secretsnubusldapsearchpostfix)
+      * [Helmfile new secret: `secrets.doveocot.sharedMailboxesMasterPassword`](#helmfile-new-secret-secretsdoveocotsharedmailboxesmasterpassword)
+      * [New Helmfile default: Nubus provisioning debug container no longer deployed](#new-helmfile-default-nubus-provisioning-debug-container-no-longer-deployed)
+      * [New Helmfile default: Postfix SMTP SASL security options](#new-helmfile-default-postfix-smtp-sasl-security-options)
+    * [Post-upgrade to versions ≥ v1.10.0](#post-upgrade-to-versions--v1100)
+      * [New application default: Dovecot full-text search index configuration](#new-application-default-dovecot-full-text-search-index-configuration)
+  * [Versions ≥ v1.9.0](#versions--v190)
+    * [Pre-upgrade to versions ≥ v1.9.0](#pre-upgrade-to-versions--v190)
+      * [New application default: Postfix SMTP SASL security option](#new-application-default-postfix-smtp-sasl-security-option)
+      * [Helmfile fix: Cassandra passwords read from `databases.*`](#helmfile-fix-cassandra-passwords-read-from-databases)
+      * [Helmfile new feature: `functional.groupware.externalClients.*`](#helmfile-new-feature-functionalgroupwareexternalclients)
+  * [Versions ≥ v1.8.0](#versions--v180)
+    * [Pre-upgrade to versions ≥ v1.8.0](#pre-upgrade-to-versions--v180)
+      * [New application default: Default group for two-factor authentication is now "2FA Users"](#new-application-default-default-group-for-two-factor-authentication-is-now-2fa-users)
+      * [New database and secrets: Portal now uses OIDC](#new-database-and-secrets-portal-now-uses-oidc)
+      * [New application default: XWiki blocks self-registration of user accounts](#new-application-default-xwiki-blocks-self-registration-of-user-accounts)
+      * [New application default: Synapse rooms `v12`](#new-application-default-synapse-rooms-v12)
+      * [New Helmfile default: Restricting characters for directory and filenames in fileshare module](#new-helmfile-default-restricting-characters-for-directory-and-filenames-in-fileshare-module)
+      * [Helmfile new default: New groupware settings changing current behaviour](#helmfile-new-default-new-groupware-settings-changing-current-behaviour)
+      * [New application default: Nextcloud apps "Spreed" and "Comments" no longer enabled by default](#new-application-default-nextcloud-apps-spreed-and-comments-no-longer-enabled-by-default)
+      * [New application default: Gravatar is switched off for Jitsi and OpenProject](#new-application-default-gravatar-is-switched-off-for-jitsi-and-openproject)
+  * [Versions ≥ v1.7.0](#versions--v170)
+    * [Pre-upgrade to versions ≥ v1.7.0](#pre-upgrade-to-versions--v170)
+      * [Helmfile fix: Ensure enterprise overrides apply when deploying from project root](#helmfile-fix-ensure-enterprise-overrides-apply-when-deploying-from-project-root)
       * [Replace Helm chart: New Notes Helm chart with support for self-signed deployments](#replace-helm-chart-new-notes-helm-chart-with-support-for-self-signed-deployments)
-    * [Post-upgrade to v1.7.0+](#post-upgrade-to-v170)
+    * [Post-upgrade to versions ≥ v1.7.0](#post-upgrade-to-versions--v170)
       * [Upstream fix: Provisioning of functional mailboxes](#upstream-fix-provisioning-of-functional-mailboxes)
-  * [v1.6.0+](#v160)
+  * [Versions ≥ v1.6.0](#versions--v160)
-    * [Pre-upgrade to v1.6.0+](#pre-upgrade-to-v160)
+    * [Pre-upgrade to versions ≥ v1.6.0](#pre-upgrade-to-versions--v160)
       * [Upstream constraint: Nubus' external secrets](#upstream-constraint-nubus-external-secrets)
       * [Helmfile new secret: `secrets.minio.openxchangeUser`](#helmfile-new-secret-secretsminioopenxchangeuser)
       * [Helmfile new object storage: `objectstores.openxchange.*`](#helmfile-new-object-storage-objectstoresopenxchange)
       * [OX App Suite fix-up: Using S3 as storage for non mail attachments (pre-upgrade)](#ox-app-suite-fix-up-using-s3-as-storage-for-non-mail-attachments-pre-upgrade)
-    * [Post-upgrade to v1.6.0+](#post-upgrade-to-v160)
+    * [Post-upgrade to versions ≥ v1.6.0](#post-upgrade-to-versions--v160)
       * [OX App Suite fix-up: Using S3 as storage for non mail attachments (post-upgrade)](#ox-app-suite-fix-up-using-s3-as-storage-for-non-mail-attachments-post-upgrade)
-  * [v1.4.0+](#v140)
+  * [Versions ≥ v1.4.0](#versions--v140)
-    * [Pre-upgrade to v1.4.0+](#pre-upgrade-to-v140)
+    * [Pre-upgrade to versions ≥ v1.4.0](#pre-upgrade-to-versions--v140)
-      * [Helmfile new feature: `functional.authentication.ssoFederation`](#helmfile-new-feature-functionalauthenticationssofederation)
       * [Helmfile cleanup: `global.additionalMailDomains` as list](#helmfile-cleanup-globaladditionalmaildomains-as-list)
-  * [v1.2.0+](#v120)
+  * [Versions ≥ v1.3.0](#versions--v130)
-    * [Pre-upgrade to v1.2.0+](#pre-upgrade-to-v120)
+    * [Pre-upgrade to versions ≥ v1.3.0](#pre-upgrade-to-versions--v130)
+      * [Helmfile new feature: `functional.authentication.ssoFederation`](#helmfile-new-feature-functionalauthenticationssofederation)
+  * [Versions ≥ v1.2.0](#versions--v120)
+    * [Pre-upgrade to versions ≥ v1.2.0](#pre-upgrade-to-versions--v120)
       * [Helmfile cleanup: Do not configure OX provisioning when no OX installed](#helmfile-cleanup-do-not-configure-ox-provisioning-when-no-ox-installed)
       * [Helmfile new default: PostgreSQL for XWiki and Nextcloud](#helmfile-new-default-postgresql-for-xwiki-and-nextcloud)
-  * [v1.1.2+](#v112)
+  * [Versions ≥ v1.1.2](#versions--v112)
-    * [Pre-upgrade to v1.1.2+](#pre-upgrade-to-v112)
+    * [Pre-upgrade to versions ≥ v1.1.2](#pre-upgrade-to-versions--v112)
       * [Helmfile feature update: App settings wrapped in `apps.` element](#helmfile-feature-update-app-settings-wrapped-in-apps-element)
-  * [v1.1.1+](#v111)
+  * [Versions ≥ v1.1.1](#versions--v111)
-    * [Pre-upgrade to v1.1.1](#pre-upgrade-to-v111)
+    * [Pre-upgrade to versions ≥ v1.1.1](#pre-upgrade-to-versions--v111)
       * [Helmfile feature update: Component specific `storageClassName`](#helmfile-feature-update-component-specific-storageclassname)
       * [Helmfile new secret: `secrets.nubus.masterpassword`](#helmfile-new-secret-secretsnubusmasterpassword)
-  * [v1.1.0+](#v110)
+  * [Versions ≥ v1.1.0](#versions--v110)
-    * [Pre-upgrade to v1.1.0](#pre-upgrade-to-v110)
+    * [Pre-upgrade to versions ≥ v1.1.0](#pre-upgrade-to-versions--v110)
       * [Helmfile cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
       * [Helmfile cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
       * [Helmfile cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
@@ -50,10 +79,10 @@ SPDX-License-Identifier: Apache-2.0
       * [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
       * [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
       * [External requirements: Redis 7.4](#external-requirements-redis-74)
-    * [Post-upgrade to v1.1.0+](#post-upgrade-to-v110)
+    * [Post-upgrade to versions ≥ v1.1.0](#post-upgrade-to-versions--v110)
       * [XWiki fix-ups](#xwiki-fix-ups)
-  * [v1.1.0](#v110-1)
+  * [Versions ≥ v1.0.0](#versions--v100)
-    * [Pre-upgrade to v1.1.0](#pre-upgrade-to-v110-1)
+    * [Pre-upgrade to versions ≥ v1.0.0](#pre-upgrade-to-versions--v100)
       * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
       * [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
       * [Changed openDesk defaults: Matrix presence status disabled](#changed-opendesk-defaults-matrix-presence-status-disabled)
@@ -61,17 +90,17 @@ SPDX-License-Identifier: Apache-2.0
       * [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
       * [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
       * [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
-    * [Post-upgrade to v1.0.0+](#post-upgrade-to-v100)
+    * [Post-upgrade to versions ≥ v1.0.0](#post-upgrade-to-versions--v100)
       * [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
       * [Optional Cleanup](#optional-cleanup)
 * [Automated migrations - Details](#automated-migrations---details)
-  * [v1.6.0+ (automated)](#v160-automated)
+  * [Versions ≥ v1.6.0 (automated)](#versions--v160-automated)
-    * [v1.6.0+ migrations-post](#v160-migrations-post)
+    * [Versions ≥ v1.6.0 migrations-post](#versions--v160-migrations-post)
-  * [v1.2.0+ (automated)](#v120-automated)
+  * [Versions ≥ v1.2.0 (automated)](#versions--v120-automated)
-    * [v1.2.0+ migrations-pre](#v120-migrations-pre)
+    * [Versions ≥ v1.2.0 migrations-pre](#versions--v120-migrations-pre)
-    * [v1.2.0+ migrations-post](#v120-migrations-post)
+    * [Versions ≥ v1.2.0 migrations-post](#versions--v120-migrations-post)
-  * [v1.1.0+ (automated)](#v110-automated)
+  * [Versions ≥ v1.1.0 (automated)](#versions--v110-automated)
-  * [v1.0.0+ (automated)](#v100-automated)
+  * [Versions ≥ v1.0.0 (automated)](#versions--v100-automated)
   * [Related components and artifacts](#related-components-and-artifacts)
   * [Development](#development)
 <!-- TOC -->
@@ -86,50 +115,435 @@ These automated migrations have limitations in the sense that they require a cer
 
 Manual checks and possible activities are also required by openDesk updates, they are described in the section [Manual update steps](#manual-update-steps).
 
-> **Note**<br>
+> [!important]
-> Please be sure to _thoroughly_ read / follow the requirements before you update / upgrade.
+> Please be sure to _thoroughly_ read / follow the requirements before you update / upgrade and assure that
+> you are reading the correct version of this document (change branch / version if necessary).
 
-> **Known limitations**<br>
+> [!warning]
 > We assume that the PV reclaim policy is set to `delete`, resulting in PVs getting deleted as soon as the related PVC is deleted; we will not address explicit deletion for PVs.
 
+
 # Deprecation warnings
 
 We cannot hold back all migrations as some are required e.g. due to a change in a specific component that we want/need to update, we try to bundle others only with major releases.
 
-This section should provide you with an overview of what changes to expect in the next major release (openDesk 2.0) expected in September 2025.
+This section provides an overview of potential changes to be part of the next major release (openDesk 2.0).
 
 - `functional.portal.link*` (see `functional.yaml.gotmpl` for details) are going to be moved into the `theme.*` tree, we are also going to move the icons used for the links currently found under `theme.imagery.portalEntries` in this step.
 - We will explicitly set the [database schema configuration](https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Configuration/#HConfigurethenamesofdatabaseschemas) for XWiki to avoid the use of the `public` schema.
-- `persistance.storages.oxConnector.storageClassName` and `persistance.storages.nubusUdmListener.storageClassName` will be templated in Helmfile requiring you to template them explicitly if their current default values differs from the global value set in `persistence.storageClassNames.RWO`.
+- Adding support for `storageClassName` templating of various components requiring upgrading of the existing PVCs:
-- The currently used Helm chart for Notes will be replaced requiring some config updates.
+  - `persistence.storages.oxConnector.storageClassName`
+  - `persistence.storages.nubusUdmListener.storageClassName`
+  - `persistence.storages.nubusProvisioningNats.storageClassName`
 
-# Automated migrations - Overview and mandatory upgrade path
+# Overview and mandatory upgrade path
 
 The following table gives an overview of the mandatory upgrade path of openDesk, required in order for the automated migrations to work as expected.
 
-To upgrade existing deployments, you cannot skip any version mentioned in the column *Mandatory version*. When a version number is not fully defined (e.g. `v1.1.x`), you can install any version matching that constraint.
+To upgrade existing deployments, you _cannot_ skip any version denoted with `yes` in the column
+*Mandatory*. This ensures [automated migrations](#automated-migrations---details) have the required previous
+state of openDesk. When a version number is not fully defined (e.g. `v1.1.x`), you can install any version
+matching that constraint, though our links always point to the newest patch release for that minor version.
 
-| Mandatory version |
+> [!warning]
-| ----------------- |
+> You must perform **all** manual pre and post upgrade steps for **any** major, minor and patch version up to your desired openDesk version!
-| v1.5.0            |
-| v1.1.x            |
-| v1.0.0            |
-| v0.9.0            |
-| v0.8.1            |
-<!-- | 1.x.x        |  add the entry to the table as soon as we get new migration requiring that the former migration was executed -->
 
-> **Note**<br>
+> [!note]
+> An exemplary update path for an upgrade from v1.3.2 to v1.7.1 would be:
+> 1. You are at v1.3.2 → pre steps for v1.4.0 to v1.5.0
+> 1. Upgrade to v1.5.0 → post steps for v1.4.0 to v1.5.0
+> 1. You are at v1.5.0 → pre steps for v1.6.0 to 1.7.1
+> 1. Upgrade to v1.7.1 → post steps for v1.6.0 to v1.7.1
+
+<!-- IMPORTANT: Make sure to mark mandatory releases if an automatic migration requires a previous update to be installed -->
+| Version                                                                                  | Mandatory | Pre-Upgrade                                                                                                                    | Post-Upgrade                             | Minimum Required Previous Version                    |
+| ---------------------------------------------------------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------- | ---------------------------------------------------- |
+| [v1.10.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.9.0) | --        | [Pre](#pre-upgrade-to-versions--v1100)                                                                                         | [Post](#post-upgrade-to-versions--v1100) | ⬇ Install ≥ v1.5.0 first                            |
+| [v1.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.9.0)  | --        | [Pre](#pre-upgrade-to-versions--v190)                                                                                          | --                                       | ⬇ Install ≥ v1.5.0 first                            |
+| [v1.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.8.0)  | --        | [Pre](#pre-upgrade-to-versions--v180)                                                                                          | --                                       | ⬇ Install ≥ v1.5.0 first                            |
+| [v1.7.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.7.1)  | --        | [Pre](#pre-upgrade-to-versions--v170)                                                                                          | [Post](#post-upgrade-to-versions--v170)  | ⬇ Install ≥ v1.5.0 first                            |
+| [v1.6.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.6.0)  | --        | [Pre](#pre-upgrade-to-versions--v160)                                                                                          | [Post](#post-upgrade-to-versions--v160)  | [⚠ Install v1.5.0 first](#versions--v160-automated) |
+| [v1.5.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.5.0)  | **yes**   | --                                                                                                                             | --                                       | ⬇ Install ≥ v1.1.x first                            |
+| [v1.4.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.4.1)  | --        | [Pre](#pre-upgrade-to-versions--v140)                                                                                          | --                                       | ⬇ Install ≥ v1.1.x first                            |
+| [v1.3.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.3.2)  | --        | [Pre](#pre-upgrade-to-versions--v130)                                                                                          | --                                       | ⬇ Install ≥ v1.1.x first                            |
+| [v1.2.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.2.1)  | --        | [Pre](#pre-upgrade-to-versions--v120)                                                                                          | --                                       | [⚠ Install v1.1.x first](#versions--v120-automated) |
+| [v1.1.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.1.2)  | **yes**   | [Pre .0](#pre-upgrade-to-versions--v110) → [Pre .1](#pre-upgrade-to-versions--v111) → [Pre .2](#pre-upgrade-to-versions--v112) | [Post](#post-upgrade-to-versions--v110)  | [⚠ Install v1.0.0 first](#versions--v110-automated) |
+| [v1.0.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.0.0)  | **yes**   | [Pre](#pre-upgrade-to-versions--v100)                                                                                          | [Post](#post-upgrade-to-versions--v100)  | [⚠ Install v0.9.0 first](#versions--v100-automated) |
+| [v0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v0.9.0)  | **yes**   | --                                                                                                                             | --                                       | --                                                   |
+
+> [!warning]
 > Be sure to check out the table in the release version you are going to install, and not the currently installed version.
 
 If you would like more details about the automated migrations, please read section [Automated migrations - Details](#automated-migrations---details).
 
 # Manual checks/actions
 
-## v1.7.0+
+> [!note]
+> We **only** use the mathematical symbol ≥ to denote for which versions manual steps must be
+> applied. For example, "Versions ≥ v1.7.0" refers to all openDesk versions (major, minor and
+> patch) starting from 1.7.0, e.g. 1.7.0, 1.7.1, 1.8.0, etc. Furthermore, if a version is not explicitly
+> listed no extra manual steps are required when upgrading to that version, e.g. in the case of an update from
+> version 1.7.0 to version 1.7.1.
 
-### Pre-upgrade to v1.7.0+
+## Versions ≥ v1.11.0
 
-### Helmfile fix: Ensure enterprise overrides apply when deploying from project root
+### Pre-upgrade to versions ≥ v1.11.0
+
+#### Helmfile new option: Annotations for external services (Dovecot, Jitsi JVB, Postfix)
+
+**Target group:** Existing deployments using `service` annotations.
+
+The three non-HTTP external services support now explicit annotations.
+See [`annotations.yaml.gomtpl`](../helmfile/environments/default/annotations.yaml.gotmpl) for reference.
+
+**Jitsi JVB**
+
+The already existing annotation key `annotations.jitsiJVB.service` has been renamed to
+`annotations.jitsiJVB.serviceExternal` be in line with the newly added ones for Postfix and Dovecot.
+If you make use of the JVB service annotation please rename the attribute to the new `serviceExternal` standard.
+
+**Dovecot**
+
+Setting service annotation by `annotations.openxchangeDovecot.service` applied the annotations to the internal
+and external service. This key now only sets annotations for the internal service. If you want to set
+annotations for the external service use the newly introduced key `annotations.openxchangeDovecot.serviceExternal`.
+
+**Postfix**
+
+Setting service annotation by `annotations.openxchangePostfix.service` applied the annotations to the internal
+and external service. This key now only sets annotations for the internal service. If you want to set
+annotations for the external service use the newly introduced key `annotations.openxchangePostfix.serviceExternal`.
+
+## Versions ≥ v1.10.0
+
+### Pre-upgrade to versions ≥ v1.10.0
+
+#### Deployment cleanup: Collabora Controller
+
+**Target group:** Existing openDesk Enterprise deployments using Collabora Controller. Actually only long running
+deployments are affected, but following the instructions won't hurt.
+
+As per upstream release notes for [Collabora Online Controller 1.1.4](https://www.collaboraonline.com/cool-controller-release-notes/)
+you have to remove the existing leases of the Controller. You can do so by setting `<your_namespace>` and executing
+the commands below.
+
+```shell
+export NAMESPACE=<your_namespace>
+export COLLABORA_CONTROLLER_DEPLOYMENT_NAME=collabora-controller-cool-controller
+kubectl -n ${NAMESPACE} scale deployment/${COLLABORA_CONTROLLER_DEPLOYMENT_NAME} --replicas=0
+kubectl -n ${NAMESPACE} delete -n collabora leases.coordination.k8s.io collabora-online
+```
+
+> [!note]
+> The Collabora Online Controller is not scaled up again, as this would happen as part of the upgrade deployment.
+
+#### Helmfile new secret: `secrets.nubus.ldapSearch.postfix`
+
+**Target group:** All existing deployments that use self-defined secrets.
+
+The updated Postfix configuration supporting LDAP group based mailing list requires a new secret that is
+declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) by the key
+`secrets.nubus.ldapSearch.postfix`.
+
+If you define your own secrets, please ensure that you provide a value for this secret, otherwise it will
+be derived from the `MASTER_PASSWORD`.
+
+#### Helmfile new secret: `secrets.doveocot.sharedMailboxesMasterPassword`
+
+**Target group:** All existing deployments that have OX App Suite enabled and that use self-defined secrets.
+
+The revised Dovecot configuration requires a new secret that is declared in
+[`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) by the key
+`secrets.doveocot.sharedMailboxesMasterPassword`.
+
+If you define your own secrets, please ensure that you provide a value for this secret, otherwise it will
+be derived from the `MASTER_PASSWORD`.
+
+#### New Helmfile default: Nubus provisioning debug container no longer deployed
+
+**Target group:** All deployments that make use of the debugging container for Nubus' provisioning stack called "nats-box",
+
+The [nats-box](https://github.com/nats-io/nats-box), a handy tool when it comes to debugging the Nubus provisioning stack, is no longer enabled in openDesk by default.
+
+To re-enable the nats-box for your deployment you have to set:
+```yaml
+technical:
+  nubus:
+    provisioning:
+      nats:
+        natsBox:
+          enabled: true
+```
+
+> [!note]
+> The nats-box also gets enabled when setting `debug.enabled: true`, but that should only be used in non-production scenarios and enabled debug
+> accross the whole deployment.
+
+#### New Helmfile default: Postfix SMTP SASL security options
+
+**Target group:** All openDesk deployments using an external SMTP relay that does not support
+[Postfix's default `smtpSASLSecurityOptions`](https://www.postfix.org/postconf.5.html#smtp_sasl_security_options).
+
+Starting from openDesk v1.9.0, the SMTP SASL security options set within openDesk are aligned with the
+recommended defaults. This might break currently working connections with external SMTP relays.
+
+> [!warning]
+> Please check your mail relays supported SASL security options and adjust your deployment accordingly to
+> prevent the disruption of mail delivery.
+
+To fall back to the behavior of openDesk < v1.9.0 (no security options at all) set the following in
+`smtp.yaml.gotmpl`
+
+``` yaml
+smtp:
+  security:
+    smtpdSASLSecurityOptions: ~
+    smtpSASLSecurityOptions: ~
+```
+
+To set specific options consult the official Postfix documentation for
+[smtpd](https://www.postfix.org/postconf.5.html#smtpd_sasl_security_options) or
+[smtp](https://www.postfix.org/postconf.5.html#smtp_sasl_security_options) and set the string options via the
+yaml array notation:
+
+``` yaml
+smtp:
+  security:
+    smtpdSASLSecurityOptions:
+      - "noanonymous"
+    smtpSASLSecurityOptions:
+      - "noanonymous"
+      - "noplaintext"
+```
+
+### Post-upgrade to versions ≥ v1.10.0
+
+#### New application default: Dovecot full-text search index configuration
+
+**Target group:** All openDesk Enterprise deployments using the groupware module.
+
+Due to a configurational change the full-text search indexes of Dovecot Pro need to be rebuilt.
+
+Run the following command inside the Dovecot container:
+
+```shell
+set -x; for d in /var/lib/dovecot/*/*; do uuid=$(basename "$d"); [[ $uuid =~ ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$ ]] || continue; doveadm fts rescan -u "$uuid"; doveadm index -u "$uuid" -q '*'; done
+```
+
+## Versions ≥ v1.9.0
+
+### Pre-upgrade to versions ≥ v1.9.0
+
+#### New application default: Postfix SMTP SASL security option
+
+**Target group:** All openDesk deployments using an external SMTP relay that does not support
+[Postfix's default `smtpSASLSecurityOptions`](https://www.postfix.org/postconf.5.html#smtp_sasl_security_options).
+
+Starting from openDesk v1.9.0, the SMTP SASL security options set within openDesk are aligned with the
+recommended defaults. This might break currently working connections with external SMTP relays. To prevent
+this you have to configure the supported options for your mail relay one of the following ways:
+
+- Recommended: Directly upgrade to v1.10.0 and set SMTP SASL options through `smtp.security.*`.
+- Configure a customization for `smtpSASLSecurityOptions`.
+
+#### Helmfile fix: Cassandra passwords read from `databases.*`
+
+**Target group:** All of the below must apply to your deployment:
+1. Enterprise Edition
+2. Using external Cassandra DB
+3. Defined the Cassandra passwords in `databases.*` (`database.yaml.gotmpl`) which got ignored until now
+4. Defined the Cassandra passwords then in `secrets.*` (`secrets.yaml.gotmpl`)
+
+The Cassandra passwords
+- `databases.dovecotDictmap.password`
+- `databases.dovecotACL.password`
+
+are no longer ignored. So please move the passwords from
+- `secrets.cassandra.dovecotDictmapUser`
+- `secrets.cassandra.dovecotACLUser`
+
+to the `databases.*` structure.
+
+#### Helmfile new feature: `functional.groupware.externalClients.*`
+
+**Target group:**
+Deployments that allow access to groupware emails via external mail clients (e.g. Thunderbird) using IMAP and SMTP.
+
+OX App Suite can display a dialog with configuration details for connecting external mail clients. In previous versions,
+this dialog was automatically enabled when Dovecot was deployed with a service type of `NodePort` or `LoadBalancer`.
+
+From now on, the dialog can be explicitly controlled via the setting
+`functional.groupware.externalClients.enabledOnboardingInfo`, which is set to `false` by default.
+If you want your users to see this dialog, set the attribute to `true`.
+
+Additionally, it is now possible to explicitly define the hostnames shown in the client onboarding dialog using the following values:
+- `functional.groupware.externalClients.fqdnImap`
+- `functional.groupware.externalClients.fqdnSmtp`
+
+If these values are not explicitly set, openDesk will use `.Values.global.domain` as in previous releases.
+
+## Versions ≥ v1.8.0
+
+### Pre-upgrade to versions ≥ v1.8.0
+
+#### New application default: Default group for two-factor authentication is now "2FA Users"
+
+**Target group:** All upgrade deployments.
+
+In previous openDesk versions, the default group for enforcing two-factor authentication (2FA) was `2fa-users`. Accounts in this group were required to set up and use time-based one-time passwords (TOTP) for 2FA during login.
+
+With the release v1.8.0 of openDesk, the openDesk IAM Nubus introduces a new default group named `2FA Users` serving the same purpose. Existing deployments will retain the old group, which will continue to enforce 2FA as before.
+
+However, for consistency and easier maintenance, we recommend migrating users from the old group to the new one and removing the old group afterward.
+
+#### New database and secrets: Portal now uses OIDC
+
+**Target group:** All upgrade deployments.
+
+The portal has been migrated to use OIDC for single sign-on by default. This introduces the following requirements for existing deployments:
+
+- New database: Deployments using external databases must provide a new PostgreSQL database. See `databases.umsAuthSession` in `databases.yaml.gotmpl` for configuration details.
+- New secrets: Deployments managing secrets manually must add:
+  - `secrets.keycloak.clientSecret.portal`: The OIDC client secret for the portal.
+  - `secrets.postgresql.umsAuthSessionUser`: For internal databases, set the secret for the database user here. If you are using an external database, you already provide these credentials in the New database step above.
+
+> [!note]
+> The SAML Client for the Nubus portal is still preserved in Keycloak and is going to be removed with openDesk 1.10.0.
+
+#### New application default: XWiki blocks self-registration of user accounts
+
+**Target group:** All openDesk deployments using XWiki.
+
+The upgrade itself requires no manual intervention. However, the previous default (self-registration enabled) may be unexpected in many deployments.
+
+XWiki supports self-registration for creating local, application-specific accounts. Before this upgrade, the feature was enabled by default. It can not be disabled at the deployment level due to limitations in the XWiki package.
+
+With the new default, self-registration is switched off for new deployments. Existing deployments must apply the change manually:
+
+1. Log in with an XWiki admin account.
+2. Open the URL below (replace `<YOURDOMAIN>` with your domain), or navigate manually:
+   - URL: `https://wiki.<YOURDOMAIN>/bin/admin/XWiki/XWikiPreferences?editor=globaladmin&section=Rights#|t=usersandgroupstable&p=1&l=10&uorg=users&wiki=local&clsname=XWiki.XWikiGlobalRights`
+   - Manual navigation: Burger menu → *Administer Wiki* (repeat for each subwiki, if applicable) → *Users & Groups* → *Rights* → *Users* (table header)
+3. In the first row labeled "Unregistered Users", ensure the box in the "Register" column shows a ❌ (disabled) by clicking it if necessary.
+
+#### New application default: Synapse rooms `v12`
+
+**Target group:** All deployments using Element/Synapse with unrestricted federation and public, federation-enabled rooms.
+
+Following the [security bulletin from matrix.org](https://matrix.org/blog/2025/08/security-release/), openDesk now sets the default room version for new Matrix rooms to v12.
+
+This change does not affect existing rooms. There is no immediate action required. However, if your setup allows unrestricted Matrix federation and you operate public, federation-enabled rooms, you should consider upgrading those rooms to v12 for improved security and compatibility.
+
+For instructions on upgrading rooms, refer to the [official upstream documentation](https://docs.element.io/latest/element-server-suite-pro/administration/upgrading-local-rooms/).
+
+OpenDesk includes several bundled widgets. When upgrading a room, a new room is created to replace the old one — widget data will not be automatically transferred to the new room.
+
+To preserve as much data as possible, dedicated upgrade guidelines for each of these widgets are available:
+
+- Matrix NeoBoard widget: https://github.com/nordeck/matrix-neoboard?tab=readme-ov-file#matrix-room-upgrades
+- Matrix Meetings widget: https://github.com/nordeck/matrix-meetings?tab=readme-ov-file#matrix-room-upgrades
+- Matrix Poll widget: https://github.com/nordeck/matrix-poll?tab=readme-ov-file#matrix-room-upgrades
+
+> [!note]
+> These instructions apply to any room upgrades, not just upgrade to `v12`.
+
+#### New Helmfile default: Restricting characters for directory and filenames in fileshare module
+
+**Target group:** All openDesk deployments using the fileshare module, as they may already contain files or directories with characters that are now restricted.
+
+openDesk now enforces restrictions on the characters allowed in directory and filenames by explicitly disallowing the following set: `* " | ? ; : \ / ~ < >`
+
+The reason is that desktop clients can not handle all characters due to restrictions in the underlying operating system and therefor syncing these directories and/or files will fail.
+
+This change was introduced because desktop clients cannot reliably handle certain characters due to operating system limitations, causing file synchronization to fail when these characters are present.
+
+For existing deployments, any files or directories containing restricted characters must be renamed before updates within the file or (sub)directory can succeed.
+
+Nextcloud provides tooling for renaming affected files using an [`occ command`](https://docs.nextcloud.com/server/latest/admin_manual/occ_command.html#sanitize-filenames) that can be executed by the operator, the command also supports a dry-run mode.
+
+You can customize the default restriction settings in `functional.yaml.gotmpl`:
+
+```yaml
+functional:
+  filestore:
+    naming:
+      forbiddenChars:
+        - '*'
+        - '"'
+        - '|'
+        - '?'
+        - ';'
+        - ':'
+        - '\'
+        - '/'
+        - '~'
+        - '<'
+        - '>'
+```
+
+#### Helmfile new default: New groupware settings changing current behaviour
+
+**Target group:** All openDesk deployments using OX App Suite
+
+The following options, newly introduced in `functional.yaml.gotmpl`, modify the previous default behavior of openDesk. Please review whether the new defaults are appropriate for your deployment:
+
+* `functional.groupware.mail.inbound.forward.enabled: false`
+  This setting prevents users from forwarding all incoming emails to external accounts.
+  Instead, the new option `functional.groupware.mail.inbound.notify.enabled: true` enables notifications to user-defined email addresses when new messages arrive.
+  To keep the previous behavior, set `forward` to `true` and `notify` to `false`.
+
+* `functional.groupware.userProfile.editRealName: false`
+  This setting prevents users from editing their display name in OX App Suite (e.g. the name shown when sending emails, in addition to the sender address).
+  The display name is centrally managed by the openDesk IAM.
+  To allow users to change it within OX App Suite, set this option to `true`.
+
+> [!note]
+> openDesk v1.8.0 adds even more options under `functional.groupware.*` while retaining the current default behaviour.
+
+#### New application default: Nextcloud apps "Spreed" and "Comments" no longer enabled by default
+
+**Target group:** All openDesk deployments using the fileshare module.
+
+The following Nextcloud apps/functions are no longer enabled by default. Please check if they are required in your deployment, i.e. are used by the user:
+
+* [Spreed](https://apps.nextcloud.com/apps/spreed): Used in openDesk to provide a chat tab to the file/directory details pane in the fileshare application.
+* Comments: Core app that lets users leave comments in the activity tab of the file/directory details pane.
+
+If required the apps can be enabled using the openDesk customization options for `opendeskNextcloudManagement`, see `customizations.yaml.gotmpl` for details, with the following settings:
+```yaml
+configuration:
+  feature:
+    comments:
+      enabled: true
+    apps:
+      spreed:
+        enabled: true
+```
+
+#### New application default: Gravatar is switched off for Jitsi and OpenProject
+
+**Target group:** All openDesk deployments using the video conference and project module that explicitly want Gravatar support.
+
+Gravatar support is no longer enabled by default in Jitsi and OpenProject. In case it is required openDesk's customization options can be used to enabled it, see `customizations.yaml.gotmpl` for details.
+
+- Jitsi: `customization.release.jitsi` with
+  ```yaml
+  jitsi:
+    web:
+      extraConfig:
+        disableThirdPartyRequests: false
+  ```
+- Open Project: `customization.release.openproject` with
+  ```yaml
+  environment:
+    OPENPROJECT_PLUGIN__OPENPROJECT__AVATARS: '{enable_gravatars: true, enable_local_avatars: true}'
+  ```
+
+## Versions ≥ v1.7.0
+
+### Pre-upgrade to versions ≥ v1.7.0
+
+#### Helmfile fix: Ensure enterprise overrides apply when deploying from project root
 
 **Target group:** All openDesk Enterprise deployments initiated from the project root using `helmfile_generic.yaml.gotmpl`
 
@@ -158,7 +572,7 @@ annotation:
   notesYProvider: {}
 ```
 
-### Post-upgrade to v1.7.0+
+### Post-upgrade to versions ≥ v1.7.0
 
 #### Upstream fix: Provisioning of functional mailboxes
 
@@ -185,16 +599,18 @@ kill ${PROVISIONING_PORT_FORWARD_PID}
 rm ${TEMPORARY_CONSUMER_JSON}
 ```
 
-## v1.6.0+
+## Versions ≥ v1.6.0
 
-### Pre-upgrade to v1.6.0+
+### Pre-upgrade to versions ≥ v1.6.0
 
 #### Upstream constraint: Nubus' external secrets
 
 **Target group:** Operators that use external secrets for Nubus.
 
-> **Note**<br>
+> [!note]
-> External Secrets are not yet a supported feature. We are working on making it available in 2025, though it is possible to make use of the support for external secrets within single applications using the openDesk [customization](../helmfile/environments/default/customization.yaml.gotmpl) options.
+> External secrets are not yet a supported feature. We are working on making it available in 2025,
+> though it is possible to make use of the support for external secrets within single applications using the
+> openDesk [customization](../helmfile/environments/default/customization.yaml.gotmpl) options.
 
 Please ensure you read the [Nubus 1.10.0 "Migration steps" section](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/changelog.html#v1-10-0-migration-steps) with focus on the paragraph "Operators that make use of the following UDM Listener secrets variables" and act accordingly.
 
@@ -204,7 +620,7 @@ Please ensure you read the [Nubus 1.10.0 "Migration steps" section](https://docs
 
 For OX App Suite to access the object storage a new secret has been introduced.
 
-It is declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) by the key: `secrets.minio.openxchangeUser`. If you define your own secrets, please ensure that you provide a value for this secret as well, otherwise the aforementioned secret will be derived from the `MASTER_PASSWORD`.
+It is declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) by the key: `secrets.minio.openxchangeUser`. If you define your own secrets, please ensure that you provide a value for this secret as well, otherwise it will be derived from the `MASTER_PASSWORD`.
 
 #### Helmfile new object storage: `objectstores.openxchange.*`
 
@@ -240,7 +656,7 @@ kubectl cp -n ${NAMESPACE} open-xchange-core-mw-default-0:/opt/open-xchange/ox-f
 2. Run the upgrade.
 3. Continue with the [related post-upgrade steps](#ox-app-suite-fix-up-using-s3-as-storage-for-non-mail-attachments-post-upgrade)
 
-### Post-upgrade to v1.6.0+
+### Post-upgrade to versions ≥ v1.6.0
 
 #### OX App Suite fix-up: Using S3 as storage for non mail attachments (post-upgrade)
 
@@ -281,15 +697,9 @@ ID    Type of Job                              Status     Further Information
 /opt/open-xchange/sbin/unregisterfilestore -A $MASTER_ADMIN_USER -P $MASTER_ADMIN_PW -i <your_old_filestore_id_from_step_3>
 ```
 
-## v1.4.0+
+## Versions ≥ v1.4.0
 
-### Pre-upgrade to v1.4.0+
+### Pre-upgrade to versions ≥ v1.4.0
-
-#### Helmfile new feature: `functional.authentication.ssoFederation`
-
-**Target group:** Deployments that make use of IdP federation as described in [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
-
-Please ensure to configure your IdP federation config details as part of `functional.authentication.ssoFederation`. You can find more details in the "Example configuration" section of [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
 
 #### Helmfile cleanup: `global.additionalMailDomains` as list
 
@@ -313,9 +723,19 @@ global:
     - "sub2.maildomain.de"
 ```
 
-## v1.2.0+
+## Versions ≥ v1.3.0
 
-### Pre-upgrade to v1.2.0+
+### Pre-upgrade to versions ≥ v1.3.0
+
+#### Helmfile new feature: `functional.authentication.ssoFederation`
+
+**Target group:** Deployments that make use of IdP federation as described in [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
+
+Please ensure to configure your IdP federation config details as part of `functional.authentication.ssoFederation`. You can find more details in the "Example configuration" section of [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
+
+## Versions ≥ v1.2.0
+
+### Pre-upgrade to versions ≥ v1.2.0
 
 #### Helmfile cleanup: Do not configure OX provisioning when no OX installed
 
@@ -376,9 +796,9 @@ In case you are planning to migrate an existing instance from MariaDB to Postgre
   - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
   - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
 
-## v1.1.2+
+## Versions ≥ v1.1.2
 
-### Pre-upgrade to v1.1.2+
+### Pre-upgrade to versions ≥ v1.1.2
 
 #### Helmfile feature update: App settings wrapped in `apps.` element
 
@@ -407,9 +827,9 @@ apps:
     enabled: true
 ```
 
-## v1.1.1+
+## Versions ≥ v1.1.1
 
-### Pre-upgrade to v1.1.1
+### Pre-upgrade to versions ≥ v1.1.1
 
 #### Helmfile feature update: Component specific `storageClassName`
 
@@ -462,9 +882,9 @@ persistence:
 
 A not yet templated secret was discovered in the Nubus deployment. It is now declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) and can be defined using: `secrets.nubus.masterpassword`. If you define your own secrets, please be sure this new secret is set to the same value as the `MASTER_PASSWORD` environment variable used in your deployment.
 
-## v1.1.0+
+## Versions ≥ v1.1.0
 
-### Pre-upgrade to v1.1.0
+### Pre-upgrade to versions ≥ v1.1.0
 
 #### Helmfile cleanup: Restructured `/helmfile/files/theme` folder
 
@@ -627,7 +1047,7 @@ The update from openDesk v1.0.0 contains Redis 7.4.1, like the other openDesk bu
 
 Please ensure the Redis you are using is updated to at least version 7.4 to support the requirement of OX App Suite.
 
-### Post-upgrade to v1.1.0+
+### Post-upgrade to versions ≥ v1.1.0
 
 #### XWiki fix-ups
 
@@ -653,13 +1073,13 @@ Unfortunately XWiki does not upgrade itself as expected. The bug has been report
 
 You should have now a fully functional XWiki instance with single sign-on and full-text search.
 
-## v1.1.0
+## Versions ≥ v1.0.0
 
-### Pre-upgrade to v1.1.0
+### Pre-upgrade to versions ≥ v1.0.0
 
 #### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus
 
-> **Warning**<br>
+> [!warning]
 > The upgrade will fail if you do not address this section in your current deployment.
 
 The update will remove unnecessary OX-Profiles in Nubus, so long as these profiles are in use.
@@ -837,7 +1257,7 @@ The IAM admin account `Administrator` is the only member of this group by defaul
 
 If you need other accounts to use the API, please assign them to the aforementioned group.
 
-### Post-upgrade to v1.0.0+
+### Post-upgrade to versions ≥ v1.0.0
 
 #### Configuration Improvement: Separate user permission for using Video Conference component
 
@@ -853,7 +1273,7 @@ This can be done as IAM admin:
 - Check the checkbox for *Video Conference* and the directly below check box for *Overwrite*.
 - Click on the green *Save* button at the top of the screen to apply the change.
 
-> **Hint**<br>
+> [!tip]
 > If you have a lot of users and want to update (almost) all them, you can select all users by clicking the checkbox in the user's table header and then de-selecting the users you do not want to update.
 
 #### Optional Cleanup
@@ -869,33 +1289,33 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
 
 # Automated migrations - Details
 
-## v1.6.0+ (automated)
+## Versions ≥ v1.6.0 (automated)
 
-> **Note**<br>
+> [!note]
 > Details can be found in [run_5.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_5.py).
 
-### v1.6.0+ migrations-post
+### Versions ≥ v1.6.0 migrations-post
 
-Restarting the StatefulSets `ums-provisioning-nats` and `ox-connector` due to a workaround applied on the NATS secrets, see the "Notes" segment of the ["Password seed" heading in getting-started.md](./docs/getting-started.md#password-seed)
+- Automatically restarts the StatefulSets `ums-provisioning-nats` and `ox-connector` due to a workaround applied on the NATS secrets, see the "Notes" segment of the ["Password seed" heading in getting-started.md](./docs/getting-started.md#password-seed)
 
-> **Note**<br>
+> [!note]
 > This change aims to prevent authentication failures with NATS in some Pods, which can lead to errors such as: `wait-for-nats Unavailable, waiting 2 seconds. Error: nats: 'Authorization Violation'`.
 
-## v1.2.0+ (automated)
+## Versions ≥ v1.2.0 (automated)
 
-> **Note**<br>
+> [!note]
 > Details can be found in [run_4.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_4.py).
 
-### v1.2.0+ migrations-pre
+### Versions ≥ v1.2.0 migrations-pre
 
-- Delete PVC `group-membership-cache-ums-portal-consumer-0`: With the upgrade the Nubus Portal Consumer no longer requires to be executed with root privileges. The PVC contains files that require root permission to access them, therefore the PVC gets deleted (and re-created) during the upgrade.
+- Automatically deletes PVC `group-membership-cache-ums-portal-consumer-0`: With the upgrade the Nubus Portal Consumer no longer requires to be executed with root privileges. The PVC contains files that require root permission to access them, therefore the PVC gets deleted (and re-created) during the upgrade.
-- Delete StatefulSet `ums-portal-consumer`: A bug was fixed in the templating of the Portal Consumer's PVC causing the values in `persistence.storages.nubusPortalConsumer.*` to be ignored. As these values are immutable, we had to delete the whole StatefulSet.
+- Automatically deletes StatefulSet `ums-portal-consumer`: A bug was fixed in the templating of the Portal Consumer's PVC causing the values in `persistence.storages.nubusPortalConsumer.*` to be ignored. As these values are immutable, we had to delete the whole StatefulSet.
 
-### v1.2.0+ migrations-post
+### Versions ≥ v1.2.0 migrations-post
 
-- Restarting Deployment `ums-provisioning-udm-transformer` and StatefulSet `ums-provisioning-udm-listener` as well as deleting the Nubus Provisioning consumer `durable_name:incoming` on stream `stream:incoming`: Due to a bug in Nubus 1.7.0 the `incoming` stream was blocked after the upgrade, the aforementioned measures unblock the stream.
+- Automatically restarts the Deployment `ums-provisioning-udm-transformer` and StatefulSet `ums-provisioning-udm-listener` and deletes the Nubus Provisioning consumer `durable_name:incoming` on stream `stream:incoming`: Due to a bug in Nubus 1.7.0 the `incoming` stream was blocked after the upgrade, the aforementioned measures unblock the stream.
 
-## v1.1.0+ (automated)
+## Versions ≥ v1.1.0 (automated)
 
 With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.
 
@@ -903,16 +1323,16 @@ openDesk's automated migrations takes care of this upgrade requirement described
 [Nubus 1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.5.1/en/changelog.html#migrate-existing-ldap-server-to-mirror-mode-readiness),
 creating the config map with the mentioned label.
 
-> **Note**<br>
+> [!note]
 > Details can be found in [run_3.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
 
-## v1.0.0+ (automated)
+## Versions ≥ v1.0.0 (automated)
 
 The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.
 
 The permissions required to execute the migrations can be found in the migration's Helm chart [`role.yaml'](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/v1.3.5/charts/opendesk-migrations/templates/role.yaml?ref_type=tags#L29).
 
-> **Note**<br>
+> [!note]
 > Details can be found in [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
 
 ## Related components and artifacts

docs/monitoring.md

@@ -23,8 +23,7 @@ openDesk includes integration with Prometheus-based monitoring.
 
 Together with [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack), you can easily leverage the full potential of the open-source cloud-native observability stack.
 
-Before enabling the following options, you need to install the respective custom resource definitions (CRDs) from the kube-prometheus-stack
+Before enabling the following options, you need to install the respective custom resource definitions (CRDs) from the kube-prometheus-stack repository which should at least include the Prometheus Operator.
-repository or Prometheus operator.
 
 # Defaults
 
@@ -33,14 +32,16 @@ All configurable options and their defaults can be found in
 
 # Metrics
 
-To deploy `podMonitor` and `serviceMonitor` custom resources, enable it by:
+To deploy `podMonitor` and `serviceMonitor` custom resources, enable them by:
 
 ```yaml
-prometheus:
+monitoring:
-  serviceMonitors:
+  prometheus:
-    enabled: true
+    serviceMonitors:
-  podMonitors:
+      enabled: true
-    enabled: true
+    podMonitors:
+      enabled: true
+```
 ```
 
 # Alerts
@@ -51,19 +52,23 @@ Some of these are created by our partners while others are defined in [opendesk-
 All alert rules are deployed as [PrometheusRule](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PrometheusRule) and can be enabled like this:
 
 ```yaml
-prometheus:
+monitoring:
-  prometheusRules:
+  prometheus:
-    enabled: true
+    prometheusRules:
+      enabled: true
 ```
 
 # Dashboards for Grafana
 
-To deploy optional Grafana dashboards with ConfigMaps, enable the functionality with:
+If your Grafana instance is deployed via kube-prometheus-stack, or you have deployed the [Sidecar for datasources](https://github.com/grafana/helm-charts/blob/main/charts/grafana/README.md#sidecar-for-datasources), openDesk can make dashboards available via ConfigMap resources. 
+
+Enable the functionality with the following snippet:
 
 ```yaml
-grafana:
+monitoring:
-  dashboards:
+  grafana:
-    enabled: true
+    dashboards:
+      enabled: true
 ```
 
 Please find further details in the [related Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards).

docs/permissions.md

@@ -52,8 +52,9 @@ Roles are defined sets of permissions that can be assigned to users. Each role c
 - **openDesk Administrator**: Manages openDesk-global settings, such as users and groups.
 - **openDesk User**: Can log in to openDesk to make use of defined openDesk applications.
 
-> **Note**<br>
+> [!note]
-> Although it is not enforced by openDesk, it is strongly recommended that a user account is not granted both roles at the same time. This is to maintain the separation of duties.
+> Although it is not enforced by openDesk, it is strongly recommended that a user account is not granted both
+> roles at the same time. This is to maintain the separation of duties.
 
 ### Application usage
 
@@ -84,7 +85,7 @@ openDesk includes predefined groups. Please see below.
 
 - **Domain Users**: Members of this group are *openDesk Users*.
 - **Domain Admins**: Members of this group are *openDesk IAM Administrators*. By default, this group has two-factor authentication (2FA) enabled.
-- **2fa-users**: Members of this group that are forced to use two-factor authentication (2FA).
+- **2FA Users**: Members of this group that are forced to use two-factor authentication (2FA).
 - **IAM API - Full Access**: Members of this group have full (read and write) access to the IAM's REST API.
 
 ### Application groups
@@ -93,15 +94,20 @@ When editing a user in the IAM, you can select if a user can access or get eleva
 
 To easily identify these groups, all of them are prefixed with `managed-by-Attribute-`.
 
-> **Note**<br>
+> [!note]
-> The membership of these groups is automatically managed based on the user's attributes from the "openDesk" tab. Any changes directly to the groups will be overwritten, so please always use the "openDesk" tab of the respective user. The IAM supports editing user attributes across multiple accounts simultaneously.
+> The membership of these groups is automatically managed based on the user's attributes from the "openDesk"
+> tab. Any changes directly to the groups will be overwritten, so please always use the "openDesk" tab of the
+> respective user. The IAM supports editing user attributes across multiple accounts simultaneously.
 
 #### Standard access to applications
 
 Unless a user is a member of a group, the respective application is not shown in the portal.
 
-> **Note**<br>
+> [!note]
-> In openDesk's identity provider, the required OIDC claims to access an application are only granted when the respective group membership is available. This means that even if a user who is not a member of an application group knows the link to the application and calls it directly, the single sign-on will be unsuccessful.
+> In openDesk's identity provider, the required OIDC claims to access an application are only granted when the
+> respective group membership is available. This means that even if a user who is not a member of an
+> application group knows the link to the application and calls it directly, the single sign-on will be
+> unsuccessful.
 
 - **managed-by-Attribute-Groupware**: Members of this group have access to the groupware applications.
 - **managed-by-Attribute-Fileshare**: Members of this group have access to the file sharing application.
@@ -130,7 +136,7 @@ Users get roles assigned based on their responsibilities and the tasks they need
 
 openDesk defines [templates](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/65-usertemplate.yaml) for the *User* and *Administrator* roles. The templates can be used by an *openDesk Administrator* to create users with these roles using the [administration portal](https://docs.opendesk.eu/administration/).
 
-> **Note**<br>
+> [!note]
 > Additional/custom templates can be created using the UDM REST API.
 
 ### *openDesk User*
@@ -195,8 +201,10 @@ Managing all application permissions within the IAM would require a superset of
 
 Within IAM groups, the visibility of openDesk applications can be configured. Like with users, this is done in the "openDesk" tab of the [group administration](https://docs.opendesk.eu/administration/gruppen/).
 
-> **Note**<br>
+> [!note]
-> Currently the openDesk applications do not support nested groups. As a result only direct group memberships of users are processed in the application.<br>
+> Currently the openDesk applications do not support nested groups. As a result only direct group memberships
-> The plan is to enable the openDesk applications to either support nested groups or to actively provision users into an application while resolving the nested group memberships for the application.
+> of users are processed in the application.<br> The plan is to enable the openDesk applications to either
+> support nested groups or to actively provision users into an application while resolving the nested group
+> memberships for the application.
 
 Within an application, each available group can have a set of application specific permissions assigned.

docs/releases.md

@@ -34,7 +34,10 @@ openDesk follows a structured release cycle to ensure predictability and reliabi
 | **Minor**      | Monthly        | New features, enhancements, may contain breaking changes or refactors (clearly flagged in the notes)              |
 | **Patch**      | On demand      | Bug fixes, security updates, minor improvements, no intended breaking changes               |
 
-> **Note:** openDesk does **not** guarantee that minor releases are 100% backward‑compatible. When a breaking change is unavoidable it is announced in the release notes under a dedicated header **“Breaking Changes”** and a migration guide is provided.
+> [!note]
+> openDesk does **not** guarantee that minor releases are 100% backward‑compatible. When a breaking > change
+> is unavoidable it is announced in the release notes under a dedicated header **“Breaking Changes”** > and a
+> migration guide is provided.
 
 ## Release schedule
 
@@ -52,7 +55,7 @@ openDesk follows a structured release cycle to ensure predictability and reliabi
 - openDesk does not guarantee an in‑place upgrade between two major versions. Always consult the release notes and plan appropriate migration efforts.
 - Even within the same major line, skipping multiple monthly minor versions is not guaranteed to work without intermediate upgrade steps.
 - All breaking changes, including those in monthly minor releases, are highlighted in the release notes under Breaking Changes.
-- Additional, non‑binding migration hints are collected in `migrations.md`
+- Additional, non‑binding migration hints are collected in [migrations.md](./migrations.md)
 
 # Patch management process
 

docs/requirements.md

@@ -29,14 +29,14 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
 - K8s cluster >= v1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
 - Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases)
-- [Helm](https://helm.sh/) >= v3.17.3, but not v3.18.0[^1]
+- [Helm](https://helm.sh/) >= v3.17.3 (but not v3.18.0[^1]) and < v4[^2],
 - [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= v1.0.0
 - [HelmDiff](https://github.com/databus23/helm-diff) >= v3.11.0
-- Volume provisioner supporting RWO (read-write-once)[^2]
+- Volume provisioner supporting RWO (read-write-once)[^3]
 - Certificate handling with [cert-manager](https://cert-manager.io/)
 
 **Additional openDesk Enterprise requirements**
-- [OpenKruise](https://openkruise.io/)[^3] >= v1.6
+- [OpenKruise](https://openkruise.io/)[^4] >= v1.6
 
 # Hardware
 
@@ -55,7 +55,7 @@ Any self-hosted or managed K8s cluster >= v1.24 listed in
 
 The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/kubespray) based clusters.
 
-> **Note**<br>
+> [!note]
 > The deployment is not tested against OpenShift.
 
 # Ingress controller
@@ -67,7 +67,7 @@ configured ingress controller deployed in your cluster.
 
 - [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx)
 
-> **Note**<br>
+> [!note]
 > The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/).
 
 **Compatibility with Ingress NGINX >= 1.12.0**
@@ -79,8 +79,9 @@ controller.config.strict-validate-path-type=false
 ```
 See the [`annotations-risk-level` documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotations-risk-level) and [`strict-validate-path-type` documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#strict-validate-path-type) for details.
 
-> **Important Note**<br>
+> [!warning]
-> Ensure to install at least Ingress NGINX 1.11.5 or 1.12.1 due to [security issues](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) in earlier versions.
+> Ensure to install at least Ingress NGINX 1.11.5 or 1.12.1 due to [security
+> issues](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) in earlier versions.
 
 ## Minimal configuration
 
@@ -96,7 +97,7 @@ See the [`allowSnippetAnnotations` documentation](https://kubernetes.github.io/i
 Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment, a local- or hostPath-
 provisioner is sufficient.
 
-> **Note**<br>
+> [!note]
 > Some components require a `ReadWriteMany` volume provisioner for distributed mode or horizontal scaling.
 
 # Certificate management
@@ -137,8 +138,11 @@ Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare
 
 # Footnotes
 
-[^1]: Due to a [Helm bug](https://github.com/helm/helm/issues/30890) Helm 3.18.0 is not supported.
+[^1]: Due to a [Helm bug](https://github.com/helm/helm/issues/30890) Helm v3.18.0 is not supported.
 
-[^2]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail.
+[^2]: Helm v4 introduced stricter flag grouping that is not yet supported by the helmdiff plugin.
+
+[^3]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail. E.g. the `local-path-provisioner` does not have sticky bit support.
+
+[^4]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
 
-[^3]: Required for Dovecot Pro as part of openDesk Enterprise Edition.

docs/scaling.md

@@ -7,6 +7,7 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Scaling</h1>
 
 This document covers the possibilities to scale the applications in openDesk.
+You may also want to review the prepared [size profiles](./size-profiles.md).
 
 It provides rough benchmarks for configuring your own environment across various scale levels.
 In production, resource demands are primarily driven by actual usage patterns and system load, especially the number of concurrently active users.
@@ -25,6 +26,7 @@ Consequently, we strongly recommend implementing monitoring and logging solution
 
 [^1]: Nextcloud is configured for attachment storage as well.
 
+
 # Upstream information
 
 While scaling services horizontally is the ideal solution, information about vertical scaling is helpful

docs/security-context.md

@@ -172,9 +172,9 @@ This list gives you an overview of templated security settings and if they compl
 | **nextcloud**/opendesk-nextcloud-notifypush | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/aio | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
-| **notes**/impress/backend | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no |
+| **notes**/impress/backend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **notes**/impress/frontend | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no |
+| **notes**/impress/frontend | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **notes**/impress/y-provider | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no |
+| **notes**/impress/y-provider | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **nubus**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/intercom-service/provisioning | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
 | **nubus**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |

docs/security.md

@@ -21,9 +21,10 @@ For more details on Chart validation, please visit: https://helm.sh/docs/topics/
 
 All charts except the ones mentioned below are verifiable:
 
-| Repository        | Verifiable |
+| Repository                | Verifiable |
-|-------------------|:----------:|
+| ------------------------- | :--------: |
-| open-xchange-repo |     no     |
+| collabora-controller-repo |     no     |
+| open-xchange-repo         |     no     |
 
 # Kubernetes security enforcements
 

docs/size-profiles.md

@@ -0,0 +1,49 @@
+<!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Size Profiles</h1>
+
+This repository contains base profiles for the following maximum user counts:
+
+- 500
+- 5,000 (5k)
+- 50,000 (50k)
+- 100,000 (100k)
+
+# Assumptions
+
+These profiles were created with some assumptions in mind:
+
+- Regular load without application-specific emphasis
+- 10% concurrent user load at max on individual applications
+
+As user profiles can vary significantly between different instances, you may want to adjust these values.
+For information on adjusting values, refer to the [scaling](./scaling.md) documentation for openDesk.
+
+# Hardware Requirements
+
+The following table provides an overview of CPU and memory requirements, including [external services](./external-services.md).
+The available memory in the cluster should be between the request and limit values. Actual memory utilization varies depending on usage patterns but will unlikely consume the complete setup limit.
+
+| **Profile** | CPUs | Memory (Gi), request | Memory (Gi), limit |
+|-------------|------|----------------------|--------------------|
+|     **500** |  >25 |                   32 |                141 |
+|      **5k** |  >54 |                   86 |                551 |
+|     **50k** | >206 |                  422 |               2058 |
+|    **100k** | >336 |                  711 |               3418 |
+
+# Location
+
+`/helmfile/environments/default-size-<max-user-profile>-overrides/`
+
+# Deployment
+
+Set the environment variable `SIZE_PROFILE` to `500`, `5k`, `50k`, or `100k` when using helmfile to use one profile.
+
+# Notes
+
+The size profiles contain resource definitions for [external services](./external-services.md) that can be used as guidance for production-grade service requirements.
+
+Large and very large instances (50k and 100k) also require more allowed concurrent connections (`max_connections`) on the databases (especially PostgreSQL) than the default value (100).

docs/theming.md

@@ -20,9 +20,9 @@ Please review the default configuration that is applied to understand your custo
 
 You can just update the files in [helmfile/files/theme](../helmfile/files/theme) to change logos, favicons etc. Note that the `.svg` versions of the favicons are also used for the portal tiles.
 
-> **Note**<br>
+> [!note]
-> Theming focuses on colors, iconography and imagery. If you like to adapt the default links in the portal pointing to external
+> Theming focuses on colors, iconography and imagery. If you like to adapt the default links in the portal
-> resources (like "Support", "Legal Notice") please check the `functional.portal` section
+> pointing to external resources (like "Support", "Legal Notice") please check the `functional.portal` section
 > in [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl)
 
 # Known limitations

helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl

@@ -47,7 +47,10 @@ ingress:
         - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
 
 podAnnotations:
-  {{ .Values.annotations.coco.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "collabora-controller"
+  {{- with .Values.annotations.coco.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 securityContext:
   allowPrivilegeEscalation: false

helmfile/apps/collabora/values.yaml.gotmpl

@@ -20,6 +20,11 @@ collabora:
     --o:num_prespawn_children={{ .Values.technical.collabora.numPrespawnChildren }}
     --o:remote_font_config.url=https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/richdocuments/settings/fonts.json
     --o:net.proto={{ if eq .Values.cluster.networking.ipFamilies "DualStack" }}all{{ else }}{{ .Values.cluster.networking.ipFamilies }}{{ end }}
+    --o:security.enable_macros_execution={{ .Values.functional.weboffice.macros.enabled }}
+    --o:security.macro_security_level={{- $val := printf "%v" .Values.functional.weboffice.macros.securityLevel -}}{{- if or (eq $val "0") (eq $val "1") -}}{{ $val }}
+      {{- else -}}
+      {{ fail (printf "Invalid value for functional.weboffice.macros.securityLevel: '%s'. Allowed values: 0 or 1" $val) }}
+      {{- end }}
     {{- if .Values.debug.enabled }}
     --o:logging.level=debug
     {{- else }}
@@ -30,7 +35,7 @@ collabora:
     {{- end }}
     {{- if .Values.apps.collaboraController.enabled }}
     --o:indirection_endpoint.url=https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/routeToken
-    --o:monitors.monitor[0]=ws://collabora-controller-cool-controller:9000/controller/ws
+    --o:monitors.monitor[0]=ws://collabora-controller-cool-controller.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:9000/controller/ws
     --o:monitors.monitor[0][@retryInterval]=5
     {{- end }}
   username: "collabora-internal-admin"
@@ -105,7 +110,10 @@ ingress:
         - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
 
 podAnnotations:
-  {{ .Values.annotations.collabora.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "collabora"
+  {{- with .Values.annotations.collabora.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   fsGroup: 1001
@@ -138,6 +146,22 @@ securityContext:
     drop:
       - "ALL"
     add:
+      # For secuity reasons, esp. when macros are enabled, Collabora isolates all documents workspaces
+      # from each other. This isolation can work in three different ways. Collabora will automatically
+      # select the best option.
+      # - Using linux user namespaces is the most efficient one. You can test if user namespaces are
+      #   available by running `unshare -Ur bash` in the Collabora Pod. If it returns
+      #   `unshare: unshare failed: Operation not permitted`
+      #   user namespaces are not available.
+      #   Capabilities required: none
+      #   Note: A container runtime still could gate syscalls like `unshare` with `CAP_SYSADMIN`. You could
+      #         try using a custom seccompProfile in that case.
+      #         Ref.: https://github.com/CollaboraOnline/online/blob/master/docker/cool-seccomp-profile.json
+      # - Linking the documents and runtime environment into their own context.
+      #   Capabilities required: `CAP_SYSADMIN`, `CAP_SYSCHROOT`, `CHOWN`, `FOWNER`
+      # - Copying the documents and runtime environment into their own context,
+      #   having impact on the performance.
+      #   Capabilities required: `CAP_SYSCHROOT`, `CHOWN`, `FOWNER`
       - "CHOWN"
       - "FOWNER"
       - "SYS_CHROOT"

helmfile/apps/cryptpad/values.yaml.gotmpl

@@ -55,7 +55,10 @@ persistence:
   enabled: false
 
 podAnnotations:
-  {{ .Values.annotations.cryptpad.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "cryptpad"
+  {{- with .Values.annotations.cryptpad.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   fsGroup: 4001

helmfile/apps/element/values-element.yaml.gotmpl

@@ -34,6 +34,7 @@ configuration:
             - org.matrix.msc2762.receive.event:net.nordeck.whiteboard.document.chunk
             - org.matrix.msc2762.send.event:net.nordeck.whiteboard.document.snapshot
             - org.matrix.msc2762.receive.event:net.nordeck.whiteboard.document.snapshot
+            - org.matrix.msc2762.receive.state_event:m.room.create
             - org.matrix.msc2762.send.state_event:m.room.power_levels#
             - org.matrix.msc2762.receive.state_event:m.room.power_levels#
             - org.matrix.msc2762.receive.state_event:m.room.member
@@ -56,6 +57,7 @@ configuration:
             - org.matrix.msc2762.receive.state_event:net.nordeck.poll
             - org.matrix.msc2762.send.state_event:net.nordeck.poll.settings
             - org.matrix.msc2762.receive.state_event:net.nordeck.poll.settings
+            - org.matrix.msc2762.receive.state_event:m.room.create
             - org.matrix.msc2762.receive.state_event:m.room.power_levels
             - org.matrix.msc2762.receive.state_event:m.room.name
             - org.matrix.msc2762.receive.state_event:m.room.member
@@ -141,7 +143,10 @@ ingress:
     {{ .Values.annotations.element.ingress | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.element.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-element"
+  {{- with .Values.annotations.element.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl

@@ -44,7 +44,10 @@ ingress:
     {{ .Values.annotations.elementMatrixNeoboardWidget.ingress | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeoboardWidget.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "matrix-neoboard-widget"
+  {{- with .Values.annotations.elementMatrixNeoboardWidget.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl

@@ -44,7 +44,10 @@ ingress:
     {{ .Values.annotations.elementMatrixNeochoiceWidget.ingress | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeochoiceWidget.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "matrix-neochoice-widget"
+  {{- with .Values.annotations.elementMatrixNeochoiceWidget.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl

@@ -25,7 +25,10 @@ image:
 fullnameOverride: "matrix-neodatefix-bot-bootstrap"
 
 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeodatefixBotBootstrap.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "values-matrix-neodatefix-bot-bootstrap"
+  {{- with .Values.annotations.elementMatrixNeodatefixBotBootstrap.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 securityContext:
   allowPrivilegeEscalation: false
@@ -42,7 +45,7 @@ securityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}
 
-podAnnotations:
+serviceAccount:
-  {{ .Values.annotations.elementMatrixNeodatefixBotBootstrap.serviceAccount | toYaml | nindent 2 }}
+  annotations:
-
+    {{ .Values.annotations.elementMatrixNeodatefixBotBootstrap.serviceAccount | toYaml | nindent 4 }}
 ...

helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl

@@ -90,7 +90,10 @@ persistence:
     {{ .Values.annotations.elementMatrixNeodatefixBot.persistence | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeodatefixBot.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "matrix-neodatefix-bot"
+  {{- with .Values.annotations.elementMatrixNeodatefixBot.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl

@@ -49,7 +49,10 @@ ingress:
     {{ .Values.annotations.elementMatrixNeodatefixWidget.ingress | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeodatefixWidget.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "matrix-neodatefix-widget"
+  {{- with .Values.annotations.elementMatrixNeodatefixWidget.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl

@@ -25,7 +25,10 @@ image:
 fullnameOverride: "opendesk-matrix-user-verification-service-bootstrap"
 
 podAnnotations:
-  {{ .Values.annotations.elementMatrixUserVerificationServiceBootstrap.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-matrix-user-verification-service-bootstrap"
+  {{- with .Values.annotations.elementMatrixUserVerificationServiceBootstrap.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 securityContext:
   allowPrivilegeEscalation: false

helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl

@@ -44,7 +44,10 @@ image:
   tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}
 
 podAnnotations:
-  {{ .Values.annotations.elementMatrixUserVerificationService.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-matrix-user-verification-service"
+  {{- with .Values.annotations.elementMatrixUserVerificationService.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-synapse-admin.yaml.gotmpl

@@ -56,7 +56,12 @@ cron:
     repository: {{ .Values.images.elementSyncAdmins.repository | quote }}
     tag: {{ .Values.images.elementSyncAdmins.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations:
+    intents.otterize.com/service-name: "opendesk-synapse-admin-cron"
 #fullnameOverride: "opendesk-synapse-admin"
+
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-admin"
 image:
   registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSynapseAdmin.registry | quote }}
   repository: {{ .Values.images.elementSynapseAdmin.repository | quote }}

helmfile/apps/element/values-synapse-adminbot-pipe.yaml.gotmpl

@@ -16,4 +16,6 @@ image:
   tag: {{ .Values.images.elementPipe.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 fullnameOverride: "opendesk-synapse-adminbot-pipe"
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-adminbot-pipe"
 ...

helmfile/apps/element/values-synapse-adminbot-web.yaml.gotmpl

@@ -20,4 +20,6 @@ ingress:
   enabled: {{ .Values.ingress.enabled }}
   tls:
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-adminbot-web"
 ...

helmfile/apps/element/values-synapse-auditbot-pipe.yaml.gotmpl

@@ -16,4 +16,6 @@ image:
   tag: {{ .Values.images.elementPipe.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 fullnameOverride: "opendesk-synapse-auditbot-pipe"
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-auditbot-pipe"
 ...

helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl

@@ -51,4 +51,6 @@ image:
   url: {{ .Values.images.elementGroupsync.repository | quote }}
   tag: {{ .Values.images.elementGroupsync.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-groupsync"
 ...

helmfile/apps/element/values-synapse-web.yaml.gotmpl

@@ -56,7 +56,10 @@ ingress:
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
 podAnnotations:
-  {{ .Values.annotations.elementSynapseWeb.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-synapse-web"
+  {{- with .Values.annotations.elementSynapseWeb.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-synapse.yaml.gotmpl

@@ -25,6 +25,14 @@ configuration:
       address:
         per_second: 2
         burst_count: 12
+    # Set higher limits for messages and media due to non-chat Matrix apps and widgets (such as NeoBoard)
+    # https://github.com/nordeck/matrix-neoboard/blob/main/docs/configuration.md#rate-limiting-settings
+    rc_message:
+      per_second: 5
+      burst_count: 25
+    rc_media_create:
+      per_second: 20
+      burst_count: 100
 
   database:
     host: {{ .Values.databases.synapse.host | quote }}
@@ -51,6 +59,7 @@ configuration:
 
   homeserver:
     serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
+    defaultRoomVersion: 12
     appServiceConfigs:
       - as_token: {{ .Values.secrets.intercom.synapseAsToken | quote }}
         hs_token: {{ .Values.secrets.intercom.synapseAsToken | quote }}
@@ -241,7 +250,10 @@ persistence:
     {{ .Values.annotations.elementSynapse.persistence | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.elementSynapse.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-synapse"
+  {{- with .Values.annotations.elementSynapse.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-well-known.yaml.gotmpl

@@ -49,7 +49,10 @@ ingress:
     {{ .Values.annotations.elementWellKnown.ingress | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.elementWellKnown.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-well-known"
+  {{- with .Values.annotations.elementWellKnown.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/jitsi/values-jitsi.yaml.gotmpl

@@ -94,6 +94,7 @@ jitsi:
             - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
     extraConfig:
       doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
+      disableThirdPartyRequests: true
     extraEnvs:
       TURN_ENABLE: "1"
     resources:
@@ -110,10 +111,11 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiWeb.pod }}
     podAnnotations:
-      {{ .Values.annotations.jitsiWeb.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "jitsi-web"
-    {{- end }}
+      {{- with .Values.annotations.jitsiWeb.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
   prosody:
     image:
       repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
@@ -163,10 +165,11 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.prosody | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiProsody.pod }}
     podAnnotations:
-      {{ .Values.annotations.jitsiProsody.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "jitsi-prosody"
-    {{- end }}
+      {{- with .Values.annotations.jitsiProsody.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
   jicofo:
     replicaCount: {{ .Values.replicas.jicofo }}
     image:
@@ -190,10 +193,11 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiJicofo.pod }}
     podAnnotations:
-      {{ .Values.annotations.jitsiJicofo.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "jitsi-jicofo"
-    {{- end }}
+      {{- with .Values.annotations.jitsiJicofo.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
   jigasi:
     replicaCount: {{ .Values.replicas.jigasi }}
     enabled: {{ .Values.sip.jigasi.enabled }}
@@ -223,10 +227,11 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jigasi | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiJigasi.pod }}
     podAnnotations:
-      {{ .Values.annotations.jitsiJigasi.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "jitsi-jigasi"
-    {{- end }}
+      {{- with .Values.annotations.jitsiJigasi.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
   jvb:
     replicaCount: {{ .Values.replicas.jvb }}
     # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
@@ -243,9 +248,9 @@ jitsi:
       {{ .Values.resources.jvb | toYaml | nindent 6 }}
     service:
       type: {{ coalesce .Values.service.type.jitsiVideoBridge .Values.cluster.service.type | quote }}
-    {{- if .Values.annotations.jitsiJvb.service }}
+    {{- if .Values.annotations.jitsiJvb.serviceExternal }}
       annotations:
-        {{ .Values.annotations.jitsiJvb.service | toYaml | nindent 8 }}
+        {{ .Values.annotations.jitsiJvb.serviceExternal | toYaml | nindent 8 }}
     {{- end }}
     securityContext:
       allowPrivilegeEscalation: false
@@ -259,10 +264,11 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jvb | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiJvb.pod }}
     podAnnotations:
-      {{ .Values.annotations.jitsiJvb.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "jitsi-jvb"
-    {{- end }}
+      {{- with .Values.annotations.jitsiJvb.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     metrics:
       prometheusAnnotations:
         {{ .Values.annotations.jitsiJvb.metricsPrometheus | toYaml | nindent 8 }}
@@ -287,10 +293,11 @@ jitsi:
       # Chart does not allow to template more
       capabilities:
         add: ["SYS_ADMIN"]
-    {{- if .Values.annotations.jitsiJibri.pod }}
     podAnnotations:
-      {{ .Values.annotations.jitsiJibri.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "jitsi-jibri"
-    {{- end }}
+      {{- with .Values.annotations.jitsiJibri.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
   imagePullSecrets:
   {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
@@ -302,6 +309,7 @@ jitsi:
   {{- end }}
 
 patchJVB:
+  backoffLimit: 12
   configuration:
     staticLoadbalancerIP: {{ .Values.cluster.networking.ingressGatewayIP | quote }}
     loadbalancerStatusField: {{ .Values.cluster.networking.loadBalancerStatusField | quote }}

helmfile/apps/nextcloud/values-nextcloud-management.yaml.gotmpl

@@ -10,7 +10,7 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 additionalAnnotations:
-  intents.otterize.com/service-name: "opendesk-nextcloud-php"
+  intents.otterize.com/service-name: "opendesk-nextcloud-management"
   {{- with .Values.annotations.nextcloudNextcloudMgmt.additional }}
   {{ . | toYaml | nindent 2}}
   {{- end }}
@@ -68,7 +68,9 @@ configuration:
       notifyPush:
         enabled: {{ gt .Values.replicas.nextcloudNotifyPush 0 }}
       spreed:
-        enabled: true
+        enabled: false
+    comments:
+      enabled: false
     circles:
       enabled: false
 
@@ -130,6 +132,7 @@ configuration:
 
   opendeskIntegration:
     centralNavigation:
+      jsonUrl: "http://ums-portal-server/portal/navigation.json"
       username:
         value: "opendesk_username"
       password:
@@ -175,8 +178,7 @@ configuration:
     token:
       value: {{ .Values.secrets.nextcloud.metricsToken | quote }}
 
-  # A sane default for windows clients would be: `* " | & ? , ; : \ / ~ < >`
+  forbiddenChars: {{ join " " .Values.functional.filestore.naming.forbiddenChars | quote }}
-  forbiddenChars: "* \" | & ? , ; : \\ / ~ < >"
 
 containerSecurityContext:
   allowPrivilegeEscalation: false

helmfile/apps/nextcloud/values-nextcloud-notifypush.yaml.gotmpl

@@ -10,7 +10,6 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 additionalAnnotations:
-  intents.otterize.com/service-name: "opendesk-nextcloud-notifypush"
   {{- with .Values.annotations.nextcloudNotifyPush.additional }}
   {{ . | toYaml | nindent 4 }}
   {{- end }}
@@ -114,7 +113,10 @@ metrics:
       {{ .Values.annotations.nextcloudNotifyPush.serviceMetrics | toYaml | nindent 6 }}
 
 podAnnotations:
-  {{ .Values.annotations.nextcloudNotifyPush.pod | toYaml | nindent 4 }}
+  intents.otterize.com/service-name: "opendesk-nextcloud-notifypush"
+  {{- with .Values.annotations.nextcloudNotifyPush.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 podSecurityContext:
   fsGroup: 101
 # prometheus:

helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl

@@ -7,7 +7,6 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 exporter:
-
   additionalAnnotations:
     intents.otterize.com/service-name: "opendesk-nextcloud-exporter"
     {{- with .Values.annotations.nextcloudExporter.additional }}
@@ -40,7 +39,10 @@ exporter:
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudExporter.tag | quote }}
   podAnnotations:
-    {{ .Values.annotations.nextcloudExporter.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "opendesk-nextcloud-exporter"
+    {{- with .Values.annotations.nextcloudExporter.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   prometheus:
     serviceMonitor:
       enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
@@ -59,8 +61,25 @@ exporter:
       {{ .Values.annotations.nextcloudExporter.serviceAccount | toYaml | nindent 6 }}
 
 aio:
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - weight: 1
+          podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+                - key: "app.kubernetes.io/name"
+                  operator: "In"
+                  values:
+                    - "aio"
+                - key: "app.kubernetes.io/instance"
+                  operator: "In"
+                  values:
+                    - "opendesk-nextcloud"
+            topologyKey: "kubernetes.io/hostname"
+
   additionalAnnotations:
-    intents.otterize.com/service-name: "opendesk-nextcloud-aio"
+    intents.otterize.com/service-name: "opendesk-nextcloud-aio-cron"
     {{- with .Values.annotations.nextcloudAio.additional }}
     {{ . | toYaml | nindent 4 }}
     {{- end }}
@@ -161,7 +180,10 @@ aio:
     tls:
       secretName: {{ .Values.ingress.tls.secretName | quote }}
   podAnnotations:
-    {{ .Values.annotations.nextcloudAio.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "opendesk-nextcloud-aio"
+    {{- with .Values.annotations.nextcloudAio.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podSecurityContext:
     fsGroup: 101
   prometheus:

helmfile/apps/notes/helmfile-child.yaml.gotmpl

@@ -11,6 +11,13 @@ repositories:
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
     url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
+  - name: "notes-customization-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.notesCustomization.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.notesCustomization.registry }}/{{ .Values.charts.notesCustomization.repository }}"
 
 releases:
   - name: "impress"
@@ -24,6 +31,17 @@ releases:
       {{- end }}
     installed: {{ .Values.apps.notes.enabled }}
     timeout: 1800
+  - name: "impress-customization"
+    chart: "notes-customization-repo/{{ .Values.charts.notesCustomization.name }}"
+    version: "{{ .Values.charts.notesCustomization.version }}"
+    wait: true
+    values:
+      - "values-customization.yaml.gotmpl"
+      {{- range .Values.customization.release.notesCustomization }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.notes.enabled }}
+    timeout: 1800
 
 commonLabels:
   deploy-stage: "component-1"

helmfile/apps/notes/values-customization.yaml.gotmpl

@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+frontend:
+  runtimeEnvs:
+    ICS_BASE_URL: {{ printf "https://%s.%s" .Values.global.hosts.intercomService .Values.global.domain | quote }}
+    PORTAL_BASE_URL: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain | quote }}
+...

helmfile/apps/notes/values.yaml.gotmpl

@@ -27,7 +27,7 @@ backend:
       {{- end }}
     ingressClassName: {{ .Values.ingress.ingressClassName }}
   ingressAdmin:
-    enabled: true
+    enabled: false
     annotations:
       {{ .Values.annotations.notesBackend.ingressAdmin | toYaml | nindent 6 }}
     ingressClassName: {{ .Values.ingress.ingressClassName }}
@@ -117,11 +117,20 @@ backend:
     seLinuxOptions:
       {{ .Values.seLinuxOptions.notesBackend | toYaml | nindent 6 }}
   podAnnotations:
-    {{ .Values.annotations.notesBackend.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-backend"
+    {{- with .Values.annotations.notesBackend.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podAnnotationsCreateUser:
-    {{ .Values.annotations.notesBackend.createUserJob | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-create-user"
+    {{- with .Values.annotations.notesBackend.createUserJob }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podAnnotationsMigrate:
-    {{ .Values.annotations.notesBackend.migrateJob | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-migrate"
+    {{- with .Values.annotations.notesBackend.migrateJob }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podSecurityContext:
     enabled: true
     fsGroup: 1000
@@ -131,19 +140,27 @@ backend:
   service:
     annotations:
       {{ .Values.annotations.notesBackend.service | toYaml | nindent 6 }}
-  {{- if .Values.certificate.selfSigned }}
   extraVolumes:
+    - name: "customization-volume"
+      configMap:
+        name: "impress-customization"
+    {{- if .Values.certificate.selfSigned }}
     - name: "trusted-cert-secret-volume"
       secret:
         secretName: "opendesk-certificates-ca-tls"
         items:
           - key: "ca.crt"
             path: "ca-certificates.crt"
+    {{- end }}
   extraVolumeMounts:
+    - name: "customization-volume"
+      mountPath: "/app/impress/configuration/theme/default.json"
+      subPath: "theme.json"
+    {{- if .Values.certificate.selfSigned }}
     - name: "trusted-cert-secret-volume"
-      mountPath: "/usr/local/lib/python3.12/site-packages/certifi/cacert.pem"
+      mountPath: "/usr/local/lib/python3.13/site-packages/certifi/cacert.pem"
       subPath: "ca-certificates.crt"
-  {{- end }}
+    {{- end }}
 
 frontend:
   image:
@@ -161,11 +178,6 @@ frontend:
     annotations:
       {{ .Values.annotations.notesFrontend.ingressMedia | toYaml | nindent 6 }}
     ingressClassName: {{ .Values.ingress.ingressClassName }}
-  extraEnvVars:
-    - name: "ICS_BASE_URL"
-      value: {{ printf "https://%s.%s" .Values.global.hosts.intercomService .Values.global.domain | quote }}
-    - name: "PORTAL_BASE_URL"
-      value: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain | quote }}
   configuration:
     objectStoreHost: {{ printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain | quote }}
   resources:
@@ -186,7 +198,10 @@ frontend:
     seLinuxOptions:
       {{ .Values.seLinuxOptions.notesFrontend | toYaml | nindent 6 }}
   podAnnotations:
-    {{ .Values.annotations.notesFrontend.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-frontend"
+    {{- with .Values.annotations.notesFrontend.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podSecurityContext:
     enabled: true
     fsGroup: 1000
@@ -197,6 +212,14 @@ frontend:
   serviceMedia:
     annotations:
       {{ .Values.annotations.notesFrontend.service | toYaml | nindent 6 }}
+  extraVolumes:
+    - name: "customization-volume"
+      configMap:
+        name: "impress-customization"
+  extraVolumeMounts:
+    - name: "customization-volume"
+      mountPath: "/usr/share/nginx/html/runtime-env.js"
+      subPath: "runtime-env.js"
 
 y-provider:
   image:
@@ -246,7 +269,10 @@ y-provider:
       {{ .Values.annotations.notesYProvider.ingressCollaborationWS | toYaml | nindent 6 }}
     ingressClassName: {{ .Values.ingress.ingressClassName }}
   podAnnotations:
-    {{ .Values.annotations.notesYProvider.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-y-provider"
+    {{- with .Values.annotations.notesYProvider.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podSecurityContext:
     enabled: true
     fsGroup: 1001

helmfile/apps/nubus/values-intercom-service.yaml.gotmpl

@@ -109,7 +109,10 @@ ingress:
     {{ .Values.annotations.nubusIntercomService.ingress | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.nubusIntercomService.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "intercom-service"
+  {{- with .Values.annotations.nubusIntercomService.pod }}
+  {{ . | toYaml | nindent 2}}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl

@@ -42,7 +42,10 @@ configuration:
       value: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
 
 podAnnotations:
-  {{ .Values.annotations.nubusNginxS3Gateway.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "nubus-nginx-s3-gateway"
+  {{- with .Values.annotations.nubusNginxS3Gateway.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 resources:
   {{ .Values.resources.nginxS3Gateway | toYaml | nindent 2 }}

helmfile/apps/nubus/values-nubus.yaml.gotmpl

@@ -86,12 +86,16 @@ global:
                       visible: "False"
             wizard:
               disabled: "No"
-
     ucs:
       web:
         theme: "light"
 
     umc:
+      # Configures that login redirects point to OIDC and not SAML. Does not disable the saml endpoint.
+      web:
+        sso:
+          enabled: false
+
       cookie-banner:
         show: "false"
       login:
@@ -179,20 +183,12 @@ keycloak:
     registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloak.registry | quote }}
     repository: {{ .Values.images.nubusKeycloak.repository }}
     tag: {{ .Values.images.nubusKeycloak.tag }}
-    # NOTE: The subchart "keycloak" does not yet support
-    # "global.imagePullPolicy". The local configuration can be removed once it
-    # does have this feature.
-    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   ingress:
     enabled: false
   keycloak:
     auth:
       username: "kcadmin"
-      # TODO: Pending secrets refactoring to be able to provide the value directly
+      password: {{ .Values.secrets.keycloak.adminPassword | quote }}
-      existingSecret:
-        name: "ums-opendesk-keycloak-credentials"
-        keyMapping:
-          adminPassword: "admin_password"
     login:
       messages:
         de:
@@ -270,7 +266,6 @@ nubusTwofaHelpdesk:
 nubusNotificationsApi:
   enabled: false
   additionalAnnotations:
-    intents.otterize.com/service-name: "ums-notifications-api"
     {{- with .Values.annotations.nubusNotificationsApi.additional }}
     {{ . | toYaml | nindent 4 }}
     {{- end }}
@@ -308,7 +303,10 @@ nubusNotificationsApi:
     annotations:
       {{ .Values.annotations.nubusNotificationsApi.persistence | toYaml | nindent 6 }}
   podAnnotations:
-    {{ .Values.annotations.nubusNotificationsApi.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-notifications-api"
+    {{- with .Values.annotations.nubusNotificationsApi.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   postgresql:
     connection:
       host: {{ .Values.databases.umsNotificationsApi.host | quote }}
@@ -335,7 +333,6 @@ nubusNotificationsApi:
 
 nubusPortalFrontend:
   additionalAnnotations:
-    intents.otterize.com/service-name: "ums-portal-frontend"
     {{- with .Values.annotations.nubusPortalFrontend.additional }}
     {{ . | toYaml | nindent 4 }}
     {{- end }}
@@ -411,7 +408,10 @@ nubusPortalFrontend:
     annotations:
       {{ .Values.annotations.nubusPortalFrontend.persistence | toYaml | nindent 6 }}
   podAnnotations:
-    {{ .Values.annotations.nubusPortalFrontend.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-portal-frontend"
+    {{- with .Values.annotations.nubusPortalFrontend.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   portalFrontend:
     branding:
       css: {{ .Values.theme.styles.portal.main | toJson }}
@@ -440,12 +440,6 @@ nubusKeycloakExtensions:
   keycloak:
     auth:
       username: "kcadmin"
-      # TODO: Pending secrets refactoring in component chart. This will refer to
-      # the secret generated by the keycloak subchart.
-      existingSecret:
-        name: "ums-opendesk-keycloak-credentials"
-        keyMapping:
-          adminPassword: "admin_password"
   proxy:
     additionalAnnotations:
       {{ .Values.annotations.nubusKeycloakExtensions.proxyAdditional | toYaml | nindent 6 }}
@@ -453,13 +447,6 @@ nubusKeycloakExtensions:
       registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionProxy.registry | quote }}
       repository: {{ .Values.images.nubusKeycloakExtensionProxy.repository }}
       tag: {{ .Values.images.nubusKeycloakExtensionProxy.tag }}
-      # NOTE: The subchart "keycloak-extensions" does not yet support
-      # "global.imagePullPolicy".
-      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    # NOTE: Remove once the keycloak-extensions subchart respects
-    # "global.imagePullSecrets".
-    imagePullSecrets:
-      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
     ingress:
       annotations:
         nginx.org/proxy-buffer-size: "8k"
@@ -555,13 +542,6 @@ nubusKeycloakExtensions:
       registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionHandler.registry | quote }}
       repository: {{ .Values.images.nubusKeycloakExtensionHandler.repository }}
       tag: {{ .Values.images.nubusKeycloakExtensionHandler.tag }}
-      # NOTE: The subchart "keycloak-extensions" does not yet support
-      # "global.imagePullPolicy".
-      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    # NOTE: Remove once the keycloak-extensions subchart respects
-    # "global.imagePullSecrets".
-    imagePullSecrets:
-      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
     podAnnotations:
       intents.otterize.com/service-name: "ums-keycloak-extensions-handler"
       {{- with .Values.annotations.nubusKeycloakExtensions.handlerPod }}
@@ -595,6 +575,7 @@ nubusPortalConsumer:
     auth:
       accessKeyId: {{ .Values.objectstores.nubus.username | quote }}
       secretAccessKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+      existingSecret: null
     bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
     endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
   persistence:
@@ -613,7 +594,7 @@ nubusPortalConsumer:
   replicaCount: {{ .Values.replicas.umsPortalConsumer }}
   resources:
     {{ .Values.resources.umsPortalConsumer | toYaml | nindent 4 }}
-  resourcesWaitForDependency:
+  initResources:
     {{ .Values.resources.umsPortalConsumerDependencies | toYaml | nindent 4 }}
   containerSecurityContext:
     seccompProfile:
@@ -661,7 +642,6 @@ nubusPortalConsumer:
 
 nubusPortalServer:
   additionalAnnotations:
-    intents.otterize.com/service-name: "ums-portal-server"
     {{- with .Values.annotations.nubusPortalServer.additional }}
     {{ . | toYaml | nindent 4 }}
     {{- end }}
@@ -699,13 +679,17 @@ nubusPortalServer:
     auth:
       accessKeyId: {{ .Values.objectstores.nubus.username | quote }}
       secretAccessKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+      existingSecret: null
     bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
     endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
   persistence:
     annotations:
       {{ .Values.annotations.nubusPortalServer.persistence | toYaml | nindent 6 }}
   podAnnotations:
-    {{ .Values.annotations.nubusPortalServer.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-portal-server"
+    {{- with .Values.annotations.nubusPortalServer.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   portalServer:
     centralNavigation:
       enabled: true
@@ -714,6 +698,8 @@ nubusPortalServer:
     featureToggles:
       notifications_api: false
       centered_layout: true
+      # Also enable adjustments in helmfile/files/theme/portal/stylesheet.css when enabling left_sidebar
+      left_sidebar: false
       newsfeed: {{ and .Values.apps.xwiki.enabled .Values.functional.portal.newsfeed.enabled }}
       umc_session_refresh: true
       welcome_message: {{ .Values.functional.portal.welcomeMessage.enabled }}
@@ -831,7 +817,10 @@ nubusUdmRestApi:
     annotations:
       {{ .Values.annotations.nubusUdmRestApi.persistence | toYaml | nindent 6 }}
   podAnnotations:
-    {{ .Values.annotations.nubusUdmRestApi.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-udm-rest-api"
+    {{- with .Values.annotations.nubusUdmRestApi.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end}}
   replicaCount: {{ .Values.replicas.umsUdmRestApi }}
   resources:
     {{ .Values.resources.umsUdmRestApi | toYaml | nindent 4 }}
@@ -890,7 +879,7 @@ nubusLdapServer:
   additionalAnnotations:
     {{ .Values.annotations.nubusLdapServer.additional | toYaml | nindent 4 }}
   additionalAnnotations:
-    intents.otterize.com/service-name: "ums-ldap-server"
+    {{ .Values.annotations.nubusLdapServer.additional | toYaml | nindent 4 }}
   dhInitcontainer:
     image:
       registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServerDhInitContainer.registry | quote }}
@@ -913,7 +902,10 @@ nubusLdapServer:
     size: {{ .Values.persistence.storages.nubusLdapServerData.size | quote }}
     storageClass: {{ coalesce .Values.persistence.storages.nubusLdapServerData.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
   podAnnotations:
-    {{ .Values.annotations.nubusLdapServer.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-ldap-server"
+    {{- with .Values.annotations.nubusLdapServer.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   replicaCountPrimary: {{ .Values.replicas.umsLdapServerPrimary }}
   replicaCountSecondary: {{ .Values.replicas.umsLdapServerSecondary }}
   replicaCountProxy: {{ .Values.replicas.umsLdapServerProxy }}
@@ -939,7 +931,6 @@ nubusProvisioning:
     {{ .Values.annotations.nubusProvisioning.additional | toYaml | nindent 4 }}
   api:
     additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-api"
       {{- with .Values.annotations.nubusProvisioning.apiAdditional }}
       {{ . | toYaml | nindent 6 }}
       {{- end }}
@@ -958,7 +949,10 @@ nubusProvisioning:
       auth:
         password: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
     podAnnotations:
-      {{ .Values.annotations.nubusProvisioning.apiPod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "ums-provisioning-api"
+      {{- with .Values.annotations.nubusProvisioning.apiPod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     resources:
       {{ .Values.resources.umsProvisioningApi | toYaml | nindent 6 }}
   containerSecurityContext:
@@ -977,7 +971,6 @@ nubusProvisioning:
       {{ .Values.seLinuxOptions.umsProvisioning | toYaml | nindent 6 }}
   dispatcher:
     additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-dispatcher"
       {{- with .Values.annotations.nubusProvisioning.dispatcherAdditional }}
       {{ . | toYaml | nindent 6 }}
       {{- end }}
@@ -989,20 +982,24 @@ nubusProvisioning:
       auth:
         password: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
     podAnnotations:
-      {{ .Values.annotations.nubusProvisioning.dispatcherPod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "ums-provisioning-dispatcher"
+      {{- with .Values.annotations.nubusProvisioning.dispatcherPod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     resources:
       {{ .Values.resources.umsProvisioningDispatcher | toYaml | nindent 6 }}
   nats:
     additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-nats"
       {{- with .Values.annotations.nubusProvisioning.natsAdditional }}
       {{ . | toYaml | nindent 6 }}
       {{- end }}
-    auth:
-      adminPassword: {{ .Values.secrets.nats.natsAdminPassword | quote }}
     config:
       cluster:
         replicas: {{ .Values.replicas.umsProvisioningNats }}
+      createUsers:
+        adminUser:
+          auth:
+            password: {{ .Values.secrets.nats.natsAdminPassword | quote }}
     containerSecurityContext:
       allowPrivilegeEscalation: false
       capabilities:
@@ -1022,22 +1019,15 @@ nubusProvisioning:
         registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNats.registry | quote }}
         repository: {{ .Values.images.nubusNats.repository }}
         tag: {{ .Values.images.nubusNats.tag }}
-        # NOTE: The subchart does not yet fully support
-        # "global.imagePullPolicy". This can be removed once the subchart has
-        # been adjusted.
-        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     natsBox:
+      enabled: {{ or .Values.technical.nubus.provisioning.nats.natsBox.enabled .Values.debug.enabled }}
       image:
         registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsBox.registry | quote }}
         repository: {{ .Values.images.nubusNatsBox.repository }}
         tag: {{ .Values.images.nubusNatsBox.tag }}
-        # NOTE: The subchart does not yet fully support
-        # "global.imagePullPolicy". This can be removed once the subchart has
-        # been adjusted.
-        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     persistence:
       size: {{ .Values.persistence.storages.nubusProvisioningNats.size }}
-      storageClass: {{ coalesce .Values.persistence.storages.nubusProvisioningNats.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+#      storageClassName: -- coalesce .Values.persistence.storages.nubusProvisioningNats.storageClassName .Values.persistence.storageClassNames.RWO | quote --
     reloader:
       image:
         registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsReloader.registry | quote }}
@@ -1052,10 +1042,12 @@ nubusProvisioning:
     serviceAccount:
       create: true
   podAnnotations:
-    {{ .Values.annotations.nubusProvisioning.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-provisioning-nats"
+    {{- with .Values.annotations.nubusProvisioning.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   prefill:
     additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-prefill"
       {{- with .Values.annotations.nubusProvisioning.prefillAdditional }}
       {{ . | toYaml | nindent 6 }}
       {{- end }}
@@ -1067,12 +1059,14 @@ nubusProvisioning:
       auth:
         password: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
     podAnnotations:
-      {{ .Values.annotations.nubusProvisioning.prefillPod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "ums-provisioning-prefill"
+      {{- with .Values.annotations.nubusProvisioning.prefillPod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     resources:
       {{ .Values.resources.umsProvisioningPrefill | toYaml | nindent 6 }}
   udmTransformer:
     additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-udm-transformer"
       {{- with .Values.annotations.nubusProvisioning.udmTransformerAdditional }}
       {{ . | toYaml | nindent 6 }}
       {{- end }}
@@ -1084,7 +1078,10 @@ nubusProvisioning:
       auth:
         password: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
     podAnnotations:
-      {{ .Values.annotations.nubusProvisioning.udmTransformerPod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "ums-provisioning-udm-transformer"
+      {{- with .Values.annotations.nubusProvisioning.udmTransformerPod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     resources:
       {{ .Values.resources.umsProvisioningUdmTransformer | toYaml | nindent 6 }}
   replicaCount:
@@ -1155,7 +1152,10 @@ nubusUdmListener:
     size: {{ .Values.persistence.storages.nubusUdmListener.size | quote }}
 #    storageClass: -- coalesce .Values.persistence.storages.nubusUdmListener.storageClassName .Values.persistence.storageClassNames.RWO | quote --
   podAnnotations:
-    {{ .Values.annotations.nubusUdmListener.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-provisioning-udm-listener"
+    {{- with .Values.annotations.nubusUdmListener.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   replicaCount: {{ .Values.replicas.umsUdmListener }}
   resources:
     {{ .Values.resources.umsUdmListener | toYaml | nindent 4 }}
@@ -1186,6 +1186,8 @@ nubusSelfServiceConsumer:
     registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusSelfServiceConsumer.registry | quote }}
     repository: {{ .Values.images.nubusSelfServiceConsumer.repository }}
     tag: {{ .Values.images.nubusSelfServiceConsumer.tag }}
+  initResources:
+    {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
   podAnnotations:
     intents.otterize.com/service-name: "ums-selfservice-listener"
     {{- with .Values.annotations.nubusSelfserviceConsumer.pod }}
@@ -1196,8 +1198,6 @@ nubusSelfServiceConsumer:
       password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}
   resources:
     {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
-  resourcesWaitForDependency:
-    {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
   replicaCount: {{ .Values.replicas.umsSelfserviceConsumer }}
   serviceAccount:
     annotations:
@@ -1211,9 +1211,9 @@ nubusSelfServiceConsumer:
 # Nubus services
 nubusStackDataUms:
   additionalAnnotations:
+    intents.otterize.com/service-name: "ums-stack-data-ums"
     argocd.argoproj.io/hook: "Sync"
     argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
-    intents.otterize.com/service-name: "ums-stack-data-ums"
     {{- with .Values.annotations.nubusStackDataUms.additional }}
     {{ . | toYaml | nindent 4 }}
     {{- end }}
@@ -1258,11 +1258,15 @@ nubusStackDataUms:
         host: {{ .Values.cache.umsSelfservice.host | quote }}
     postgresql:
       auth:
+        database: {{ .Values.databases.umsSelfservice.name | quote }}
         username: {{ .Values.databases.umsSelfservice.username | quote }}
       connection:
         host: {{ .Values.databases.umsSelfservice.host | quote }}
   podAnnotations:
-    {{ .Values.annotations.nubusStackDataUms.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-stack-data-ums"
+    {{- with .Values.annotations.nubusStackDataUms.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   resources:
     {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}
   stackDataContext:
@@ -1317,6 +1321,7 @@ nubusStackDataUms:
     portalLinkSupport: {{ .Values.functional.portal.linkSupport | quote }}
     portalLinkFeedback: {{ .Values.functional.portal.linkFeedback | quote }}
     oxDefaultContext: "1"
+    oxDefaultLanguage: {{ .Values.functional.internationalization.defaultLanguage | quote }}
     oxContextHidden: true
     oxSystemUserPassword: {{ .Values.secrets.nubus.ldapSearch.ox }}
     portalOxLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
@@ -1448,23 +1453,43 @@ nubusUmcServer:
     bundled: false
     server: {{ .Values.cache.umsSelfservice.host | quote }}
     auth:
-      password: ""
+      # The memcached connection is not authenticated in openDesk but the umc-server pod needs a secret it can mount.
+      password: "stub-value"
+      existingSecret: null
   podAnnotations:
-    {{ .Values.annotations.nubusUmcServer.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-umc-server"
+    {{- with .Values.annotations.nubusUmcServer.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
+  # Ref.: https://docs.software-univention.de/nubus-kubernetes-operation/1.x/en/reference.html#envvar-nubusUmcServer.podManagementPolicy
+  podManagementPolicy: "{{ if gt .Values.replicas.umsUmcServer 4 }}Parallel{{ else }}OrderedReady{{ end }}"
   postgresql:
-    bundled: false
+    selfservice:
-    connection:
+      connection:
-      host: {{ .Values.databases.umsSelfservice.host | quote }}
+        host: {{ .Values.databases.umsSelfservice.host | quote }}
-      port: {{ .Values.databases.umsSelfservice.port | quote }}
+        port: {{ .Values.databases.umsSelfservice.port | quote }}
-    auth:
+      auth:
-      username: {{ .Values.databases.umsSelfservice.username | quote }}
+        username: {{ .Values.databases.umsSelfservice.username | quote }}
-      database: {{ .Values.databases.umsSelfservice.name | quote }}
+        database: {{ .Values.databases.umsSelfservice.name | quote }}
-      password: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
+        password: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
-      # NOTE: Nubus has still an existing secret configured for legacy reasons.
+        # NOTE: Nubus has still an existing secret configured for legacy reasons.
-      # This disables the existing secret and ensures that the value from above
+        # This disables the existing secret and ensures that the value from above
-      # is used.
+        # is used.
-      existingSecret:
+        existingSecret:
-        name: null
+          name: null
+    authSession:
+      connection:
+        host: {{ .Values.databases.umsAuthSession.host | quote }}
+        port: {{ .Values.databases.umsAuthSession.port | quote }}
+      auth:
+        username: {{ .Values.databases.umsAuthSession.username | quote }}
+        database: {{ .Values.databases.umsAuthSession.name | quote }}
+        password: {{ .Values.databases.umsAuthSession.password | default .Values.secrets.postgresql.umsAuthSessionUser | quote }}
+        # NOTE: Nubus has still an existing secret configured for legacy reasons.
+        # This disables the existing secret and ensures that the value from above
+        # is used.
+        existingSecret:
+          name: null
   proxy:
     image:
       registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusUmcServerProxy.registry | quote }}
@@ -1531,7 +1556,10 @@ nubusUmcGateway:
   initResources:
     {{ .Values.resources.umsUmcGateway | toYaml | nindent 4 }}
   podAnnotations:
-    {{ .Values.annotations.nubusUmcGateway.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-umc-gateway"
+    {{- with .Values.annotations.nubusUmcGateway.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   replicaCount: {{ .Values.replicas.umsUmcGateway }}
   serviceAccount:
     annotations:
@@ -1552,7 +1580,6 @@ nubusKeycloakBootstrap:
       - ldapAndUserModelAttributeName: "oxContextIDNum"
     twoFactorAuthentication:
       enabled: true
-      group: "2fa-users"
   config:
     debug:
       enabled: {{ .Values.debug.enabled }}
@@ -1574,20 +1601,18 @@ nubusKeycloakBootstrap:
     registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakBootstrap.registry | quote }}
     repository: {{ .Values.images.nubusKeycloakBootstrap.repository }}
     tag: {{ .Values.images.nubusKeycloakBootstrap.tag }}
-    # NOTE: The subchart does not yet fully support
-    # "global.imagePullPolicy". This can be removed once the subchart has
-    # been adjusted.
-    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   keycloak:
     auth:
       username: "kcadmin"
-      existingSecret:
-        name: "ums-opendesk-keycloak-credentials"
   ldap:
     auth:
       bindDn: {{ printf "uid=ldapsearch_keycloak,cn=users,%s" .Values.ldap.baseDn }}
       existingSecret:
         name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
+  oidc:
+    rp:
+      umcServer:
+        password: {{ .Values.secrets.keycloak.clientSecret.portal | quote }}
   podAnnotations:
     intents.otterize.com/service-name: "ums-keycloak-bootstrap"
     {{- with .Values.annotations.nubusKeycloakBootstrapNubus.pod }}
@@ -1613,9 +1638,6 @@ extraSecrets:
   - name: "ums-opendesk-guardian-client-secret"
     stringData:
       managementApiClientSecret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
-  - name: "ums-opendesk-keycloak-credentials"
-    stringData:
-      admin_password: {{ .Values.secrets.keycloak.adminPassword | quote }}
   - name: "ums-keycloak-postgresql-opendesk-credentials"
     stringData:
       keycloakDatabasePassword: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}

helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl

@@ -84,7 +84,7 @@ config:
   managed:
     clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list',
                     'offline_access', 'roles', 'address', 'phone' ]
-    clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}',
+    clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC OIDC', '${client_account}',
                '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}',
                '${client_security-admin-console}' ]
   keycloak:
@@ -101,6 +101,8 @@ config:
     revokeRefreshToken: {{ .Values.functional.authentication.realmSettings.revokeRefreshToken }}
     ssoSessionIdleTimeout: {{ .Values.functional.authentication.realmSettings.ssoSessionIdleTimeout }}
     ssoSessionMaxLifespan: {{ .Values.functional.authentication.realmSettings.ssoSessionMaxLifespan }}
+    accessCodeLifespanUserAction: {{ .Values.functional.authentication.realmSettings.accessCodeLifespanUserAction }}
+    accessCodeLifespanLogin: {{ .Values.functional.authentication.realmSettings.accessCodeLifespanLogin }}
     offlineSessionIdleTimeout: {{ .Values.functional.authentication.realmSettings.offlineSessionIdleTimeout }}
     offlineSessionMaxLifespanEnabled: {{ .Values.functional.authentication.realmSettings.offlineSessionMaxLifespanEnabled }}
     offlineSessionMaxLifespan: {{ .Values.functional.authentication.realmSettings.offlineSessionMaxLifespan }}
@@ -115,7 +117,7 @@ config:
     idpDetails: {{ .Values.functional.authentication.ssoFederation.idpDetails | toYaml | nindent 6 }}
   twoFactorSettings:
     additionalGroups: {{ .Values.functional.authentication.twoFactor.groups | toYaml | nindent 6 }}
-  precreateGroups: [ 'Domain Admins', 'Domain Users', '2fa-users', 'IAM API - Full Access',
+  precreateGroups: [ 'Domain Admins', 'Domain Users', 'IAM API - Full Access',
                      {{ if .Values.apps.nextcloud.enabled }}'managed-by-attribute-Fileshare', 'managed-by-attribute-FileshareAdmin',{{ end }}
                      {{ if .Values.apps.xwiki.enabled }}'managed-by-attribute-Knowledgemanagement', 'managed-by-attribute-KnowledgemanagementAdmin',{{ end }}
                      {{ if .Values.apps.element.enabled }}'managed-by-attribute-Livecollaboration', 'managed-by-attribute-LivecollaborationAdmin',{{ end }}

helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl

@@ -23,7 +23,7 @@ dovecot:
     port: {{ .Values.databases.dovecotDictmap.port }}
     username: {{ .Values.databases.dovecotDictmap.username | quote }}
     password:
-      value: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
+      value: {{ .Values.databases.dovecotDictmap.password | default .Values.secrets.cassandra.dovecotDictmapUser | quote }}
     keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
   sharedMailboxes:
     enabled: true
@@ -31,15 +31,20 @@ dovecot:
     port: {{ .Values.databases.dovecotACL.port }}
     username: {{ .Values.databases.dovecotACL.username | quote }}
     password:
-      value: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
+      value: {{ .Values.databases.dovecotACL.password | default .Values.secrets.cassandra.dovecotACLUser | quote }}
     keyspace: {{ .Values.databases.dovecotACL.name | quote }}
+    masterPassword:
+      value: {{ .Values.secrets.dovecot.sharedMailboxesMasterPassword | quote }}
   objectStorage:
     bucket: {{ .Values.objectstores.dovecot.bucket | quote }}
+    cacheTmpfs: {{ if .Values.technical.dovecot.objectStorage.cacheTmpfs }}true{{ else }}false{{ end }}
     encryption:
       privateKey:
         value: {{ requiredEnv "DOVECOT_CRYPT_PRIVATE_KEY" | quote }}
       publicKey:
         value: {{ requiredEnv "DOVECOT_CRYPT_PUBLIC_KEY" | quote }}
+    fsCacheSize: {{ .Values.technical.dovecot.objectStorage.fsCacheSize | quote }}
+    ftsCacheSize: {{ .Values.technical.dovecot.objectStorage.ftsCacheSize | quote }}
     fqdn: {{ .Values.objectstores.dovecot.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
     username: {{ .Values.objectstores.dovecot.username | quote }}
     password:

helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl

@@ -126,7 +126,10 @@ persistence:
     {{ .Values.annotations.openxchangeDovecot.persistence | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.openxchangeDovecot.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "open-xchange-dovecot"
+  {{- with .Values.annotations.openxchangeDovecot.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 resources:
   {{ .Values.resources.dovecot | toYaml | nindent 2 }}
@@ -137,6 +140,8 @@ service:
     {{ .Values.annotations.openxchangeDovecot.service | toYaml | nindent 4 }}
   external:
     enabled: true
+    annotations:
+      {{ .Values.annotations.openxchangeDovecot.serviceExternal | toYaml | nindent 6 }}
     type: {{ coalesce .Values.service.type.dovecot .Values.cluster.service.type | quote }}
 {{- end }}
 

helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl

@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 additionalAnnotations:
+  intents.otterize.com/service-name: "open-xchange-bootstrap"
   argocd.argoproj.io/hook: "Sync"
   argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
   {{- with .Values.annotations.openxchangeBootstrap.additional }}

helmfile/apps/open-xchange/values-openxchange-contact-picker.yaml.gotmpl

@@ -5,6 +5,7 @@
 appsuite:
   core-mw:
     podAnnotations:
+      intents.otterize.com/service-name: "open-xchange-core-mw"
       logging.open-xchange.com/format: "appsuite-json"
       {{- with .Values.annotations.openxchangeEnterpriseContactPicker.appsuiteCoreMwPod }}
       {{ . | toYaml | nindent 6 }}

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -31,7 +31,10 @@ nextcloud-integration-ui:
     - name: {{ . | quote }}
   {{- end }}
   podAnnotations:
-    {{ .Values.annotations.openxchangeNextcloudIntegrationUi.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "open-xchange-nextcloud-integration-ui"
+    {{- with .Values.annotations.openxchangeNextcloudIntegrationUi.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   replicaCount: {{ .Values.replicas.openxchangeNextcloudIntegrationUI }}
   resources:
     {{ .Values.resources.openxchangeNextcloudIntegrationUI | toYaml | nindent 4 }}
@@ -66,7 +69,10 @@ public-sector-ui:
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   replicaCount: {{ .Values.replicas.openxchangePublicSectorUI }}
   podAnnotations:
-    {{ .Values.annotations.openxchangePublicSectorUi.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "open-xchange-public-sector-ui"
+    {{- with .Values.annotations.openxchangePublicSectorUi.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   resources:
     {{ .Values.resources.openxchangePublicSectorUI | toYaml | nindent 4 }}
   securityContext:
@@ -152,6 +158,7 @@ appsuite:
       drive-client-windows-ox-route:
         annotations:
           {{ .Values.annotations.openxchangeAppsuiteIngress.driveClientWindowsOxRoute | toYaml | nindent 10 }}
+      {{ if .Values.functional.groupware.mail.encryption.enabled }}
       guard-api-route:
         annotations:
           {{ .Values.annotations.openxchangeAppsuiteIngress.guardApiRoute | toYaml | nindent 10 }}
@@ -161,6 +168,7 @@ appsuite:
       guard-pgp-route:
         annotations:
           {{ .Values.annotations.openxchangeAppsuiteIngress.guardPgpRoute | toYaml | nindent 10 }}
+      {{ end }}
       http-api-routes-api:
         annotations:
           {{ .Values.annotations.openxchangeAppsuiteIngress.httpApiRoutesApi | toYaml | nindent 10 }}
@@ -218,6 +226,11 @@ appsuite:
         productName: {{ .Values.theme.texts.productName | quote }}
         oidcLogin: true
         oidcPath: "/oidc/"
+        notificationMails:
+          button:
+            textColor: {{ .Values.theme.colors.white | quote }}
+            backgroundColor: {{ .Values.theme.colors.primary | quote }}
+            borderColor: {{ .Values.theme.colors.primary | quote }}
     defaultScaling:
       nodes:
         default:
@@ -249,6 +262,10 @@ appsuite:
               open-xchange-authentication-masterpassword: "enabled"
           properties:
             com.openexchange.calendar.allowOrganizerPartStatChanges: "true"
+            # Mailfilter
+            com.openexchange.mail.filter.passwordSource: global
+            com.openexchange.mail.filter.masterPassword:  {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
+            com.openexchange.mail.filter.preferredSaslMech: ""
           propertiesFiles:
             /opt/open-xchange/etc/masterpassword-authentication.properties:
               com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
@@ -300,7 +317,10 @@ appsuite:
     jolokiaPassword: {{ .Values.secrets.oxAppSuite.jolokiaPassword | quote }}
     hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
     podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreMw.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-mw"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreMw.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     serviceAccount:
       annotations:
         {{ .Values.annotations.openxchangeAppsuiteCoreMw.serviceAccount | toYaml | nindent 8 }}
@@ -310,7 +330,7 @@ appsuite:
         # enable admin pack
         # admin: enabled
         documents: "disabled"
-        guard: "enabled"
+        guard: {{ ternary "enabled" "disabled" .Values.functional.groupware.mail.encryption.enabled }}
         # disabling admin role breaks webmail
         # {{- if .Values.technical.oxAppSuite.provisioning.dedicatedCoreMwPod }}
         # admin: "disabled"
@@ -327,7 +347,10 @@ appsuite:
         pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
       replicaCount: {{ .Values.replicas.openxchangeGotenberg }}
       podAnnotations:
-        {{ .Values.annotations.openxchangeAppsuiteCoreMw.gotenbergPod | toYaml | nindent 8 }}
+        intents.otterize.com/service-name: "open-xchange-gotenberg"
+        {{- with .Values.annotations.openxchangeAppsuiteCoreMw.gotenbergPod }}
+        {{ . | toYaml | nindent 8 }}
+        {{- end }}
       resources:
         {{ .Values.resources.openxchangeGotenberg | toYaml | nindent 8 }}
       securityContext:
@@ -340,18 +363,19 @@ appsuite:
         runAsNonRoot: true
         runAsUser: 1001
         runAsGroup: 1001
-        privileged: false
         seccompProfile:
           type: "RuntimeDefault"
         seLinuxOptions:
           {{ .Values.seLinuxOptions.openxchangeGotenberg | toYaml | nindent 10 }}
       serviceAccount:
         create: false
+    {{ if .Values.functional.groupware.mail.encryption.enabled }}
     hooks:
       beforeAppsuiteStart:
         create-guard-dir.sh: |
           mkdir -p /opt/open-xchange/guard-files
           chown open-xchange:open-xchange /opt/open-xchange/guard-files
+    {{ end }}
     packages:
       status:
         open-xchange-oidc: "enabled"
@@ -377,13 +401,16 @@ appsuite:
         open-xchange-admin-soap-usercopy: "disabled"
         open-xchange-admin-user-copy: "disabled"
         {{- end }}
-        {{- if .Values.functional.groupware.davSupport.enabled }}
+        open-xchange-authentication-application-storage-rdb: {{ ternary "enabled" "disabled" .Values.functional.groupware.davSupport.enabled }}
-        open-xchange-authentication-application-storage-rdb: "enabled"
+        open-xchange-mail-categories: {{ ternary "enabled" "disabled" .Values.functional.groupware.mail.categories.enabled }}
-        {{- end }}
     properties:
       com.openexchange.hostname: {{ printf "%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
+      com.openexchange.share.guestHostname: {{ printf "%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
       com.openexchange.UIWebPath: "/appsuite/"
       com.openexchange.showAdmin: "false"
+      # Various Mail settings
+      com.openexchange.mail.deleteDraftOnTransport: "true"
+      com.openexchange.capability.document_preview_xrechnung: "true"
       # PDF Export
       com.openexchange.capability.mail_export_pdf: "true"
       com.openexchange.mail.exportpdf.gotenberg.enabled: "true"
@@ -430,6 +457,7 @@ appsuite:
       com.openexchange.mail.transport.authType: "xoauth2"
       com.openexchange.mail.transportServer: "postfix-ox"
       com.openexchange.mail.transportServerSource: "global"
+      com.openexchange.mail.maxMailSize: {{ mul .Values.functional.groupware.mail.maxSize 1024 1024 | int | printf "%d" | quote }}
       # Mail Login Resolver
       com.openexchange.mail.login.resolver.enabled: "true"
       com.openexchange.mail.login.resolver.ldap.enabled: "true"
@@ -439,6 +467,11 @@ appsuite:
       com.openexchange.mail.login.resolver.ldap.contextNameAttribute: "oxContextIDNum"
       com.openexchange.mail.login.resolver.ldap.entitySearchFilter: "(&(oxContextIDNum=[cid])(uid=[uname]))"
       com.openexchange.mail.login.resolver.ldap.mailLoginAttribute: "entryUUID"
+      # Contacts collector
+      # Ref.: https://documentation.open-xchange.com/components/middleware/config/8/#mode=search&term=contactCollect
+      com.openexchange.contactcollector.enabled: "true"
+      com.openexchange.user.contactCollectOnMailTransport: "true"
+      com.openexchange.user.contactCollectOnMailAccess: "false"
       # Requirements for OX Connector
       com.openexchange.user.enforceUniqueDisplayName: "false"
       com.openexchange.folderstorage.database.preferDisplayName: "false"
@@ -453,18 +486,61 @@ appsuite:
       # Old capability can be used to toggle all integrations with a single switch
       com.openexchange.capability.public-sector: "true"
       # New capabilities in 2.0
-      com.openexchange.capability.public-sector-element: "true"
+      com.openexchange.capability.public-sector-element: {{ .Values.apps.element.enabled | quote }}
       com.openexchange.capability.public-sector-navigation: "true"
       com.openexchange.capability.client-onboarding: "true"
       com.openexchange.capability.dynamic-theme: "true"
       com.openexchange.capability.filestorage_nextcloud: "true"
       com.openexchange.capability.filestorage_nextcloud_oauth: "true"
-      com.openexchange.capability.guard: "true"
+      com.openexchange.capability.guard: {{ .Values.functional.groupware.mail.encryption.enabled | quote }}
-      com.openexchange.capability.guard-mail: "true"
+      com.openexchange.capability.guard-mail: {{ .Values.functional.groupware.mail.encryption.enabled | quote }}
-      com.openexchange.capability.smime: "true"
+      com.openexchange.capability.smime: {{ .Values.functional.groupware.mail.encryption.enabled | quote }}
-      com.openexchange.capability.share_links: "false"
-      com.openexchange.capability.invite_guests: "false"
       com.openexchange.capability.document_preview: "true"
+      # Mail Categories
+      com.openexchange.mail.categories: {{ .Values.functional.groupware.mail.categories.enabled | quote }}
+      {{ if .Values.functional.groupware.mail.categories.enabled }}
+      com.openexchange.mail.categories.general.name.fallback: "General"
+      com.openexchange.mail.categories.general.name.de_DE: "Allgemein"
+      com.openexchange.mail.categories.identifiers: "newsletter,invites,socialmedia"
+      com.openexchange.mail.categories.newsletter.flag: "$newsletter"
+      com.openexchange.mail.categories.newsletter.name.fallback: "Newsletter"
+      com.openexchange.mail.categories.newsletter.name.de_DE: "Newsletter"
+      com.openexchange.mail.categories.newsletter.description: "Emails containing newsletters or promotional content"
+      com.openexchange.mail.categories.newsletter.description.de_DE: "E-Mails mit Newslettern oder Werbeinhalten"
+      com.openexchange.mail.categories.newsletter.icon: "megaphone"
+      com.openexchange.mail.categories.invites.flag: "$invites"
+      com.openexchange.mail.categories.invites.name.fallback: "Invitations"
+      com.openexchange.mail.categories.invites.name.de_DE: "Einladungen"
+      com.openexchange.mail.categories.invites.description: "Emails with event invitations and RSVPs"
+      com.openexchange.mail.categories.invites.description.de_DE: "E-Mails mit Veranstaltungseinladungen und Rückmeldungen"
+      com.openexchange.mail.categories.invites.icon: "calendar-check"
+      com.openexchange.mail.categories.socialmedia.flag: "$socialmedia"
+      com.openexchange.mail.categories.socialmedia.name.fallback: "Social Media"
+      com.openexchange.mail.categories.socialmedia.name.de_DE: "Soziale Medien"
+      com.openexchange.mail.categories.socialmedia.description: "Updates and notifications from social media platforms"
+      com.openexchange.mail.categories.socialmedia.description.de_DE: "Aktualisierungen und Benachrichtigungen von sozialen Medien"
+      com.openexchange.mail.categories.socialmedia.icon: "people"
+      com.openexchange.mail.user.categories.identifiers: "uc1,uc2,uc3"
+      com.openexchange.mail.categories.uc1.flag: "$uc1"
+      com.openexchange.mail.categories.uc1.name.fallback: "Your category 1"
+      com.openexchange.mail.categories.uc1.name.de_DE: "Eigene Kategorie 1"
+      com.openexchange.mail.categories.uc2.flag: "$uc2"
+      com.openexchange.mail.categories.uc2.name.fallback: "Your category 2"
+      com.openexchange.mail.categories.uc2.name.de_DE: "Eigene Kategorie 2"
+      com.openexchange.mail.categories.uc3.flag: "$uc3"
+      com.openexchange.mail.categories.uc3.name.fallback: "Your category 3"
+      com.openexchange.mail.categories.uc3.name.de_DE: "Eigene Kategorie 3"
+      {{- end }}
+      # functional.groupware.mail.inbound.*
+      com.openexchange.capability.public-sector-autonotify: {{ .Values.functional.groupware.mail.inbound.notify.enabled | quote }}
+      {{- if not .Values.functional.groupware.mail.inbound.forward.enabled }}
+      com.openexchange.mail.filter.blacklist.actions: "redirect"
+      {{- end }}
+      com.openexchange.mail.filter.options.apply.blockedActions: "redirect,notify"
+      # functional.groupware.externalSharing.*
+      com.openexchange.capability.share_links: {{ .Values.functional.groupware.externalSharing.shareLinks.enabled | quote }}
+      com.openexchange.capability.invite_guests: {{ .Values.functional.groupware.externalSharing.inviteGuests.enabled | quote }}
+      com.openexchange.share.guestCapabilityMode: "inherit"
       # Secondary Accounts
       com.openexchange.mail.secondary.authType: "XOAUTH2"
       com.openexchange.mail.transport.secondary.authType: "xoauth2"
@@ -473,14 +549,15 @@ appsuite:
       com.openexchange.file.storage.nextcloud.oauth.webdav.username.strategy: "user"
       com.openexchange.nextcloud.filepicker.includeAccessToken: "false"
       # Element integration
-      com.openexchange.conference.element.enabled: "true"
+      com.openexchange.conference.element.enabled: {{ .Values.apps.element.enabled | quote }}
       com.openexchange.conference.element.meetingHostUrl: http://matrix-neodatefix-bot
       com.openexchange.conference.element.matrixLoginUrl: http://opendesk-synapse-web:8008/_matrix/client/v3/login
-      com.openexchange.conference.element.matrixUuidClaimName: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
+      com.openexchange.conference.element.matrixUuidClaimName: {{ ternary "opendesk_useruuid" "opendesk_username" .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}
       # GDPR
       com.openexchange.gdpr.dataexport.enabled: "false"
       com.openexchange.gdpr.dataexport.active: "false"
       # Guard
+      {{- if .Values.functional.groupware.mail.encryption.enabled }}
       com.openexchange.guard.storage.file.fileStorageType: "file"
       com.openexchange.guard.storage.file.uploadDirectory: "/opt/open-xchange/guard-files/"
       com.openexchange.guard.guestSMTPMailFrom: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
@@ -494,6 +571,17 @@ appsuite:
       # http = (await import('./io.ox/core/http.js')).default
       # await http.POST({ module: 'oxguard/smime', params: { action: 'test' } })
       com.openexchange.smime.test: {{ .Values.debug.enabled | quote }}
+      {{- end }}
+      # Client Onboarding
+      com.openexchange.client.onboarding.enabled: {{ .Values.functional.groupware.externalClients.enabledOnboardingInfo | quote }}
+      com.openexchange.client.onboarding.mail.imap.host: {{ default .Values.global.domain .Values.functional.groupware.externalClients.fqdnImap | quote }}
+      com.openexchange.client.onboarding.mail.imap.port: "993"
+      com.openexchange.client.onboarding.mail.imap.secure: "true"
+      com.openexchange.client.onboarding.mail.imap.requireTls: "false"
+      com.openexchange.client.onboarding.mail.smtp.host: {{ default .Values.global.domain .Values.functional.groupware.externalClients.fqdnSmtp | quote }}
+      com.openexchange.client.onboarding.mail.smtp.port: "587"
+      com.openexchange.client.onboarding.mail.smtp.secure: "false"
+      com.openexchange.client.onboarding.mail.smtp.requireTls: "true"
       # DAV
       {{- if .Values.functional.groupware.davSupport.enabled }}
       com.openexchange.caldav.enabled: "true"
@@ -584,6 +672,8 @@ appsuite:
     uiSettings:
       io.ox.nextcloud//server: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/fs/"
       io.ox.public-sector//ics/url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/"
+      # Is user allowed to edit own display name
+      io.ox/mail//editRealName: {{ .Values.functional.groupware.userProfile.editRealName | quote }}
       # Show the Enterprise Picker in the top right corner instead of the launcher drop-down
       io.ox/core//features/enterprisePicker/showLauncher: "false"
       io.ox/core//features/enterprisePicker/showTopRightLauncher: "true"
@@ -594,8 +684,9 @@ appsuite:
       # Resources
       io.ox/core//features/resourceCalendars: "true"
       io.ox/core//features/managedResources: "true"
-      # Categories
+      # Features
-      io.ox/core//features/categories: "true"
+      io.ox/core//features/signatureDesigner: "true"
+      io.ox/core//features/categories: {{ .Values.functional.groupware.mail.categories.enabled | quote }}
       io.ox/core//categories/predefined: >
         [{ "name": "Predefined", "color": "orange", "icon": "bi/exclamation-circle.svg" }]
       # Nextcloud integration
@@ -607,9 +698,6 @@ appsuite:
       io.ox/core//coloredIcons: "false"
       # Mail templates
       io.ox/core//features/templates: "true"
-      # Contact Collector
-      io.ox/mail//contactCollectOnMailTransport: "true"
-      # io.ox/mail//contactCollectOnMailAccess: "true"
       # Dynamic theme
       io.ox/dynamic-theme//mainColor: {{ .Values.theme.colors.primary | quote }}
       io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
@@ -622,6 +710,7 @@ appsuite:
       io.ox/dynamic-theme//folderHover: {{ .Values.theme.colors.secondaryGreyLight | quote }}
       # openDesk logo in top bar links to portal
       io.ox/core//logoAction: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain | quote }}
+    {{ if .Values.functional.groupware.mail.encryption.enabled }}
     secretETCFiles:
       # Format of the OX Guard master key:
       # MC+base64(20 random bytes)
@@ -629,6 +718,7 @@ appsuite:
       oxguardpass: |
         {{ .Values.secrets.oxAppSuite.oxguardMC }}
         {{ .Values.secrets.oxAppSuite.oxguardRC }}
+    {{ end }}
     redis: &redisConfiguration
       enabled: true
       mode: "standalone"
@@ -690,7 +780,10 @@ appsuite:
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     replicaCount: {{ .Values.replicas.openxchangeCoreUI }}
     podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreUi.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-ui"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreUi.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     resources:
       {{ .Values.resources.openxchangeCoreUI | toYaml | nindent 6 }}
     securityContext:
@@ -727,7 +820,10 @@ appsuite:
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     overrides: {}
     podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreUiMiddleware.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-ui-middleware"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreUiMiddleware.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     redis: *redisConfiguration
     replicaCount: {{ .Values.replicas.openxchangeCoreUIMiddleware }}
     resources:
@@ -776,7 +872,10 @@ appsuite:
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     {{- if .Values.annotations.openxchangeAppsuiteCoreDocumentconverter.pod }}
     podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreDocumentconverter.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-documentconverter"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreDocumentconverter.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     {{- end }}
     redis: *redisConfiguration
     replicaCount: {{ .Values.replicas.openxchangeCoreDocumentConverter }}
@@ -828,7 +927,10 @@ appsuite:
       tag: {{ .Values.images.openxchangeCoreGuidedtours.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreGuidedtours.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-guidedtours"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreGuidedtours.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     replicaCount: {{ .Values.replicas.openxchangeCoreGuidedtours }}
     resources:
       {{- .Values.resources.openxchangeCoreGuidedtours | toYaml | nindent 6 }}
@@ -872,7 +974,10 @@ appsuite:
           secretKey: "."
     {{- if .Values.annotations.openxchangeAppsuiteCoreImageconverter.pod }}
     podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreImageconverter.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-imageconverter"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreImageconverter.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     {{- end }}
     redis: *redisConfiguration
     replicaCount: {{ .Values.replicas.openxchangeCoreImageConverter }}
@@ -898,7 +1003,7 @@ appsuite:
       create: false
 
   guard-ui:
-    enabled: true
+    enabled: {{ .Values.functional.groupware.mail.encryption.enabled }}
     imagePullSecrets:
     {{- range .Values.global.imagePullSecrets }}
       - name: {{ . | quote }}
@@ -908,7 +1013,8 @@ appsuite:
       repository: {{ .Values.images.openxchangeGuardUI.repository | quote }}
       tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    podAnnotations: {}
+    podAnnotations:
+      intents.otterize.com/service-name: "open-xchange-guard-ui"
     replicaCount: {{ .Values.replicas.openxchangeGuardUI }}
     resources:
       {{- .Values.resources.openxchangeGuardUI | toYaml | nindent 6 }}
@@ -928,6 +1034,7 @@ appsuite:
         {{ .Values.seLinuxOptions.openxchangeGuardUI | toYaml | nindent 8 }}
     serviceAccount:
       create: false
+
   core-spellcheck:
     enabled: false
 
@@ -943,7 +1050,10 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreUserGuide.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-user-guide"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreUserGuide.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     replicaCount: {{ .Values.replicas.openxchangeCoreUserGuide }}
     resources:
       {{- .Values.resources.openxchangeCoreUserGuide | toYaml | nindent 6 }}

helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl

@@ -45,15 +45,15 @@ oxConnector:
   oxDefaultContext: "1"
   oxImapServer: "imap://127.0.0.1:143"
   oxLocalTimezone: "Europe/Berlin"
-  oxLanguage: "de_DE"
+  oxLanguage: {{ .Values.functional.internationalization.defaultLanguage | quote }}
   oxMasterAdmin: "admin"
   oxMasterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
   oxSmtpServer: "smtp://127.0.0.1:587"
-  oxSoapServer: "http://open-xchange-core-mw-admin"
+  oxSoapServer: {{ printf "http://%s.%s.svc.%s" "open-xchange-core-mw-admin" (.Values.apps.oxAppSuite.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
 
 provisioningApi:
   connection:
-    baseUrl: "http://ums-provisioning-api"
+    baseUrl: {{ printf "http://%s.%s.svc.%s" "ums-provisioning-api" (.Values.apps.nubus.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
   auth:
     username: "ox-connector"
     password: {{ .Values.secrets.oxConnector.provisioningApiPassword | quote }}
@@ -68,7 +68,10 @@ persistence:
   #storageClass: {{ coalesce .Values.persistence.storages.oxConnector.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
 
 podAnnotations:
-  {{ .Values.annotations.nubusOxConnector.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "open-xchange-connector"
+  {{- with .Values.annotations.nubusOxConnector.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 replicaCount: {{ .Values.replicas.oxConnector }}
 

helmfile/apps/open-xchange/values-postfix.yaml.gotmpl

@@ -45,14 +45,13 @@ postfix:
   domain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
   hostname: "postfix"
   inetProtocols: "ipv4"
+  messageSizeLimit: {{ mul .Values.functional.groupware.mail.maxSize 1024 1024 | int | printf "%d" | quote }}
   milterDefaultAction: "tempfail"
   {{- if .Values.apps.dkimpy.enabled }}
   dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
   {{- end }}
-
+  minTLSVersion: "TLSv1.2"
-  minTLSVersion: "TLSv1.3"
+  smtpdTLSMandatoryCiphers: "medium"
-  smtpdTLSMandatoryCiphers: "high"
-
   rspamdHost: ""
   {{- if .Values.smtp.host }}
   relayHost:
@@ -64,13 +63,15 @@ postfix:
         value: {{ .Values.smtp.username }}
       password:
         value: {{ .Values.smtp.password }}
+  smtpSASLAuthEnable: "yes"
+  {{- else }}
+  smtpSASLAuthEnable: "no"
   {{- end }}
   allowRelayNets: false
-  smtpSASLAuthEnable: "yes"
-  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
   smtpTLSSecurityLevel: "encrypt"
   smtpdSASLAuthEnable: "yes"
-  smtpdSASLSecurityOptions: "noanonymous"
+  smtpdSASLSecurityOptions: {{ .Values.smtp.security.smtpdSASLSecurityOptions | join ", " | quote }}
+  smtpSASLSecurityOptions: {{ .Values.smtp.security.smtpSASLSecurityOptions | join ", " | quote }}
   smtpdSASLType: "dovecot"
   smtpdTLSSecurityLevel: "encrypt"
   smtpdTLSCertFile: "/etc/tls/tls.crt"
@@ -80,6 +81,25 @@ postfix:
   staticAuthDB:
     enabled: false
 
+  ldapTransportMaps: []
+
+  ldapVirtualAliasMaps:
+    - host: "ums-ldap-server"
+      scheme: "ldap"
+      port: 389
+      baseDn: "{{ .Values.ldap.baseDn }}"
+      bindDn: "uid=ldapsearch_postfix,cn=users,{{ .Values.ldap.baseDn }}"
+      password:
+        value: {{ .Values.secrets.nubus.ldapSearch.postfix | quote }}
+      # ldap filter to find groups with mail address
+      queryFilter: "(&(|(objectClass=univentionMailList)(objectClass=posixGroup))(|(mailPrimaryAddress=%s)(mailAlternativeAddress=%s)))"
+      # -- use this attribute if the query already returns email addresses of members and no recursive lookup needs to be done
+      resultAttribute: ""
+      # -- do a recursive search on the specified attribute if found, should be a DN
+      specialResultAttribute: "uniqueMember"
+      # -- return the following attribute from all found leaves when a recursive search is done
+      leafResultAttribute: "mailPrimaryAddress"
+
   {{- if .Values.antivirus.milter.host }}
   smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
   {{- else }}
@@ -93,7 +113,10 @@ postfix:
   virtualTransport: "lmtps:dovecot:24"
 
 podAnnotations:
-  {{ .Values.annotations.openxchangePostfix.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "open-xchange-postfix"
+  {{- with .Values.annotations.openxchangePostfix.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 replicaCount: {{ .Values.replicas.postfix }}
 
@@ -106,6 +129,8 @@ service:
     {{ .Values.annotations.openxchangePostfix.service | toYaml | nindent 4 }}
   external:
     enabled: true
+    annotations:
+      {{ .Values.annotations.openxchangePostfix.serviceExternal | toYaml | nindent 6 }}
     type: {{ coalesce .Values.service.type.postfix .Values.cluster.service.type | quote }}
 {{- end }}
 ...

helmfile/apps/opendesk-migrations-post/values.yaml.gotmpl

@@ -5,7 +5,10 @@ additionalAnnotations:
   {{ .Values.annotations.opendeskMigrationsPost.additional | toYaml | nindent 2 }}
 
 podAnnotations:
-  {{ .Values.annotations.opendeskMigrationsPost.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-migrations-post"
+  {{- with .Values.annotations.opendeskMigrationsPost.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 serviceAccount:
   annotations:

helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl

@@ -74,7 +74,10 @@ job:
   enabled: true
 
 podAnnotations:
-  {{ .Values.annotations.openprojectBootstrap.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-openproject-bootstrap"
+  {{- with .Values.annotations.openprojectBootstrap.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/opendesk-services/values-opendesk-static-files.yaml.gotmpl

@@ -15,8 +15,8 @@ assets:
   element:
     subdomain: {{ .Values.global.hosts.element }}
     paths:
-      - path: "/vector-icons/favicon.........ico"
+      - path: "/vector-icons/favicon.png"
-        data: {{ .Values.theme.imagery.chat.faviconIco }}
+        data: {{ .Values.theme.imagery.chat.faviconPng }}
   jitsi:
     subdomain: {{ .Values.global.hosts.jitsi }}
     paths:
@@ -27,7 +27,7 @@ assets:
     paths:
       - path: "/resources/...../login/UCS/img/favicon.ico"
         data: {{ .Values.theme.imagery.login.faviconIco }}
-      - path: "/static-files/login/logo.svg"
+      - path: "/opendesk-static-files/login/logo.svg"
         data: {{ .Values.theme.imagery.login.logoSvg }}
   nextcloud:
     subdomain: {{ .Values.global.hosts.nextcloud }}
@@ -36,11 +36,21 @@ assets:
         data: {{ .Values.theme.imagery.files.faviconPng }}
       - path: "/core/img/favicon.ico"
         data: {{ .Values.theme.imagery.files.faviconIco }}
+      - path: "/apps/integration_swp/logo"
+        data: {{ .Values.theme.imagery.logoHeaderSvgB64 }}
+        mimeType: "image/svg+xml"
+      - path: "/apps/theming/img/background/jenna-kim-the-globe-dark.webp"
+        data: {{ .Values.theme.imagery.login.backgroundJpg }}
+        mimeType: "image/jpeg"
   notes:
     subdomain: {{ .Values.global.hosts.notes }}
     paths:
-      - path: "/favicon.ico"
+      - path: "/assets/favicon-light.ico"
         data: {{ .Values.theme.imagery.notes.faviconIco }}
+      - path: "/assets/favicon-dark.png"
+        data: {{ .Values.theme.imagery.notes.faviconPng }}
+      - path: "/assets/favicon-light.png"
+        data: {{ .Values.theme.imagery.notes.faviconPng }}
   openproject:
     subdomain: {{ .Values.global.hosts.openproject }}
     paths:
@@ -64,7 +74,6 @@ assets:
         data: {{ .Values.theme.imagery.portal.waitingSpinnerSvg }}
       - path: "/static-files/login/background.jpg"
         data: {{ .Values.theme.imagery.login.backgroundJpg }}
-
   xwiki:
     subdomain: {{ .Values.global.hosts.xwiki }}
     paths:
@@ -107,7 +116,10 @@ image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 podAnnotations:
-  {{ .Values.annotations.opendeskServicesStaticFiles.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-static-files"
+  {{- with .Values.annotations.opendeskServicesStaticFiles.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl

@@ -10,12 +10,18 @@ additionalAnnotations:
   {{ .Values.annotations.opendeskServicesOtterize.additional | toYaml | nindent 2 }}
 
 apps:
+  cassandra:
+    enabled: {{ .Values.apps.cassandra.enabled }}
+  certificates:
+    enabled: {{ .Values.apps.certificates.enabled }}
   clamavDistributed:
     enabled: {{ .Values.apps.clamavDistributed.enabled }}
   clamavSimple:
     enabled: {{ .Values.apps.clamavSimple.enabled }}
   collabora:
     enabled: {{ .Values.apps.collabora.enabled }}
+  collaboraController:
+    enabled: {{ .Values.apps.collaboraController.enabled }}
   cryptpad:
     enabled: {{ .Values.apps.cryptpad.enabled }}
   dkimpy:
@@ -24,6 +30,12 @@ apps:
     enabled: {{ .Values.apps.dovecot.enabled }}
   element:
     enabled: {{ .Values.apps.element.enabled }}
+  elementAdmin:
+    enabled: {{ .Values.apps.elementAdmin.enabled }}
+  elementGroupsync:
+    enabled: {{ .Values.apps.elementGroupsync.enabled }}
+  home:
+    enabled: {{ .Values.apps.home.enabled }}
   jitsi:
     enabled: {{ .Values.apps.jitsi.enabled }}
   mariadb:
@@ -42,7 +54,7 @@ apps:
     enabled: {{ .Values.apps.nubus.enabled }}
   openproject:
     enabled: {{ .Values.apps.openproject.enabled }}
-  oxAppsuite:
+  oxAppSuite:
     enabled: {{ .Values.apps.oxAppSuite.enabled }}
   postfix:
     enabled: {{ .Values.apps.postfix.enabled }}
@@ -50,6 +62,8 @@ apps:
     enabled: {{ .Values.apps.postgresql.enabled }}
   redis:
     enabled: {{ .Values.apps.redis.enabled }}
+  staticFiles:
+    enabled: {{ .Values.apps.staticFiles.enabled }}
   xwiki:
     enabled: {{ .Values.apps.xwiki.enabled }}
 

helmfile/apps/openproject/values.yaml.gotmpl

@@ -95,6 +95,7 @@ environment:
   OPENPROJECT_SEED_DESIGN_MAIN__MENU__BG__HOVER__BACKGROUND: {{ .Values.theme.colors.secondaryGreyLight | quote }}
   OPENPROJECT_SEED_DESIGN_LOGO: "data:image/svg+xml;base64,{{ .Values.theme.imagery.logoHeaderSvgB64 }}"
   OPENPROJECT_SEED_DESIGN_FAVICON: "data:image/svg+xml;base64,{{ .Values.theme.imagery.projects.faviconSvg }}"
+  OPENPROJECT_PLUGIN__OPENPROJECT__AVATARS: '{enable_gravatars: false, enable_local_avatars: true}'
 
   {{- if .Values.certificate.selfSigned }}
   SSL_CERT_FILE: "/etc/ssl/certs/ca-certificates.crt"
@@ -130,7 +131,10 @@ persistence:
   enabled: false
 
 podAnnotations:
-  {{ .Values.annotations.openproject.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "openproject"
+  {{- with .Values.annotations.openproject.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 postgresql:
   bundled: false

helmfile/apps/services-external/values-cassandra.yaml.gotmpl

@@ -73,8 +73,10 @@ persistence:
   storageClass: {{ coalesce .Values.persistence.storages.cassandra.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
 
 podAnnotations:
-  {{ .Values.annotations.cassandra.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "cassandra"
-
+  {{- with .Values.annotations.cassandra.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 podSecurityContext:
   enabled: true
   fsGroup: 1001

helmfile/apps/services-external/values-clamav-distributed.yaml.gotmpl

@@ -26,7 +26,10 @@ clamd:
     tag: {{ .Values.images.clamd.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   podAnnotations:
-    {{ .Values.annotations.servicesExternalClamavDistributed.clamdPod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "clamav-distributed"
+    {{- with .Values.annotations.servicesExternalClamavDistributed.clamdPod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podSecurityContext:
     enabled: true
     fsGroup: 101
@@ -81,7 +84,10 @@ freshclam:
     tag: {{ .Values.images.freshclam.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   podAnnotations:
-    {{ .Values.annotations.servicesExternalClamavDistributed.freshclamPod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "clamav-freshclam"
+    {{- with .Values.annotations.servicesExternalClamavDistributed.freshclamPod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podSecurityContext:
     enabled: true
     fsGroup: 101
@@ -129,7 +135,10 @@ icap:
     tag: {{ .Values.images.icap.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   podAnnotations:
-    {{ .Values.annotations.servicesExternalClamavDistributed.icapPod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "clamav-icap"
+    {{- with .Values.annotations.servicesExternalClamavDistributed.icapPod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podSecurityContext:
     enabled: true
     fsGroup: 101
@@ -169,7 +178,10 @@ milter:
     tag: {{ .Values.images.milter.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   podAnnotations:
-    {{ .Values.annotations.servicesExternalClamavDistributed.milterPod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "clamav-milter"
+    {{- with .Values.annotations.servicesExternalClamavDistributed.milterPod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   podSecurityContext:
     enabled: true
     fsGroup: 101

helmfile/apps/services-external/values-clamav-simple.yaml.gotmpl

@@ -44,7 +44,10 @@ persistence:
     {{ .Values.annotations.servicesExternalClamavSimple.persistence | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.servicesExternalClamavSimple.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "clamav-simple"
+  {{- with .Values.annotations.servicesExternalClamavSimple.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/services-external/values-dkimpy.yaml.gotmpl

@@ -30,7 +30,10 @@ image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 podAnnotations:
-  {{ .Values.annotations.servicesExternalDkimpy.service | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "dkimpy-milter"
+  {{- with .Values.annotations.servicesExternalDkimpy.service }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true

helmfile/apps/services-external/values-mariadb.yaml.gotmpl

@@ -78,6 +78,7 @@ persistence:
     {{ .Values.annotations.servicesExternalMariadb.persistence | toYaml | nindent 4 }}
 
 podAnnotations:
+  intents.otterize.com/service-name: "mariadb"
   argocd.argoproj.io/hook: "PostSync"
   argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
   {{- with .Values.annotations.servicesExternalMariadb.pod }}

helmfile/apps/services-external/values-memcached.yaml.gotmpl

@@ -34,8 +34,10 @@ image:
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 podAnnotations:
-  {{ .Values.annotations.servicesExternalMemcached.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "memcached"
-
+  {{- with .Values.annotations.servicesExternalMemcached.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end}}
 replicaCount: {{ .Values.replicas.memcached }}
 
 resources:

helmfile/apps/services-external/values-minio.yaml.gotmpl

@@ -134,7 +134,10 @@ provisioning:
       withLock: false
     {{- end }}
   podAnnotations:
-    {{ .Values.annotations.servicesExternalMinio.provisioningPod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "minio-provisioning"
+    {{- with .Values.annotations.servicesExternalMinio.provisioningPod }}
+    {{ . | toYaml | nindent 4}}
+    {{- end }}
   policies:
     - name: "migrations-bucket-policy"
       statements:
@@ -271,7 +274,10 @@ provisioning:
     {{ .Values.resources.minio | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.servicesExternalMinio.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "minio"
+  {{- with .Values.annotations.servicesExternalMinio.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 
 readinessProbe:
   enabled: true

helmfile/apps/services-external/values-postfix.yaml.gotmpl

@@ -41,7 +41,10 @@ persistence:
     {{ .Values.annotations.servicesExternalPostfix.persistence | toYaml | nindent 4 }}
 
 podAnnotations:
-  {{ .Values.annotations.servicesExternalPostfix.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "postfix"
+  {{- with .Values.annotations.servicesExternalPostfix.pod }}
+  {{ . | toYaml | nindent 2}}
+  {{- end}}
 
 podSecurityContext:
   enabled: true
@@ -68,19 +71,19 @@ postfix:
         value: {{ .Values.smtp.username }}
       password:
         value: {{ .Values.smtp.password }}
+  smtpSASLAuthEnable: "yes"
+  {{- else }}
+  smtpSASLAuthEnable: "no"
   {{- end }}
   # Warning: This setting allows unauthenticated mail relay from relayNets!
   allowRelayNets: true
   relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
-
+  minTLSVersion: "TLSv1.2"
-  minTLSVersion: "TLSv1.3"
+  smtpdTLSMandatoryCiphers: "medium"
-  smtpdTLSMandatoryCiphers: "high"
-
-  smtpSASLAuthEnable: "yes"
-  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
   smtpTLSSecurityLevel: "encrypt"
   smtpdSASLAuthEnable: "yes"
-  smtpdSASLSecurityOptions: "noanonymous"
+  smtpdSASLSecurityOptions: {{ .Values.smtp.security.smtpdSASLSecurityOptions | join ", " | quote }}
+  smtpSASLSecurityOptions: {{ .Values.smtp.security.smtpSASLSecurityOptions | join ", " | quote }}
   smtpdSASLType: "cyrus"
   smtpdTLSSecurityLevel: "may"
   smtpdTLSCertFile: "/etc/tls/tls.crt"
@@ -94,6 +97,25 @@ postfix:
     password:
       value: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
 
+  ldapTransportMaps: []
+
+  ldapVirtualAliasMaps:
+    - host: "ums-ldap-server"
+      scheme: "ldap"
+      port: 389
+      baseDn: "{{ .Values.ldap.baseDn }}"
+      bindDn: "uid=ldapsearch_postfix,cn=users,{{ .Values.ldap.baseDn }}"
+      password:
+        value: {{ .Values.secrets.nubus.ldapSearch.postfix | quote }}
+      # ldap filter to find groups with mail address
+      queryFilter: "(&(|(objectClass=univentionMailList)(objectClass=posixGroup))(|(mailPrimaryAddress=%s)(mailAlternativeAddress=%s)))"
+      # -- use this attribute if the query already returns email addresses of members and no recursive lookup needs to be done
+      resultAttribute: ""
+      # -- do a recursive search on the specified attribute if found, should be a DN
+      specialResultAttribute: "uniqueMember"
+      # -- return the following attribute from all found leaves when a recursive search is done
+      leafResultAttribute: "mailPrimaryAddress"
+
   {{- if .Values.antivirus.milter.host }}
   smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
   {{- else }}
@@ -109,8 +131,6 @@ postfix:
   virtualTransport: "lmtps:dovecot:24"
   {{- end }}
 
-podAnnotations: {}
-
 replicaCount: {{ .Values.replicas.postfix }}
 
 resources:

helmfile/apps/services-external/values-postgresql.yaml.gotmpl

@@ -67,6 +67,9 @@ job:
     - username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
       password: {{ .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
       connectionLimit: {{ .Values.databases.umsGuardianManagementApi.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.umsAuthSession.username | quote }}
+      password: {{ .Values.secrets.postgresql.umsAuthSessionUser | quote }}
+      connectionLimit: {{ .Values.databases.umsAuthSession.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
     - username: {{ .Values.databases.umsSelfservice.username | quote }}
       password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
       connectionLimit: {{ .Values.databases.umsSelfservice.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
@@ -96,6 +99,8 @@ job:
       user: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
     - name: {{ .Values.databases.umsNotificationsApi.name | quote }}
       user: {{ .Values.databases.umsNotificationsApi.username | quote }}
+    - name: {{ .Values.databases.umsAuthSession.name | quote }}
+      user: {{ .Values.databases.umsAuthSession.username | quote }}
     - name: {{ .Values.databases.umsSelfservice.name | quote }}
       user: {{ .Values.databases.umsSelfservice.username | quote }}
 {{ if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
@@ -115,6 +120,7 @@ persistence:
     {{ .Values.annotations.servicesExternalPostgresql.persistence | toYaml | nindent 4 }}
 
 podAnnotations:
+  intents.otterize.com/service-name: "postgresql"
   argocd.argoproj.io/hook: "PostSync"
   argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
   {{- with .Values.annotations.servicesExternalPostgresql.pod}}

helmfile/apps/services-external/values-redis.yaml.gotmpl

@@ -44,7 +44,10 @@ master:
     annotations:
       {{ .Values.annotations.servicesExternalRedis.masterPersistence | toYaml | nindent 6 }}
   podAnnotations:
-    {{ .Values.annotations.servicesExternalRedis.masterPod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "redis"
+    {{- with .Values.annotations.servicesExternalRedis.masterPod }}
+    {{ . | toYaml | nindent 4  }}
+    {{- end }}
   resources:
     {{ .Values.resources.redis | toYaml | nindent 4 }}
   service:

helmfile/apps/xwiki/values.yaml.gotmpl

@@ -86,7 +86,6 @@ customConfigs:
     xwiki.authentication.ldap.groupcache_expiration: 300
     ## Mapping for XWiki attributes to the respective LDAP attributes
     xwiki.authentication.ldap.fields_mapping: "last_name=sn,first_name=givenName,email=mailPrimaryAddress"
-
   xwiki.properties:
     {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
     distribution.defaultUI: "com.xwiki.projects.swp:xwiki-swp-flavor-enterprise-main"
@@ -171,6 +170,9 @@ properties:
   ## This option overwrites the LDAP group mappings including all dynamically created mappings,
   # therefore on XWiki restart an LDAP sync is triggered to load the dynamic mapping.
   "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.ldap_group_mapping": "xwiki:XWiki.XWikiAdminGroup=cn=managed-by-attribute-KnowledgemanagementAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
+  ## Collabora ODT / DOCX export
+  "property:xwiki:Collabora.Code.Configuration^Collabora.Code.ConfigurationClass.isEnabled": 1
+  "property:xwiki:Collabora.Code.Configuration^Collabora.Code.ConfigurationClass.server": "http://collabora:9980"
   ## SMTP settings
   "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.mailDomain | default .Values.global.domain }}"
   "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
@@ -182,9 +184,9 @@ properties:
   "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.addOIDCObject": 1
   "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.OIDCIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
   "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.colorTheme": "FlamingoThemes.Iceberg"
-  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.default_language": "de_DE"
+  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.default_language": {{ .Values.functional.internationalization.defaultLanguage | quote }}
   "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.timezone": "Europe/Berlin"
-  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.languages": "de_DE"
+  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.languages": {{ .Values.functional.internationalization.defaultLanguage | quote }}
   "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.link-color": "@brand-primary"
   "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.btn-primary-bg": "@brand-primary"
   "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.navbar-default-color": "@brand-primary"

helmfile/bases/environments.yaml.gotmpl

@@ -8,12 +8,30 @@ environments:
       {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
       - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
       {{- end }}
+      {{- if eq (env "SIZE_PROFILE") "500" }}
+      - "../../environments/default-size-500-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "5k" }}
+      - "../../environments/default-size-5k-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "50k" }}
+      - "../../environments/default-size-50k-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "100k" }}
+      - "../../environments/default-size-100k-overrides/*.yaml.gotmpl"
+      {{- end }}
   dev:
     values:
       - "../../environments/default/*.yaml.gotmpl"
       {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
       - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
       {{- end }}
+      {{- if eq (env "SIZE_PROFILE") "500" }}
+      - "../../environments/default-size-500-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "5k" }}
+      - "../../environments/default-size-5k-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "50k" }}
+      - "../../environments/default-size-50k-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "100k" }}
+      - "../../environments/default-size-100k-overrides/*.yaml.gotmpl"
+      {{- end }}
       - "../../environments/dev/*.yaml.gotmpl"
   test:
     values:
@@ -21,6 +39,15 @@ environments:
       {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
       - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
       {{- end }}
+      {{- if eq (env "SIZE_PROFILE") "500" }}
+      - "../../environments/default-size-500-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "5k" }}
+      - "../../environments/default-size-5k-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "50k" }}
+      - "../../environments/default-size-50k-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "100k" }}
+      - "../../environments/default-size-100k-overrides/*.yaml.gotmpl"
+      {{- end }}
       - "../../environments/test/*.yaml.gotmpl"
   prod:
     values:
@@ -28,5 +55,14 @@ environments:
       {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
       - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
       {{- end }}
+      {{- if eq (env "SIZE_PROFILE") "500" }}
+      - "../../environments/default-size-500-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "5k" }}
+      - "../../environments/default-size-5k-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "50k" }}
+      - "../../environments/default-size-50k-overrides/*.yaml.gotmpl"
+      {{- else if eq (env "SIZE_PROFILE") "100k" }}
+      - "../../environments/default-size-100k-overrides/*.yaml.gotmpl"
+      {{- end }}
       - "../../environments/prod/*.yaml.gotmpl"
 ...

helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl

@@ -6,12 +6,12 @@ charts:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/product-development/charts/opendesk-dovecot-pro"
     name: "dovecot"
-    version: "3.1.7"
+    version: "3.3.0"
     verify: true
   oxAppSuite:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/charts-mirror"
     name: "appsuite-public-sector-pro-chart"
-    version: "1.19.197"
+    version: "1.21.244"
     verify: false
 ...

helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl

@@ -5,8 +5,7 @@ images:
   collabora:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "25.04.3.4.1@sha256:929ce210bb1ff46275af64e94ce02ab0a0470572eba8251ad35b8b4296c3a171"
+    tag: "25.04.6.3.1@sha256:9ea79433e71db3b9056f47a0c8324a3a4f23f78b2412222991abf63969a714f1"
-
   dovecot:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/dovecot-pro"
@@ -14,9 +13,9 @@ images:
   nextcloud:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/nextcloud/images/opendesk-nextcloud"
-    tag: "31.0.6@sha256:cf893f2a7e1613a8c7641651c8a459f321c8bbbd234071b89f5638163ada00ef"
+    tag: "1.6.11@sha256:79bab3b5745eb2c0fdd5a8858d277495deb7f6e43b42c7046d5bfbee039aed0a"
   openxchangeCoreMW:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/middleware-public-sector-pro"
-    tag: "8.39.70@sha256:94b6e9325dfa4c91587b761946151987dd49000727ab81d10a41fdc7c17ae2cb"
+    tag: "8.41.58@sha256:da4aff1b890a463b01cc2c6b75c56fc5fe887d9ec5d2c7065535c083385044b6"
 ...

helmfile/environments/default-size-100k-overrides/persistence.yaml.gotmpl

@@ -0,0 +1,69 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+persistence:
+  # Will be used as default if not otherwise define on the component level
+  storageClassNames:
+    RWX: ""
+    RWO: ""
+
+  storages:
+    cassandra:
+      size: "300Gi"
+      commitLogsize: "8Gi"
+      storageClassName: ~
+    clamav:
+      size: "1Gi"
+      storageClassName: ~
+    dovecot:
+      size: "1200Gi"
+      storageClassName: ~
+    mariadb:
+      size: "320Gi"
+      storageClassName: ~
+    matrixNeoDateFixBot:
+      size: "1Gi"
+      storageClassName: ~
+    minio:
+      size: "2500Gi" # Open-Xchange: "10000Gi", with just 100Mi per user + OpenProject: "4000Gi" + Nextcloud: "10000Gi", with just 100Mi per user + Nubus: "50Gi" + Notes: "50Gi"
+      storageClassName: ~
+    nubusLdapServerData:
+      size: "25Gi"
+      storageClassName: ~
+    nubusPortalConsumer:
+      size: "25Gi"
+      storageClassName: ~
+    nubusProvisioningNats:
+      size: "25Gi"
+      storageClassName: ~
+    # This option was introduced with openDesk 1.6. For now we want to use the Helm charts default empty string
+    # to avoid issues during the upgrade modifying an existing PV, as the migrations in 1.6 required a smooth
+    # Nubus deployment.
+    # In a later openDesk release we will advise in the migrations.md to explicitly set this on existing deployments
+    # to the default storage class.
+    nubusUdmListener:
+      size: "1Gi"
+      #storageClassName: ""
+    oxConnector:
+      size: "1Gi"
+      # This value is not passed on to the related Helm chart yet, but required for linting purposes.
+      storageClassName: ~
+    postfix:
+      size: "50Gi"
+      storageClassName: ~
+    postgresql:
+      size: "1000Gi"
+      storageClassName: ~
+    prosody:
+      size: "1Gi"
+      storageClassName: ~
+    redis:
+      size: "75Gi"
+      storageClassName: ~
+    synapse:
+      size: "10000Gi" # just 100Mi per user
+      storageClassName: ~
+    xwiki:
+      size: "50Gi"
+      storageClassName: ~
+...

helmfile/environments/default-size-100k-overrides/replicas.yaml.gotmpl

@@ -0,0 +1,230 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+replicas:
+
+  ## Note: Databases should be deployed separately
+  # -- component: Cassandra
+  # -- scalable: tbd
+  cassandra: 3
+
+  # -- component: Persistence Layer
+  # -- scalable: false
+  mariadb: 1
+  # -- scalable: false
+  memcached: 1
+  # -- scalable: true
+  minio: 1
+  # -- scalable: false
+  postgres: 1
+  # -- scalable: tbd
+  redis: 1
+
+  # ClamAV
+
+  # -- component: Antivirus (ClamAV)
+  # -- scalable: true
+  # -- comment: clamav-simple - supports `ReadWriteOnce` PVCs.
+  clamav: 3
+  # -- scalable: true
+  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
+  clamd: 3
+  # -- scalable: true
+  # -- comment: clamav-distributed - You do not want to scale this service, as it just updates the signature files
+  # centrally an should be a singleton.
+  freshclam: 1
+  # -- scalable: true
+  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
+  icap: 3
+  # -- scalable: true
+  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
+  milter: 3
+
+  # IAM / Nubus
+
+  # -- component: IAM (Nubus)
+  # -- scalable: true
+  intercomService: 1
+  # -- scalable: true
+  keycloak: 5
+  # -- scalable: false
+  oxConnector: 1
+  # -- scalable: tbd
+  umsGuardianAuthorizationApi: 1
+  # -- scalable: tbd
+  umsGuardianManagementApi: 1
+  # -- scalable: tbd
+  umsGuardianManagementUi: 1
+  # -- scalable: tbd
+  umsGuardianOpenPolicyAgent: 1
+  # -- scalable: false
+  # -- comment: Should not be scaled, is an async process.
+  umsKeycloakExtensionsHandler: 1
+  # -- scalable: true
+  umsKeycloakExtensionsProxy: 1
+  # -- scalable: tbd
+  umsLdapNotifier: 1
+  # -- scalable: true
+  # -- comment: Please find details on the following `umsLdapServer*` entries in the upstream documentation:
+  # https://docs.software-univention.de/nubus-kubernetes-operation/latest/en/configuration/ldap.html#directory-service-high-availability-and-scalability
+  umsLdapServerPrimary: 2
+  # -- scalable: true
+  umsLdapServerSecondary: 8
+  # -- scalable: true
+  # -- comment: The LDAP proxy is only required in situations where there are clients outside of UDM writing into the
+  # LDAP like Samba. This is not a use case within openDesk so the LDAP Proxy's replica count should be kept at `0`
+  umsLdapServerProxy: 0
+  # -- scalable: tbd
+  umsNotificationsApi: 2
+  # -- scalable: true
+  umsPortalFrontend: 8
+  # -- scalable: false
+  umsPortalConsumer: 1
+  # -- scalable: true
+  umsPortalServer: 20
+  # -- scalable: tdb
+  umsProvisioningApi: 1
+  # -- scalable: false
+  umsProvisioningDispatcher: 1
+  # -- scalable: tdb
+  umsProvisioningNats: 1
+  # -- scalable: tdb
+  umsProvisioningPrefill: 1
+  # -- scalable: false
+  umsProvisioningUdmTransformer: 1
+  # -- scalable: tbd
+  umsSelfserviceConsumer: 1
+  # -- scalable: true
+  umsUdmListener: 1
+  # -- scalable: tbd
+  umsUdmRestApi: 8
+  # -- scalable: tbd
+  umsUmcGateway: 1
+  # -- scalable: tbd
+  umsUmcServer: 16
+  # -- scalable: tbd
+  umsUmcServerProxy: 1
+  # -- scalable: true
+  nginxS3Gateway: 1
+
+  # Nextcloud
+
+  # -- component: Filestore (Nextcloud)
+  # -- scalable: true
+  nextcloud: 12
+  # -- scalable: true
+  nextcloudNotifyPush: 1
+  # -- scalable: true
+  nextcloudExporter: 1
+
+  # Collabora:
+
+  # -- component: Weboffice (Collabora)
+  # -- scalable: true
+  # -- comment: If Collabora Controller is enabled, Collabora is autoscaling and the value below will be ignored.
+  # Please check `enterpriseFeatures.collabora.autoscaling` for autoscaling settings.
+  collabora: 50
+  # -- scalable: true
+  # -- comment: Load between Collabora Controller Pods is going to one Pod (the leader) only, therefore raise the number
+  # e.g. to `2` for high availability of the Collabora Controller.
+  collaboraController: 1
+
+  # Cryptpad
+
+  # -- component: Pad (CryptPad)
+  # -- scalable: false
+  cryptpad: 1
+
+  # OX App Suite
+  
+  # -- component: Groupware (OX AppSuite, OX Dovecot etc.)
+  # -- scalable: false
+  # -- comment: Scalable in openDesk Enterprise only
+  dovecot: 1
+  # -- component: Groupware (OX App Suite)
+  # -- scalable: tbd
+  openxchangeCoreDocumentConverter: 1
+  # -- scalable: tbd
+  openxchangeCoreGuidedtours: 1
+  # -- scalable: tbd
+  openxchangeCoreImageConverter: 1
+  # -- scalable: tbd
+  openxchangeCoreMW: 17
+  # -- scalable: tbd
+  openxchangeCoreUI: 1
+  # -- scalable: tbd
+  openxchangeCoreUIMiddleware: 2
+  # -- scalable: tbd
+  openxchangeCoreUserGuide: 1
+  # -- scalable: tbd
+  openxchangeGotenberg: 1
+  # -- scalable: tbd
+  openxchangeGuardUI: 1
+  # -- scalable: tbd
+  openxchangeNextcloudIntegrationUI: 1
+  # -- scalable: tbd
+  openxchangePluginsUI: 1
+  # -- scalable: tbd
+  openxchangePublicSectorUI: 1
+
+  # -- component: Project management (OpenProject)
+  # -- scalable: true
+  openprojectWeb: 53 # max 10'000 active users / 1'500 active users per 8 web workers = ~53 web workers
+  # -- scalable: true
+  # -- comment: Async service working on processing queue content. Can work on queues in parallel (when needed). Check
+  # https://www.openproject.org/docs/installation-and-operations/installation/helm-chart/ for details, as e.g.
+  # dedicated workers for specific queues are possible with OpenProject.
+  openprojectWorker: 26 # max 10'000 active users / 1'500 active users per 4 background workers = ~26 web workers
+
+  # -- component: Knowledge management (XWiki)
+  # -- scalable: false
+  xwiki: 1 # currently just vertial scaling
+
+  # -- component: Chat (Element, Synapse)
+  # -- scalable: true
+  element: 9 # no information about that, but as it distributes the web client to the users' browsers, there should be some server running parallel
+  # -- scalable: tbd
+  matrixNeoBoardWidget: 1
+  # -- scalable: tbd
+  matrixNeoChoiceWidget: 1
+  # -- scalable: tbd
+  matrixNeoDateFixBot: 1
+  # -- scalable: tbd
+  matrixNeoDateFixWidget: 1
+  # -- scalable: tbd
+  matrixUserVerificationService: 1
+  # -- scalable: tbd
+  synapse: 24
+  # -- scalable: true
+  synapseWeb: 3 # no information about that, but as HAproxy, a redundant setup should be senseful in larger deployments
+  # -- scalable: true		
+  wellKnown: 1
+
+  # -- component: Note taking (Notes) # No experience so far regarding heavy load (?), 10 replicas just a guess, atm
+  # -- scalable: true
+  notesBackend: 50
+  # -- scalable: true
+  notesFrontend: 10
+  # -- scalable: true
+  notesYProvider: 50
+
+  # Jitsi
+  # Current Helm Chart does only support one shard; shard can handle up to 1500 concurrent user
+
+  # -- component: Video conference (Jitsi)
+  # -- scalable: tbd
+  jibri: 1
+  # -- scalable: tbd
+  jicofo: 1
+  # -- scalable: tbd
+  jigasi: 1
+  # -- scalable: tbd
+  jitsi: 1
+  # -- scalable: tbd
+  jitsiKeycloakAdapter: 1
+  # -- scalable: tbd
+  jvb: 15 # 15 jvb maximum per shard; each jvb with up to 8Gi memory
+  # Jitsi
+  # 3 shards, each for up to 4000 concurrent users
+
+...

helmfile/environments/default-size-100k-overrides/resources.yaml.gotmpl

@@ -0,0 +1,655 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+resources:
+  cassandra:
+    limits:
+      cpu: 99
+      memory: "26Gi"
+    requests:
+      cpu: 1
+      memory: "1Gi"
+  clamd:
+    limits:
+      cpu: 99
+      memory: "16Gi"
+    requests:
+      cpu: 2
+      memory: "2Gi"
+  collabora:
+    # without autoscaling:
+    limits:
+      cpu: 99
+      memory: "26Gi"
+    requests:
+      cpu: 4
+      memory: "8Gi"
+    ## with autoscaling:
+    #limits:
+    #  cpu: 4
+    #  memory: "8Gi"
+    #requests:
+    #  cpu: 4
+    #  memory: "8Gi"
+  collaboraController:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.5
+      memory: "256Mi"
+  cryptpad:
+    limits:
+      cpu: 99
+      memory: "8Gi"
+    requests:
+      cpu: 0.1
+      memory: "512Mi"
+  dkimpy:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "128Mi"
+  dovecot:
+    limits:
+      cpu: 8
+      memory: "26Gi"
+    requests:
+      cpu: 1
+      memory: "1Gi"
+  element:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  freshclam:
+    limits:
+      cpu: 8
+      memory: "1Gi"
+    requests:
+      cpu: 0.5
+      memory: "512Mi"
+  icap:
+    limits:
+      cpu: 8
+      memory: "512Mi"
+    requests:
+      cpu: 0.5
+      memory: "128Mi"
+  intercomService:
+    limits:
+      cpu: 2
+      memory: "1Gi"
+    requests:
+      cpu: 0.5
+      memory: "128Mi"
+  # The Jibri container requires 2Gi /dev/shm so we need a limit based on the expected memory consumption of the
+  # service plus the 2Gi /dev/shm
+  jibri:
+    limits:
+      cpu: 99
+      memory: "3Gi"
+    requests:
+      cpu: 0.1
+      memory: "384Mi"
+  # The jicofo, jvb and jigasi containers require 3GB memory for the Java process, so we limit it to 3.5Gi overall consumption.
+  jicofo:
+    limits:
+      cpu: 99
+      memory: "3584Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  # The jicofo, jvb and jigasi containers require 3GB memory for the Java process, so we limit it to 3.5Gi overall consumption.
+  jigasi:
+    limits:
+      cpu: 99
+      memory: "3584Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  jitsi:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  jitsiKeycloakAdapter:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.01
+      memory: "48Mi"
+  # The jicofo, jvb and jigasi containers require 3GB memory for the Java process, so we limit it to 3.5Gi overall consumption.
+  jvb:
+    limits:
+      cpu: 99
+      memory: "8Gi"
+    requests:
+      cpu: 0.5
+      memory: "1Gi"
+  mariadb:
+    limits:
+      cpu: 99
+      memory: "108Gi"
+    requests:
+      cpu: 1
+      memory: "4Gi"
+  matrixNeoBoardWidget:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "48Mi"
+  matrixNeoChoiceWidget:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "48Mi"
+  matrixNeoDateFixBot:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "128Mi"
+  matrixNeoDateFixWidget:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "48Mi"
+  matrixUserVerificationService:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "128Mi"
+  memcached:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  milter:
+    limits:
+      cpu: 99
+      memory: "96Mi"
+    requests:
+      cpu: 0.1
+      memory: "16Mi"
+  minio:
+    limits:
+      cpu: 8
+      memory: "8Gi"
+    requests:
+      cpu: 1.5
+      memory: "2Gi"
+  nextcloud:
+    limits:
+      cpu: 11
+      memory: "40Gi"
+    requests:
+      cpu: 2
+      memory: "8Gi"
+  nextcloudCron:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "512Mi"
+  nextcloudExporter:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  nextcloudNotifyPush:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "512Mi"
+  nginxS3Gateway:
+    limits:
+      cpu: 99
+      memory: "64Mi"
+    requests:
+      cpu: "100m"
+      memory: "16Mi"
+  notesBackend:
+    limits:
+      cpu: 99
+      memory: "3Gi"
+    requests:
+      cpu: 0.1
+      memory: "768Mi"
+  notesFrontend:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  notesYProvider:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "200Mi"
+  opendeskKeycloakBootstrap:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  opendeskStaticFiles:
+    limits:
+      cpu: 99
+      memory: "64Mi"
+    requests:
+      cpu: 0.01
+      memory: "16Mi"
+  openproject:
+    limits:
+      cpu: 99
+      memory: "3Gi"
+    requests:
+      cpu: 0.1
+      memory: "768Mi"
+  openprojectDbInit:
+    limits:
+      cpu: 99
+      memory: "768Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  openprojectAppInit:
+    limits:
+      cpu: 99
+      memory: "768Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  openprojectSeederJob:
+    limits:
+      cpu: 99
+      memory: "768Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  openprojectWorkers:
+    limits:
+      cpu: 99
+      memory: "4Gi"
+    requests:
+      cpu: 0.25
+      memory: "512Mi"
+  openxchangeCoreDocumentConverter:
+    limits:
+      cpu: 2
+      memory: "6Gi"
+    requests:
+      cpu: 0.25
+      memory: "1.25Gi"
+  openxchangeCoreGuidedtours:
+    limits:
+      cpu: 1
+      memory: "1Gi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  openxchangeCoreImageConverter:
+    limits:
+      cpu: 2
+      memory: "6Gi"
+    requests:
+      cpu: 0.5
+      memory: "1.25Gi"
+  openxchangeCoreMW:
+    limits:
+      cpu: 4
+      memory: "16Gi"
+    requests:
+      cpu: 1
+      memory: "1.25Gi"
+  openxchangeCoreUI:
+    limits:
+      cpu: 1
+      memory: "1Gi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  openxchangeCoreUIMiddleware:
+    limits:
+      cpu: 1
+      memory: "1536Mi"
+    requests:
+      cpu: 0.5
+      memory: "192Mi"
+  openxchangeCoreUIMiddlewareUpdater:
+    limits:
+      cpu: 99
+      memory: "768Mi"
+    requests:
+      cpu: 0.5
+      memory: "192Mi"
+  openxchangeCoreUserGuide:
+    limits:
+      cpu: 1
+      memory: "128Mi"
+    requests:
+      cpu: 0.02
+      memory: "32Mi"
+  openxchangeGotenberg:
+    limits:
+      cpu: 1
+      memory: "512Mi"
+    requests:
+      cpu: 0.05
+      memory: "32Mi"
+  openxchangeGuardUI:
+    limits:
+      cpu: 1
+      memory: "512Mi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  openxchangeNextcloudIntegrationUI:
+    limits:
+      cpu: 1
+      memory: "512Mi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  openxchangePluginsUI:
+    limits:
+      cpu: 1
+      memory: "1Gi"
+    requests:
+      cpu: 0.05
+      memory: "32Mi"
+  openxchangePublicSectorUI:
+    limits:
+      cpu: 1
+      memory: "1Gi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  oxConnector:
+    limits:
+      cpu: 99
+      memory: "4Gi"
+    requests:
+      cpu: 0.1
+      memory: "1Gi"
+  postfix:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "16Mi"
+  postgresql:
+    limits:
+      cpu: 99
+      memory: "1098Gi" # Element: "230Gi" + Nextcloud: "516Gi" + OpenProject: "96Gi" + XWiki: "256Gi"
+    requests:
+      cpu: 10
+      memory: "128Gi"
+  prosody:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  redis:
+    limits:
+      cpu: 16
+      memory: "63Gi"
+    requests:
+      cpu: 2
+      memory: "4Gi"
+  synapse:
+    limits:
+      cpu: 99
+      memory: "16Gi"
+    requests:
+      cpu: 1
+      memory: "2Gi"
+  synapseWeb:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "64Mi"
+  umsGuardianManagementApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsGuardianManagementUi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsGuardianAuthorizationApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsKeycloak:
+    limits:
+      cpu: 99
+      memory: "2Gi"
+    requests:
+      cpu: 0.1
+      memory: "512Mi"
+  umsKeycloakBootstrap:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsKeycloakExtensionHandler:
+    limits:
+      cpu: 8
+      memory: "1Gi"
+    requests:
+      cpu: 0.2
+      memory: "250Mi"
+  umsKeycloakExtensionProxy:
+    limits:
+      cpu: 8
+      memory: "1Gi"
+    requests:
+      cpu: 0.2
+      memory: "250Mi"
+  umsLdapNotifier:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsLdapServer:
+    limits:
+      cpu: 8
+      memory: "4Gi"
+    requests:
+      cpu: 3
+      memory: "2Gi"
+  umsNotificationsApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsPortalFrontend:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsPortalConsumer:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsPortalConsumerDependencies:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsPortalServer:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsProvisioningApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "100Mi"
+  umsProvisioningDispatcher:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsProvisioningPrefill:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsProvisioningRegisterConsumers:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "64Mi"
+  umsProvisioningUdmTransformer:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "64Mi"
+  umsProvisioningNats:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "128Mi"
+  umsSelfserviceConsumer:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsStackDataUms:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsOpenPolicyAgent:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUdmListener:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUdmRestApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUdmRestApiInit:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUmcGateway:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUmcServer:
+    limits:
+      cpu: 2
+      memory: "2Gi"
+    requests:
+      cpu: 0.3
+      memory: "500Mi"
+  wellKnown:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  xwiki:
+    limits:
+      cpu: 99
+      memory: "192Gi"
+    requests:
+      cpu: 20
+      memory: "34Gi"
+...

helmfile/environments/default-size-500-overrides/persistence.yaml.gotmpl

@@ -0,0 +1,69 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+persistence:
+  # Will be used as default if not otherwise define on the component level
+  storageClassNames:
+    RWX: ""
+    RWO: ""
+
+  storages:
+    cassandra:
+      size: "10Gi"
+      commitLogsize: "2560Mi"
+      storageClassName: ~
+    clamav:
+      size: "1Gi"
+      storageClassName: ~
+    dovecot:
+      size: "10Gi"
+      storageClassName: ~
+    mariadb:
+      size: "5Gi"
+      storageClassName: ~
+    matrixNeoDateFixBot:
+      size: "1Gi"
+      storageClassName: ~
+    minio:
+      size: "122Gi" # Open-Xchange: "50Gi", with just 100Mi per user + OpenProject: "20Gi" + Nextcloud: "50Gi", with just 100Mi per user + Nubus: "1Gi" + Notes: "1Gi"
+      storageClassName: ~
+    nubusLdapServerData:
+      size: "1Gi"
+      storageClassName: ~
+    nubusPortalConsumer:
+      size: "1Gi"
+      storageClassName: ~
+    nubusProvisioningNats:
+      size: "1Gi"
+      storageClassName: ~
+    # This option was introduced with openDesk 1.6. For now we want to use the Helm charts default empty string
+    # to avoid issues during the upgrade modifying an existing PV, as the migrations in 1.6 required a smooth
+    # Nubus deployment.
+    # In a later openDesk release we will advise in the migrations.md to explicitly set this on existing deployments
+    # to the default storage class.
+    nubusUdmListener:
+      size: "1Gi"
+      #storageClassName: ""
+    oxConnector:
+      size: "1Gi"
+      # This value is not passed on to the related Helm chart yet, but required for linting purposes.
+      storageClassName: ~
+    postfix:
+      size: "1Gi"
+      storageClassName: ~
+    postgresql:
+      size: "5Gi"
+      storageClassName: ~
+    prosody:
+      size: "1Gi"
+      storageClassName: ~
+    redis:
+      size: "1Gi"
+      storageClassName: ~
+    synapse:
+      size: "50Gi" # just 100Mi per user
+      storageClassName: ~
+    xwiki:
+      size: "5Gi"
+      storageClassName: ~
+...

helmfile/environments/default-size-500-overrides/replicas.yaml.gotmpl

@@ -0,0 +1,227 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+replicas:
+
+  ## Note: Databases should be deployed separately
+  # -- component: Cassandra
+  # -- scalable: tbd
+  cassandra: 1
+
+  # -- component: Persistence Layer
+  # -- scalable: false
+  mariadb: 1
+  # -- scalable: false
+  memcached: 1
+  # -- scalable: true
+  minio: 1
+  # -- scalable: false
+  postgres: 1
+  # -- scalable: tbd
+  redis: 1
+
+  # ClamAV
+
+  # -- component: Antivirus (ClamAV)
+  # -- scalable: true
+  # -- comment: clamav-simple - supports `ReadWriteOnce` PVCs.
+  clamav: 1
+  # -- scalable: true
+  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
+  clamd: 1
+  # -- scalable: true
+  # -- comment: clamav-distributed - You do not want to scale this service, as it just updates the signature files
+  # centrally an should be a singleton.
+  freshclam: 1
+  # -- scalable: true
+  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
+  icap: 1
+  # -- scalable: true
+  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
+  milter: 1
+
+  # IAM / Nubus
+
+  # -- component: IAM (Nubus)
+  # -- scalable: true
+  intercomService: 1
+  # -- scalable: true
+  keycloak: 1
+  # -- scalable: false
+  oxConnector: 1
+  # -- scalable: tbd
+  umsGuardianAuthorizationApi: 1
+  # -- scalable: tbd
+  umsGuardianManagementApi: 1
+  # -- scalable: tbd
+  umsGuardianManagementUi: 1
+  # -- scalable: tbd
+  umsGuardianOpenPolicyAgent: 1
+  # -- scalable: false
+  # -- comment: Should not be scaled, is an async process.
+  umsKeycloakExtensionsHandler: 1
+  # -- scalable: true
+  umsKeycloakExtensionsProxy: 1
+  # -- scalable: tbd
+  umsLdapNotifier: 1
+  # -- scalable: true
+  # -- comment: Please find details on the following `umsLdapServer*` entries in the upstream documentation:
+  # https://docs.software-univention.de/nubus-kubernetes-operation/latest/en/configuration/ldap.html#directory-service-high-availability-and-scalability
+  umsLdapServerPrimary: 1
+  # -- scalable: true
+  umsLdapServerSecondary: 1
+  # -- scalable: true
+  # -- comment: The LDAP proxy is only required in situations where there are clients outside of UDM writing into the
+  # LDAP like Samba. This is not a use case within openDesk so the LDAP Proxy's replica count should be kept at `0`
+  umsLdapServerProxy: 0
+  # -- scalable: tbd
+  umsNotificationsApi: 1
+  # -- scalable: true
+  umsPortalFrontend: 1
+  # -- scalable: false
+  umsPortalConsumer: 1
+  # -- scalable: true
+  umsPortalServer: 1
+  # -- scalable: tdb
+  umsProvisioningApi: 1
+  # -- scalable: false
+  umsProvisioningDispatcher: 1
+  # -- scalable: tdb
+  umsProvisioningNats: 1
+  # -- scalable: tdb
+  umsProvisioningPrefill: 1
+  # -- scalable: false
+  umsProvisioningUdmTransformer: 1
+  # -- scalable: tbd
+  umsSelfserviceConsumer: 1
+  # -- scalable: true
+  umsUdmListener: 1
+  # -- scalable: tbd
+  umsUdmRestApi: 1
+  # -- scalable: tbd
+  umsUmcGateway: 1
+  # -- scalable: tbd
+  umsUmcServer: 1
+  # -- scalable: tbd
+  umsUmcServerProxy: 1
+  # -- scalable: true
+  nginxS3Gateway: 1
+
+  # Nextcloud
+
+  # -- component: Filestore (Nextcloud)
+  # -- scalable: true
+  nextcloud: 1
+  # -- scalable: true
+  nextcloudNotifyPush: 1
+  # -- scalable: true
+  nextcloudExporter: 1
+
+  # Collabora:
+
+  # -- component: Weboffice (Collabora)
+  # -- scalable: true
+  # -- comment: If Collabora Controller is enabled, Collabora is autoscaling and the value below will be ignored.
+  # Please check `enterpriseFeatures.collabora.autoscaling` for autoscaling settings.
+  collabora: 1
+  # -- scalable: true
+  # -- comment: Load between Collabora Controller Pods is going to one Pod (the leader) only, therefore raise the number
+  # e.g. to `2` for high availability of the Collabora Controller.
+  collaboraController: 1
+
+  # Cryptpad
+
+  # -- component: Pad (CryptPad)
+  # -- scalable: false
+  cryptpad: 1
+
+  # OX App Suite
+
+  # -- component: Groupware (OX AppSuite, OX Dovecot etc.)
+  # -- scalable: false
+  # -- comment: Scalable in openDesk Enterprise only
+  dovecot: 1
+  # -- component: Groupware (OX App Suite)
+  # -- scalable: tbd
+  openxchangeCoreDocumentConverter: 1
+  # -- scalable: tbd
+  openxchangeCoreGuidedtours: 1
+  # -- scalable: tbd
+  openxchangeCoreImageConverter: 1
+  # -- scalable: tbd
+  openxchangeCoreMW: 1
+  # -- scalable: tbd
+  openxchangeCoreUI: 1
+  # -- scalable: tbd
+  openxchangeCoreUIMiddleware: 1
+  # -- scalable: tbd
+  openxchangeCoreUserGuide: 1
+  # -- scalable: tbd
+  openxchangeGotenberg: 1
+  # -- scalable: tbd
+  openxchangeGuardUI: 1
+  # -- scalable: tbd
+  openxchangeNextcloudIntegrationUI: 1
+  # -- scalable: tbd
+  openxchangePluginsUI: 1
+  # -- scalable: tbd
+  openxchangePublicSectorUI: 1
+
+  # -- component: Project management (OpenProject)
+  # -- scalable: true
+  openprojectWeb: 1 # max 50 active users
+  # -- scalable: true
+  # -- comment: Async service working on processing queue content. Can work on queues in parallel (when needed). Check
+  # https://www.openproject.org/docs/installation-and-operations/installation/helm-chart/ for details, as e.g.
+  # dedicated workers for specific queues are possible with OpenProject.
+  openprojectWorker: 1 # max 50 active users
+
+  # -- component: Knowledge management (XWiki)
+  # -- scalable: false
+  xwiki: 1 # currently just vertial scaling (resources)
+
+  # -- component: Chat (Element, Synapse)
+  # -- scalable: true
+  element: 1 # no information about that, but as it distributes the web client to the users' browsers, there should be some server running parallel
+  # -- scalable: tbd
+  matrixNeoBoardWidget: 1
+  # -- scalable: tbd
+  matrixNeoChoiceWidget: 1
+  # -- scalable: tbd
+  matrixNeoDateFixBot: 1
+  # -- scalable: tbd
+  matrixNeoDateFixWidget: 1
+  # -- scalable: tbd
+  matrixUserVerificationService: 1
+  # -- scalable: tbd
+  synapse: 1 
+  # -- scalable: true
+  synapseWeb: 1 # no information about that, but as HAproxy, a redundant setup should be senseful in larger deployments
+  # -- scalable: true		
+  wellKnown: 1
+
+  # -- component: Note taking (Notes) # No experience so far regarding heavy load (?), 10 replicas just a guess, atm
+  # -- scalable: true
+  notesBackend: 1
+  # -- scalable: true
+  notesFrontend: 1
+  # -- scalable: true
+  notesYProvider: 1
+
+  # Jitsi
+
+  # -- component: Video conference (Jitsi)
+  # -- scalable: tbd
+  jibri: 1
+  # -- scalable: tbd
+  jicofo: 1
+  # -- scalable: tbd
+  jigasi: 1
+  # -- scalable: tbd
+  jitsi: 1
+  # -- scalable: tbd
+  jitsiKeycloakAdapter: 1
+  # -- scalable: tbd
+  jvb: 1 
+
+...

helmfile/environments/default-size-500-overrides/resources.yaml.gotmpl

@@ -0,0 +1,655 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+resources:
+  cassandra:
+    limits:
+      cpu: 99
+      memory: "4Gi"
+    requests:
+      cpu: 1
+      memory: "1Gi"
+  clamd:
+    limits:
+      cpu: 99
+      memory: "4Gi"
+    requests:
+      cpu: 2
+      memory: "2Gi"
+  collabora:
+    # without autoscaling:
+    limits:
+      cpu: 99
+      memory: "8Gi"
+    requests:
+      cpu: 4
+      memory: "8Gi"
+    ## with autoscaling:
+    #limits:
+    #  cpu: 4
+    #  memory: "8Gi"
+    #requests:
+    #  cpu: 4
+    #  memory: "8Gi"
+  collaboraController:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.5
+      memory: "256Mi"
+  cryptpad:
+    limits:
+      cpu: 99
+      memory: "2Gi"
+    requests:
+      cpu: 0.1
+      memory: "512Mi"
+  dkimpy:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "128Mi"
+  dovecot:
+    limits:
+      cpu: 99
+      memory: "4Gi"
+    requests:
+      cpu: 1
+      memory: "1Gi"
+  element:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  freshclam:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "96Mi"
+  icap:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "16Mi"
+  intercomService:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "64Mi"
+  # The Jibri container requires 2Gi /dev/shm so we need a limit based on the expected memory consumption of the
+  # service plus the 2Gi /dev/shm
+  jibri:
+    limits:
+      cpu: 99
+      memory: "3Gi"
+    requests:
+      cpu: 0.1
+      memory: "384Mi"
+  # The jicofo, jvb and jigasi containers require 3GB memory for the Java process, so we limit it to 3.5Gi overall consumption.
+  jicofo:
+    limits:
+      cpu: 99
+      memory: "3584Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  # The jicofo, jvb and jigasi containers require 3GB memory for the Java process, so we limit it to 3.5Gi overall consumption.
+  jigasi:
+    limits:
+      cpu: 99
+      memory: "3584Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  jitsi:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  jitsiKeycloakAdapter:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.01
+      memory: "48Mi"
+  # The jicofo, jvb and jigasi containers require 3GB memory for the Java process, so we limit it to 3.5Gi overall consumption.
+  jvb:
+    limits:
+      cpu: 99
+      memory: "8Gi"
+    requests:
+      cpu: 0.5
+      memory: "1Gi"
+  mariadb:
+    limits:
+      cpu: 99
+      memory: "8Gi"
+    requests:
+      cpu: 1
+      memory: "1Gi"
+  matrixNeoBoardWidget:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "48Mi"
+  matrixNeoChoiceWidget:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "48Mi"
+  matrixNeoDateFixBot:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "128Mi"
+  matrixNeoDateFixWidget:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "48Mi"
+  matrixUserVerificationService:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "128Mi"
+  memcached:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  milter:
+    limits:
+      cpu: 99
+      memory: "96Mi"
+    requests:
+      cpu: 0.1
+      memory: "16Mi"
+  minio:
+    limits:
+      cpu: 99
+      memory: "4Gi"
+    requests:
+      cpu: 1.5
+      memory: "512Mi"
+  nextcloud:
+    limits:
+      cpu: 1.5
+      memory: "8Gi"
+    requests:
+      cpu: 1
+      memory: "1Gi"
+  nextcloudCron:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "512Mi"
+  nextcloudExporter:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  nextcloudNotifyPush:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "512Mi"
+  nginxS3Gateway:
+    limits:
+      cpu: 99
+      memory: "64Mi"
+    requests:
+      cpu: "100m"
+      memory: "16Mi"
+  notesBackend:
+    limits:
+      cpu: 99
+      memory: "768Mi"
+    requests:
+      cpu: 0.1
+      memory: "512Mi"
+  notesFrontend:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  notesYProvider:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "128Mi"
+  opendeskKeycloakBootstrap:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  opendeskStaticFiles:
+    limits:
+      cpu: 99
+      memory: "64Mi"
+    requests:
+      cpu: 0.01
+      memory: "16Mi"
+  openproject:
+    limits:
+      cpu: 99
+      memory: "3Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  openprojectDbInit:
+    limits:
+      cpu: 99
+      memory: "768Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  openprojectAppInit:
+    limits:
+      cpu: 99
+      memory: "768Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  openprojectSeederJob:
+    limits:
+      cpu: 99
+      memory: "768Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  openprojectWorkers:
+    limits:
+      cpu: 99
+      memory: "4Gi"
+    requests:
+      cpu: 0.25
+      memory: "512Mi"
+  openxchangeCoreDocumentConverter:
+    limits:
+      cpu: 99
+      memory: "6Gi"
+    requests:
+      cpu: 0.25
+      memory: "1.25Gi"
+  openxchangeCoreGuidedtours:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  openxchangeCoreImageConverter:
+    limits:
+      cpu: 99
+      memory: "6Gi"
+    requests:
+      cpu: 0.5
+      memory: "1.25Gi"
+  openxchangeCoreMW:
+    limits:
+      cpu: 99
+      memory: "15Gi"
+    requests:
+      cpu: 1
+      memory: "1.25Gi"
+  openxchangeCoreUI:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  openxchangeCoreUIMiddleware:
+    limits:
+      cpu: 1
+      memory: "1536Mi"
+    requests:
+      cpu: 0.5
+      memory: "192Mi"
+  openxchangeCoreUIMiddlewareUpdater:
+    limits:
+      cpu: 99
+      memory: "768Mi"
+    requests:
+      cpu: 0.5
+      memory: "192Mi"
+  openxchangeCoreUserGuide:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.02
+      memory: "32Mi"
+  openxchangeGotenberg:
+    limits:
+      cpu: 99
+      memory: "96Mi"
+    requests:
+      cpu: 0.05
+      memory: "32Mi"
+  openxchangeGuardUI:
+    limits:
+      cpu: 99
+      memory: "96Mi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  openxchangeNextcloudIntegrationUI:
+    limits:
+      cpu: 99
+      memory: "96Mi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  openxchangePluginsUI:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.05
+      memory: "32Mi"
+  openxchangePublicSectorUI:
+    limits:
+      cpu: 99
+      memory: "96Mi"
+    requests:
+      cpu: 0.01
+      memory: "32Mi"
+  oxConnector:
+    limits:
+      cpu: 99
+      memory: "2Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  postfix:
+    limits:
+      cpu: 99
+      memory: "128Mi"
+    requests:
+      cpu: 0.1
+      memory: "16Mi"
+  postgresql:
+    limits:
+      cpu: 99
+      memory: "21Gi" # Element: "4Gi" + Nextcloud: "3Gi" + OpenProject: "8Gi" + XWiki: "6Gi"
+    requests:
+      cpu: 1
+      memory: "8Gi"
+  prosody:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  redis:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.5
+      memory: "128Mi"
+  synapse:
+    limits:
+      cpu: 99
+      memory: "11Gi"
+    requests:
+      cpu: 1
+      memory: "768Mi"
+  synapseWeb:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "64Mi"
+  umsGuardianManagementApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsGuardianManagementUi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsGuardianAuthorizationApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsKeycloak:
+    limits:
+      cpu: 99
+      memory: "2Gi"
+    requests:
+      cpu: 0.1
+      memory: "512Mi"
+  umsKeycloakBootstrap:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsKeycloakExtensionHandler:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "48Mi"
+  umsKeycloakExtensionProxy:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "48Mi"
+  umsLdapNotifier:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsLdapServer:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsNotificationsApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsPortalFrontend:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsPortalConsumer:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsPortalConsumerDependencies:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsPortalServer:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsProvisioningApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "100Mi"
+  umsProvisioningDispatcher:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsProvisioningPrefill:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsProvisioningRegisterConsumers:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "64Mi"
+  umsProvisioningUdmTransformer:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "64Mi"
+  umsProvisioningNats:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "128Mi"
+  umsSelfserviceConsumer:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsStackDataUms:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsOpenPolicyAgent:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUdmListener:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUdmRestApi:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUdmRestApiInit:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUmcGateway:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsUmcServer:
+    limits:
+      cpu: 2
+      memory: "2Gi"
+    requests:
+      cpu: 0.3
+      memory: "500Mi"
+  wellKnown:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "32Mi"
+  xwiki:
+    limits:
+      cpu: 99
+      memory: "8Gi"
+    requests:
+      cpu: 4
+      memory: "2Gi"
+...

helmfile/environments/default-size-50k-overrides/persistence.yaml.gotmpl

@@ -0,0 +1,69 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+persistence:
+  # Will be used as default if not otherwise define on the component level
+  storageClassNames:
+    RWX: ""
+    RWO: ""
+
+  storages:
+    cassandra:
+      size: "150Gi"
+      commitLogsize: "8Gi"
+      storageClassName: ~
+    clamav:
+      size: "1Gi"
+      storageClassName: ~
+    dovecot:
+      size: "600Gi"
+      storageClassName: ~
+    mariadb:
+      size: "160Gi"
+      storageClassName: ~
+    matrixNeoDateFixBot:
+      size: "1Gi"
+      storageClassName: ~
+    minio:
+      size: "12050Gi" # Open-Xchange: "5000Gi", with just 100Mi per user + OpenProject: "2000Gi" + Nextcloud: "5000Gi", with just 100Mi per user + Nubus: "25Gi" + Notes: "25Gi"
+      storageClassName: ~
+    nubusLdapServerData:
+      size: "12Gi"
+      storageClassName: ~
+    nubusPortalConsumer:
+      size: "12Gi"
+      storageClassName: ~
+    nubusProvisioningNats:
+      size: "12Gi"
+      storageClassName: ~
+    # This option was introduced with openDesk 1.6. For now we want to use the Helm charts default empty string
+    # to avoid issues during the upgrade modifying an existing PV, as the migrations in 1.6 required a smooth
+    # Nubus deployment.
+    # In a later openDesk release we will advise in the migrations.md to explicitly set this on existing deployments
+    # to the default storage class.
+    nubusUdmListener:
+      size: "1Gi"
+      #storageClassName: ""
+    oxConnector:
+      size: "1Gi"
+      # This value is not passed on to the related Helm chart yet, but required for linting purposes.
+      storageClassName: ~
+    postfix:
+      size: "25Gi"
+      storageClassName: ~
+    postgresql:
+      size: "500Gi"
+      storageClassName: ~
+    prosody:
+      size: "1Gi"
+      storageClassName: ~
+    redis:
+      size: "38Gi"
+      storageClassName: ~
+    synapse:
+      size: "5000Gi" # just 100Mi per user
+      storageClassName: ~
+    xwiki:
+      size: "40Gi"
+      storageClassName: ~
+...