fix(element): Bump NeoBoard Widget to v1.20.0

Signed-off-by: Milton Moura <miltonmoura@gmail.com>
Move guest flag to defaults
2025-12-06 15:31:38 +01:00 · 2024-10-03 14:34:25 +00:00 · 2024-10-03 13:46:22 +00:00 · 2024-10-03 12:58:17 +00:00 · 2024-10-03 12:56:09 +00:00 · 2024-10-03 12:26:39 +00:00
170 changed files with 5375 additions and 3782 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,7 +6,11 @@

 # Ignore changes to sample environments
 helmfile/environments/dev/*.yaml.gotmpl
+helmfile/environments/test/*.yaml.gotmpl
 helmfile/environments/prod/*.yaml.gotmpl
+!helmfile/environments/dev/sample.yaml.gotmpl
+!helmfile/environments/test/sample.yaml.gotmpl
+!helmfile/environments/prod/sample.yaml.gotmpl

 # Ignore in CI generated files
 .kyverno/opendesk.yaml
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,7 +4,7 @@
 ---
 include:
  - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "v2.3.3"
+    ref: "v2.3.4"
    file:
      - "ci/common/automr.yml"
      - "ci/common/lint.yml"
@@ -36,9 +36,11 @@ stages:
  - "env-cleanup"
  - "env"
  - "pre-services-deploy"
+  - "migrations-pre"
  - "basic-services-deploy"
  - "component-deploy-stage-1"
  - "component-deploy-stage-2"
+  - "migrations-post"
  - "lint"
  - "tests"
  - "env-stop"
@@ -77,6 +79,12 @@ variables:
    options:
      - "yes"
      - "no"
+  DEPLOY_MIGRATIONS:
+    description: "Deploy K8s job for migrations (pre & post)."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
  DEPLOY_SERVICES:
    description: "Enable Service deployment."
    value: "no"
@@ -84,13 +92,7 @@ variables:
      - "yes"
      - "no"
  DEPLOY_UMS:
-    description: "Enable Univention Management Stack deployment."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
-  DEPLOY_PROVISIONING:
-    description: "Enable Provisioning Components."
+    description: "Enable Nubus deployment."
    value: "no"
    options:
      - "yes"
@@ -119,12 +121,6 @@ variables:
    options:
      - "yes"
      - "no"
-  DEPLOY_ICS:
-    description: "Enable ICS deployment."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
  DEPLOY_XWIKI:
    description: "Enable XWiki deployment."
    value: "no"
@@ -151,7 +147,7 @@ variables:
      - "no"
  RUN_TESTS:
    description: "Triggers execution of E2E-tests."
-    value: "yes"
+    value: "no"
    options:
      - "yes"
      - "no"
@@ -163,14 +159,26 @@ variables:
      - "no"
  TESTS_BRANCH:
    description: "Branch of E2E-tests on which the test pipeline is triggered"
-    value: "main"
+    value: "develop"
+  TESTS_PROJECT_URL:
+    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
+    value: "gitlab.opencode.de/api/v4/projects/1506"
+  TESTS_TESTSET:
+    description: "Selects testset for E2E-tests"
+    value: "Smoke"
+    options:
+      - "Regression"
+      - "Smoke"
+  TESTS_GRACE_PERIOD:
+    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail. GRACE_PERIOD is the period in seconds that should be waited before running the tests."
+    value: "0"

 .deploy-common:
  cache: {}
  dependencies: []
  extends: ".environments"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.0.1\
-          @sha256:d38f41b88374e055332860018f2936db8807b763caf6089735db0484cbb2842a"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.1.0\
+          @sha256:74f349066ac5d20e3afaa6abd28781b4c8dc086f67e3d3c1b8345e4a9c3371b1"
  script:
    - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
    # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD
@@ -208,6 +216,7 @@ env-cleanup:
        done
        kubectl delete pvc --all --namespace ${NAMESPACE};
        kubectl delete jobs --all --namespace ${NAMESPACE};
+        kubectl delete configmaps --all --namespace ${NAMESPACE};
      else
        helmfile destroy --namespace ${NAMESPACE};
      fi
@@ -227,14 +236,6 @@ env-start:
  script:
    - "echo \"Deploying to Environment ${NAMESPACE} in ${CLUSTER} Cluster\""
    - "kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -"
-    - >
-      kubectl create secret
-      --namespace "${NAMESPACE}"
-      docker-registry external-registry
-      --docker-server "${EXTERNAL_REGISTRY}"
-      --docker-username "${EXTERNAL_REGISTRY_USERNAME}"
-      --docker-password "${EXTERNAL_REGISTRY_PASSWORD}"
-      --dry-run=client -o yaml | kubectl apply -f -
  stage: "env"

 policies-deploy:
@@ -250,6 +251,30 @@ policies-deploy:
    COMPONENT: "services"
    ADDITIONAL_ARGS: "-l name=opendesk-otterize"

+migrations-pre:
+  stage: "migrations-pre"
+  extends: ".deploy-common"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
+      when: "on_success"
+  variables:
+    COMPONENT: "migrations-pre"
+
+migrations-post:
+  stage: "migrations-post"
+  extends: ".deploy-common"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
+      when: "on_success"
+  variables:
+    COMPONENT: "migrations-post"
+
 services-deploy:
  stage: "basic-services-deploy"
  extends: ".deploy-common"
@@ -262,19 +287,7 @@ services-deploy:
  variables:
    COMPONENT: "services"

-provisioning-deploy:
-  stage: "component-deploy-stage-2"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no" || $DEPLOY_PROVISIONING != "no")
-      when: "on_success"
-  variables:
-    COMPONENT: "provisioning"
-
-ums-deploy:
+nubus-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
@@ -284,7 +297,7 @@ ums-deploy:
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no")
      when: "on_success"
  variables:
-    COMPONENT: "univention-management-stack"
+    COMPONENT: "nubus"

 ox-deploy:
  stage: "component-deploy-stage-1"
@@ -299,18 +312,6 @@ ox-deploy:
  variables:
    COMPONENT: "open-xchange"

-ics-deploy:
-  stage: "component-deploy-stage-1"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ICS != "no")
-      when: "on_success"
-  variables:
-    COMPONENT: "intercom-service"
-
 xwiki-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
@@ -428,15 +429,11 @@ env-stop:

 .ums-default-password: &ums-default-password
  - |
-    UMS_PASSWORDS=$( \
-      kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}' \
-      | yq '.properties.password' > passwords.txt \
-    )
    DEFAULT_USER_PASSWORD=$( \
-      awk 'NR==1{print $1}' passwords.txt \
+       kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.user_password}' | base64 -d \
    )
    DEFAULT_ADMIN_PASSWORD=$(
-      awk 'NR==3{print $1}' passwords.txt \
+       kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.admin_password}' | base64 -d \
    )

 run-tests:
@@ -448,6 +445,11 @@ run-tests:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
      when: "on_success"
+  parallel:
+    matrix:
+      - LANGUAGE:
+          - "de"
+          - "en"
  script:
    - *ums-default-password
    - |
@@ -457,27 +459,29 @@ run-tests:
        \"ref\": \"${TESTS_BRANCH}\", \
        \"token\": \"${CI_JOB_TOKEN}\", \
        \"variables\": { \
-          \"url\": \"https://portal.${DOMAIN}\", \
+          \"operator\": \"${OPERATOR}\", \
+          \"cluster\": \"${CLUSTER}\", \
+          \"namespace\": \"${NAMESPACE}\", \
+          \"url\": \"https://portal.${DOMAIN}/\", \
+          \"language\": \"${LANGUAGE}\", \
          \"user_name\": \"${DEFAULT_USER_NAME}\", \
          \"user_password\": \"${DEFAULT_USER_PASSWORD}\", \
          \"admin_name\": \"${DEFAULT_ADMIN_NAME}\", \
          \"admin_password\": \"${DEFAULT_ADMIN_PASSWORD}\", \
-          \"DEPLOY_ALL_COMPONENTS\": \"${DEPLOY_ALL_COMPONENTS}\", \
-          \"DEPLOY_COLLABORA\": \"${DEPLOY_COLLABORA}\", \
-          \"DEPLOY_ELEMENT\": \"${DEPLOY_ELEMENT}\", \
-          \"DEPLOY_ICS\": \"${DEPLOY_ICS}\", \
-          \"DEPLOY_JITSI\": \"${DEPLOY_JITSI}\", \
-          \"DEPLOY_KEYCLOAK\": \"${DEPLOY_UMS}\", \
-          \"DEPLOY_NEXTCLOUD\": \"${DEPLOY_NEXTCLOUD}\", \
-          \"DEPLOY_OPENPROJECT\": \"${DEPLOY_OPENPROJECT}\", \
-          \"DEPLOY_OX\": \"${DEPLOY_OX}\", \
-          \"DEPLOY_SERVICES\": \"${DEPLOY_SERVICES}\", \
-          \"DEPLOY_UCS\": \"${DEPLOY_UMS}\", \
-          \"DEPLOY_XWIKI\": \"${DEPLOY_XWIKI}\", \
-          \"DEPLOY_PROVISIONING\": \"${DEPLOY_PROVISIONING}\" \
+          \"screenshot_test\": \"yes\", \
+          \"screenshot_before_step\": \"yes\", \
+          \"screenshot_after_step\": \"yes\", \
+          \"screenshot_redirect_step\": \"yes\", \
+          \"testset\": \"${TESTS_TESTSET}\", \
+          \"testprofile\": \"Namespace\", \
+          \"gitlab_functional_yaml\": \"https://gitlab.opencode.de/api/v4/projects/1317/repository/files/helmfile%2Fenvironments%2Fdefault%2Ffunctional.yaml?ref=develop\", \
+          \"gitlab_env_namespace_template\": \"https://gitlab.opencode.de/api/v4/projects/1564/repository/files/environments%2F{operator}%2F{cluster}%2F{namespace}.yaml.gotmpl?ref=main\", \
+          \"gitlab_default_env_namespace\": \"values\", \
+          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\" \
        } \
      }" \
      "https://${TESTS_PROJECT_URL}/trigger/pipeline"
+  retry: 1

 avscan-prepare:
  stage: ".pre"
@@ -654,5 +658,4 @@ renovate:
  script:
    - "renovate ${RENOVATE_EXTRA_FLAGS}"
  stage: "renovate"
-
 ...
--- a/.gitlab/common/common.yml
+++ b/.gitlab/common/common.yml
@@ -2,10 +2,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.4.4\
-    @sha256:4120fe717071876f4c9ff128f26019d089fda158a4fb1912911e09af2fd3875f"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.5\
-    @sha256:60870adb64b0503d4a6efd16cef4e074b91a4ca52b48811cfcea057bcccd07e4"
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.5.0\
+    @sha256:630e102edc70c9e730a46180e79ff278fd8b5039eb336110e0df89fe415225ef"
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.6\
+    @sha256:0a8997876a0c3f5a3c73eb6bd75c5cde63757bc31b983bfd92cfcb17389d536f"

 .common:
  cache: {}
--- a/.gitlab/lint/lint-kyverno.yml
+++ b/.gitlab/lint/lint-kyverno.yml
@@ -14,18 +14,19 @@ lint-kyverno:
          - "collabora"
          - "cryptpad"
          - "element"
-          - "intercom-service"
          - "jitsi"
          - "nextcloud"
+          - "nubus"
          - "open-xchange"
          - "openproject"
          - "openproject-bootstrap"
-          - "provisioning"
          - "services"
-          - "univention-management-stack"
          - "xwiki"
  script:
    - "cd ${CI_PROJECT_DIR}/helmfile/apps/${APP}"
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-env
+      -d ${CI_PROJECT_DIR}/helmfile/environments
    - "helmfile template -e test --include-needs > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
    - >
      node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
--- a/.reuse/dep5
+++ b/.reuse/dep5
@@ -1,16 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: openDesk - der Souveräne Arbeitsplatz
-Upstream-Contact: <opendesk@zendis.de>
-Source: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk
-
-Files: helmfile/environments/default/theme/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: Apache-2.0
-
-Files: helmfile/files/gpg-pubkeys/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: CC0-1.0
-
-Files: cspell.json
-Copyright: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-License: Apache-2.0
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,31 @@
+# [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24)
+
+
+### Bug Fixes
+
+* **collabora:** Update to 24.04.5.1.1. ([8a2d951](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8a2d951c3b59c3f8ddb508ad8f95798774b7c4b0))
+* **collabora:** Update to 24.04.5.1.2. ([74d444e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/74d444e2d6065082be3ca90373a4d3b1836ea7a8))
+* **docs:** Update workflow.md. ([fd3df7d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fd3df7df6740d8e54b433c039d294843582e8947))
+* **docu:** Update documentation on integration uses cases ([#95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/95)). ([382af1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/382af1dfb966b5d10da4790212d6422a4a8c5618))
+* **helmfile:** Add S3 bucket for migrations. ([972020f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/972020f946d8238e65b1c1e2942682c797306e1a))
+* **helmfile:** Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details. ([26a7641](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/26a7641a5ab764196af6bbe26d97907de86f541e))
+* **jitsi:** Raise memory limit for jicofo and jvb as required by upstream product. ([fe923bb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fe923bb9cd58873957adb018c1410d33bb4d8f3a))
+* **keycloak:** Support for custom OIDC Clients and ClientScopes. ([46412d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/46412d1a9e4547dea8d0da3e322400ea148edf19))
+* **nextcloud:** Support templating of default quota and `*_retention_obligation` settings ([#93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/93)). ([23ef1d5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/23ef1d557bc0fdf6faac59f7a287f1ef1b302404))
+* **nextcloud:** Update to 28.0.7 including latest apps for 28. ([671f57a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/671f57a809eb4bb791698cda39f7711ac4833334))
+* **nextcloud:** Update to 28.0.7 including the apps, fix admin panel warnings ([#94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/94)). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details. ([63f8394](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63f8394e044670a89a642e933600b68ff740a102))
+* **openproject:** Bump to 14.3.0 and update Helm chart to 7.0.0. ([6b609ed](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6b609edc4a60601ca45372b4fc691f0ac7c9ed93))
+* **openproject:** Support for adding token to enable OpenProject Premium. ([dfaf4be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dfaf4be640209f5908815cceaf29db591212ddaa))
+* **xwiki:** Add email address mapping to LDAP sync; Fix hostname `null` value in notification links. ([1067e72](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1067e725b3dabce4ddfeb60b4cbe9e5b4d0db0e5))
+* **xwiki:** Remove .rtf and .odt export options as they are currently non functional. ([b806d51](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b806d51311c6d406ea3c93842601ddf5dbd13bb3))
+* **xwiki:** Update to 16.4. ([db7f5d6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/db7f5d60bdae437cebe58ab10f928a4a348e1ee3))
+* **xwiki:** Update to 16.4.1. ([e54aaab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e54aaab072f31713b5172e4bab9ba7e9ca9c5c26))
+
+
+### Features
+
+* **authentication:** Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage. ([b4570a9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4570a9a873efa6c896fe543ab0ba3b94fd086c0))
+
 ## [0.8.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.0...v0.8.1) (2024-07-01)


--- a/README.md
+++ b/README.md
@@ -29,16 +29,16 @@ openDesk is a Kubernetes based, open-source and cloud-native digital workplace s
 openDesk currently features the following functional main components:

 | Function             | Functional Component        | Component<br/>Version                                                                 | Upstream Documentation                                                                                                                       |
-| -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| -------------------- | --------------------------- |---------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                                 |
 | Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                                 |
-| File management      | Nextcloud                   | [28.0.5](https://nextcloud.com/de/changelog/#28-0-5)                                  | [Nextcloud 28](https://docs.nextcloud.com/)                                                                                                  |
-| Groupware            | OX App Suite                | [8.23](https://documentation.open-xchange.com/appsuite/releases/8.23/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
-| Knowledge management | XWiki                       | [15.10.8](https://www.xwiki.org/xwiki/bin/view/Blog/XWiki15108Released)               | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                            |
+| File management      | Nextcloud                   | [29.0.7](https://nextcloud.com/de/changelog/#29-0-7)                                  | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                                  |
+| Groupware            | OX App Suite                | [8.26](https://documentation.open-xchange.com/appsuite/releases/8.26/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
+| Knowledge management | XWiki                       | [16.4.1](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.1/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                            |
 | Portal & IAM         | Nubus                       | Product Preview[^1]                                                                   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html)                                                    |
-| Project management   | OpenProject                 | [14.2.0](https://www.openproject.org/docs/release-notes/14-2-0/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
-| Videoconferencing    | Jitsi                       | [2.0.9457](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9457) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
-| Weboffice            | Collabora                   | [24.04.4.2.1](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
+| Project management   | OpenProject                 | [14.5.1](https://www.openproject.org/docs/release-notes/14-5-1/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
+| Videoconferencing    | Jitsi                       | [2.0.9646](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9646) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
+| Weboffice            | Collabora                   | [24.04.7.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |

 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+
+version = 1
+
+[[annotations]]
+path = "cspell.json"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/gpg-pubkeys/*"
+SPDX-FileCopyrightText = "2023 Bundesministerium des Innern und für Heimat, PG ZenDiS \"Projektgruppe für Aufbau ZenDiS\""
+SPDX-License-Identifier = "CC0-1.0"
+
+[[annotations]]
+path = "helmfile/files/theme/*"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/portal-tiles/*"
+SPDX-FileCopyrightText = "2024 Google LLC"
+SPDX-License-Identifier = "Apache-2.0"
--- a/cspell.json
+++ b/cspell.json
@@ -69,7 +69,12 @@
        "cryptpad",
        "clamav",
        "templating",
-        "localpart"
+        "localpart",
+        "Addressbooks",
+        "filestore",
+        "trashbin",
+        "bootstrap",
+        "configurability"
    ],
    "ignoreWords": [],
    "import": []
--- a/dev/charts-local.py
+++ b/dev/charts-local.py
@@ -25,7 +25,7 @@ script_path = os.path.dirname(os.path.realpath(__file__))
 log_path = script_path+'/../logs'
 charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml'
 base_repo_path = script_path+'/..'
-base_helmfile = base_repo_path+'/helmfile_generic.yaml'
+base_helmfile = base_repo_path+'/helmfile_generic.yaml.gotmpl'
 helmfile_backup_extension = '.bak'

 Path(log_path).mkdir(parents=True, exist_ok=True)
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -33,10 +33,11 @@ You might want to set credential variables in the GitLab project at `Settings` >
 # Tests

 The GitLab CI pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another GitLab project.
-The `DEPLOY_`-variables are used to determine which components should be tested.
 In order for the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this GitLab project's CI variables
 that can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
 `<domain of gitlab>/api/v4/projects/<id>`.
-
+To select the current testset, use the variable `TESTS_TESTSET`. Default: `Smoke`.
 If the branch of the test pipeline is not `main` this can be set with the `.gitlab-ci.yml` variable
 `TESTS_BRANCH` while creating a new pipeline.
+
+The variable `testprofile` within the job is set to `Namespace`, which tells the e2e tests to use environment specific settings that will be read from the cluster and namespace specific file in the opendesk-env repository.
--- a/docs/components.md
+++ b/docs/components.md
@@ -10,11 +10,11 @@ This section covers the internal system requirements as well as external service
 <!-- TOC -->
 * [Overview](#overview)
 * [Component integration](#component-integration)
-  * [Intercom Service (ICS)](#intercom-service-ics)
+  * [Intercom Service / Silent Login](#intercom-service--silent-login)
  * [Filepicker](#filepicker)
  * [Central Navigation](#central-navigation)
-  * [(Read \& write) Central contacts](#read--write-central-contacts)
-  * [OpenProject file store](#openproject-file-store)
+  * [Central Contacts](#central-contacts)
+  * [File Store (OpenProject -\> Nextcloud)](#file-store-openproject---nextcloud)
 * [Identity data flows](#identity-data-flows)
 * [Provisioning](#provisioning)
 <!-- TOC -->
@@ -33,21 +33,20 @@ they need to be replaced in production deployments.
 | ClamAV (Simple)             | Antivirus engine               | Eval       |
 | Collabora                   | Weboffice                      | Functional |
 | CryptPad                    | Weboffice                      | Functional |
+| dkimpy-milter               | DKIM milter for Postfix        | Eval       |
 | Element                     | Secure communications platform | Functional |
-| Intercom Service            | Cross service data exchange    | Functional |
 | Jitsi                       | Videoconferencing              | Functional |
 | MariaDB                     | Database                       | Eval       |
 | Memcached                   | Cache Database                 | Eval       |
 | MinIO                       | Object Storage                 | Eval       |
 | Nextcloud                   | File share                     | Functional |
+| Nubus (UMS)                 | Identity Management & Portal   | Functional |
 | OpenProject                 | Project management             | Functional |
 | OX Appsuite                 | Groupware                      | Functional |
 | OX Dovecot                  | Mail backend (IMAP)            | Functional |
-| Provisioning (OX Connector) | Groupware provisioning         | Functional |
 | Postfix                     | MTA                            | Eval       |
 | PostgreSQL                  | Database                       | Eval       |
 | Redis                       | Cache Database                 | Eval       |
-| Univention Management Stack | Identity Management & Portal   | Functional |
 | XWiki                       | Knowledge Management           | Functional |

 # Component integration
@@ -56,58 +55,91 @@ Some use cases require inter component integration.

 ```mermaid
 flowchart TD
-  OXAppSuiteFrontend-->|SilentLogin, Filepicker, CentralNavigation|IntercomService
-  Element-->|CentralNavigation|IntercomService
-  IntercomService-->|SilentLogin, TokenExchange|IdP
-  IntercomService-->|Filepicker|Nextcloud
-  IntercomService-->|CentralNavigation|Portal
-  OXAppSuiteBackend-->|Filepicker|Nextcloud
-  Nextcloud-->|CentralNavigation|Portal
-  OpenProject-->|CentralNavigation|Portal
-  OpenProject-->|File store|Nextcloud
-  XWiki-->|CentralNavigation|Portal
-  Nextcloud-->|CentralContacts|OXAppSuiteBackend
-  OXAppSuiteFrontend-->|Filepicker|OXAppSuiteBackend
+  OX-AppSuite_Frontend-->|Silent Login, Filepicker, Central Navigation|Intercom_Service
+  Element-->|Silent Login, Central Navigation|Intercom_Service
+  Intercom_Service-->|Silent Login, Token Exchange|IdP
+  Intercom_Service-->|Filepicker|Nextcloud
+  Intercom_Service-->|Central Navigation|Portal
+  OX-AppSuite_Backend-->|Filepicker|Nextcloud
+  Nextcloud-->|Central Navigation|Portal
+  OpenProject-->|Central Navigation|Portal
+  OpenProject-->|File Store|Nextcloud
+  XWiki-->|Central Navigation|Portal
+  Nextcloud-->|Central Contacts|OX-AppSuite_Backend
+  OX-AppSuite_Frontend-->|Filepicker|OX-AppSuite_Backend
 ```

-## Intercom Service (ICS)
+Most details can be found in the upstream documentation that is linked in the respective sections.

-The Univention Intercom Service's role is to enable cross-application integration based on browser interaction.
-Handling authentication when the frontend of an application is using the API from another application is often a
-challenge.
-For more details on the ICS please refer to its own [doc](./components/intercom-service.md).
+## Intercom Service / Silent Login

-To establish a session with the Intercom Service, the application that wants to use the ICS must initiate a silent
-login.
+The Intercom Service is deployed in context of Nubus/UMS. Its role is to enable cross-application integration
+based on the user's browser interaction as handling authentication when the frontend of an application has to call
+the API from another application is often a challenge.

-Currently only OX AppSuite is using the frontend-based integration, and therefore it is right now the only consumer of
-the ICS API.
+To establish a session with the Intercom Service an application can use the silent login feature within an iframe.
+
+Currently only OX AppSuite and Element are using the frontend based integration.
+
+**Links**
+- [Intercom Service upstream documentation](https://docs.software-univention.de/intercom-service/latest/index.html).

 ## Filepicker

-The Nextcloud filepicker which is integrated into the OX AppSuite allows you to add attachments or links to files from
-and saving attachments to Nextcloud.
+The Nextcloud filepicker is integrated into the OX AppSuite supporting the following use cases against the respective openDesk instance's Nextcloud:
+- Attaching files from Nextcloud to emails.
+- Adding links of Nextcloud files to emails.
+- Saving attachments from emails into Nextcloud.
+- Attaching files from Nextcloud to calendar entries.

-The filepicker is using frontend and backend based integration.
-Frontend-based integration means that OX AppSuite in the browser is communicating with ICS.
-While using backend-based integration, OX AppSuite middleware is communicating with Nextcloud, which is especially used
-when adding a file to an email or storing a file into Nextcloud.
+The filepicker is using frontend and backend based integration:
+- For frontend based integration the OX AppSuite frontend uses the Intercom Service.
+- Backend based integration is coming from OX AppSuite middleware. The middleware is communicating directly with Nextcloud,
+which is used when adding a file to an email or storing a file into Nextcloud, to avoid passing these files through the user's browser.
+
+**Links**
+- [OX AppSuite Nextcloud Integration upstream documentation](https://gitlab.open-xchange.com/extensions/nextcloud-integration/-/tree/main/documentation).

 ## Central Navigation

-Central navigation is based on an API endpoint in the portal that provides the contents of the portal for a user to
-allow components to render the menu showing all available SWP applications for the user.
+Central navigation is based on an API endpoint in the Nubus portal that returns a JSON containing the contents of the portal for
+a given user. The response from the API endpoint is used in the openDesk applications to render the central navigation.

-## (Read & write) Central contacts
+The API can be called by
+- frontend services through the Intercom Service's `/navigation.json` endpoint or
+- backend services directly at the portal's `/univention/portal/navigation.json` endpoint.

-Open-Xchange App Suite is used to manage contacts within openDesk. There is an API in the AppSuite that is being used by
-Nextcloud to lookup contacts as well as to create contacts. This is maybe done when a file is shared with a not yet
-available personal contact.
+The central navigation expects the API caller to present a shared secret for authentication and the username for whom the portal
+contents should be returned for.

-## OpenProject file store
+A `curl` based request returning the navigation contents looks like this:

-By default, Nextcloud is a configured option for storing attachments in OpenProject.
-The file store can be enabled on a per-project level in OpenProject's project admin section.
+```
+curl 'https://portal.<DOMAIN>/univention/portal/navigation.json?base=https%3A//portal.<DOMAIN>&language=de-DE' -u "<USERNAME>:<SHARED_SECRET>"
+```
+
+## Central Contacts
+
+OX App Suite is managing contacts in openDesk. Therefore Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
+- create a new contact in the user's contacts folder when a file is shared with a yet unknown email address.
+- retrieve contacts from the user's contacts folder to support search-as-you-type when starting to share a file.
+
+**Links:**
+- Currently used [OX Contacts API (deprecated)](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Contacts).
+- New [OX Addressbooks API](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Addressbooks) the Central Contacts integration will switch to.
+
+## File Store (OpenProject -> Nextcloud)
+
+While OpenProject allows you to attach files to work packages directly, it is often preferred that the files are
+stored within Nextcloud or to link an existing file from your openDesk Nextcloud to a work package.
+
+Therefore openDesk pre-configures the trust between the openDesk instance's OpenProject and Nextcloud during the `openproject-boostrap` deployment step. As prerequisite for that openDesk's Nextcloud contains the `integration_openproject` app.
+
+The file store still needs to be enabled on a per-project level in OpenProject's project admin section.
+
+**Links:**
+- [OpenProject's documentation on Nextcloud integration](https://www.openproject.org/docs/system-admin-guide/integrations/nextcloud/)
+- [OpenProject Integration Nextcloud app](https://apps.nextcloud.com/apps/integration_openproject)

 # Identity data flows

--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -36,6 +36,9 @@ component's log level to debug and it get some features like:
 - An ingress for `http://minio-console.<your_domain>` is configured.
 and set the log level for components to "Debug".

+**Note**: When enabling debug and running upgrades you must manually delete all jobs before the upgrade. As with debug
+we keep the jobs and some job fields are immutable it could otherwise lead into an upgrade failure.
+
 **Note:** All containers should write their log output to STDOUT, if you find (valuable) logs inside a container, please let us know!

 # Adding containers to a pod for debugging purposes
@@ -52,7 +55,7 @@ Below you will find some wrap-up notes when it comes to debugging openDesk by ad

 You can add a container by editing and updating an existing deployment, which is quite comfortable with tools like [Lens](https://k8slens.dev/).

- Select the container you want to make use of as debugging container, in the example below it's `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:1.0.0`.
+- Select the container you want to make use of as debugging container, in the example below it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
 - Ensure the `shareProcessNamespace` option is enabled for the Pod.
 - Reference the selected container within the `containers` array of the deployment.
 - In case you want to access another containers filesystem, ensure the user/group settings of both containers match.
@@ -121,7 +124,7 @@ Now you can add the ephemeral container with:
 ```
 kubectl -n ${NAMESPACE} debug -it --attach=false -c ${EPH_CONTAINER_NAME} --image={DEBUG_IMAGE} ${POD_NAME}
 ```
-and open it's interactive terminal with
+and open its interactive terminal with
 ```
 kubectl -n ${NAMESPACE} attach -it -c ${EPH_CONTAINER_NAME} ${POD_NAME}
 ```
@@ -153,7 +156,7 @@ OpenProject is a Ruby on Rails application. Therefore you can make use of the Ra
 and run debug code like this:

 ```
-uri = URI('https://nextcloud.url/index.php/apps/integration_openproject/check-config')
+uri = URI('https://nextcloud.url/apps/integration_openproject/check-config')
 Net::HTTP.start(uri.host, uri.port,
  :use_ssl => uri.scheme == 'https') do |http|
  request = Net::HTTP::Get.new uri
--- a/docs/development.md
+++ b/docs/development.md
@@ -138,6 +138,9 @@ configured to pull artifacts that do not originate from Open CoDE into projects

 The mirror script takes the information on what artifacts to mirror from the annotation inside the two yaml files:
 - `# upstreamRegistry` *required*: To identify the source registry
+- `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public the access credentials have to be specified as ENV variables containing the value of this key in their name, so you want to specific that key all uppercase:
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORT`
 - `# upstreamRepository` *required*: To identify the source repository
 - `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set it activates the mirror for the component. Only tags are being mirrored that match the given regular expression. **Note:** You have to use single quotes for this attribute's value in case you use backslash leading regex notation like `\d`.
 - `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing groups
--- a/docs/enhanced-configuration/idp-federation.md
+++ b/docs/enhanced-configuration/idp-federation.md
@@ -44,9 +44,9 @@ We will provide additional documents regarding user provisioning in the future,
  - UDM REST API:
    - Build a provisioning solution by yourself using the [UDM REST API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html).
    - The API gives you full control over the contents of the IAM in order to create, update or delete users and groups.
-  - Directory Connector:
+  - Nubus Directory Importer:
    - It is based on a Python one-way directory synchronization for users and groups.
-    - We will provide more details on this approach soon one the tool is made publicly available.
+    - Please find more details in the [upstream product's documentation](https://docs.software-univention.de/nubus-kubernetes-operation/latest/en/howto-connect-external-iam.html).
 - Ad-hoc provisioning (AHP)
  - This feature is currently not available in the openDesk Keycloak, but there are plans by the Supplier Univention to make it available.
  - Ad-hoc provisioning creates an user account on the fly during a users first login.
@@ -146,8 +146,8 @@ The following configuration is taking place in the Keycloak realm `opendesk`.
  - *Client ID*: Use the client ID you took form your organization's IdP config (`opendesk-federation-client` in this example)
  - *Client Secret*: Use the secret you took form your organization's IdP config
  - When completed with *Add* you get to the detailed IdP configured that also needs some updates (you may need to open the *Advanced* section to access some settings)
-	- *Back-channel logout*: `On`
-	- *Disable user info*: `On`
+    - *Back-channel logout*: `On`
+    - *Disable user info*: `On`
    - *First login flow override*: `auto-federate-flow`

 - In case you want to forcefully redirect all users to your organizations IdP (disabling login with local openDesk accounts):
--- a/docs/enhanced-configuration/matrix-federation.md
+++ b/docs/enhanced-configuration/matrix-federation.md
@@ -37,10 +37,11 @@ If not used it is also set to `opendesk.domain.tld`.
 The following setting can disable federation:

 ```yaml
-externalServices:
-  matrix:
-    federation:
-      enabled: false
+functional:
+  externalServices:
+    matrix:
+      federation:
+        enabled: false
 ```

 ## Separate Matrix domain
--- a/docs/enhanced-configuration/separate-mail-matrix-domain.md
+++ b/docs/enhanced-configuration/separate-mail-matrix-domain.md
@@ -9,6 +9,10 @@ SPDX-License-Identifier: Apache-2.0
 * [Example configuration](#example-configuration)
  * [Mail domain](#mail-domain)
  * [Matrix domain](#matrix-domain)
+    * [DNS](#dns)
+    * [Webserver](#webserver)
+      * [Content Security Policy](#content-security-policy)
+      * [.well-known](#well-known)

 # Use case

@@ -59,7 +63,9 @@ or via environment variable
 export MATRIX_DOMAIN=my_organization.tld
 ```

-This setup requires also a different DNS setup:
+### DNS
+
+The following changes apply to the standard DNS:

 | Record name                      | Type | Value                                  | Comment                                                                            |
 | -------------------------------- | ---- | -------------------------------------- | ---------------------------------------------------------------------------------- |
@@ -67,6 +73,14 @@ This setup requires also a different DNS setup:

 *Note:* `matrix.opendesk.domain.tld` in the "Value" column can also be the IP address where synapse TLS port is listening to.

+### Webserver
+
+#### Content Security Policy
+
+The webserver of `my_organization.tld` should add `*.opendesk.domain.tld` to its CSP header.
+
+#### .well-known
+
 If you want to use other Matrix clients,
 e.g., Element Messenger for [iOS](https://apps.apple.com/de/app/element-messenger/id1083446067)
 or [Android](https://play.google.com/store/apps/details?id=im.vector.app),
@@ -82,4 +96,4 @@ you need to create a JSON file with the following contents that is served from
 ```

 This ensures clients know where to find the Matrix protocol endpoint when users specify `my_organization.tld`
-as their homeserver.
+as their homeserver.
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -3,7 +3,7 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 -->

-<h1>Getting stated</h1>
+<h1>Getting started</h1>

 This documentation should enable you to create your own evaluation instance of openDesk on your Kubernetes cluster.

@@ -52,7 +52,7 @@ files.
 > All configuration options and their default values can be found in files at `helmfile/environments/default/`

 For the following guide, we will use `dev` as environment, where variables can be set in
-`helmfile/environments/dev/values.yaml`.
+`helmfile/environments/dev/values.yaml.gotmpl`.

 ## DNS

@@ -60,16 +60,16 @@ The deployment is designed to deploy each application/service under a dedicated
 For your convenience, we recommend to create a `*.domain.tld` A-Record to your cluster ingress controller,
 otherwise you need to create an A-Record for each subdomain.

-| Record name             | Type | Value                                              | Additional information                                                             |
-| ----------------------- | ---- | -------------------------------------------------- | ---------------------------------------------------------------------------------- |
-| *.domain.tld            | A    | IPv4 address of your Ingress Controller            |                                                                                    |
-| *.domain.tld            | AAAA | IPv6 address of your Ingress Controller            |                                                                                    |
-| mail.domain.tld         | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| mail.domain.tld         | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| domain.tld              | MX   | `10 mail.domain.tld`                               |                                                                                    |
-| domain.tld              | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                                         |
-| _dmarc.domain.tld       | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                                           |
-| _matrix._tcp.domain.tld | SRV  | `1 10 PORT matrix.domain.tld`                      | `PORT` is your NodePort/LoadBalancer port of `opendesk-synapse-federation` service |
+| Record name                   | Type | Value                                              | Additional information                                           |
+|-------------------------------|------|----------------------------------------------------|------------------------------------------------------------------|
+| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                  |
+| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                  |
+| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                  |
+| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                       |
+| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                         |
+| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional DKIM settings                                           |

 ## Domain

@@ -100,29 +100,27 @@ export DOMAIN=domain.tld

 All available apps and their default value can be found in `helmfile/environments/default/workplace.yaml`.

-| Component                   | Name                                | Default | Description                    |
-| --------------------------- | ----------------------------------- | ------- | ------------------------------ |
-| Certificates                | `certificates.enabled`              | `true`  | TLS certificates               |
-| ClamAV (Distributed)        | `clamavDistributed.enabled`         | `false` | Antivirus engine               |
-| ClamAV (Simple)             | `clamavSimple.enabled`              | `true`  | Antivirus engine               |
-| Collabora                   | `collabora.enabled`                 | `true`  | Weboffice                      |
-| CryptPad                    | `cryptpad.enabled`                  | `true`  | Weboffice                      |
-| Dovecot                     | `dovecot.enabled`                   | `true`  | Mail backend                   |
-| Element                     | `element.enabled`                   | `true`  | Secure communications platform |
-| Intercom Service            | `intercom.enabled`                  | `true`  | Cross service data exchange    |
-| Jitsi                       | `jitsi.enabled`                     | `true`  | Videoconferencing              |
-| MariaDB                     | `mariadb.enabled`                   | `true`  | Database                       |
-| Memcached                   | `memcached.enabled`                 | `true`  | Cache Database                 |
-| MinIO                       | `minio.enabled`                     | `true`  | Object Storage                 |
-| Nextcloud                   | `nextcloud.enabled`                 | `true`  | File share                     |
-| OpenProject                 | `openproject.enabled`               | `true`  | Project management             |
-| OX Appsuite                 | `oxAppsuite.enabled`                | `true`  | Groupware                      |
-| Provisioning                | `oxConnector.enabled`               | `true`  | Backend provisioning           |
-| Postfix                     | `postfix.enabled`                   | `true`  | MTA                            |
-| PostgreSQL                  | `postgresql.enabled`                | `true`  | Database                       |
-| Redis                       | `redis.enabled`                     | `true`  | Cache Database                 |
-| Univention Management Stack | `univentionManagementStack.enabled` | `true`  | Identity Management & Portal   |
-| XWiki                       | `xwiki.enabled`                     | `true`  | Knowledge management           |
+| Component            | Name                        | Default | Description                    |
+| -------------------- | --------------------------- | ------- | ------------------------------ |
+| Certificates         | `certificates.enabled`      | `true`  | TLS certificates               |
+| ClamAV (Distributed) | `clamavDistributed.enabled` | `false` | Antivirus engine               |
+| ClamAV (Simple)      | `clamavSimple.enabled`      | `true`  | Antivirus engine               |
+| Collabora            | `collabora.enabled`         | `true`  | Weboffice                      |
+| CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
+| Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
+| Element              | `element.enabled`           | `true`  | Secure communications platform |
+| Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
+| MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
+| Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
+| MinIO                | `minio.enabled`             | `true`  | Object Storage                 |
+| Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
+| Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
+| OpenProject          | `openproject.enabled`       | `true`  | Project management             |
+| OX Appsuite          | `oxAppsuite.enabled`        | `true`  | Groupware                      |
+| Postfix              | `postfix.enabled`           | `true`  | MTA                            |
+| PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
+| Redis                | `redis.enabled`             | `true`  | Cache Database                 |
+| XWiki                | `xwiki.enabled`             | `true`  | Knowledge management           |

 Exemplary, Jitsi can be disabled like:

@@ -157,6 +155,15 @@ alternatively you can use an environment variable:
 export PRIVATE_IMAGE_REGISTRY_URL=my_private_registry.domain.tld
 ```

+or control repository override fine-granular per registry:
+
+```yaml
+repositories:
+  image:
+    dockerHub: "my_private_registry.domain.tld/docker.io/"
+    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
+```
+
 If authentication is required, you can reference imagePullSecrets as following:

 ```yaml
@@ -195,21 +202,31 @@ If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to pr
 ```yaml
 cluster:
  networking:
-    cidr: "127.0.0.0/8"
+    cidr:
+      - "127.0.0.0/8"
+```
+
+If your load balancer / reverse proxy IPs are not already covered by the above `cidr` you need to
+explicitly configure the related IPs or IP ranges:
+
+```yaml
+cluster:
+  networking:
+    incomingCIDR:
+      - "172.16.0.0/12"
 ```

 ### Ingress

-By default, the `ingressClassName` is empty to choose your default ingress controller, you may want to customize it by
-setting:
+By default, the `ingressClassName` is empty to choose your default ingress controller. You may want to customize it by
+setting the following attribute to the name of the currently only supported ingress controller `ingress-nginx` (see
+[requirements.md](./requirements.md)) for reference) within your deployment if that is not the clusters default ingress.

 ```yaml
 ingress:
-  ingressClassName: "cilium"
+  ingressClassName: "name-of-my-nginx-ingress"
 ```

-**Note:** Please check the [requirements.md](./requirements.md) for the supported Ingress controllers.
-
 ### Container runtime

 Some apps require specific configuration for the container runtime. You can set your container runtime like `cri-o`,
@@ -253,6 +270,8 @@ To use the openDesk functionality with its web based user interface you need to

 | Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
+| openDesk           | Kubernetes Ingress      |    80 |  TCP |
+| openDesk           | Kubernetes Ingress      |   443 |  TCP |
 | Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |

 #### Mail clients
@@ -278,6 +297,20 @@ smtp:
  password: "secret"
 ```

+Enabling DKIM signing of emails helps to reduce spam and increases trust.
+openDesk ships dkimpy-milter as Postfix milter for signing mails.
+
+```yaml
+dkimpy:
+  enable: true
+  dkim:
+    key:
+      value: |
+        HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E=
+    selector: "default"
+    useED25519: true # when false, RSA is used
+```
+
 ### TURN configuration

 Some components (Jitsi, Element) use for direct communication a TURN server. You can configure your own TURN server with
@@ -377,8 +410,7 @@ When all apps are successfully deployed and pod status' went to `Running` or `Su
 https://portal.domain.tld
 ```

-If you change the subdomain of `univentionManagementStack`, you need to replace `portal`
-by your specified subdomain.
+If you change the subdomain of `nubus`, you need to replace `portal` by your specified subdomain.

 **Credentials:**

--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -0,0 +1,285 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Upgrade migrations</h1>
+
+* [Disclaimer](#disclaimer)
+* [Releases upgrades](#releases-upgrades)
+  * [From v0.9.0](#from-v090)
+    * [Changed openDesk defaults](#changed-opendesk-defaults)
+      * [MatrixID localpart update](#matrixid-localpart-update)
+      * [File-share configurability](#file-share-configurability)
+      * [Updated default subdomains in `global.hosts`](#updated-default-subdomains-in-globalhosts)
+      * [Updated `global.imagePullSecrets`](#updated-globalimagepullsecrets)
+      * [Removal of unnecessary OX-Profiles in Nubus](#removal-of-unnecessary-ox-profiles-in-nubus)
+      * [Dedicated group for access of the UDM REST API](#dedicated-group-for-access-of-the-udm-rest-api)
+    * [Automated migrations](#automated-migrations)
+      * [Local Postfix as Relay](#local-postfix-as-relay)
+      * [Updated IAM component Nubus](#updated-iam-component-nubus)
+        * [Manual cleanup](#manual-cleanup)
+  * [From v0.8.1](#from-v081)
+    * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
+    * [Updated customizable template attributes](#updated-customizable-template-attributes)
+    * [`migrations` S3 bucket](#migrations-s3-bucket)
+* [Related components and artefacts](#related-components-and-artefacts)
+  * [Development](#development)
+
+# Disclaimer
+
+We do not offer support for upgrades before we reach openDesk 1.0.
+
+Though we try to ease the pain when it comes to 0.x upgrades. That is what this document is for.
+
+**Limitations:**
+- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was
+  deleted and will cover an explicit delete for PVs.
+
+# Releases upgrades
+
+## From v0.9.0
+
+### Changed openDesk defaults
+
+#### MatrixID localpart update
+
+Until 0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's MatrixID. Due to restrictions of the
+Matrix protocol, an update of a MatrixID is not possible, therefore, it was technically convenient to use the UUID
+as it is immutable (see https://de.wikipedia.org/wiki/Universally_Unique_Identifier for more details on UUIDs.)
+
+From the user experience perspective, that was a bad approach, so from now on, by default, the username which
+is also used for logging into openDesk is used to define the localpart of the MatrixID.
+
+For existing installations: The changed setting only affects users that login to Element the first time. Existing
+user accounts will not be harmed. If you want existing users to get new MatrixIDs based on the new setting, you
+need to update their external ID in Synapse and deactivate the old user afterward. The user will get a new
+Matrix account from scratch, losing the existing contacts, chats and rooms.
+
+The following Admin API calls are helpful:
+- GET /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain> get the user's existing external_id (auth_provider: "oidc")
+- PUT /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain> update user's external_id with JSON payload:
+  `{ "external_ids": [ { "auth_provider": "oidc", "external_id": "<old_id>+deprecated" } ] }`
+- POST /_synapse/admin/v1/deactivate/@<entryuuid>:<matrixdomain> deactivate old user with JSON payload:
+  `{ "erase": true }`
+
+For more details, check the Admin API documentation:
+https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html
+
+You can enforce the old standard with the following setting:
+```
+functional:
+  chat:
+    matrix:
+      profile:
+        useImmutableIdentifierForLocalpart: true
+```
+
+#### File-share configurability
+
+Now we provide some configurability regarding the sharing capabilities of the Nextcloud component.
+
+The new default is different from the standard until now.
+To keep the current state after the upgrade from 0.9.0, you have to provide the following settings:
+
+```
+functional:
+  filestore:
+    sharing:
+      external:
+        enabled: true
+```
+
+Please also check the other new options available at `functional.filestore.sharing`.
+
+#### Updated default subdomains in `global.hosts`
+
+We have streamlined the subdomain names used by openDesk to be more user-friendly and to avoid the use of specific
+product names.
+
+This results in following change of default subdomain naming:
+
+- **collabora**: `collabora` → `office`
+- **cryptpad**: `cryptpad` → `pad`
+- **minioApi**: `minio` → `objectstore`
+- **minioConsole**: `minio-console` → `objectstore-ui`
+- **nextcloud**: `fs` → `files`
+- **openproject**: `project` → `projects`
+
+During upgrade, any existing environment needs to keep the old subdomains,
+cause url/link changes are not every supported and not tested at all.
+
+If you have not already defined the entire `global.hosts` dictionary in your custom environments values, please set it
+to the defaults that were used before the upgrade:
+
+```yaml
+global:
+  hosts:
+    collabora: "collabora"
+    cryptpad: "cryptpad"
+    element: "chat"
+    intercomService: "ics"
+    jitsi: "meet"
+    keycloak: "id"
+    matrixNeoBoardWidget: "matrix-neoboard-widget"
+    matrixNeoChoiceWidget: "matrix-neochoice-widget"
+    matrixNeoDateFixBot: "matrix-neodatefix-bot"
+    matrixNeoDateFixWidget: "matrix-neodatefix-widget"
+    minioApi: "minio"
+    minioConsole: "minio-console"
+    nextcloud: "fs"
+    openproject: "project"
+    openxchange: "webmail"
+    synapse: "matrix"
+    synapseFederation: "matrix-federation"
+    univentionManagementStack: "portal"
+    whiteboard: "whiteboard"
+    xwiki: "wiki"
+```
+
+In case you would like to use the updated hostnames you at least have to apply some manual changes. But do this at
+your own risk. Be also aware that some of your user's bookmarks and links will stop working.
+
+- Update the affected portal tiles:
+  - All tiles in the "Files" category.
+  - The "Projects" tile in the "Management" category.
+- There are two options to change the link for the portal tiles:
+  - Use an admin account to access the portal's edit mode (on the bottom of the sidebar portal's menu).
+  - Utilize the UDM REST API to update the portal tile objects.
+- Update the hostnames for the OpenProject-Nextcloud integration using a functional admin user for both components:
+  - In OpenProject: *Administration* > *Files* > *External file storages* > Select `Nextcloud at [your_domain]`
+    Edit *Details* - *General Information* - *Storage provider* and update the *hostname* to `files.<your_domain>`.
+  - In Nextcloud: *Administration* > *OpenProject* > *OpenProject server* update the *OpenProject host* to
+    to `projects.<your_domain>`.
+
+#### Updated `global.imagePullSecrets`
+
+Without using a custom registry, you can pull all the openDesk images without authentication.
+Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them.
+
+You can keep the current settings by setting the `external-registry` in your custom environment values:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "external-registry"
+```
+
+#### Removal of unnecessary OX-Profiles in Nubus
+
+The update will remove unnecessary OX-Profiles in Nubus, but can't as long as these profiles are in use.
+
+So please ensure that only the following two supported profiles are assigned to your users:
+- `opendesk_standard`: "opendesk Standard"
+- `none`: "Login disabled"
+
+You can check and update the profiles as follows:
+- Login as IAM admin.
+- Open the user module.
+- Open the extended search by clicking the funnel (Trichter) icon next to the search input field.
+- Open the "Property" (Eigenschaft) list and select "OX Access" (OX-Berechtigung).
+- In the input field right next to the list enter an asterisk (*).
+- Start the search by clicking once more on the funnel icon.
+- Sort the result list for the "OX Access" column
+- Edit every user that has a value different to `opendesk_standard` or `none`:
+  - Open the user.
+  - Go to section "OX App Suite".
+  - Change the value in the dropdown "OX Access" to either:
+    - "openDesk Standard" if the user should be able to use the Groupware module or
+    - "Login disabled" if the user should not user the Groupware module.
+    - Update the user account with the green "SAVE" button on top of the page.
+
+#### Dedicated group for access of the UDM REST API
+
+Prerequisite: You allow the use of the [IAM's API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html)
+with the following settings:
+
+```
+functional:
+  externalServices:
+    nubus:
+      udmRestApi:
+        enabled: true
+```
+
+With 0.9.0 all members of the group "Domain Admins" were able to successfully authenticate with the API.
+
+This has been changed and there is now a dedicated group required for using the API: `IAM API - Full Access`
+
+If you need specific accounts to make use of the API, please go ahead and assign them to the aforementioned group.
+
+### Automated migrations
+
+#### Local Postfix as Relay
+
+All components relay outgoing mails to the local Postfix. In order for the configuration to be picked up by all components the following restarts are triggered in the migrations `POST` stage:
+
+- Deployments:
+  - `opendesk-nextcloud-php`
+  - `ums-umc-server`
+- Stateful Sets:
+  - `ums-selfservice-listener`
+  - `opendesk-synapse`
+
+#### Updated IAM component Nubus
+
+openDesk is integrating the latest [Nubus](https://www.univention.de/produkte/nubus/) development from Univention. The now redundant and scalable LDAP requires migration activities. These have been automated to avoid manual interaction. The `run_2` of the openDesk
+upgrade migrations executes the following steps:
+
+- Stage `PRE`:
+  - Delete service `ums-keycloak`, as it will be recreated headless.
+  - Scale down `statefulset/ums-ldap-server` and `statefulset/ums-ldap-notifier` in preparation or the next step:
+  - Create two new PVCs `shared-data-ums-ldap-server-primary-0` and `shared-data-ums-ldap-server-primary-1` for the new LDAP primary pods as copy from the existing `shared-data-ums-ldap-server-0`. The LDAP secondaries will sync from the primary nodes.
+- Stage `POST`:
+  - Restart Keycloak.
+
+##### Manual cleanup
+
+Currently we do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the no longer used PVCs after successful upgrade:
+```
+NAMESPACE=<your_namespace>
+kubectl -n ${NAMESPACE} delete pvc shared-data-ums-ldap-server-0
+kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
+```
+
+## From v0.8.1
+
+### Updated `cluster.networking.cidr`
+
+- Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1), please update your setup accordingly if you explicitly set this value.
+- Reference:[cluster.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/cluster.yaml)
+
+### Updated customizable template attributes
+
+- Action: Please ensure you update you custom deployment values according with the updated default value structure.
+- References:
+  - `functional.` prefix for `authentication.*`, `externalServices.*`, `admin.*` and `filestore.*`, see [functional.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/functional.yaml).
+  - `debug.` prefix for `cleanup.*`, see [debug.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/debug.yaml).
+  - `monitoring.` prefix for `prometheus.*` and `graphana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
+  - `smtp.` prefix for `localpartNoReply`, see [smtp.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/smtp.yaml).
+
+### `migrations` S3 bucket
+
+- Action: For self managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
+- Reference: `objectstores.migrations` in [objectstores.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/objectstores.yaml)
+
+# Related components and artefacts
+
+openDesk comes with two upgrade steps as part of the deployment, they can be found in the folder [/helmfile/apps](../helmfile/apps/) as all other components:
+
+- `migrations-pre`: Is the very first app that gets deployed.
+- `migrations-post`: Is the last app that gets deployed.
+
+Both migrations have to be deployed exclusively at their first/last position and not in parallel with other components.
+
+The status of the upgrade migrations is tracked in the ConfigMap `migrations-status`, more details can be found in the [README.md of the related container image](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/README.md).
+
+## Development
+
+When a new upgrade migration is required, ensure to address the following list:
+
+- Update the generated release version file [`global.generated.yaml`](../helmfile/environments/default/global.generated.yaml) at least on the patch level to test the upgrade in your feature branch as well as trigger it in the `develop` branch after the feature branch was merged. The set value gets overwritten during the release process with the release's actual version number.
+- You have to implement the migration logic as a runner script in the [`opendesk-migrations`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations) image. Please find more instructions in the linked repository.
+- You most likely have to update the [`opendesk-migrations` Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations) within the `rules` section of the [`role.yaml`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/templates/role.yaml) to provide the permissions required for the execution of your migration's logic.
+- You have to set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
+- Update the [`charts.yaml`](../helmfile/environments/default/charts.yaml) and [`images.yaml`](../helmfile/environments/default/images.yaml) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -24,7 +24,7 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)
 - Domain and DNS Service
 - Ingress controller (Ingress NGINX)
 - [Helm](https://helm.sh/) >= v3.9.0
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v0.157.0**
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc.5**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
 - Volume provisioner supporting RWO (read-write-once)
 - Certificate handling with [cert-manager](https://cert-manager.io/)
@@ -33,11 +33,13 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)

 The following minimal requirements are thought for initial evaluation deployment:

-| Spec | Value                                                |
-|------|------------------------------------------------------|
-| CPU  | 8 Cores of x64 or x86 CPU (ARM is not supported yet) |
-| RAM  | 16 GB, recommended 32 GB                             |
-| Disk | HDD or SSD, >10 GB                                   |
+| Spec | Value                                                 |
+| ---- | ----------------------------------------------------- |
+| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
+| RAM  | 32 GB, more recommended                               |
+| Disk | HDD or SSD, >10 GB                                    |
+
+Check [`scaling.md`](./scaling.md) for more details on resource requirements and scalability.

 # Kubernetes

--- a/docs/scaling.md
+++ b/docs/scaling.md
@@ -7,55 +7,17 @@ SPDX-License-Identifier: Apache-2.0

 This document should cover the abilities to scale apps.

-<!-- TOC -->
-* [Replicas](#replicas)
-<!-- TOC -->
+# Horizontal scalability

-# Replicas
+We are working on generating this document automatically based on the file
+[`replicas.yaml`](../helmfile/environments/default/replicas.yaml) that contains necessary annotations.
+In the meantime this file can be used to check the components scaling support / capabilities.

-The Replicas can be increased of almost any component, but is only effective for high-availability or load-balancing for
-apps with a check-mark in `Scaling (effective)` column.
+# Upstream information

-Verified positive effects are marked with a check-mark in `Scaling (verified)` column, apps which are not yet tested are
-marked with a gear.
+While scaling services horizontally is the ideal solution, information about vertical scaling is helpful
+when it comes to defining the applications resources, see [`resources.yaml`](../helmfile/environments/default/resources.yaml) for references.

+Please find below links to the application's upstream resources about scaling:

-| Component                   | Name                                     | Scaling (effective) | Scaling (verified) |
-|-----------------------------|------------------------------------------|:-------------------:|:------------------:|
-| ClamAV                      | `replicas.clamav`                        | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.clamd`                         | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.freshclam`                     |         :x:         |        :x:         |
-|                             | `replicas.icap`                          | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.milter`                        | :white_check_mark:  | :white_check_mark: |
-| Collabora                   | `replicas.collabora`                     | :white_check_mark:  |       :gear:       |
-| CryptPad                    | `replicas.cryptpad`                      | :white_check_mark:  |       :gear:       |
-| Dovecot                     | `replicas.dovecot`                       |         :x:         |       :gear:       |
-| Element                     | `replicas.element`                       | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.matrixNeoBoardWidget`          | :white_check_mark:  |       :gear:       |
-|                             | `replicas.matrixNeoChoiceWidget`         | :white_check_mark:  |       :gear:       |
-|                             | `replicas.matrixNeoDateFixBot`           | :white_check_mark:  |       :gear:       |
-|                             | `replicas.matrixNeoDateFixWidget`        | :white_check_mark:  |       :gear:       |
-|                             | `replicas.matrixUserVerificationService` | :white_check_mark:  |       :gear:       |
-|                             | `replicas.synapse`                       |         :x:         |       :gear:       |
-|                             | `replicas.synapseWeb`                    | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.wellKnown`                     | :white_check_mark:  | :white_check_mark: |
-| Intercom Service            | `replicas.intercomService`               | :white_check_mark:  | :white_check_mark: |
-| Jitsi                       | `replicas.jibri`                         | :white_check_mark:  |       :gear:       |
-|                             | `replicas.jicofo`                        | :white_check_mark:  |       :gear:       |
-|                             | `replicas.jitsi `                        | :white_check_mark:  |       :gear:       |
-|                             | `replicas.jitsiKeycloakAdapter`          | :white_check_mark:  |       :gear:       |
-|                             | `replicas.jvb `                          |         :x:         |        :x:         |
-| Keycloak                    | `replicas.keycloak`                      | :white_check_mark:  |       :gear:       |
-| Memcached                   | `replicas.memcached`                     |       :gear:        |       :gear:       |
-| Minio                       | `replicas.minioDistributed`              | :white_check_mark:  | :white_check_mark: |
-| Nextcloud                   | `replicas.nextcloudApache2`              | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.nextcloudExporter`             | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.nextcloudPHP`                  | :white_check_mark:  | :white_check_mark: |
-| OpenProject                 | `replicas.openproject`                   | :white_check_mark:  | :white_check_mark: |
-| Postfix                     | `replicas.postfix`                       |         :x:         |       :gear:       |
-| Redis                       | `replicas.redis`                         |       :gear:        |       :gear:       |
-| Univention Management Stack |                                          |       :gear:        |       :gear:       |
-|                             | `replicas.umsPortalFrontend`             | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.umsPortalServer`               | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.umsUdmRestApi`                 | :white_check_mark:  | :white_check_mark: |
-| XWiki                       | `replicas.xwiki`                         |         :x:         |       :gear:       |
+- [OpenProject system requirements](https://www.openproject.org/docs/installation-and-operations/system-requirements/)
--- a/docs/security-context.md
+++ b/docs/security-context.md
@@ -158,7 +158,6 @@ This list gives you an overview of templated security settings and if they compl
 | **element**/opendesk-synapse | :white_check_mark: | no | no | yes | yes | 10991 | 10991 | yes | yes |
 | **element**/opendesk-synapse-web | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-well-known | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
-| **intercom-service**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **jitsi**/jitsi | :white_check_mark: | no | no | yes | yes | 1993 | 1993 | yes | yes |
 | **jitsi**/jitsi/jitsi/jibri | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no ["SYS_ADMIN"] |
 | **jitsi**/jitsi/jitsi/jicofo | :x: | no | no | no | no | 0 | 0 | yes | no |
@@ -183,7 +182,7 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **provisioning**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **open-xchange**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
 | **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
 | **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
@@ -196,6 +195,7 @@ This list gives you an overview of templated security settings and if they compl
 | **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
 | **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **univention-management-stack**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
--- a/docs/workflow.md
+++ b/docs/workflow.md
@@ -22,8 +22,8 @@ SPDX-License-Identifier: Apache-2.0
      * [Branch workflows](#branch-workflows)
        * [`main`](#main)
        * [`develop`](#develop)
-        * [`docu`](#docu)
-        * [`mntn`](#mntn)
+        * [`docs`](#docs)
+        * [`fix`](#fix)
        * [`feat`](#feat)
      * [Branch names](#branch-names)
      * [Commit messages / Conventional Commits](#commit-messages--conventional-commits)
@@ -169,8 +169,8 @@ The basic facts for the flow are:
  - Developers can create sub-branches from their feature branch(es) as needed.
 - When a *feature* branch gets pushed a Merge Request in `Draft` state is automatically created.
 - We know three types of *feature* branches:
-  - `docu`: Doing just documentation changes
-  - `mntn`: Maintenance of the openDesk software components and minor configurational changes
+  - `docs`: Doing just documentation changes
+  - `fix`: Maintenance of the openDesk software components and minor configurational changes
  - `feat`: All changes that do not fall into the two categories above, especially
    - supplier deliverables and
    - configurational changes that have a significant impact on openDesk users or require migrations[^1]
@@ -185,21 +185,21 @@ gitGraph
    checkout "develop"
    commit id: "QA 'nightly develop'"
    commit id: "  "
-    branch "docu"
-    checkout "docu"
+    branch "docs"
+    checkout "docs"
    commit id: "Documentation commits" type: HIGHLIGHT
    checkout "develop"
-    merge "docu"
+    merge "docs"
    checkout "main"
    merge "develop" tag: "No release"
    checkout "develop"
    commit id: "   "
-    branch "mntn"
-    checkout "mntn"
+    branch "fix"
+    checkout "fix"
    commit id: "Maintenance commits" type: HIGHLIGHT
-    commit id: "QG 'mntn'" type: REVERSE
+    commit id: "QG 'fix'" type: REVERSE
    checkout "develop"
-    merge "mntn"
+    merge "fix"
    commit id: "QA 'release merge'" type: REVERSE
    checkout "main"
    merge "develop" tag: "Patch or minor release"
@@ -231,7 +231,7 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
 1. Linting
   - Blocking
     - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
-     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in the [development](./development.md) docu
+     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in [development.md](./development.md).
   - Non Blocking
     - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
     - Formal: Yaml
@@ -277,8 +277,8 @@ This section will explain the workflow for each branch (type) based on the Gitfl

 - `QA 'nightly main'`: Execute the SQG based on the most recent release. The upgrade test environment should be a long-standing environment that only gets built from scratch with the previous technical release when something breaks the environment.
 - Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release) which itself is based on the [Semantic Versioning (SemVer) notation](https://semver.org) to automatically create technical releases on the merge points.
-  - "No release": When a merge from `develop` includes only changes from `docu` branches the merge into `main` will only consist of `docs` or `chore` commits. No new release will be generated by that merge.
-  - "Patch or minor release": When changes from `mntn` branches get merged these might contain `fix` or `feat` commits causing a new technical release to be built with an updated version on Patch or Minor level.
+  - "No release": When a merge from `develop` includes only changes from `docs` branches the merge into `main` will only consist of `docs` or `chore` commits. No new release will be generated by that merge.
+  - "Patch or minor release": When changes from `fix` branches get merged these might contain `fix` or `feat` commits causing a new technical release to be built with an updated version on Patch or Minor level.
  - "Minor or major release": When changes from `feat` branches get merged these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on Minor or Major level.
 - "Manual Functional Release Activities": Technical releases are loosely coupled to functional releases. The additional activities for a functional release select an existing technical release as a basis to generate the artifacts required for a functional release, for example:
  - Conduct additional manual explorative and regression tests.
@@ -289,19 +289,19 @@ This section will explain the workflow for each branch (type) based on the Gitfl
 - `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based in this case on the head revision of the `develop` branch.
 - `QA 'release merge'`: The Merge Request for this merge has to be created manually by members of the platform development team. It should document:
  - That the SQG was successfully executed upon the to-be merged state - it could be done explicitly or based on a `QA 'nightly develop'`
-  - In case of `mntn` changes that usually how no test automation: Changes have been verified by a member of the platform development team.
+  - In case of `fix` changes that usually how no test automation: Changes have been verified by a member of the platform development team.
  - That the changes have been reviewed by at least two members of the platform development team giving their approval on the Merge Request.
- Merge points (from `docu`, `mntn`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.
+- Merge points (from `docs`, `fix`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.

-##### `docu`
+##### `docs`

-Branches of type `docu` only contain the commits themselves and have to adhere to the workflow basic fact that:
+Branches of type `docs` only contain the commits themselves and have to adhere to the workflow basic fact that:
 > All merges into `develop` or `main` require two approvals from the platform development team.

-##### `mntn`
+##### `fix`

-Besides the actual changes being committed in an `mntn` branch there is only the:
- `QG 'mntn'`: In addition to validating the actual change the owner of the branch has to ensure the successful execution of the SQG.
+Besides the actual changes being committed in an `fix` branch there is only the:
+- `QG 'fix'`: In addition to validating the actual change the owner of the branch has to ensure the successful execution of the SQG.

 ##### `feat`

@@ -318,47 +318,29 @@ This branch type requires the most activities on top of the actual development:

 #### Branch names

-Branches created from the `develop` branch have to adhere to the following notation: `<party[-developer]>/<type>/<component>/<details>`:
+Branches created from the `develop` branch have to adhere to the following notation: `<type>/<responsible_developer>/<details>`:

- `<party[-developer]>`: An identifier for the developing party optionally plus the name of the developer or team working on that branch. The following two-letter shorthand notations should be used for the owner:
-  - Suppliers
-    - `co`: Collabora
-    - `cp`: CryptPad
-    - `el`: Element
-    - `nc`: Nextcloud
-    - `nd`: Nordeck
-    - `op`: OpenProject
-    - `ox`: Open-Xchange
-    - `uv`: Univention
-    - `xw`: XWiki
-  - Other
-    - `pd`: (openDesk) Platform Development
-    - `xx`: Other, not one of the parties mentioned before
-
- `<type>`: Based on the branch types described in this document valid values for type are
-  - `docu`
-  - `mntn`
+- `<type>`: From the list of branch types explained above:
+  - `docs`
+  - `fix`
  - `feat`
-
- `<component>`: Valid components are
+- `<responsible_developer>`: Something that makes you identifiable as owner of the branch, e.g. the first letter of your first name followed by your family name.
+- `<details>`: A very short note about what is going to happen in the branch and ideally what component is affected from the following list of components:
  - `helmfile`
  - `ci`
-  - `cross-functional`
  - `docs`
  - `collabora`
  - `cryptpad`
  - `element`
  - `jitsi`
  - `nextcloud`
+  - `nubus`
  - `open-xchange`
  - `openproject`
  - `services`
-  - `univention-management-stack`
  - `xwiki`

- `<details>`: A very short note about what is going to happen in the branch
-
-Example: `pd-tom/fix/open-xchange/bump_to_8.76`.
+Example: `feat/tmueller/bump_nextcloud_to_29.0.0`.

 **Note**: The above naming convention is not enforced yet, but please ensure you make use of it.

@@ -367,18 +349,18 @@ Example: `pd-tom/fix/open-xchange/bump_to_8.76`.
 Commit messages must adhere to the [Conventional Commit standard](https://www.conventionalcommits.org/en/v1.0.0/#summary). Commits that do not adhere to the standard get rejected by either [Gitlab push rules](https://docs.gitlab.com/ee/user/project/repository/push_rules.html) or the CI.

 ```text
-<type>(<scope>): [path/to/issue#1] <short summary>
+<type>(<scope>): [path/to/issue#1] <short summary>.
  │       │              │                │
  │       │              |                └─> Summary in present tense, sentence case, with no period at the end
  │       │              |
  │       │              └─> Issue reference (optional)
  │       │
-  │       └─> Commit Scope: helmfile, docs, collabora, intercom-service, ...
+  │       └─> Commit Scope: helmfile, docs, collabora, nextcloud, open-xhcange etc.
  │
  └─> Commit Type: chore, ci, docs, feat, fix
 ```

-Example: `fix(univention-management-stack): Update standard session timeout of openDesk realm in Keycloak`
+Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`

 **Beware**: The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.

--- a/helmfile.yaml.gotmpl
+++ b/helmfile.yaml.gotmpl
@@ -15,7 +15,7 @@ environments:
 ---
 # yamllint disable
 helmfiles:
-  - path: "./helmfile_generic.yaml"
+  - path: "./helmfile_generic.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 # {{/*
--- a/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/\
-      {{ .Values.charts.collabora.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"

 releases:
  - name: "collabora-online"
@@ -19,6 +18,7 @@ releases:
    version: "{{ .Values.charts.collabora.version }}"
    values:
      - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.collaboraOnline | default "additionalValues: false" }}
    installed: {{ .Values.collabora.enabled }}

 commonLabels:
--- a/helmfile/apps/collabora/helmfile.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile.yaml.gotmpl
@@ -6,7 +6,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/collabora/values.yaml.gotmpl
+++ b/helmfile/apps/collabora/values.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,7 +8,7 @@ autoscaling:
  enabled: false

 collabora:
-  extra_params: "--o:ssl.enable=false --o:ssl.termination=true --o:fetch_update_check=0"
+  extra_params: "--o:ssl.enable=false --o:ssl.termination=true --o:fetch_update_check=0 --o:remote_font_config.url=https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/richdocuments/settings/fonts.json"
  username: "collabora-internal-admin"
  password: {{ .Values.secrets.collabora.adminPassword | quote }}
  aliasgroups:
@@ -17,14 +18,14 @@ fullnameOverride: "collabora"

 grafana:
  dashboards:
-    enabled: {{ .Values.grafana.dashboards.enabled }}
+    enabled: {{ .Values.monitoring.grafana.dashboards.enabled }}
    labels:
-      {{ .Values.grafana.dashboards.labels | toYaml | nindent 6 }}
+      {{ .Values.monitoring.grafana.dashboards.labels | toYaml | nindent 6 }}
    annotations:
-      {{ .Values.grafana.dashboards.annotations | toYaml | nindent 6 }}
+      {{ .Values.monitoring.grafana.dashboards.annotations | toYaml | nindent 6 }}

 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
  tag: {{ .Values.images.collabora.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}

@@ -83,18 +84,20 @@ ingress:
      hosts:
        - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"

+podAnnotations: {}
+
 podSecurityContext:
  fsGroup: 100

 prometheus:
  servicemonitor:
-    enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
+    enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
    labels:
-      {{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
+      {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
  rules:
-    enabled: {{ .Values.prometheus.prometheusRules.enabled }}
+    enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
    additionalLabels:
-      {{ .Values.prometheus.prometheusRules.labels | toYaml | nindent 6 }}
+      {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 6 }}

 replicaCount: {{ .Values.replicas.collabora }}

@@ -115,17 +118,9 @@ securityContext:
      - "ALL"
    add:
      - "CHOWN"
-      - "DAC_OVERRIDE"
      - "FOWNER"
-      - "FSETID"
-      - "KILL"
-      - "SETGID"
-      - "SETUID"
-      - "SETPCAP"
-      - "NET_BIND_SERVICE"
-      - "NET_RAW"
      - "SYS_CHROOT"
-      - "MKNOD"
+
  seLinuxOptions:
    {{ .Values.seLinuxOptions.collabora | toYaml | nindent 4 }}
 serviceAccount:
--- a/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/\
-      {{ .Values.charts.cryptpad.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"

 releases:
  - name: "cryptpad"
@@ -19,6 +18,7 @@ releases:
    version: "{{ .Values.charts.cryptpad.version }}"
    values:
      - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.cryptpad | default "additionalValues: false" }}
    installed: {{ .Values.cryptpad.enabled }}

 commonLabels:
--- a/helmfile/apps/cryptpad/helmfile.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile.yaml.gotmpl
@@ -6,7 +6,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/cryptpad/values.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/values.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/README.md or
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/values.yaml
@@ -23,7 +26,7 @@ enableEmbedding: true
 fullnameOverride: "cryptpad"

 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
  tag: {{ .Values.images.cryptpad.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}

@@ -50,6 +53,8 @@ ingress:
 persistence:
  enabled: false

+podAnnotations: {}
+
 podSecurityContext:
  fsGroup: 4001

--- a/helmfile/apps/element/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/element/helmfile-child.yaml.gotmpl
@@ -10,40 +10,36 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/\
-      {{ .Values.charts.element.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
  - name: "element-well-known-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.elementWellKnown.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/\
-      {{ .Values.charts.elementWellKnown.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
  - name: "synapse-web-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseWeb.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/\
-      {{ .Values.charts.synapseWeb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
  - name: "synapse-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapse.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/\
-      {{ .Values.charts.synapse.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+
  - name: "synapse-create-account-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseCreateAccount.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/\
-      {{ .Values.charts.synapseCreateAccount.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"

  # openDesk Matrix Widgets
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
@@ -53,41 +49,35 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/\
-      {{ .Values.charts.matrixUserVerificationService.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
  - name: "matrix-neoboard-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
-      {{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neochoice-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
-      {{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neodatefix-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/\
-      {{ .Values.charts.matrixNeodatefixWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
  - name: "matrix-neodatefix-bot-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/\
-      {{ .Values.charts.matrixNeodatefixBot.repository }}"
-
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"

 releases:
  - name: "opendesk-element"
@@ -95,6 +85,7 @@ releases:
    version: "{{ .Values.charts.element.version }}"
    values:
      - "values-element.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskElement | default "additionalValues: false" }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -103,6 +94,7 @@ releases:
    version: "{{ .Values.charts.elementWellKnown.version }}"
    values:
      - "values-well-known.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskWellKnown | default "additionalValues: false" }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -111,6 +103,7 @@ releases:
    version: "{{ .Values.charts.synapseWeb.version }}"
    values:
      - "values-synapse-web.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskSynapseWeb | default "additionalValues: false" }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -119,6 +112,7 @@ releases:
    version: "{{ .Values.charts.synapse.version }}"
    values:
      - "values-synapse.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskSynapse | default "additionalValues: false" }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

--- a/helmfile/apps/intercom-service/helmfile.yaml
+++ b/helmfile/apps/intercom-service/helmfile.yaml
@@ -6,7 +6,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/element/values-element.yaml.gotmpl
+++ b/helmfile/apps/element/values-element.yaml.gotmpl
@@ -1,19 +1,25 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
  endToEndEncryption: true
  additionalConfiguration:
-    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+  {{- if not .Values.configuration.homeserver.guestModule.enabled }}
+    disable_guests: true
+  {{- end }}
+
+    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=opendesk-matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"

    "net.nordeck.element_web.module.opendesk":
      config:
        banner:
          ics_navigation_json_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/navigation.json"
          ics_silent_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/silent"
-          portal_logo_svg_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
-          portal_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/"
+          portal_logo_svg_url: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
+          portal_url: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/"
        custom_css_variables:
          --cpd-color-bg-action-primary-rest: {{ .Values.theme.colors.primary | quote }}
          --cpd-color-text-action-accent: {{ .Values.theme.colors.primary | quote }}
@@ -42,6 +48,8 @@ configuration:
            - org.matrix.msc3819.send.to_device:net.nordeck.whiteboard.connection_signaling
            - org.matrix.msc3819.receive.to_device:net.nordeck.whiteboard.connection_signaling
            - town.robin.msc3846.turn_servers
+            - org.matrix.msc4039.upload_file
+            - org.matrix.msc4039.download_file
        "https://{{ .Values.global.hosts.matrixNeoChoiceWidget }}.{{ .Values.global.domain }}/*":
          preload_approved: true
          capabilities_approved:
@@ -121,7 +129,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.element.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.element.registry | quote }}
  repository: {{ .Values.images.element.repository | quote }}
  tag: {{ .Values.images.element.tag | quote }}

@@ -133,6 +141,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -26,7 +29,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoBoardWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoBoardWidget.registry | quote }}
  repository: {{ .Values.images.matrixNeoBoardWidget.repository | quote }}
  tag: {{ .Values.images.matrixNeoBoardWidget.tag | quote }}

@@ -37,6 +40,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -26,7 +29,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoChoiceWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoChoiceWidget.registry | quote }}
  repository: {{ .Values.images.matrixNeoChoiceWidget.repository | quote }}
  tag: {{ .Values.images.matrixNeoChoiceWidget.tag | quote }}

@@ -37,6 +40,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
@@ -1,9 +1,12 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}

 configuration:
  username: "meetings-bot"
@@ -16,13 +19,15 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
  url: {{ .Values.images.synapseCreateUser.repository | quote }}
  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 fullnameOverride: "matrix-neodatefix-bot-bootstrap"

+podAnnotations: {}
+
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
--- a/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
@@ -11,16 +14,16 @@ global:
 configuration:
  bot:
    username: "meetings-bot"
-    displayname: "Terminplaner Bot"
+    display name: "Scheduler Bot"
  openxchangeBaseUrl: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
  strings:
-    breakoutSessionWidgetName: "Breakoutsessions"
-    calendarRoomName: "Terminplaner"
-    calendarWidgetName: "Terminplaner"
-    cockpitWidgetName: "Meeting Steuerung"
-    jitsiWidgetName: "Videokonferenz"
+    breakoutSessionWidgetName: "Breakout Sessions"
+    calendarRoomName: "Scheduler"
+    calendarWidgetName: "Scheduler"
+    cockpitWidgetName: "Meeting control"
+    jitsiWidgetName: "Video conference"
    matrixNeoBoardWidgetName: "Whiteboard"
-    matrixNeoChoiceWidgetName: "Abstimmungen"
+    matrixNeoChoiceWidgetName: "Votes"

 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -47,7 +50,7 @@ extraEnvVars:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixBot.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoDateFixBot.registry | quote }}
  repository: {{ .Values.images.matrixNeoDateFixBot.repository | quote }}
  tag: {{ .Values.images.matrixNeoDateFixBot.tag | quote }}

@@ -58,13 +61,15 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

-livenessProbe:
+liveness sample:
  enabled: true

 persistence:
  size: {{ .Values.persistence.size.matrixNeoDateFixBot | quote }}
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
  bot:
@@ -31,7 +34,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoDateFixWidget.registry | quote }}
  repository: {{ .Values.images.matrixNeoDateFixWidget.repository | quote }}
  tag: {{ .Values.images.matrixNeoDateFixWidget.tag | quote }}

@@ -42,6 +45,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
@@ -1,9 +1,12 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}

 configuration:
  username: "uvs"
@@ -16,13 +19,15 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
  url: {{ .Values.images.synapseCreateUser.repository | quote }}
  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 fullnameOverride: "opendesk-matrix-user-verification-service-bootstrap"

+podAnnotations: {}
+
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
--- a/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -35,10 +38,12 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixUserVerificationService.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixUserVerificationService.registry | quote }}
  repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
  tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-synapse-web.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-web.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 clusterDomain: {{ .Values.cluster.networking.domain }}

@@ -29,7 +32,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseWeb.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseWeb.registry | quote }}
  repository: {{ .Values.images.synapseWeb.repository | quote }}
  tag: {{ .Values.images.synapseWeb.tag | quote }}

@@ -48,6 +51,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
  additionalConfiguration:
@@ -11,8 +14,8 @@ configuration:
        - "m.space.parent"
        - "net.nordeck.meetings.metadata"
        - "m.room.power_levels"
-    # When a user logs into Element a parallel request is done through Intercom Service to allow Synapse API
-    # interaction, to avoid (temporary) blocking of the user for followup logins we want to raise the limits.
+    # To allow intercom service logins for the users and also allow proper testautomation we want to raise the
+    # ratelimit in a reasonable manner.
    # https://matrix-org.github.io/synapse/v1.59/usage/configuration/config_documentation.html#ratelimiting
    rc_login:
      account:
@@ -40,18 +43,39 @@ configuration:
              regex: "@.*"
        url: null
        sender_localpart: intercom-service
+      - as_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+        id: ox-appsuite
+        namespaces:
+          users:
+            - exclusive: false
+              regex: "@.*"
+        url: null
+        sender_localpart: ox-appsuite
+
+    presence:
+      enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
+
+    profile:
+      allowUsersToUpdateDisplayname: {{ .Values.functional.chat.matrix.profile.allowUsersToUpdateDisplayname }}

    smtp:
-      senderAddress: "{{ .Values.localpartNoReply }}@{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}"
-      host: {{ .Values.smtp.host | quote }}
-      port: {{ .Values.smtp.port }}
-      username: {{ .Values.smtp.username | quote }}
-      password: {{ .Values.smtp.password | quote }}
+      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      port: 25
+      tls: false
+      starttls: false
+      username: ""
+      password: ""

    oidc:
      clientId: "opendesk-matrix"
      clientSecret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
      issuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+      matrixIdLocalpart: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
+      scopes:
+        - "openid"
+        - "opendesk-matrix-scope"

    turn:
      sharedSecret: {{ .Values.turn.credentials | quote }}
@@ -67,10 +91,9 @@ configuration:
        {{- end }}

    guestModule:
-      enabled: true
      image:
        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-        registry: {{ .Values.global.imageRegistry | default .Values.images.synapseGuestModule.registry | quote }}
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapseGuestModule.registry | quote }}
        repository: {{ .Values.images.synapseGuestModule.repository | quote }}
        tag: {{ .Values.images.synapseGuestModule.tag | quote }}

@@ -91,7 +114,7 @@ containerSecurityContext:
    {{ .Values.seLinuxOptions.synapse | toYaml | nindent 4 }}

 federation:
-  enabled: {{ .Values.externalServices.matrix.federation.enabled }}
+  enabled: {{ .Values.functional.externalServices.matrix.federation.enabled }}
  ingress:
    host: "{{ .Values.global.hosts.synapseFederation }}.{{ .Values.global.domain }}"
    enabled: {{ .Values.ingress.enabled }}
@@ -109,7 +132,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapse.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapse.registry | quote }}
  repository: {{ .Values.images.synapse.repository | quote }}
  tag: {{ .Values.images.synapse.tag | quote }}

@@ -117,6 +140,8 @@ persistence:
  size: {{ .Values.persistence.size.synapse | quote }}
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 10991
--- a/helmfile/apps/element/values-well-known.yaml.gotmpl
+++ b/helmfile/apps/element/values-well-known.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
  e2ee:
@@ -30,7 +33,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.wellKnown.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.wellKnown.registry | quote }}
  repository: {{ .Values.images.wellKnown.repository | quote }}
  tag: {{ .Values.images.wellKnown.tag | quote }}

@@ -42,6 +45,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/intercom-service/helmfile-child.yaml
+++ b/helmfile/apps/intercom-service/helmfile-child.yaml
@@ -1,27 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
---
-repositories:
-  # Intercom Service
-  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
-  - name: "intercom-service-repo"
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.intercomService.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/\
-      {{ .Values.charts.intercomService.repository }}"
-
-releases:
-  - name: "intercom-service"
-    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
-    version: "{{ .Values.charts.intercomService.version }}"
-    values:
-      - "values.yaml.gotmpl"
-    installed: {{ .Values.intercom.enabled }}
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "intercom-service"
-...
--- a/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/\
-      {{ .Values.charts.jitsi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"

 releases:
  - name: "jitsi"
@@ -19,6 +18,7 @@ releases:
    version: "{{ .Values.charts.jitsi.version }}"
    values:
      - "values-jitsi.yaml.gotmpl"
+      - {{ .Values.customization.release.jitsi | default "additionalValues: false" }}
    installed: {{ .Values.jitsi.enabled }}
    timeout: 900

--- a/helmfile/apps/jitsi/helmfile.yaml
+++ b/helmfile/apps/jitsi/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/jitsi/helmfile.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile.yaml.gotmpl
@@ -6,7 +6,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -9,6 +10,7 @@ global:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations: {}

 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -27,11 +29,11 @@ containerSecurityContext:
    {{ .Values.seLinuxOptions.jitsiKeycloakAdapter | toYaml | nindent 4 }}

 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiKeycloakAdapter.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsiKeycloakAdapter.registry | quote }}
  repository: {{ .Values.images.jitsiKeycloakAdapter.repository | quote }}
  tag: {{ .Values.images.jitsiKeycloakAdapter.tag | quote }}

@@ -48,8 +50,9 @@ jitsi:
  web:
    replicaCount: {{ .Values.replicas.jitsi }}
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
      tag: {{ .Values.images.jitsi.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    ingress:
      enabled: {{ .Values.ingress.enabled }}
      ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -61,6 +64,8 @@ jitsi:
        - secretName: {{ .Values.ingress.tls.secretName | quote }}
          hosts:
            - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
+    extraConfigJs:
+      doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
    extraEnvs:
      TURN_ENABLE: "1"
    resources:
@@ -79,8 +84,9 @@ jitsi:
        {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
  prosody:
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
      tag: {{ .Values.images.prosody.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    imagePullSecrets:
    {{- range .Values.global.imagePullSecrets }}
      - name: {{ . | quote }}
@@ -128,8 +134,9 @@ jitsi:
  jicofo:
    replicaCount: {{ .Values.replicas.jicofo }}
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
      tag: {{ .Values.images.jicofo.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    xmpp:
      password: {{ .Values.secrets.jitsi.jicofoAuthPassword | quote }}
      componentSecret: {{ .Values.secrets.jitsi.jicofoComponentPassword | quote }}
@@ -150,8 +157,9 @@ jitsi:
  jvb:
    replicaCount: {{ .Values.replicas.jvb }}
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
      tag: {{ .Values.images.jvb.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    xmpp:
      password: {{ .Values.secrets.jitsi.jvbAuthPassword | quote }}
    resources:
@@ -173,8 +181,9 @@ jitsi:
  jibri:
    replicaCount: {{ .Values.replicas.jibri }}
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
      tag: {{ .Values.images.jibri.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    recorder:
      password: {{ .Values.secrets.jitsi.jibriRecorderPassword | quote }}
    xmpp:
@@ -211,9 +220,12 @@ patchJVB:
      {{ .Values.seLinuxOptions.jitsiPatchJVB | toYaml | nindent 6 }}
  image:
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiPatchJVB.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.jitsiPatchJVB.registry | quote }}
    repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
    tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
+
+podAnnotations: {}
+
 replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}

 resources:
--- a/helmfile/apps/migrations-post/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/migrations-post/helmfile-child.yaml.gotmpl
@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # openDesk Migrations
+  # Source:
+  - name: "openproject-migrations-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.migrations.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+
+releases:
+  - name: "opendesk-migrations-post"
+    chart: "openproject-migrations-repo/{{ .Values.charts.migrations.name }}"
+    version: "{{ .Values.charts.migrations.version }}"
+    wait: true
+    waitForJobs: true
+    values:
+      - "values.yaml.gotmpl"
+      - "../../shared/migrations.yaml.gotmpl"
+      - {{ .Values.customization.release.migrationsPost | default "additionalValues: false" }}
+    installed: {{ .Values.migrations.enabled }}
+    timeout: 900
+
+commonLabels:
+  deploy-stage: "component-0"
+  component: "opendesk-migrations"
+...
--- a/helmfile/apps/migrations-post/helmfile.yaml.gotmpl
+++ b/helmfile/apps/migrations-post/helmfile.yaml.gotmpl
@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/migrations-post/values.yaml.gotmpl
+++ b/helmfile/apps/migrations-post/values.yaml.gotmpl
@@ -0,0 +1,10 @@
+{{/*
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+podAnnotations: {}
+
+migrations:
+  stage: "POST"
+...
--- a/helmfile/apps/migrations-pre/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/migrations-pre/helmfile-child.yaml.gotmpl
@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # openDesk Migrations
+  # Source:
+  - name: "openproject-migrations-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.migrations.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+
+releases:
+  - name: "opendesk-migrations-pre"
+    chart: "openproject-migrations-repo/{{ .Values.charts.migrations.name }}"
+    version: "{{ .Values.charts.migrations.version }}"
+    wait: true
+    waitForJobs: true
+    values:
+      - "values.yaml.gotmpl"
+      - "../../shared/migrations.yaml.gotmpl"
+      - {{ .Values.customization.release.migrationsPre | default "additionalValues: false" }}
+    installed: {{ .Values.migrations.enabled }}
+    timeout: 900
+
+commonLabels:
+  deploy-stage: "component-0"
+  component: "opendesk-migrations"
+...
--- a/helmfile/apps/migrations-pre/helmfile.yaml.gotmpl
+++ b/helmfile/apps/migrations-pre/helmfile.yaml.gotmpl
@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/migrations-pre/values.yaml.gotmpl
+++ b/helmfile/apps/migrations-pre/values.yaml.gotmpl
@@ -0,0 +1,10 @@
+{{/*
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+podAnnotations: {}
+
+migrations:
+  stage: "PRE"
+...
--- a/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
@@ -10,16 +10,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/\
-      {{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
  - name: "nextcloud-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.nextcloud.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/\
-      {{ .Values.charts.nextcloud.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"

 releases:
  - name: "opendesk-nextcloud-management"
@@ -27,6 +25,7 @@ releases:
    version: "{{ .Values.charts.nextcloudManagement.version }}"
    values:
      - "values-nextcloud-mgmt.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskNextcloudManagement | default "additionalValues: false" }}
    waitForJobs: true
    wait: true
    installed: {{ .Values.nextcloud.enabled }}
@@ -36,6 +35,7 @@ releases:
    version: "{{ .Values.charts.nextcloud.version }}"
    values:
      - "values-nextcloud.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskNextcloud | default "additionalValues: false" }}
    needs:
      - "opendesk-nextcloud-management"
    installed: {{ .Values.nextcloud.enabled }}
--- a/helmfile/apps/nextcloud/helmfile.yaml
+++ b/helmfile/apps/nextcloud/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/nextcloud/helmfile.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -14,7 +14,7 @@ additionalAnnotations:
  intents.otterize.com/service-name: "opendesk-nextcloud-php"

 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}

 configuration:
  administrator:
@@ -35,6 +35,9 @@ configuration:
        value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
    host: {{ .Values.cache.nextcloud.host | quote }}
    port: {{ .Values.cache.nextcloud.port | quote }}
+  collabora:
+    # internalWopiUrl: ""
+    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
  database:
    host: {{ .Values.databases.nextcloud.host | quote }}
    port: {{ .Values.databases.nextcloud.port | quote }}
@@ -45,7 +48,7 @@ configuration:
        value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
  ldap:
    host: {{ .Values.ldap.host | quote }}
-    password: {{ .Values.secrets.univentionManagementStack.ldapSearch.nextcloud | quote }}
+    password: {{ .Values.secrets.nubus.ldapSearch.nextcloud | quote }}
    adminGroupName: "managed-by-attribute-FileshareAdmin"
  objectstore:
    auth:
@@ -70,16 +73,36 @@ configuration:
      value: "opendesk_username"
    password:
      value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  sharing:
+    allowLinks: {{ .Values.functional.filestore.sharing.external.enabled }}
+    allowMailNotification: {{ .Values.functional.filestore.sharing.external.enabled }}
+    allowPublicUpload: {{ .Values.functional.filestore.sharing.external.enabled }}
+    enforceLinksPassword: {{ .Values.functional.filestore.sharing.external.enforcePasswords }}
+    enforcePasswordProtection: {{ .Values.functional.filestore.sharing.external.enforcePasswords }}
+    defaultInternalExpireEnabled: {{ .Values.functional.filestore.sharing.internal.expiry.activeByDefault }}
+    defaultInternalExpireEnforced: {{ .Values.functional.filestore.sharing.internal.expiry.enforced }}
+    defaultInternalExpireDays: {{ .Values.functional.filestore.sharing.internal.expiry.defaultDays | quote }}
+    defaultExternalExpireEnabled: {{ .Values.functional.filestore.sharing.external.expiry.activeByDefault }}
+    defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
+    defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
  smtp:
    auth:
+      enabled: false
      username:
-        value: {{ .Values.smtp.username | quote }}
+        value: ""
      password:
-        value: {{ .Values.smtp.password | quote }}
-    host: {{ .Values.smtp.host | quote }}
-    port: {{ .Values.smtp.port | quote }}
-    fromAddress: {{ .Values.localpartNoReply | quote }}
-    mailDomain: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
+        value: ""
+    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    port: 25
+    fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
+    mailDomain: "{{ .Values.global.domain }}"
+    security: ""
+    skipVerifyPeer: true
+  quota:
+    default: "{{ .Values.functional.filestore.quota.default }} GB"
+    retentionObligation:
+      trashbin: {{ .Values.functional.filestore.nextcloud.retentionObligation.trashbin | quote }}
+      versions: {{ .Values.functional.filestore.nextcloud.retentionObligation.versions | quote }}

  serverinfo:
    token: {{ .Values.secrets.nextcloud.metricsToken | quote }}
@@ -91,28 +114,30 @@ containerSecurityContext:
      - "ALL"
  enabled: true
  privileged: false
-  runAsUser: 65532
-  runAsGroup: 65532
+  runAsUser: 101
+  runAsGroup: 101
  seccompProfile:
    type: "RuntimeDefault"
  readOnlyRootFilesystem: false
  runAsNonRoot: true
  seLinuxOptions:
    {{ .Values.seLinuxOptions.nextcloudManagement | toYaml | nindent 4 }}
+podSecurityContext:
+  fsGroup: 101

 debug:
-  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"1"{{ end }}
+  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudManagement.registry | quote }}
-  repository: {{ .Values.images.nextcloudManagement.repository | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
+  repository: {{ .Values.images.nextcloud.repository | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  tag: {{ .Values.images.nextcloudManagement.tag | quote }}
+  tag: {{ .Values.images.nextcloud.tag | quote }}

 theme:
  {{ .Values.theme | toYaml | nindent 2 }}

 resources:
-  {{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
+  {{ .Values.resources.nextcloud | toYaml | nindent 4 }}

 ...
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -28,26 +28,27 @@ exporter:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.nextcloudExporter | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudExporter.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloudExporter.registry | quote }}
    repository: "{{ .Values.images.nextcloudExporter.repository }}"
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    tag: {{ .Values.images.nextcloudExporter.tag | quote }}
+  podAnnotations: {}
  prometheus:
    serviceMonitor:
-      enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
+      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
      labels:
-        {{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
+        {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
    prometheusRule:
-      enabled: {{ .Values.prometheus.prometheusRules.enabled }}
+      enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
      additionalLabels:
-        {{ .Values.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
+        {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
  replicaCount: {{ .Values.replicas.nextcloudExporter }}
  resources:
    {{ .Values.resources.nextcloudExporter | toYaml | nindent 4 }}

-php:
+aio:
  additionalAnnotations:
-    intents.otterize.com/service-name: "opendesk-nextcloud-php"
+    intents.otterize.com/service-name: "opendesk-nextcloud"
  configuration:
    cache:
      auth:
@@ -66,6 +67,7 @@ php:
          value: "nextcloud_user"
        password:
          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
+    trustedProxies: {{ join " " .Values.cluster.networking.cidr | quote }}
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
@@ -73,55 +75,23 @@ php:
        - "ALL"
    enabled: true
    privileged: false
-    runAsUser: 65532
-    runAsGroup: 65532
+    runAsUser: 101
+    runAsGroup: 101
    seccompProfile:
      type: "RuntimeDefault"
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    seLinuxOptions:
-      {{ .Values.seLinuxOptions.nextcloudPHP | toYaml | nindent 6 }}
+      {{ .Values.seLinuxOptions.nextcloud | toYaml | nindent 6 }}
  cron:
    successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
  debug:
-    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"1"{{ end }}
+    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudPHP.registry | quote }}
-    repository: "{{ .Values.images.nextcloudPHP.repository }}"
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
+    repository: "{{ .Values.images.nextcloud.repository }}"
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    tag: {{ .Values.images.nextcloudPHP.tag | quote }}
-  prometheus:
-    serviceMonitor:
-      enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
-      labels:
-        {{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
-    prometheusRule:
-      enabled: {{ .Values.prometheus.prometheusRules.enabled }}
-      additionalLabels:
-        {{ .Values.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
-  replicaCount: {{ .Values.replicas.nextcloudPHP }}
-  resources:
-    {{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
-
-apache2:
-  configuration:
-    php:
-      host: "opendesk-nextcloud-php.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}"
-  containerSecurityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - "ALL"
-    enabled: true
-    privileged: false
-    runAsUser: 65532
-    runAsGroup: 65532
-    seccompProfile:
-      type: "RuntimeDefault"
-    readOnlyRootFilesystem: true
-    runAsNonRoot: true
-    seLinuxOptions:
-      {{ .Values.seLinuxOptions.nextcloudApache2 | toYaml | nindent 6 }}
+    tag: {{ .Values.images.nextcloud.tag | quote }}
  ingress:
    enabled: {{ .Values.ingress.enabled }}
    annotations:
@@ -135,12 +105,20 @@ apache2:
    host: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
    tls:
      secretName: {{ .Values.ingress.tls.secretName | quote }}
-  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudApache2.registry | quote }}
-    repository: {{ .Values.images.nextcloudApache2.repository | quote }}
-    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    tag: {{ .Values.images.nextcloudApache2.tag | quote }}
-  replicaCount: {{ .Values.replicas.nextcloudApache2 }}
+  podAnnotations: {}
+  podSecurityContext:
+    fsGroup: 101
+  prometheus:
+    serviceMonitor:
+      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
+      labels:
+        {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
+    prometheusRule:
+      enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
+      additionalLabels:
+        {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
+  replicaCount: {{ .Values.replicas.nextcloud }}
  resources:
-    {{ .Values.resources.nextcloudApache2 | toYaml | nindent 4 }}
+    {{ .Values.resources.nextcloud | toYaml | nindent 4 }}
+
 ...
--- a/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
@@ -0,0 +1,68 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # Univention Management Stack Umbrella Chart
+  - name: "nubus"
+    keyring: "../../files/gpg-pubkeys/univention-de.gpg"
+    verify: {{ .Values.charts.nubus.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url:
+      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
+  # Intercom Service
+  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
+  - name: "intercom-service-repo"
+    keyring: "../../files/gpg-pubkeys/univention-de.gpg"
+    verify: {{ .Values.charts.intercomService.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+  # openDesk Keycloak Bootstrap Chart
+  - name: "opendesk-keycloak-bootstrap-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+
+releases:
+  # Univention Management Stack Umbrella Chart
+  - name: "ums"
+    chart: "nubus/{{ .Values.charts.nubus.name }}"
+    version: "{{ .Values.charts.nubus.version }}"
+    values:
+      - "values-nubus.yaml.gotmpl"
+      - "values-opendesk-customization.yaml.gotmpl"
+      - "values-opendesk-images.yaml.gotmpl"
+      - {{ .Values.customization.release.ums | default "additionalValues: false" }}
+    installed: {{ .Values.nubus.enabled }}
+    timeout: 900
+  # Intercom-Service
+  - name: "intercom-service"
+    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
+    version: "{{ .Values.charts.intercomService.version }}"
+    values:
+      - "values-intercom-service.yaml.gotmpl"
+      - {{ .Values.customization.release.intercomService | default "additionalValues: false" }}
+    installed: {{ .Values.nubus.enabled }}
+
+  # openDesk Keycloak Bootstrap Chart
+  - name: "opendesk-keycloak-bootstrap"
+    chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.opendeskKeycloakBootstrap.name }}"
+    version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
+    values:
+      - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskKeycloakBootstrap | default "additionalValues: false" }}
+    needs:
+      - "ums"
+    installed: {{ .Values.nubus.enabled }}
+    timeout: 900
+
+commonLabels:
+  deploy-stage: "component-1"
+  component: "nubus"
+...
--- a/helmfile/apps/nubus/helmfile.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -52,10 +55,12 @@ ics:
    url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
    audience: "opendesk-oxappsuite"
  nextcloud:
+    origin: {{ .Values.global.hosts.nextcloud | quote }}
+    subdomain: {{ .Values.global.hosts.nextcloud | quote }}
    audience: "opendesk-nextcloud"
 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.intercom.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.intercom.registry | quote }}
  repository: {{ .Values.images.intercom.repository | quote }}
  tag: {{ .Values.images.intercom.tag | quote }}

@@ -67,11 +72,47 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 1000
  fsGroupChangePolicy: "Always"

+provisioning:
+  enabled: true
+  config:
+    nubusBaseUrl: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
+    keycloak:
+      url: "http://ums-keycloak:8080/realms/{{ .Values.platform.realm }}/"
+      username: "kcadmin"
+      realm: {{ .Values.platform.realm | quote }}
+      connection:
+        host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
+        baseUrl: "http://ums-keycloak:8080"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+    ics_client:
+      clientSecret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
+      credentialSecret:
+        key: "ics_secret"
+  image:
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository | quote }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag | quote }}
+  provisioningImage:
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakBootstrap.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloakBootstrap.repository | quote }}
+    tag: {{ .Values.images.nubusKeycloakBootstrap.tag | quote }}
+  securityContext:
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.intercom | toYaml | nindent 6 }}
+
 replicaCount: {{ .Values.replicas.intercomService }}

 resources:
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -0,0 +1,594 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  nubusDeployment: true
+  ldap:
+    baseDn: {{ .Values.ldap.baseDn | quote }}
+    domainName: {{ .Values.global.domain | quote }}
+  domain: {{ .Values.global.domain | quote }}
+  subDomains:
+    portal: {{ .Values.global.hosts.nubus | quote }}
+    keycloak: {{ .Values.global.hosts.keycloak | quote }}
+  ingressClass: {{ .Values.ingress.ingressClassName | default "nginx" | quote }}
+  certManagerIssuer: {{ .Values.certificate.issuerRef.name | quote }}
+  nubusMasterPassword: {{ env "MASTER_PASSWORD" | default "sovereign-workplace" | quote }}
+  keycloak:
+    realm: {{ .Values.platform.realm | quote }}
+  objectStorage:
+    bucket: {{ .Values.objectstores.nubus.bucket | quote }}
+    connection:
+      host: "minio"
+      port: "9000"
+      protocol: "http"
+  credentialOverride:
+    ldapServer:
+      adminPassword: {{ .Values.secrets.nubus.ldapSecret | quote}}
+    defaultUsers:
+      defaultAdminPassword: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote}}
+      defaultUserPassword: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote}}
+      defaultAdministratorPassword: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote}}
+    portalConsumer:
+      minio:
+        accessKey: {{ .Values.objectstores.nubus.username | quote }}
+        secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+      provisioningApi:
+        password: {{ .Values.secrets.nubus.portalConsumer.provisioningApiPassword | quote}}
+    provisioning:
+      api:
+        adminPassword: {{ .Values.secrets.nubus.provisioning.api.adminPassword | quote}}
+        natsPassword: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
+        prefillPassword: {{ .Values.secrets.nubus.provisioning.api.prefillPassword | quote}}
+        udmTransformerPassword: {{ .Values.secrets.nubus.provisioning.api.udmTransformerPassword | quote}}
+      dispatcher:
+        natsPassword: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
+      nats:
+        adminPassword: {{ .Values.secrets.nats.natsAdminPassword | quote}}
+      prefill:
+        natsPassword: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
+      udmTransformer:
+        natsPassword: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
+    selfserviceConsumer:
+      provisioningApi:
+        password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}
+
+  # -- Extensions to load. Add entries to load additional extensions into Nubus.
+  extensions:
+    - name: "ox"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOxExtension.registry | quote }}
+        repository: {{ .Values.images.nubusOxExtension.repository }}
+        tag: {{ .Values.images.nubusOxExtension.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+    - name: "opendesk"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpendeskExtension.registry | quote }}
+        repository: {{ .Values.images.nubusOpendeskExtension.repository }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        tag: {{ .Values.images.nubusOpendeskExtension.tag }}
+
+  # -- Allows to configure the system extensions to load. This is intended for
+  # internal usage, prefer to use `global.extensions` for user configured
+  # extensions.
+  systemExtensions:
+    - name: "portal"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalExtension.registry | quote }}
+        repository: {{ .Values.images.nubusPortalExtension.repository }}
+        tag: {{ .Values.images.nubusPortalExtension.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+  configUcr:
+    directory:
+      manager:
+        rest:
+          authorized-groups:
+            domain-admins: __DELETE_KEY__
+            iam-api-full-access: "cn=IAM API - Full Access,cn=groups,{{ .Values.ldap.baseDn }}"
+        web:
+          modules:
+            users:
+              user:
+                add:
+                  default: "cn=openDesk User,cn=templates,cn=univention,{{ .Values.ldap.baseDn }}"
+                properties:
+                  description:
+                    syntax: "TextArea"
+                  firstname:
+                    required: "true"
+                  mailPrimaryAddress:
+                    required: "true"
+                  username:
+                    syntax: "uid"
+                search:
+                  autosearch: "True"
+                wizard:
+                  property:
+                    invite:
+                      default: "True"
+                    overridePWLength:
+                      default: "False"
+                      visible: "False"
+                    pwdChangeNextLogin:
+                      default: "True"
+                      visible: "False"
+            wizard:
+              disabled: "No"
+
+    ucs:
+      web:
+        theme: "light"
+
+    umc:
+      cookie-banner:
+        show: "false"
+      login:
+        password-complexity-message:
+          de: "Das Passwort muss den folgenden Anforderungen entsprechen:<br><ul><li>Mindestlänge: 8 Zeichen</li></ul>Anmerkung: Wird befinden uns nicht in einer Produktivumgebung."
+          en: "Password must comply with the following rules:<br><ul><li>Minimum length: 8 characters</li></ul>Note: We are in a non production (dev/test/demo) system."
+      module:
+        udm:
+          oxmail:
+            oxcontext:
+              disabled: "True"
+          portals:
+            all:
+              disabled: "True"
+      self-service:
+        account-registration:
+          usertemplate: __DELETE_KEY__
+        passwordreset:
+          token_validity_period: 172800
+          blacklist:
+            groups: __DELETE_KEY__
+
+ingress:
+  certManager:
+    enabled: false
+  tls:
+    enabled: {{ .Values.ingress.tls.enabled }}
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+# Nubus bundled services
+postgresql:
+  enabled: false
+  provisioning:
+    enabled: false
+
+minio:
+  enabled: false
+
+# Nubus services which use customer supplied services
+keycloak:
+  keycloak:
+    auth:
+      username: "kcadmin"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+  postgresql:
+    connection:
+      host: {{ .Values.databases.keycloak.host | quote }}
+      port: {{ .Values.databases.keycloak.port | quote }}
+    auth:
+      username: {{ .Values.databases.keycloak.username | quote }}
+      database: {{ .Values.databases.keycloak.name | quote }}
+      credentialSecret:
+        name: "ums-keycloak-postgresql-opendesk-credentials"
+        key: "keycloakDatabasePassword"
+  config:
+    exposeAdminConsole: {{ .Values.debug.enabled }}
+
+nubusGuardian:
+  provisioning:
+    enabled: false
+    config:
+      nubusBaseUrl: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain }}
+      keycloak:
+        realm: {{ .Values.platform.realm | quote }}
+        username: "kcadmin"
+        connection:
+          host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
+          baseUrl: "http://ums-keycloak:8080"
+        credentialSecret:
+          name: "ums-opendesk-keycloak-credentials"
+          key: "admin_password"
+      managementApi:
+        credentialSecret:
+          name: "ums-opendesk-guardian-client-secret"
+          key: "managementApiClientSecret"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+  postgresql:
+    connection:
+      host: {{ .Values.databases.umsGuardianManagementApi.host | quote }}
+      port: {{ .Values.databases.umsGuardianManagementApi.port | quote }}
+    auth:
+      username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
+      database: {{ .Values.databases.umsGuardianManagementApi.name | quote }}
+      credentialSecret:
+        name: "ums-guardian-postgresql-opendesk-credentials"
+        key: "guardianDatabasePassword"
+
+nubusNotificationsApi:
+  postgresql:
+    connection:
+      host: {{ .Values.databases.umsNotificationsApi.host | quote }}
+      port: {{ .Values.databases.umsNotificationsApi.port | quote }}
+    auth:
+      username: {{ .Values.databases.umsNotificationsApi.username | quote }}
+      database: {{ .Values.databases.umsNotificationsApi.name | quote }}
+      existingSecret: "ums-notifications-api-postgresql-opendesk-credentials"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusPortalFrontend:
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName }}
+
+    # TODO: Remove the block "items" once the "redirects" section has been
+    # corrected.
+    #
+    # This does override the path configuration of the ingress
+    # "ums-portal-frontend-redirects" to avoid that "/univention/*" is
+    # redirected to "/univention/portal/".
+    items:
+      - name: rewrites
+        # -- Define the Fully Qualified Domain Name (FQDN) where application should be reachable.
+        host: ""
+
+        # -- Define the Ingress paths.
+        paths:
+          - path: /univention/(portal|selfservice)/
+            pathType: ImplementationSpecific
+          - path: /univention/(portal|selfservice)/index.html
+            pathType: ImplementationSpecific
+          - path: /univention/(portal|selfservice)/(css|fonts|i18n|media|js|oidc|custom)(/.*)
+            pathType: ImplementationSpecific
+          - path: /univention/(portal)/(icons)(/.*)$
+            pathType: ImplementationSpecific
+
+        # -- The Ingress controller class name.
+        ingressClassName: ""
+
+        # -- Define custom ingress annotations.
+        # annotations:
+        #   nginx.ingress.kubernetes.io/rewrite-target: /
+        annotations:
+          nginx.ingress.kubernetes.io/rewrite-target: "/$2$3"
+          nginx.ingress.kubernetes.io/use-regex: "true"
+
+        # -- Secure an Ingress by specifying a Secret that contains a TLS private key and certificate.
+        #
+        # Ref.: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
+        tls:
+          # enabled: true
+          # Set to override the global secretName
+          secretName: ""
+      - name: redirects
+        host: ""
+        paths:
+          - pathType: Exact
+            path: /$
+          - pathType: Exact
+            path: /univention$
+          - pathType: Exact
+            path: /univention/$
+          - pathType: Exact
+            path: /univention/portal$
+          - pathType: Exact
+            path: /univention/selfservice$
+        ingressClassName: ""
+        annotations:
+          nginx.ingress.kubernetes.io/permanent-redirect: "/univention/portal/"
+        tls:
+          # enabled: true
+          # Set to override the global secretName
+          secretName: ""
+
+nubusKeycloakExtensions:
+  keycloak:
+    auth:
+      username: "kcadmin"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+  proxy:
+    ingress:
+      paths:
+        {{- if .Values.debug.enabled }}
+        - pathType: "Prefix"
+          path: "/admin/"
+        {{- end }}
+        - pathType: "Prefix"
+          path: "/realms/"
+        - pathType: "Prefix"
+          path: "/js/"
+        - pathType: "Prefix"
+          path: "/resources/"
+        - pathType: "Prefix"
+          path: "/fingerprintjs"
+      certManager:
+        enabled: false
+      tls:
+        enabled: {{ .Values.ingress.tls.enabled }}
+        secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+
+  postgresql:
+    connection:
+      host: {{ .Values.databases.keycloakExtension.host | quote }}
+      port: {{ .Values.databases.keycloakExtension.port | quote }}
+    auth:
+      database: {{ .Values.databases.keycloakExtension.name | quote }}
+      username: {{ .Values.databases.keycloakExtension.username | quote }}
+      credentialSecret:
+        name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
+        key: "umcKeycloakExtensionsDatabasePassword"
+  smtp:
+    connection:
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      port: 25
+      ssl: false
+      starttls: false
+    auth:
+      enabled: false
+      username: ""
+      credentialSecret:
+        name: "ums-keycloak-extensions-smtp-opendesk-credentials"
+        key: "umcKeycloakExtensionsSmtpPassword"
+  handler:
+    appConfig:
+      logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
+      newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
+      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+
+nubusPortalListener:
+  enabled: false
+
+nubusPortalConsumer:
+  enabled: true
+  portalConsumer:
+    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
+    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
+  provisioningApi:
+    auth:
+      username: "portal-consumer"
+
+nubusPortalServer:
+  portalServer:
+    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
+    objectStorageCredentialSecret:
+      name: "ums-portal-server-minio-opendesk-credentials"
+      accessKeyKey: "access-key-id"
+      secretKeyKey: "secret-key-id"
+    centralNavigation:
+      enabled: true
+      authenticatorSecretName: "ums-opendesk-portal-server-central-navigation"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusUdmRestApi:
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusProvisioning:
+  enabled: true
+
+nubusUdmListener:
+  enabled: true
+
+nubusSelfServiceListener:
+  enabled: false
+
+nubusSelfServiceConsumer:
+  enabled: true
+
+# Nubus services
+nubusStackDataUms:
+  additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
+    argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
+  stackDataContext:
+    umcPostgresqlHostname: {{ .Values.databases.umsSelfservice.host | quote }}
+    umcPostgresqlUsername: {{ .Values.databases.umsSelfservice.username | quote }}
+    umcMemcachedHostname: {{ .Values.cache.umsSelfservice.host | quote }}
+    umcMemcachedUsername: ""
+    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
+    umcHtmlTitle: "openDesk Portal"
+    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    smtpPort: 25
+    smtpUser: ""
+    smtpStartTls: false
+    ldapBase: {{ .Values.ldap.baseDn }}
+  templateContext:
+    # creates the default.user and default.admin
+    loadDevData: true
+    portalHeaderLogo: {{ toYaml .Values.theme.imagery.logoHeaderSvgB64 | quote }}
+    portalTiles: {{ toYaml .Values.theme.portalTiles | nindent 6 }}
+    portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }}
+    portalRealtimeVideoconferenceLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.jitsi .Values.global.domain }}
+    portalManagementProjectLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openproject .Values.global.domain }}
+    portalManagementKnowledgeLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.xwiki .Values.global.domain }}
+    portalGroupwareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
+    portalFileshareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.nextcloud .Values.global.domain }}
+    portalTitleDE: "openDesk Portal"
+    portalTitleEN: "openDesk Portal"
+    oxDefaultContext: "1"
+    ldapSearchUsers:
+      {{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
+      - username: {{ printf "ldapsearch_%s" $username | quote }}
+        password: {{ $password | quote }}
+        lastname: "LDAP-Search-User"
+      {{- end }}
+    ldapSystemUsers: []
+    portaltileGroupUserStandard:
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupUserAdmin:
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Support,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupUserAll:
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupGroupware:
+      - 'cn=managed-by-attribute-Groupware,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupFileshare:
+      - 'cn=managed-by-attribute-Fileshare,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementProject:
+      - 'cn=managed-by-attribute-Projectmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementKnowledge:
+      - 'cn=managed-by-attribute-Knowledgemanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementLearn:
+      - 'cn=managed-by-attribute-Learnmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupLiveCollaboration:
+      - 'cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}'
+    systemInformation:
+      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
+      {{- if .Values.functional.admin.portal.deploymentTimestamp.enabled }}
+      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
+      {{- else }}
+      deployDate: false
+      {{- end }}
+  # In openDesk the external memcache does not expect a username to be set. Overwriting
+  # the default username of `selfservice` is part of the customizing:
+  nubusUmcServer:
+    memcached:
+      auth:
+        username: ""
+
+nubusUmcServer:
+  postgresql:
+    bundled: false
+    connection:
+      host: {{ .Values.databases.umsSelfservice.host | quote }}
+      port: {{ .Values.databases.umsSelfservice.port | quote }}
+    auth:
+      username: {{ .Values.databases.umsSelfservice.username | quote }}
+      database: {{ .Values.databases.umsSelfservice.name | quote }}
+      credentialSecret:
+        name: "ums-umc-server-postgresql-opendesk-credentials"
+        key: "umcServerDatabasePassword"
+  memcached:
+    bundled: false
+    server: {{ .Values.cache.umsSelfservice.host | quote }}
+    auth:
+      credentialSecret:
+        name: "ums-umc-server-memcached-opendesk-credentials"
+        key: "umcServerMemcachedPassword"
+  smtp:
+    credentialSecret:
+      name: "ums-umc-server-smtp-credentials-custom"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusUmcGateway:
+  umcGateway:
+    umcHtmlTitle: "openDesk Portal"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+    # TODO: Remove the block "paths" once it has been corrected upstream.
+    paths:
+        - path: /()(univention/)(languages.json|meta.json|theme.css)
+          pathType: ImplementationSpecific
+        - path: /()(univention/)((js|management|themes)/.*)
+          pathType: ImplementationSpecific
+        - path: /()(univention/login/)(dialog.js|main.js|LoginDialog.js|i18n/.*?/main.json)
+          pathType: ImplementationSpecific
+
+nubusKeycloakBootstrap:
+  additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
+  keycloak:
+    auth:
+      username: "kcadmin"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+  bootstrap:
+    ldapMappers:
+      - ldapAndUserModelAttributeName: "opendeskProjectmanagementAdmin"
+      - ldapAndUserModelAttributeName: "oxContextIDNum"
+    twoFactorAuthentication:
+      enabled: true
+      group: "2fa-users"
+  ldap:
+    auth:
+      bindDn: {{ printf "uid=ldapsearch_keycloak,cn=users,%s" .Values.ldap.baseDn }}
+      credentialSecret:
+        name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
+
+# Credential secrets for accessing customer supplied services
+extraSecrets:
+  - name: "ums-opendesk-portal-server-central-navigation"
+    stringData:
+      authenticator.secret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  - name: "ums-opendesk-guardian-client-secret"
+    stringData:
+      managementApiClientSecret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
+  - name: "ums-opendesk-keycloak-credentials"
+    stringData:
+      admin_password: {{ .Values.secrets.keycloak.adminPassword | quote }}
+  - name: "ums-keycloak-postgresql-opendesk-credentials"
+    stringData:
+      keycloakDatabasePassword: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
+  - name: "ums-guardian-postgresql-opendesk-credentials"
+    stringData:
+      guardianDatabasePassword: {{ .Values.databases.umsGuardianManagementApi.password | default .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
+  - name: "ums-notifications-api-postgresql-opendesk-credentials"
+    stringData:
+      password: {{ .Values.databases.umsNotificationsApi.password | default .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
+  - name: "ums-umc-server-postgresql-opendesk-credentials"
+    stringData:
+      umcServerDatabasePassword: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
+  - name: "ums-umc-server-memcached-opendesk-credentials"
+    stringData:
+      umcServerMemcachedPassword: ""
+  - name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
+    stringData:
+      umcKeycloakExtensionsDatabasePassword: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
+  - name: "ums-keycloak-extensions-smtp-opendesk-credentials"
+    stringData:
+      umcKeycloakExtensionsSmtpPassword: ""
+  - name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
+    stringData:
+      password: {{ .Values.secrets.nubus.ldapSearch.keycloak | quote }}
+  - name: "ums-portal-server-minio-opendesk-credentials"
+    stringData:
+      access-key-id: {{ .Values.objectstores.nubus.username | quote }}
+      secret-key-id: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+  - name: "ums-umc-server-smtp-credentials-custom"
+    stringData:
+      password: ""
--- a/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
@@ -0,0 +1,630 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+keycloak:
+  enabled: true
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: false
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsKeycloak | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-keycloak"
+  replicaCount: {{ .Values.replicas.keycloak }}
+  resources:
+    {{ .Values.resources.umsKeycloak | toYaml | nindent 4 }}
+
+nubusGuardian:
+  authorizationApi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-guardian-authorization-api"
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    replicaCount: {{ .Values.replicas.umsGuardianAuthorizationApi }}
+    resources:
+      {{ .Values.resources.umsGuardianAuthorizationApi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianAuthorizationApi | toYaml | nindent 8 }}
+  managementApi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-guardian-management-api"
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    replicaCount: {{ .Values.replicas.umsGuardianManagementApi }}
+    resources:
+      {{ .Values.resources.umsGuardianManagementApi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianManagementApi | toYaml | nindent 8 }}
+  managementUi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-guardian-management-ui"
+    replicaCount: {{ .Values.replicas.umsGuardianManagementUi }}
+    resources:
+      {{ .Values.resources.umsGuardianManagementUi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianManagementUi | toYaml | nindent 8 }}
+  openPolicyAgent:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-ums-open-policy-agent"
+    replicaCount: {{ .Values.replicas.umsGuardianOpenPolicyAgent }}
+    resources:
+      {{ .Values.resources.umsOpenPolicyAgent | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsGuardianOpenPolicyAgent | toYaml | nindent 8 }}
+  provisioning:
+    # Using openDesk keycloak provisioning
+    enabled: false
+
+nubusNotificationsApi:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-notifications-api"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsNotificationsApi | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    create: true
+  replicaCount: {{ .Values.replicas.umsNotificationsApi }}
+  resources:
+    {{ .Values.resources.umsNotificationsApi | toYaml | nindent 4 }}
+
+nubusUmcServer:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-umc-server"
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  containerSecurityContextInit:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  proxy:
+    replicaCount: {{ .Values.replicas.umsUmcServerProxy }}
+  replicaCount: {{ .Values.replicas.umsUmcServer }}
+
+  resources:
+    {{ .Values.resources.umsUmcServer | toYaml | nindent 4 }}
+  selfService:
+    passwordresetEmailBody: |
+        Sehr geehrte Benutzerin, sehr geehrter Benutzer,
+
+        Ihr Benutzername für {domainname} lautet: {username}
+
+        Sie erhalten diese Nachricht, da Sie Ihr Passwort zurücksetzen möchten oder weil Ihr Benutzer neu im System angelegt wurde.
+
+        Klicken Sie bitte auf den folgenden Link, um Ihr Passwort zu setzen:
+        https://{fqdn}/univention/portal/#/selfservice/newpassword/?token={token}&username={username}
+
+        Der genannte Link ist nur 48 Stunden gültig, danach fordern Sie ihn bitte erneut an unter:
+        https://{fqdn}/univention/portal/#/selfservice/passwordforgotten
+
+        Mit freundlichen Grüßen
+        Ihr {domainname} Passwort-Service
+
+nubusKeycloakExtensions:
+  handler:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    replicaCount: {{ .Values.replicas.umsKeycloakExtensionsHandler }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-keycloak-extensions-handler"
+    resources:
+      {{ .Values.resources.umsKeycloakExtensionHandler | toYaml | nindent 6 }}
+    securityContext:
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler | toYaml | nindent 8 }}
+  proxy:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    replicaCount: {{ .Values.replicas.umsKeycloakExtensionsProxy }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-keycloak-extensions-proxy"
+    resources:
+      {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 6 }}
+    securityContext:
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler | toYaml | nindent 8 }}
+
+nubusPortalConsumer:
+  portalConsumer:
+    image:
+      pullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . | quote }}
+        {{- end }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-portal-consumer"
+  replicaCount: {{ .Values.replicas.umsPortalConsumer }}
+  resources:
+    {{ .Values.resources.umsPortalConsumer | toYaml | nindent 4 }}
+  resourcesWaitForDependency:
+    {{ .Values.resources.umsPortalConsumerDependencies | toYaml | nindent 4 }}
+  persistence:
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.portalConsumer | quote }}
+  securityContext:
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalConsumer | toYaml | nindent 6 }}
+
+nubusUdmListener:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 102
+    runAsGroup: 65534
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUdmListener | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUdmListener }}
+  resources:
+    {{ .Values.resources.umsUdmListener | toYaml | nindent 4 }}
+
+nubusPortalServer:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-portal-server"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalServer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    create: true
+  replicaCount: {{ .Values.replicas.umsPortalServer }}
+  resources:
+    {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
+
+nubusLdapNotifier:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 101
+    runAsGroup: 102
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsLdapNotifier | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-ldap-notifier"
+  replicaCount: {{ .Values.replicas.umsLdapNotifier }}
+  resources:
+    {{ .Values.resources.umsLdapNotifier | toYaml | nindent 4 }}
+
+nubusLdapServer:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  highAvailabilityMode: false
+  replicaCountPrimary: 1
+  replicaCountSecondary: 0 # {{ .Values.replicas.umsLdapServerSecondary }}
+  replicaCountProxy: 0 # {{ .Values.replicas.umsLdapServerProxy }}
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-ldap-server"
+  serviceAccount:
+    create: true
+  initResources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
+  resources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
+  persistence:
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.ldapServerData | quote }}
+  extraVolumes:
+    - name: "migration-scripts"
+      secret:
+        secretName: "ums-ldap-server-migration"
+        defaultMode: 0555
+  extraVolumeMounts:
+    - name: "migration-scripts"
+      mountPath: "/entrypoint.d/30-purge.sh"
+      subPath: "30-purge.sh"
+    - name: "migration-scripts"
+      mountPath: "/entrypoint.d/95-slapadd-24-ldiff.sh"
+      subPath: "95-slapadd-24-ldif.sh"
+  extraSecrets:
+    - name: "ums-ldap-server-migration"
+      stringData:
+        30-purge.sh: |
+          #!/usr/bin/env bash
+          me=$(basename "$0")
+          echo "- Running ${me}"
+          if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
+            echo "- Cleaning up /var/lib/univention-ldap."
+            cd /var/lib/univention-ldap
+            rm -rf internal
+            rm -rf ldap
+            ls -l
+          else
+            echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
+          fi
+        95-slapadd-24-ldif.sh: |
+          #!/usr/bin/env bash
+          me=$(basename "$0")
+          echo "- Running ${me}"
+          ls -l /var/lib/univention-ldap
+          if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
+            echo "- slapadd-ing /var/lib/univention-ldap/ldap-24-export.ldif"
+            ls -l /var/lib/univention-ldap/
+            rm -rf /var/lib/univention-ldap/ldap
+            rm -rf /var/lib/univention-ldap/internal
+            echo "- deleted /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
+            ls -l /var/lib/univention-ldap/
+            mkdir /var/lib/univention-ldap/ldap
+            mkdir /var/lib/univention-ldap/internal
+            echo "- created /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
+            ls -l /var/lib/univention-ldap/
+            /usr/sbin/slapadd -v -l /var/lib/univention-ldap/ldap-24-export.ldif
+            echo "- slapadd executed"
+            ls -l /var/lib/univention-ldap/
+            mv /var/lib/univention-ldap/ldap-24-export.ldif /var/lib/univention-ldap/ldap-24-export.ldif-imported
+            echo "- import file renamed"
+            ls -l /var/lib/univention-ldap/
+          else
+            echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
+          fi
+nubusPortalFrontend:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-portal-frontend"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalFrontend | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    create: true
+  replicaCount: {{ .Values.replicas.umsPortalFrontend }}
+  resources:
+    {{ .Values.resources.umsPortalFrontend | toYaml | nindent 4 }}
+  portalFrontend:
+    branding:
+      css: {{ .Values.theme.imagery.portalCss | toJson }}
+      favicon: {{ .Values.theme.imagery.faviconIcoB64 | toJson }}
+      logo: {{ .Values.theme.imagery.logoHeaderSvgB64 | toJson }}
+      backgroundImage: {{ .Values.theme.imagery.logoPortalBackgroundSvgB64 | toJson }}
+
+nubusStackDataUms:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsStackDataUms | toYaml | nindent 6 }}
+  pullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-stack-data-ums"
+  resources:
+    {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}
+
+nubusSelfServiceConsumer:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsSelfserviceConsumer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-selfservice-listener"
+  resources:
+    {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsSelfserviceConsumer }}
+
+nubusUdmRestApi:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-udm-rest-api"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUdmRestApi | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    annotations:
+      intended.usage: "compliance"
+  resources:
+    {{ .Values.resources.umsUdmRestApi | toYaml | nindent 4 }}
+  initResources:
+    {{ .Values.resources.umsUdmRestApiInit | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUdmRestApi }}
+
+nubusUmcGateway:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcGateway | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUmcGateway }}
+  resources:
+    {{ .Values.resources.umsUmcGateway | toYaml | nindent 4 }}
+
+nubusKeycloakBootstrap:
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    readOnlyRootFilesystem: false
+    runAsGroup: 1000
+    runAsNonRoot: true
+    runAsUser: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsKeycloakBootstrap | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-keycloak-bootstrap"
+  serviceAccount:
+    annotations:
+      intended.usage: "compliance"
+  resources:
+    {{ .Values.resources.umsKeycloakBootstrap | toYaml | nindent 4 }}
+
+nubusProvisioning:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsProvisioning | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount:
+    dispatcher: {{ .Values.replicas.umsProvisioningDispatcher }}
+    udmTransformer: {{ .Values.replicas.umsProvisioningUdmTransformer }}
+    prefill: {{ .Values.replicas.umsProvisioningPrefill }}
+    api: {{ .Values.replicas.umsProvisioningApi }}
+
+  serviceAccount:
+    create: true
+  nats:
+    config:
+      cluster:
+        replicas: {{ .Values.replicas.umsProvisioningNats }}
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - "ALL"
+      enabled: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      seccompProfile:
+        type: "RuntimeDefault"
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsProvisioningNats | toYaml | nindent 8 }}
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    persistence:
+      size: {{ .Values.persistence.size.nubus.provisioningNats }}
+    resources:
+      {{ .Values.resources.umsProvisioningNats | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-nats"
+    serviceAccount:
+      create: true
+  api:
+    resources:
+      {{ .Values.resources.umsProvisioningApi | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-api"
+  dispatcher:
+    resources:
+      {{ .Values.resources.umsProvisioningDispatcher | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-dispatcher"
+  prefill:
+    resources:
+      {{ .Values.resources.umsProvisioningPrefill | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-prefill"
+  registerConsumers:
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-register-consumers"
+  udmTransformer:
+    resources:
+      {{ .Values.resources.umsProvisioningUdmTransformer | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-udm-transformer"
+  resources:
+    registerConsumers:
+      {{ .Values.resources.umsProvisioningRegisterConsumers | toYaml | nindent 6 }}
--- a/helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl
@@ -0,0 +1,260 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+keycloak:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloak.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloak.repository }}
+    tag: {{ .Values.images.nubusKeycloak.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusKeycloakBootstrap:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakBootstrap.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloakBootstrap.repository }}
+    tag: {{ .Values.images.nubusKeycloakBootstrap.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusKeycloakExtensions:
+    handler:
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionHandler.registry | quote }}
+        repository: {{ .Values.images.nubusKeycloakExtensionHandler.repository }}
+        tag: {{ .Values.images.nubusKeycloakExtensionHandler.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+    proxy:
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionProxy.registry | quote }}
+        repository: {{ .Values.images.nubusKeycloakExtensionProxy.repository }}
+        tag: {{ .Values.images.nubusKeycloakExtensionProxy.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusLdapNotifier:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapNotifier.registry | quote }}
+    repository: {{ .Values.images.nubusLdapNotifier.repository }}
+    tag: {{ .Values.images.nubusLdapNotifier.tag }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusLdapServer:
+  ldapServer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServer.registry | quote }}
+      repository: {{ .Values.images.nubusLdapServer.repository }}
+      tag: {{ .Values.images.nubusLdapServer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  dhInitcontainer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServerDhInitContainer.registry | quote }}
+      repository: {{ .Values.images.nubusLdapServerDhInitContainer.repository }}
+      tag: {{ .Values.images.nubusLdapServerDhInitContainer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusNotificationsApi:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusNotificationsApi.registry | quote }}
+    repository: {{ .Values.images.nubusNotificationsApi.repository }}
+    tag: {{ .Values.images.nubusNotificationsApi.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalFrontend:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalFrontend.registry | quote }}
+    repository: {{ .Values.images.nubusPortalFrontend.repository }}
+    tag: {{ .Values.images.nubusPortalFrontend.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalConsumer:
+  portalConsumer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalConsumer.registry | quote }}
+      repository: {{ .Values.images.nubusPortalConsumer.repository }}
+      tag: {{ .Values.images.nubusPortalConsumer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalServer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalServer.registry | quote }}
+    repository: {{ .Values.images.nubusPortalServer.repository }}
+    tag: {{ .Values.images.nubusPortalServer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusProvisioning:
+  api:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningEventsAndConsumerApi.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
+      tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  dispatcher:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningDispatcher.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningDispatcher.repository }}
+      tag: {{ .Values.images.nubusProvisioningDispatcher.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  udmTransformer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningUdmTransformer.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningUdmTransformer.repository }}
+      tag: {{ .Values.images.nubusProvisioningUdmTransformer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  prefill:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningPrefill.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
+      tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registerConsumers:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  nats:
+    nats:
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNats.registry | quote }}
+        repository: {{ .Values.images.nubusNats.repository }}
+        tag: {{ .Values.images.nubusNats.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    reloader:
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsReloader.registry | quote }}
+        repository: {{ .Values.images.nubusNatsReloader.repository }}
+        tag: {{ .Values.images.nubusNatsReloader.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    natsBox:
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsBox.registry | quote }}
+        repository: {{ .Values.images.nubusNatsBox.repository }}
+        tag: {{ .Values.images.nubusNatsBox.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusProvisioningEventsAndConsumerApi:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningEventsAndConsumerApi.registry | quote }}
+    repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
+    tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusProvisioningPrefill:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningPrefill.registry | quote }}
+    repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
+    tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUdmListener:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningUdmListener.registry | quote }}
+    repository: {{ .Values.images.nubusProvisioningUdmListener.repository }}
+    tag: {{ .Values.images.nubusProvisioningUdmListener.tag }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusSelfServiceConsumer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusSelfServiceConsumer.registry | quote }}
+    repository: {{ .Values.images.nubusSelfServiceConsumer.repository }}
+    tag: {{ .Values.images.nubusSelfServiceConsumer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUdmRestApi:
+  udmRestApi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUdmRestApi.registry | quote }}
+      repository: {{ .Values.images.nubusUdmRestApi.repository }}
+      tag: {{ .Values.images.nubusUdmRestApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUmcGateway:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUmcGateway.registry | quote }}
+    repository: {{ .Values.images.nubusUmcGateway.repository }}
+    tag: {{ .Values.images.nubusUmcGateway.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUmcServer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUmcServer.registry | quote }}
+    repository: {{ .Values.images.nubusUmcServer.repository }}
+    tag: {{ .Values.images.nubusUmcServer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  proxy:
+    image:
+      registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusUmcServerProxy.registry | quote }}
+      repository: {{ .Values.images.nubusUmcServerProxy.repository }}
+      tag: {{ .Values.images.nubusUmcServerProxy.tag }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusWaitForDependency:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+
+nubusGuardian:
+  provisioning:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianProvisioning.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianProvisioning.repository }}
+      tag: {{ .Values.images.nubusGuardianProvisioning.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  authorizationApi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianAuthorizationApi.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianAuthorizationApi.repository }}
+      tag: {{ .Values.images.nubusGuardianAuthorizationApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  managementApi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianManagementApi.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianManagementApi.repository }}
+      tag: {{ .Values.images.nubusGuardianManagementApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  managementUi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianManagementUi.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianManagementUi.repository }}
+      tag: {{ .Values.images.nubusGuardianManagementUi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  openPolicyAgent:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpenPolicyAgent.registry | quote }}
+      repository: {{ .Values.images.nubusOpenPolicyAgent.repository }}
+      tag: {{ .Values.images.nubusOpenPolicyAgent.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusStackDataUms:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusDataLoader.registry | quote }}
+    repository: {{ .Values.images.nubusDataLoader.repository }}
+    tag: {{ .Values.images.nubusDataLoader.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
--- a/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
@@ -11,16 +11,25 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.opendeskKeycloakBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.opendeskKeycloakBootstrap.registry | quote }}
  repository: {{ .Values.images.opendeskKeycloakBootstrap.repository | quote }}
  tag: {{ .Values.images.opendeskKeycloakBootstrap.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
-  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}

 config:
+  custom:
+    clientScopes:
+      {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
+    clients:
+      {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
+  managed:
+    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
+    # 'guardian-management-api', 'guardian-scripts', 'guardian-ui' clients have been added explicitly for the moment (see further down this file)
+    clients: [ 'opendesk-intercom', 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
  keycloak:
    adminUser: "kcadmin"
    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
@@ -29,14 +38,19 @@ config:
      enabled: true
      internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
  twoFactorSettings:
-    additionalGroups: {{ .Values.authentication.twoFactor.groups }}
-  custom:
+    additionalGroups: {{ .Values.functional.authentication.twoFactor.groups }}
+  opendesk:
+    # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
+    # to LDAP group membership to ensure a user cannot access an application without the required
+    # group membership.
+    # ToDo: Ensure all applications verify the token's signature to ensure it is not tampered.
    clientScopes:
      - name: "read_contacts"
        protocol: "openid-connect"
      - name: "write_contacts"
        protocol: "openid-connect"
-      - name: "opendesk"
+      - name: "opendesk-openproject-scope"
+        description: "Scope for the claims required by openDesk's OpenProject instance."
        protocol: "openid-connect"
        protocolMappers:
          - name: "opendesk_useruuid"
@@ -61,6 +75,306 @@ config:
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
+          - name: "opendeskProjectmanagementAdmin"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "opendeskProjectmanagementAdmin"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "openproject_admin"
+              jsonType.label: "String"
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+          - name: "given name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "firstName"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "given_name"
+              jsonType.label: "String"
+          - name: "family name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "lastName"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "family_name"
+              jsonType.label: "String"
+      - name: "opendesk-jitsi-scope"
+        description: "Scope for the claims required by openDesk's Jitsi instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+          - name: "full name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-full-name-mapper"
+            consentRequired: false
+            config:
+              id.token.claim: true
+              introspection.token.claim: true
+              access.token.claim: true
+              userinfo.token.claim: true
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+      - name: "opendesk-nextcloud-scope"
+        description: "Scope for the claims required by openDesk's Nextcloud instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+          - name: "context"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "oxContextIDNum"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "context"
+              jsonType.label: "String"
+      - name: "opendesk-matrix-scope"
+        description: "Scope for the claims required by openDesk's Matrix instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+          - name: "full name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-full-name-mapper"
+            consentRequired: false
+            config:
+              id.token.claim: true
+              introspection.token.claim: true
+              access.token.claim: true
+              userinfo.token.claim: true
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+      - name: "opendesk-xwiki-scope"
+        description: "Scope for the claims required by openDesk's XWiki instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+          - name: "full name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-full-name-mapper"
+            consentRequired: false
+            config:
+              id.token.claim: true
+              introspection.token.claim: true
+              access.token.claim: true
+              userinfo.token.claim: true
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+      - name: "opendesk-dovecot-scope"
+        description: "Scope for the claims required by openDesk's Dovecot instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+      - name: "opendesk-oxappsuite-scope"
+        description: "Scope for the claims required by openDesk's OX Appuite instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "context"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "oxContextIDNum"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "context"
+              jsonType.label: "String"
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
    clients:
      - name: "opendesk-dovecot"
        clientId: "opendesk-dovecot"
@@ -74,62 +388,7 @@ config:
        attributes:
          backchannel.logout.session.required: false
        defaultClientScopes:
-          - "opendesk"
-      - name: "opendesk-intercom"
-        clientId: "opendesk-intercom"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/callback"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.revoke.offline.tokens: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
-        protocolMappers:
-          - name: "intercom-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "opendesk-intercom"
-              id.token.claim: false
-              access.token.claim: true
-          # temporary additional claim while entryuuid is a hardcoded attribute in IntercomService and we cannot set
-          # it to `opendesk_useruuid` standard claim. For reference:
-          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/app.js#L89
-          - name: "entryuuid_temp"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "entryUUID"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "entryuuid"
-              jsonType.label: "String"
-          # temporary additional claim while phoenixusername is a hardcoded attribute in IntercomService and we cannot
-          # set it to `opendesk_username` standard claim. For reference:
-          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/routes/navigation.js#L27
-          - name: "phoenixusername_temp"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "phoenixusername"
-              jsonType.label: "String"
-        defaultClientScopes:
-          - "opendesk"
-          - "offline_access"
+          - "opendesk-dovecot-scope"
      - name: "opendesk-jitsi"
        clientId: "opendesk-jitsi"
        protocol: "openid-connect"
@@ -142,8 +401,7 @@ config:
        fullScopeAllowed: true
        authorizationServicesEnabled: false
        defaultClientScopes:
-          - "opendesk"
-          - "profile"
+          - "opendesk-jitsi-scope"
      - name: "opendesk-matrix"
        clientId: "opendesk-matrix"
        protocol: "openid-connect"
@@ -152,7 +410,7 @@ config:
        redirectUris:
          - "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*"
          - "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        standardFlowEnabled: true
        directAccessGrantsEnabled: true
        serviceAccountsEnabled: true
@@ -163,14 +421,11 @@ config:
        attributes:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
-          - "opendesk"
-        optionalClientScopes:
-          - "email"
-          - "profile"
-        # This is a temporary OIDC client for matrix, as the OIDC logout still uses "matrix" as client ID. Unless that
-        # is solved and also is able to use "opendesk-matrix" we keep that dummy client that
+          - "opendesk-matrix-scope"
+      # The following is a temporary OIDC client for matrix, as the OIDC logout still uses "matrix" as client ID.
+      # Unless that is solved and also is able to use "opendesk-matrix" we keep that dummy client that
      - name: "matrix"
        clientId: "matrix"
        protocol: "openid-connect"
@@ -182,7 +437,9 @@ config:
        publicClient: false
        authorizationServicesEnabled: false
        attributes:
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+        defaultClientScopes: []
+        optionalClientScopes: []
      - name: "opendesk-nextcloud"
        clientId: "opendesk-nextcloud"
        protocol: "openid-connect"
@@ -190,30 +447,17 @@ config:
        secret: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
        authorizationServicesEnabled: false
        attributes:
          backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/index.php/apps/user_oidc/backchannel-logout/opendesk"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
-        protocolMappers:
-          - name: "context"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "oxContextIDNum"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "context"
-              jsonType.label: "String"
+          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/user_oidc/backchannel-logout/opendesk"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
-          - "opendesk"
-          - "email"
+          - "opendesk-nextcloud-scope"
          - "read_contacts"
          - "write_contacts"
      - name: "opendesk-openproject"
@@ -223,7 +467,7 @@ config:
        secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
@@ -232,23 +476,9 @@ config:
        attributes:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
-        protocolMappers:
-          - name: "opendeskProjectmanagementAdmin"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "opendeskProjectmanagementAdmin"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "openproject_admin"
-              jsonType.label: "String"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
-          - "opendesk"
-          - "email"
-          - "profile"
+          - "opendesk-openproject-scope"
      - name: "opendesk-oxappsuite"
        clientId: "opendesk-oxappsuite"
        protocol: "openid-connect"
@@ -256,7 +486,7 @@ config:
        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
@@ -264,21 +494,9 @@ config:
        attributes:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
-        protocolMappers:
-          - name: "context"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "oxContextIDNum"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "context"
-              jsonType.label: "String"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
-          - "opendesk"
+          - "opendesk-oxappsuite-scope"
          - "read_contacts"
          - "write_contacts"
      - name: "opendesk-xwiki"
@@ -288,7 +506,7 @@ config:
        secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
@@ -296,304 +514,9 @@ config:
        attributes:
          backchannel.logout.session.required: false
          backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/oidc/authenticator/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
-          - "opendesk"
-          - "address"
-          - "email"
-          - "profile"
-      - name: "guardian-management-api"
-        clientId: "guardian-management-api"
-        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        protocol: "openid-connect"
-        publicClient: false
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
-        fullScopeAllowed: true
-        standardFlowEnabled: true
-        implicitFlowEnabled: false
-        directAccessGrantsEnabled: false
-        serviceAccountsEnabled: true
-        protocolMappers:
-          - name: "Client Host"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usersessionmodel-note-mapper"
-            consentRequired: false
-            config:
-              user.session.note: "clientHost"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "clientHost"
-              jsonType.label: "String"
-          - name: "Client ID"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usersessionmodel-note-mapper"
-            consentRequired: false
-            config:
-              user.session.note: "client_id"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "client_id"
-              jsonType.label: "String"
-          - name: "guardian-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              userinfo.token.claim: false
-              id.token.claim: false
-              access.token.claim: true
-          - name: "audiencemap"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian-cli"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-          - name: "dn"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: false
-              user.attribute: "LDAP_ENTRY_DN"
-              id.token.claim: false
-              access.token.claim: true
-              claim.name: "dn"
-              jsonType.label: "String"
-          - name: "username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "username"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "preferred_username"
-              jsonType.label: "String"
-          - name: "uid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "uid"
-              jsonType.label: "String"
-          - name: "email"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "email"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "email"
-              jsonType.label: "String"
-          - name: "Client IP Address"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usersessionmodel-note-mapper"
-            consentRequired: false
-            config:
-              user.session.note: "clientAddress"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "clientAddress"
-              jsonType.label: "String"
-      - name: "guardian-scripts"
-        clientId: "guardian-scripts"
-        description: ""
-        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        adminUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        surrogateAuthRequired: false
-        enabled: true
-        alwaysDisplayInConsole: false
-        clientAuthenticatorType: "client-secret"
-        redirectUris:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
-        webOrigins:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        bearerOnly: false
-        consentRequired: false
-        standardFlowEnabled: true
-        implicitFlowEnabled: false
-        directAccessGrantsEnabled: true
-        serviceAccountsEnabled: false
-        publicClient: true
-        frontchannelLogout: false
-        protocol: "openid-connect"
-        fullScopeAllowed: true
-        protocolMappers:
-          - name: "email"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "email"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "email"
-              jsonType.label: "String"
-          - name: "guardian-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              id.token.claim: false
-              access.token.claim: true
-              userinfo.token.claim: false
-          - name: "username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "username"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "preferred_username"
-              jsonType.label: "String"
-          - name: "uid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "uid"
-              jsonType.label: "String"
-          - name: "audiencemap"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian-scripts"
-              id.token.claim: true
-              access.token.claim: true
-              userinfo.token.claim: true
-          - name: "dn"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              aggregate.attrs: false
-              multivalued: false
-              userinfo.token.claim: false
-              user.attribute: "LDAP_ENTRY_DN"
-              id.token.claim: false
-              access.token.claim: true
-              claim.name: "dn"
-              jsonType.label: "String"
-        defaultClientScopes:
-          - "opendesk"
-          - "web-origins"
-          - "acr"
-          - "roles"
-          - "profile"
-          - "email"
-        optionalClientScopes:
-          - "address"
-          - "phone"
-          - "offline_access"
-          - "microprofile-jwt"
-      - name: "guardian-ui"
-        clientId: "guardian-ui"
-        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        clientAuthenticatorType: "client-secret"
-        redirectUris:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
-        standardFlowEnabled: true
-        publicClient: true
-        implicitFlowEnabled: false
-        directAccessGrantsEnabled: false
-        serviceAccountsEnabled: false
-        protocol: "openid-connect"
-        fullScopeAllowed: true
-        protocolMappers:
-          - name: "uid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "uid"
-              jsonType.label: "String"
-          - name: "username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "username"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "preferred_username"
-              jsonType.label: "String"
-          - name: "dn"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: "false"
-              user.attribute: "LDAP_ENTRY_DN"
-              id.token.claim: false
-              access.token.claim: true
-              claim.name: "dn"
-              jsonType.label: "String"
-          - name: "audiencemap"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              id.token.claim: true
-              access.token.claim: true
-              userinfo.token.claim: true
-          - name: "email"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "email"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "email"
-              jsonType.label: "String"
-          - name: "guardian-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              id.token.claim: false
-              access.token.claim: true
-              userinfo.token.claim: false
-
+          - "opendesk-xwiki-scope"

 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/\
-      {{ .Values.charts.dovecot.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"

  # Open-Xchange
  - name: "open-xchange-repo"
@@ -20,8 +19,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/\
-      {{ .Values.charts.openXchangeAppSuite.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"

  # openDesk Open-Xchange Bootstrap
  # Source:
@@ -32,8 +30,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
-      {{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/{{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
+
+  # OX Connector
+  - name: "ox-connector-repo"
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"

 releases:
  - name: "dovecot"
@@ -41,6 +45,7 @@ releases:
    version: "{{ .Values.charts.dovecot.version }}"
    values:
      - "values-dovecot.yaml.gotmpl"
+      - {{ .Values.customization.release.dovecot | default "additionalValues: false" }}
    installed: {{ .Values.dovecot.enabled }}
    timeout: 900

@@ -50,6 +55,7 @@ releases:
    values:
      - "values-openxchange.yaml.gotmpl"
      - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
+      - {{ .Values.customization.release.openXchange | default "additionalValues: false" }}
    installed: {{ .Values.oxAppsuite.enabled }}
    timeout: 900

@@ -58,9 +64,20 @@ releases:
    version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
    values:
      - "values-openxchange-bootstrap.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskOpenXchangeBootstrap | default "additionalValues: false" }}
    installed: {{ .Values.oxAppsuite.enabled }}
    timeout: 900

+  - name: "ox-connector"
+    chart: "ox-connector-repo/{{ .Values.charts.oxConnector.name }}"
+    version: "{{ .Values.charts.oxConnector.version }}"
+    values:
+      - "values-oxconnector.yaml.gotmpl"
+      - {{ .Values.customization.release.oxConnector | default "additionalValues: false" }}
+    installed: {{ .Values.oxAppsuite.enabled }}
+    needs:
+      - "open-xchange"
+
 commonLabels:
  deploy-stage: "component-1"
  component: "open-xchange"
--- a/helmfile/apps/open-xchange/helmfile.yaml
+++ b/helmfile/apps/open-xchange/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/open-xchange/helmfile.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -1,18 +1,17 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.dovecot.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.dovecot.registry | quote }}
  repository: {{ .Values.images.dovecot.repository | quote }}
  tag: {{ .Values.images.dovecot.tag | quote }}
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . | quote }}
-{{- end }}
+  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}

 dovecot:
  mailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
@@ -23,7 +22,7 @@ dovecot:
    port: 389
    base: "dc=swp-ldap,dc=internal"
    dn: "uid=ldapsearch_dovecot,cn=users,dc=swp-ldap,dc=internal"
-    password: {{ .Values.secrets.univentionManagementStack.ldapSearch.dovecot | quote }}
+    password: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
  oidc:
    enabled: true
    clientID: "opendesk-dovecot"
@@ -31,12 +30,12 @@ dovecot:
    introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
    introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
    usernameAttribute: "opendesk_username"
-  loginTrustedNetworks: {{ .Values.cluster.networking.cidr | quote }}
+  loginTrustedNetworks: {{ join " " .Values.cluster.networking.cidr | quote }}

  submission:
    enabled: true
    ssl: "no"
-    host: "postfix:25"
+    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"

 certificate:
  secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -67,6 +66,9 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.dovecot | toYaml | nindent 4 }}

+
+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 1000
--- a/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl
@@ -1,20 +1,29 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
+
+containerSecurityContext:
+  seccompProfile:
+    type: "RuntimeDefault"
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.openxchangeBootstrap | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.openxchangeBootstrap.registry | quote }}
  url: {{ .Values.images.openxchangeBootstrap.repository | quote }}
  tag: {{ .Values.images.openxchangeBootstrap.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . | quote }}
-{{- end }}
+  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
+
+podAnnotations:
+  argocd.argoproj.io/hook: "Sync"
+  argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
 ...
--- a/helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 appsuite:
  core-mw:
@@ -23,7 +26,7 @@ appsuite:
            type: "adminDN"
            adminDN:
              dn: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
-              password: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
+              password: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}

    uiSettings:
      # Enterprise contact picker
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -19,13 +20,15 @@ global:

 nextcloud-integration-ui:
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeNextcloudIntegrationUI.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeNextcloudIntegrationUI.registry | quote }}
    repository: {{ .Values.images.openxchangeNextcloudIntegrationUI.repository | quote }}
    tag: {{ .Values.images.openxchangeNextcloudIntegrationUI.tag | quote }}
  imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
    - name: {{ . | quote }}
  {{- end }}
+  podAnnotations: {}
+  replicaCount: {{ .Values.replicas.openxchangeNextcloudIntegrationUI }}
  resources:
    {{ .Values.resources.openxchangeNextcloudIntegrationUI | toYaml | nindent 4 }}
  securityContext:
@@ -46,14 +49,17 @@ nextcloud-integration-ui:

 public-sector-ui:
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangePublicSectorUI.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangePublicSectorUI.registry | quote }}
    repository: {{ .Values.images.openxchangePublicSectorUI.repository | quote }}
    tag: {{ .Values.images.openxchangePublicSectorUI.tag | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
    - name: {{ . | quote }}
  {{- end }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  replicaCount: {{ .Values.replicas.openxchangePublicSectorUI }}
+  podAnnotations: {}
  resources:
    {{ .Values.resources.openxchangePublicSectorUI | toYaml | nindent 4 }}
  securityContext:
@@ -116,6 +122,7 @@ appsuite:
    jolokiaLogin: "jolokia"
    jolokiaPassword: {{ .Values.secrets.oxAppsuite.jolokiaPassword | quote }}
    hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
+    podAnnotations: {}
    serviceAccount:
      create: true
    features:
@@ -131,9 +138,11 @@ appsuite:
        - name: {{ . | quote }}
      {{- end }}
      image:
-        repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGotenberg.registry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
+        repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeGotenberg.registry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
        tag: {{ .Values.images.openxchangeGotenberg.tag | quote }}
        pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+      replicaCount: {{ .Values.replicas.openxchangeGotenberg }}
+      podAnnotations: {}
      resources:
        {{ .Values.resources.openxchangeGotenberg | toYaml | nindent 8 }}
      securityContext:
@@ -185,7 +194,7 @@ appsuite:
      com.openexchange.oidc.opLogoutEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
      com.openexchange.oidc.opTokenEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
      com.openexchange.oidc.rpRedirectURIAuth: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/appsuite/api/oidc/auth"
-      com.openexchange.oidc.rpRedirectURILogout: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+      com.openexchange.oidc.rpRedirectURILogout: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
      com.openexchange.oidc.rpRedirectURIPostSSOLogout: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/appsuite/api/oidc/logout"
      com.openexchange.oidc.ssoLogout: "true"
      com.openexchange.oidc.startDefaultBackend: "true"
@@ -238,9 +247,14 @@ appsuite:
      com.openexchange.mail.secondary.authType: "XOAUTH2"
      com.openexchange.mail.transport.secondary.authType: "xoauth2"
      # Nextcloud integration
-      com.openexchange.file.storage.nextcloud.oauth.url: "http://opendesk-nextcloud-apache2/"
+      com.openexchange.file.storage.nextcloud.oauth.url: "http://opendesk-nextcloud-aio/"
      com.openexchange.file.storage.nextcloud.oauth.webdav.username.strategy: "user"
      com.openexchange.nextcloud.filepicker.includeAccessToken: "false"
+      # Element integration
+      com.openexchange.conference.element.enabled: "true"
+      com.openexchange.conference.element.meetingHostUrl: http://matrix-neodatefix-bot
+      com.openexchange.conference.element.matrixLoginUrl: http://opendesk-synapse-web:8008/_matrix/client/v3/login
+      com.openexchange.conference.element.matrixUuidClaimName: opendesk_useruuid
      # GDPR
      com.openexchange.gdpr.dataexport.enabled: "false"
      com.openexchange.gdpr.dataexport.active: "false"
@@ -259,6 +273,7 @@ appsuite:
      com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
      com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
      com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
+      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
    propertiesFiles:
      /opt/open-xchange/etc/AdminDaemon.properties:
        MASTER_ACCOUNT_OVERRIDE: "true"
@@ -269,7 +284,7 @@ appsuite:
      /opt/open-xchange/etc/ldapauth.properties:
        java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/dc=swp-ldap,dc=internal"
        bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
-        bindDNPassword: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
+        bindDNPassword: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}
        bindOnly: "false"
      /opt/open-xchange/etc/antivirus.properties:
        com.openexchange.antivirus.enabled: "true"
@@ -311,7 +326,7 @@ appsuite:
      # io.ox/mail//contactCollectOnMailAccess: "true"
      # Dynamic theme
      io.ox/dynamic-theme//mainColor: {{ .Values.theme.colors.primary | quote }}
-      io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
+      io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
      io.ox/dynamic-theme//topbarBackground: {{ .Values.theme.colors.white | quote }}
      io.ox/dynamic-theme//topbarColor: {{ .Values.theme.colors.black | quote }}
      io.ox/dynamic-theme//listSelected: {{ .Values.theme.colors.primary15 | quote }}
@@ -326,15 +341,16 @@ appsuite:
      oxguardpass: |
        {{ .Values.secrets.oxAppsuite.oxguardMC }}
        {{ .Values.secrets.oxAppsuite.oxguardRC }}
-    redis:
+    redis: &redisConfiguration
      enabled: true
      mode: "standalone"
      hosts:
-        - "redis-master"
+        - "redis-master:6379"
      auth:
+        enabled: true
        password: {{ .Values.secrets.redis.password | quote }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreMW.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreMW.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -349,6 +365,7 @@ appsuite:
    {{- range .Values.global.imagePullSecrets }}
      - name: {{ . | quote }}
    {{- end }}
+    replicas: {{ .Values.replicas.openxchangeCoreMW }}
    resources:
      {{ .Values.resources.openxchangeCoreMW | toYaml | nindent 6 }}

@@ -359,10 +376,12 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUI.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreUI.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreUI.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreUI.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    replicaCount: {{ .Values.replicas.openxchangeCoreUI }}
+    podAnnotations: {}
    resources:
      {{ .Values.resources.openxchangeCoreUI | toYaml | nindent 6 }}
    securityContext:
@@ -391,20 +410,14 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUIMiddleware.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreUIMiddleware.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreUIMiddleware.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    overrides: {}
-    redis:
-      mode: "standalone"
-      hosts:
-        - "redis-master:6379"
-      auth:
-        enabled: true
-        password: {{ .Values.secrets.redis.password | quote }}
-        # Workaround for a bug in 8.23
-        ca: ""
+    podAnnotations: {}
+    redis: *redisConfiguration
+    replicaCount: {{ .Values.replicas.openxchangeCoreUIMiddleware }}
    resources:
      {{ .Values.resources.openxchangeCoreUIMiddleware | toYaml | nindent 6 }}
    updater:
@@ -438,9 +451,12 @@ appsuite:
        remoteCache:
          enabled: false
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeDocumentConverter.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeDocumentConverter.registry | quote }}
      repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
      tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
+    podAnnotations: {}
+    redis: *redisConfiguration
+    replicaCount: {{ .Values.replicas.openxchangeCoreDocumentConverter }}
    resources:
      {{- .Values.resources.openxchangeCoreDocumentConverter | toYaml | nindent 6 }}
    securityContext:
@@ -482,10 +498,12 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreGuidedtours.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreGuidedtours.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreGuidedtours.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreGuidedtours.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    podAnnotations: {}
+    replicaCount: {{ .Values.replicas.openxchangeCoreGuidedtours }}
    resources:
      {{- .Values.resources.openxchangeCoreGuidedtours | toYaml | nindent 6 }}
    securityContext:
@@ -510,7 +528,7 @@ appsuite:
    basicAuthLogin: "oxlogin"
    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeImageConverter.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeImageConverter.registry | quote }}
      repository: {{ .Values.images.openxchangeImageConverter.repository | quote }}
      tag: {{ .Values.images.openxchangeImageConverter.tag | quote }}
    objectCache:
@@ -519,6 +537,9 @@ appsuite:
          endpoint: "."
          accessKey: "."
          secretKey: "."
+    podAnnotations: {}
+    redis: *redisConfiguration
+    replicaCount: {{ .Values.replicas.openxchangeCoreImageConverter }}
    resources:
      {{- .Values.resources.openxchangeCoreImageConverter | toYaml | nindent 6 }}
    securityContext:
@@ -545,9 +566,12 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGuardUI.registry }}/{{ .Values.images.openxchangeGuardUI.repository }}"
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeGuardUI.registry | quote }}
+      repository: {{ .Values.images.openxchangeGuardUI.repository | quote }}
      tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    podAnnotations: {}
+    replicaCount: {{ .Values.replicas.openxchangeGuardUI }}
    resources:
      {{- .Values.resources.openxchangeGuardUI | toYaml | nindent 6 }}
    securityContext:
@@ -570,7 +594,7 @@ appsuite:
  core-user-guide:
    enabled: true
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUserGuide.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreUserGuide.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreUserGuide.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreUserGuide.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -578,6 +602,8 @@ appsuite:
    {{- range .Values.global.imagePullSecrets }}
      - name: {{ . | quote }}
    {{- end }}
+    podAnnotations: {}
+    replicaCount: {{ .Values.replicas.openxchangeCoreUserGuide }}
    resources:
      {{- .Values.resources.openxchangeCoreUserGuide | toYaml | nindent 6 }}
    securityContext:
--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -1,12 +1,25 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.oxConnector.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.oxConnector.registry | quote }}
  repository: {{ .Values.images.oxConnector.repository | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  tag: {{ .Values.images.oxConnector.tag | quote }}

+  waitForDependency:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+    pullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . | quote }}
+    {{- end }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag | quote }}
+
 imagePullSecrets:
 {{- range .Values.global.imagePullSecrets }}
  - name: {{ . | quote }}
@@ -16,16 +29,8 @@ ingress:
  enabled: false

 oxConnector:
-  caCert: "ucctempldapstring"
-  debugLevel: {{ if .Values.debug.enabled }}"4"{{ else }}"1"{{ end }}
  domainName: {{ .Values.global.domain | quote }}
-  ldapHost: {{ .Values.ldap.host | quote }}
-  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
-  ldapPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
-  ldapBaseDn: "dc=swp-ldap,dc=internal"
-  ldapHostDn: "cn=admin,dc=swp-ldap,dc=internal"
-  tlsMode: "off"
-  notifierServer: {{ .Values.ldap.notifierHost | quote }}
+  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
  oxDefaultContext: "1"
  oxImapServer: "imap://127.0.0.1:143"
  oxLocalTimezone: "Europe/Berlin"
@@ -35,12 +40,21 @@ oxConnector:
  oxSmtpServer: "smtp://127.0.0.1:587"
  oxSoapServer: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"

+provisioningApi:
+  connection:
+    baseUrl: "http://ums-provisioning-api"
+  auth:
+    username: "ox-connector"
+    password: {{ .Values.secrets.oxConnector.provisioningApiPassword | quote }}
+
 resources:
  {{ .Values.resources.oxConnector | toYaml | nindent 2 }}

 persistence:
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

+podAnnotations: {}
+
 ## Container deployment probes
 probes:
  liveness:
--- a/helmfile/apps/openproject-bootstrap/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject-bootstrap/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/\
-      {{ .Values.charts.openprojectBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"

 releases:
  - name: "opendesk-openproject-bootstrap"
@@ -21,6 +20,7 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskOpenprojectBootstrap | default "additionalValues: false" }}
    installed: {{ .Values.openproject.enabled }}
    timeout: 900

--- a/helmfile/apps/openproject-bootstrap/helmfile.yaml
+++ b/helmfile/apps/openproject-bootstrap/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/openproject-bootstrap/helmfile.yaml.gotmpl
+++ b/helmfile/apps/openproject-bootstrap/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/openproject-bootstrap/values.yaml.gotmpl
+++ b/helmfile/apps/openproject-bootstrap/values.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -11,10 +12,12 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
-  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}

 config:
+  debug:
+    enabled: {{ .Values.debug.enabled }}
  openproject:
    fileshareName: "Nextcloud at {{ .Values.global.domain }}"
    admin:
@@ -42,7 +45,7 @@ containerSecurityContext:
    {{ .Values.seLinuxOptions.openprojectBootstrap | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openprojectBootstrap.registry | quote }}
  repository: {{ .Values.images.openprojectBootstrap.repository | quote }}
  tag: {{ .Values.images.openprojectBootstrap.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy |quote }}
@@ -50,6 +53,8 @@ image:
 job:
  enabled: true

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 1000
--- a/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/\
-      {{ .Values.charts.openproject.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"

 releases:
  - name: "openproject"
@@ -21,8 +20,9 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.openproject | default "additionalValues: false" }}
    installed: {{ .Values.openproject.enabled }}
-    timeout: 900
+    timeout: 1500

 commonLabels:
  deploy-stage: "component-1"
--- a/helmfile/apps/openproject/helmfile.yaml
+++ b/helmfile/apps/openproject/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/openproject/helmfile.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,6 +8,10 @@ global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

+appInit:
+  resources:
+    {{ .Values.resources.openprojectAppInit | toYaml | nindent 4 }}
+
 containerSecurityContext:
  enabled: true
  privileged: false
@@ -23,6 +28,15 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.openproject | toYaml | nindent 4 }}

+dbInit:
+  image:
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.openprojectDbInit.registry | quote }}
+    repository: {{ .Values.images.openprojectDbInit.repository | quote }}
+    tag: {{ .Values.images.openprojectDbInit.tag | quote }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  resources:
+    {{ .Values.resources.openprojectDbInit | toYaml | nindent 4 }}
+
 environment:
 # For more details and more options see
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
@@ -31,13 +45,12 @@ environment:
  OPENPROJECT_USER__DEFAULT__TIMEZONE: "Europe/Berlin"
  OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
  OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"
-  OPENPROJECT_PER__PAGE__OPTIONS: "20, 50, 100, 200"
  OPENPROJECT_EMAIL__DELIVERY__METHOD: "smtp"
  OPENPROJECT_DEFAULT__COMMENT__SORT__ORDER: "desc"
  # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
  OPENPROJECT_SEED_LDAP_OPENDESK_HOST: {{ .Values.ldap.host | quote }}
  OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
-  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.univentionManagementStack.ldapSearch.openproject | quote }}
+  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.nubus.ldapSearch.openproject | quote }}
  OPENPROJECT_SEED_LDAP_OPENDESK_SECURITY: "plain_ldap"
  OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,dc=swp-ldap,dc=internal"
  OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "dc=swp-ldap,dc=internal"
@@ -57,34 +70,30 @@ environment:
  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_USER: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
  OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
  OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
-  OPENPROJECT_SMTP__USER__NAME: {{ .Values.smtp.username | quote }}
-  OPENPROJECT_SMTP__PASSWORD: {{ .Values.smtp.password | quote }}
-  OPENPROJECT_SMTP__PORT: {{ .Values.smtp.port | quote }}
+  OPENPROJECT_SMTP__USER__NAME: ""
+  OPENPROJECT_SMTP__PASSWORD: ""
+  OPENPROJECT_SMTP__PORT: 25
  OPENPROJECT_SMTP__SSL: "false" # (default=false)
-  OPENPROJECT_SMTP__ADDRESS: {{ .Values.smtp.host | quote }}
-  OPENPROJECT_SMTP__AUTHENTICATION: "plain"
-  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
-  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
-  OPENPROJECT_MAIL__FROM: "{{ .Values.localpartNoReply }}@{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
-  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
+  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  OPENPROJECT_SMTP__AUTHENTICATION: "none"
+  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "false"
+  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "none"
+  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.nubus .Values.global.domain | quote }}
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
+  {{- if .Values.enterprise.openproject.token }}
+  OPENPROJECT_ENTERPRISE__TOKEN: {{ .Values.enterprise.openproject.token | quote }}
+  {{- end }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.openproject.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openproject.registry | quote }}
  repository: {{ .Values.images.openproject.repository | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  tag: {{ .Values.images.openproject.tag | quote }}

-initdb:
-  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectInitDb.registry | quote }}
-    repository: {{ .Values.images.openprojectInitDb.repository | quote }}
-    tag: {{ .Values.images.openprojectInitDb.tag | quote }}
-    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-
 memcached:
  bundled: false
  connection:
@@ -94,6 +103,8 @@ memcached:
 persistence:
  enabled: false

+podAnnotations: {}
+
 postgresql:
  bundled: false
  auth:
@@ -129,7 +140,7 @@ openproject:
    host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
    identifier: "opendesk-openproject"
    provider: "keycloak"
-    scope: "[openid,opendesk]"
+    scope: "[openid,opendesk-openproject-scope]"
    secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
    tokenEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
    userinfoEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/userinfo"
@@ -177,5 +188,12 @@ s3:
 seederJob:
  annotations:
    intents.otterize.com/service-name: "openproject-seeder"
+  resources:
+    {{ .Values.resources.openprojectSeederJob | toYaml | nindent 4 }}
+
+workers:
+  default:
+    resources:
+      {{ .Values.resources.openprojectWorkers | toYaml | nindent 6 }}

 ...
--- a/helmfile/apps/provisioning/helmfile-child.yaml
+++ b/helmfile/apps/provisioning/helmfile-child.yaml
@@ -1,24 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
---
-repositories:
-  # OX Connector
-  - name: "ox-connector-repo"
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/\
-      {{ .Values.charts.oxConnector.repository }}"
-
-releases:
-  - name: "ox-connector"
-    chart: "ox-connector-repo/{{ .Values.charts.oxConnector.name }}"
-    version: "{{ .Values.charts.oxConnector.version }}"
-    values:
-      - "values-oxconnector.yaml.gotmpl"
-    installed: {{ .Values.oxConnector.enabled }}
-
-commonLabels:
-  deploy-stage: "component-2"
-  component: "provisioning"
-...
--- a/helmfile/apps/provisioning/helmfile.yaml
+++ b/helmfile/apps/provisioning/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/services/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/services/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/\
-      {{ .Values.charts.otterize.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"

  # openDesk Home
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
@@ -21,8 +20,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/\
-      {{ .Values.charts.home.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"

  # openDesk Certificates
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
@@ -32,8 +30,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/\
-      {{ .Values.charts.certificates.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"

  # openDesk PostgreSQL
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postgresql
@@ -43,8 +40,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/\
-      {{ .Values.charts.postgresql.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"

  # openDesk MariaDB
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
@@ -54,8 +50,17 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/\
-      {{ .Values.charts.mariadb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
+
+  # openDesk dkimpy-milter
+  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter
+  - name: "dkimpy-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.dkimpy.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"

  # openDesk Postfix
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
@@ -65,8 +70,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/\
-      {{ .Values.charts.postfix.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"

  # openDesk ClamAV
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
@@ -76,16 +80,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/\
-      {{ .Values.charts.clamav.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
  - name: "clamav-simple-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.clamavSimple.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/\
-      {{ .Values.charts.clamavSimple.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"

  # VMWare Bitnami
  # Source: https://github.com/bitnami/charts/
@@ -95,24 +97,21 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/\
-      {{ .Values.charts.memcached.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
  - name: "redis-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.redis.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/\
-      {{ .Values.charts.redis.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
  - name: "minio-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.minio.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/\
-      {{ .Values.charts.minio.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"

 releases:
  - name: "opendesk-otterize"
@@ -120,6 +119,7 @@ releases:
    version: "{{ .Values.charts.otterize.version }}"
    values:
      - "values-otterize.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskOtterize | default "additionalValues: false" }}
    installed: {{ .Values.security.otterizeIntents.enabled }}
    timeout: 900

@@ -128,6 +128,7 @@ releases:
    version: "{{ .Values.charts.home.version }}"
    values:
      - "values-home.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskHome | default "additionalValues: false" }}
    installed: {{ .Values.home.enabled }}

  - name: "opendesk-certificates"
@@ -135,6 +136,7 @@ releases:
    version: "{{ .Values.charts.certificates.version }}"
    values:
      - "values-certificates.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskCertificates | default "additionalValues: false" }}
    installed: {{ .Values.certificates.enabled }}
    timeout: 900

@@ -143,6 +145,7 @@ releases:
    version: "{{ .Values.charts.redis.version }}"
    values:
      - "values-redis.yaml.gotmpl"
+      - {{ .Values.customization.release.redis | default "additionalValues: false" }}
    installed: {{ .Values.redis.enabled }}
    timeout: 900

@@ -151,6 +154,7 @@ releases:
    version: "{{ .Values.charts.memcached.version }}"
    values:
      - "values-memcached.yaml.gotmpl"
+      - {{ .Values.customization.release.memcached | default "additionalValues: false" }}
    installed: {{ .Values.memcached.enabled }}
    timeout: 900

@@ -159,6 +163,7 @@ releases:
    version: "{{ .Values.charts.postgresql.version }}"
    values:
      - "values-postgresql.yaml.gotmpl"
+      - {{ .Values.customization.release.postgresql | default "additionalValues: false" }}
    installed: {{ .Values.postgresql.enabled }}
    timeout: 900

@@ -167,6 +172,7 @@ releases:
    version: "{{ .Values.charts.mariadb.version }}"
    values:
      - "values-mariadb.yaml.gotmpl"
+      - {{ .Values.customization.release.mariadb | default "additionalValues: false" }}
    installed: {{ .Values.mariadb.enabled }}
    timeout: 900

@@ -175,14 +181,25 @@ releases:
    version: "{{ .Values.charts.postfix.version }}"
    values:
      - "values-postfix.yaml.gotmpl"
+      - {{ .Values.customization.release.postfix | default "additionalValues: false" }}
    installed: {{ .Values.postfix.enabled }}
    timeout: 900

+  - name: "opendesk-dkimpy-milter"
+    chart: "dkimpy-repo/{{ .Values.charts.dkimpy.name }}"
+    version: "{{ .Values.charts.dkimpy.version }}"
+    values:
+      - "values-dkimpy.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskDkimpyMilter | default "additionalValues: false" }}
+    installed: {{ .Values.dkimpy.enabled }}
+    timeout: 900
+
  - name: "clamav"
    chart: "clamav-repo/{{ .Values.charts.clamav.name }}"
    version: "{{ .Values.charts.clamav.version }}"
    values:
      - "values-clamav-distributed.yaml.gotmpl"
+      - {{ .Values.customization.release.clamav | default "additionalValues: false" }}
    installed: {{ .Values.clamavDistributed.enabled }}
    timeout: 900

@@ -191,6 +208,7 @@ releases:
    version: "{{ .Values.charts.clamavSimple.version }}"
    values:
      - "values-clamav-simple.yaml.gotmpl"
+      - {{ .Values.customization.release.clamavSimple | default "additionalValues: false" }}
    installed: {{ .Values.clamavSimple.enabled }}
    timeout: 900

@@ -199,6 +217,7 @@ releases:
    version: "{{ .Values.charts.minio.version }}"
    values:
      - "values-minio.yaml.gotmpl"
+      - {{ .Values.customization.release.minio | default "additionalValues: false" }}
    installed: {{ .Values.minio.enabled }}
    timeout: 900

--- a/helmfile/apps/services/helmfile.yaml
+++ b/helmfile/apps/services/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/services/helmfile.yaml.gotmpl
+++ b/helmfile/apps/services/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/services/values-certificates.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -6,13 +7,54 @@ SPDX-License-Identifier: Apache-2.0
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
+    {{- if .Values.collabora.enabled }}
+    collabora: {{ .Values.global.hosts.collabora }}
+    {{- end }}
+    {{- if .Values.cryptpad.enabled }}
+    cryptpad: {{ .Values.global.hosts.cryptpad }}
+    {{- end }}
+    {{- if .Values.element.enabled }}
+    element: {{ .Values.global.hosts.element }}
+    matrixNeoBoardWidget: {{ .Values.global.hosts.matrixNeoBoardWidget }}
+    matrixNeoChoiceWidget: {{ .Values.global.hosts.matrixNeoChoiceWidget }}
+    matrixNeoDateFixBot: {{ .Values.global.hosts.matrixNeoDateFixBot }}
+    matrixNeoDateFixWidget: {{ .Values.global.hosts.matrixNeoDateFixWidget }}
+    synapse: {{ .Values.global.hosts.synapse }}
+    synapseFederation: {{ .Values.global.hosts.synapseFederation }}
+    whiteboard: {{ .Values.global.hosts.whiteboard }}
+    {{- end }}
+    {{- if .Values.nubus.enabled }}
+    intercomService: {{ .Values.global.hosts.intercomService }}
+    {{- end }}
+    {{- if .Values.jitsi.enabled }}
+    jitsi: {{ .Values.global.hosts.jitsi }}
+    {{- end }}
+    {{- if .Values.minio.enabled }}
+    minioApi: {{ .Values.global.hosts.minioApi }}
+    minioConsole: {{ .Values.global.hosts.minioConsole }}
+    {{- end }}
+    {{- if .Values.nextcloud.enabled }}
+    nextcloud: {{ .Values.global.hosts.nextcloud }}
+    {{- end }}
+    {{- if .Values.openproject.enabled }}
+    openproject: {{ .Values.global.hosts.openproject }}
+    {{- end }}
+    {{- if .Values.oxAppsuite.enabled }}
+    openxchange: {{ .Values.global.hosts.openxchange }}
+    {{- end }}
+    {{- if .Values.nubus.enabled }}
+    keycloak: {{ .Values.global.hosts.keycloak }}
+    nubus: {{ .Values.global.hosts.nubus }}
+    {{- end }}
+    {{- if .Values.xwiki.enabled }}
+    xwiki: {{ .Values.global.hosts.xwiki }}
+    {{- end }}

 issuerRef:
  name: {{ .Values.certificate.issuerRef.name | quote }}

 cleanup:
-  keepRessourceOnDelete: {{ .Values.cleanup.keepRessourceOnDelete }}
+  keepRessourceOnDelete: {{ .Values.debug.cleanup.keepRessourceOnDelete }}

 wildcard: {{ .Values.certificate.wildcard }}
 ...
--- a/helmfile/apps/services/values-clamav-distributed.yaml.gotmpl
+++ b/helmfile/apps/services/values-clamav-distributed.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 clamd:
  containerSecurityContext:
@@ -18,10 +21,11 @@ clamd:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.clamd | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.clamd.registry | quote }}
    repository: {{ .Values.images.clamd.repository | quote }}
    tag: {{ .Values.images.clamd.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
  podSecurityContext:
    enabled: true
    fsGroup: 101
@@ -62,10 +66,11 @@ freshclam:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.freshclam | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.freshclam.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.freshclam.registry | quote }}
    repository: {{ .Values.images.freshclam.repository | quote }}
    tag: {{ .Values.images.freshclam.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
  podSecurityContext:
    enabled: true
    fsGroup: 101
@@ -73,7 +78,15 @@ freshclam:
  replicaCount: {{ .Values.replicas.freshclam }}
  resources:
    {{ .Values.resources.freshclam | toYaml | nindent 4 }}
-
+  settings:
+    database:
+      auth:
+        {{ .Values.repositories.clamav.auth | toYaml | nindent 8 }}
+      mirror:
+        scheme: {{ .Values.repositories.clamav.mirror.scheme | quote }}
+        url: {{ .Values.repositories.clamav.mirror.url | quote }}
+      customURLs:
+        {{ .Values.repositories.clamav.customURLs | toYaml | nindent 8 }}
 global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
@@ -95,10 +108,11 @@ icap:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.icap | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.icap.registry | quote }}
    repository: {{ .Values.images.icap.repository | quote }}
    tag: {{ .Values.images.icap.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
  podSecurityContext:
    enabled: true
    fsGroup: 101
@@ -124,10 +138,11 @@ milter:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.milter | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.milter.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.milter.registry | quote }}
    repository: {{ .Values.images.milter.repository | quote }}
    tag: {{ .Values.images.milter.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
  podSecurityContext:
    enabled: true
    fsGroup: 101
--- a/helmfile/apps/services/values-clamav-simple.yaml.gotmpl
+++ b/helmfile/apps/services/values-clamav-simple.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -23,12 +26,12 @@ global:

 image:
  clamav:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.clamd.registry | quote }}
    repository: {{ .Values.images.clamd.repository | quote }}
    tag: {{ .Values.images.clamd.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  icap:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.icap.registry | quote }}
    repository: {{ .Values.images.icap.repository | quote }}
    tag: {{ .Values.images.icap.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -37,6 +40,8 @@ persistence:
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
  size: {{ .Values.persistence.size.clamav | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
@@ -47,4 +52,14 @@ replicaCount: {{ .Values.replicas.clamav }}
 resources:
  {{ .Values.resources.clamd | toYaml | nindent 4 }}

+settings:
+  freshclam:
+    database:
+      auth:
+        {{ .Values.repositories.clamav.auth | toYaml | nindent 8 }}
+      mirror:
+        scheme: {{ .Values.repositories.clamav.mirror.scheme | quote }}
+        url: {{ .Values.repositories.clamav.mirror.url | quote }}
+      customURLs:
+        {{ .Values.repositories.clamav.customURLs | toYaml | nindent 8 }}
 ...
--- a/helmfile/apps/services/values-dkimpy.yaml.gotmpl
+++ b/helmfile/apps/services/values-dkimpy.yaml.gotmpl
@@ -0,0 +1,47 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+containerSecurityContext:
+  allowPrivilegeEscalation: true
+  capabilities: {}
+  enabled: true
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  privileged: false
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.dkimpy | toYaml | nindent 4 }}
+
+global:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.dkimpy.registry | quote }}
+  repository: {{ .Values.images.dkimpy.repository | quote }}
+  tag: {{ .Values.images.dkimpy.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 1000
+
+configuration:
+  domain: "{{ .Values.global.domain }}{{ if .Values.global.mailDomain }}, {{ .Values.global.mailDomain }}{{ end }}"
+  key:
+    {{ .Values.smtp.dkim.key | toYaml | nindent 4 }}
+  mode: "s"
+  selector: {{ .Values.smtp.dkim.selector }}
+  useED25519: {{ .Values.smtp.dkim.useED25519 }}
+
+replicaCount: {{ .Values.replicas.dkimpy }}
+
+resources:
+  {{ .Values.resources.dkimpy | toYaml | nindent 2 }}
+...
--- a/helmfile/apps/services/values-mariadb.yaml.gotmpl
+++ b/helmfile/apps/services/values-mariadb.yaml.gotmpl
@@ -1,8 +1,12 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}

 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -25,7 +29,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.mariadb.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.mariadb.registry | quote }}
  repository: {{ .Values.images.mariadb.repository | quote }}
  tag: {{ .Values.images.mariadb.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -35,19 +39,32 @@ job:
  retries: 10
  wait: 30
  users:
-    - username: "xwiki_user"
-      password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
-    - username: "openxchange_user"
-      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
-    - username: "nextcloud_user"
+    - username: {{ .Values.databases.nextcloud.username | quote }}
      password: {{ .Values.secrets.mariadb.nextcloudUser | quote}}
+      connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
+    # users for the moment.
+    - username: "openxchange_user"
+    # - username: {{ .Values.databases.xwiki.username | quote }}
+      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
+      connectionLimit: {{ .Values.databases.oxAppsuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: "xwiki_user"
+    # - username: {{ .Values.databases.oxAppsuite.username | quote }}
+      password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
+      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
  databases:
-    - name: "xwiki"
-      user: "xwiki_user"
-    - name: "nextcloud"
-      user: "nextcloud_user"
+    - name: {{ .Values.databases.nextcloud.name | quote }}
+      user: {{ .Values.databases.nextcloud.username | quote }}
+    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
+    # users for the moment.
    - name: "openxchange"
      user: "openxchange_user"
+    # - name: {{ .Values.databases.oxAppsuite.name | quote }}
+    #   user: {{ .Values.databases.oxAppsuite.username | quote }}
+    - name: "xwiki"
+      user: "xwiki_user"
+    # - name: {{ .Values.databases.xwiki.name | quote }}
+    #   user: {{ .Values.databases.xwiki.username | quote }}

 mariadb:
  rootPassword: {{ .Values.secrets.mariadb.rootPassword | quote }}
@@ -56,6 +73,8 @@ persistence:
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
  size: {{ .Values.persistence.size.mariadb | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 1001
--- a/helmfile/apps/services/values-memcached.yaml.gotmpl
+++ b/helmfile/apps/services/values-memcached.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 architecture: {{ if gt .Values.replicas.memcached 1 }}"high-availability"{{ else }}"standalone"{{ end }}

@@ -24,11 +27,13 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.memcached.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.memcached.registry | quote }}
  repository: {{ .Values.images.memcached.repository | quote }}
  tag: {{ .Values.images.memcached.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}

+podAnnotations: {}
+
 replicaCount: {{ .Values.replicas.memcached }}

 resources:
--- a/helmfile/apps/services/values-minio.yaml.gotmpl
+++ b/helmfile/apps/services/values-minio.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 apiIngress:
  enabled: {{ .Values.ingress.enabled }}
@@ -39,7 +42,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.minio.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.minio.registry | quote }}
  repository: "{{ .Values.images.minio.repository }}"
  tag: "{{ .Values.images.minio.tag }}"
  pullPolicy: "{{ .Values.global.imagePullPolicy }}"
@@ -67,9 +70,9 @@ mode: {{ if gt .Values.replicas.minio 1 }}"distributed"{{ else }}"standalone"{{

 metrics:
  serviceMonitor:
-    enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
+    enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
    additionalLabels:
-      {{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
+      {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}

 networkPolicy:
  enabled: false
@@ -85,20 +88,48 @@ persistence:
 provisioning:
  enabled: true
  cleanupAfterFinished:
-    enabled: true
+    enabled: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+    seconds: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
  extraCommands:
    - "mc anonymous set download provisioning/ums/portal-assets"
  buckets:
-    - name: {{ .Values.objectstores.openproject.bucket | quote }}
-      versioning: true
-      withLock: false
-    - name: {{ .Values.objectstores.univentionManagementStack.bucket | quote }}
+    - name: {{ .Values.objectstores.migrations.bucket | quote }}
      versioning: false
      withLock: false
    - name: {{ .Values.objectstores.nextcloud.bucket | quote }}
      versioning: true
      withLock: false
+    - name: {{ .Values.objectstores.openproject.bucket | quote }}
+      versioning: true
+      withLock: false
+    - name: {{ .Values.objectstores.nubus.bucket | quote }}
+      versioning: false
+      withLock: false
  policies:
+    - name: "migrations-bucket-policy"
+      statements:
+        - resources:
+            - "arn:aws:s3:::migrations"
+          effect: "Allow"
+          actions:
+            - "s3:*"
+        - resources:
+            - "arn:aws:s3:::migrations/*"
+          effect: "Allow"
+          actions:
+            - "s3:*"
+    - name: "nextcloud-bucket-policy"
+      statements:
+        - resources:
+            - "arn:aws:s3:::nextcloud"
+          effect: "Allow"
+          actions:
+            - "s3:*"
+        - resources:
+            - "arn:aws:s3:::nextcloud/*"
+          effect: "Allow"
+          actions:
+            - "s3:*"
    - name: "openproject-bucket-policy"
      statements:
        - resources:
@@ -123,30 +154,12 @@ provisioning:
          effect: "Allow"
          actions:
            - "s3:*"
-    - name: "nextcloud-bucket-policy"
-      statements:
-        - resources:
-            - "arn:aws:s3:::nextcloud"
-          effect: "Allow"
-          actions:
-            - "s3:*"
-        - resources:
-            - "arn:aws:s3:::nextcloud/*"
-          effect: "Allow"
-          actions:
-            - "s3:*"
  users:
-    - username: {{ .Values.objectstores.openproject.username | quote }}
-      password: {{ .Values.secrets.minio.openprojectUser | quote }}
+    - username: {{ .Values.objectstores.migrations.username | quote }}
+      password: {{ .Values.secrets.minio.migrationsUser | quote }}
      disabled: false
      policies:
-        - "openproject-bucket-policy"
-      setPolicies: true
-    - username: {{ .Values.objectstores.univentionManagementStack.username | quote }}
-      password: {{ .Values.secrets.minio.umsUser | quote }}
-      disabled: false
-      policies:
-        - "ums-bucket-policy"
+        - "migrations-bucket-policy"
      setPolicies: true
    - username: {{ .Values.objectstores.nextcloud.username | quote }}
      password: {{ .Values.secrets.minio.nextcloudUser | quote }}
@@ -154,9 +167,23 @@ provisioning:
      policies:
        - "nextcloud-bucket-policy"
      setPolicies: true
+    - username: {{ .Values.objectstores.openproject.username | quote }}
+      password: {{ .Values.secrets.minio.openprojectUser | quote }}
+      disabled: false
+      policies:
+        - "openproject-bucket-policy"
+      setPolicies: true
+    - username: {{ .Values.objectstores.nubus.username | quote }}
+      password: {{ .Values.secrets.minio.umsUser | quote }}
+      disabled: false
+      policies:
+        - "ums-bucket-policy"
+      setPolicies: true
  resources:
    {{ .Values.resources.minio | toYaml | nindent 4 }}

+podAnnotations: {}
+
 readinessProbe:
  enabled: true
  initialDelaySeconds: 5
--- a/helmfile/apps/services/values-otterize.yaml.gotmpl
+++ b/helmfile/apps/services/values-otterize.yaml.gotmpl
@@ -16,8 +16,6 @@ apps:
    enabled: {{ .Values.dovecot.enabled }}
  element:
    enabled: {{ .Values.element.enabled }}
-  intercom:
-    enabled: {{ .Values.intercom.enabled }}
  jitsi:
    enabled: {{ .Values.jitsi.enabled }}
  mariadb:
@@ -32,8 +30,6 @@ apps:
    enabled: {{ .Values.openproject.enabled }}
  oxAppsuite:
    enabled: {{ .Values.oxAppsuite.enabled }}
-  oxConnector:
-    enabled: {{ .Values.oxConnector.enabled }}
  postfix:
    enabled: {{ .Values.postfix.enabled }}
  postgresql:
@@ -41,14 +37,13 @@ apps:
  redis:
    enabled: {{ .Values.redis.enabled }}
  univentionManagementStack:
-    enabled: {{ .Values.univentionManagementStack.enabled }}
+    enabled: {{ .Values.nubus.enabled }}
  xwiki:
    enabled: {{ .Values.xwiki.enabled }}

 ingressController:
  {{ .Values.security.ingressController | toYaml | nindent 2 }}

-
 extraApps:
  clusterPostfix:
    enabled: {{ .Values.security.clusterPostfix.enabled }}
--- a/helmfile/apps/services/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services/values-postfix.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 certificate:
  secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -25,7 +28,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.postfix.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.postfix.registry | quote }}
  repository: {{ .Values.images.postfix.repository | quote }}
  tag: {{ .Values.images.postfix.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -49,9 +52,12 @@ postfix:
    - fileName: "sasl_passwd.map"
      content:
        - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
+  {{- if .Values.dkimpy.enabled }}
+  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
+  {{- end }}
  rspamdHost: ""
  relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
-  relayNets: {{ .Values.cluster.networking.cidr | quote}}
+  relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
  smtpSASLAuthEnable: "yes"
  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
  smtpUseTLS: "yes"
@@ -70,6 +76,8 @@ postfix:
  virtualMailboxDomains: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  virtualTransport: "lmtps:dovecot:24"

+podAnnotations: {}
+
 replicaCount: {{ .Values.replicas.postfix }}

 resources:
--- a/helmfile/apps/services/values-postgresql.yaml.gotmpl
+++ b/helmfile/apps/services/values-postgresql.yaml.gotmpl
@@ -1,6 +1,13 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
+cleanup:
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
+
 containerSecurityContext:
  allowPrivilegeEscalation: false
  capabilities:
@@ -17,8 +24,6 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.postgresql | toYaml | nindent 4 }}

-job:
-
 podSecurityContext:
  enabled: true
  fsGroup: 1001
@@ -34,7 +39,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.postgresql.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.postgresql.registry | quote }}
  repository: {{ .Values.images.postgresql.repository | quote }}
  tag: {{ .Values.images.postgresql.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -43,41 +48,50 @@ image:

 job:
  users:
-    - username: "keycloak_user"
+    - username: {{ .Values.databases.keycloak.username | quote }}
      password: {{ .Values.secrets.postgresql.keycloakUser | quote }}
-    - username: "openproject_user"
+      connectionLimit: {{ .Values.databases.keycloak.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.openproject.username | quote }}
      password: {{ .Values.secrets.postgresql.openprojectUser | quote }}
-    - username: "keycloak_extensions_user"
+      connectionLimit: {{ .Values.databases.openproject.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.keycloakExtension.username | quote }}
      password: {{ .Values.secrets.postgresql.keycloakExtensionUser | quote }}
-    - username: "matrix_user"
+      connectionLimit: {{ .Values.databases.keycloakExtension.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.synapse.username | quote }}
      password: {{ .Values.secrets.postgresql.matrixUser | quote }}
-    - username: "notificationsapi_user"
+      connectionLimit: {{ .Values.databases.synapse.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.umsNotificationsApi.username | quote }}
      password: {{ .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
-    - username: "guardianmanagementapi_user"
+      connectionLimit: {{ .Values.databases.umsNotificationsApi.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
      password: {{ .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
-    - username: "selfservice_user"
+      connectionLimit: {{ .Values.databases.umsGuardianManagementApi.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.umsSelfservice.username | quote }}
      password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
+      connectionLimit: {{ .Values.databases.umsSelfservice.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
  databases:
-    - name: "keycloak"
-      user: "keycloak_user"
-    - name: "keycloak_extensions"
-      user: "keycloak_extensions_user"
-    - name: "openproject"
-      user: "openproject_user"
-    - name: "matrix"
-      user: "matrix_user"
+    - name: {{ .Values.databases.keycloak.name | quote }}
+      user: {{ .Values.databases.keycloak.username | quote }}
+    - name: {{ .Values.databases.keycloakExtension.name | quote }}
+      user: {{ .Values.databases.keycloakExtension.username | quote }}
+    - name: {{ .Values.databases.openproject.name | quote }}
+      user: {{ .Values.databases.openproject.username | quote }}
+    - name: {{ .Values.databases.synapse.name | quote }}
+      user: {{ .Values.databases.synapse.username | quote }}
      additionalParams: "ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0"
-    - name: "guardianmanagementapi"
-      user: "guardianmanagementapi_user"
-    - name: "notificationsapi"
-      user: "notificationsapi_user"
-    - name: "selfservice"
-      user: "selfservice_user"
+    - name: {{ .Values.databases.umsGuardianManagementApi.name | quote }}
+      user: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
+    - name: {{ .Values.databases.umsNotificationsApi.name | quote }}
+      user: {{ .Values.databases.umsNotificationsApi.username | quote }}
+    - name: {{ .Values.databases.umsSelfservice.name | quote }}
+      user: {{ .Values.databases.umsSelfservice.username | quote }}

 persistence:
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
  size: {{ .Values.persistence.size.postgresql | quote }}

+podAnnotations: {}
+
 postgres:
  password: {{ .Values.secrets.postgresql.postgresUser | quote }}

--- a/helmfile/apps/services/values-redis.yaml.gotmpl
+++ b/helmfile/apps/services/values-redis.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 architecture: "standalone"

@@ -12,7 +15,7 @@ global:
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.redis.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.redis.registry | quote }}
  repository: {{ .Values.images.redis.repository | quote }}
  tag: {{ .Values.images.redis.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -35,6 +38,7 @@ master:
  count: {{ .Values.replicas.redis }}
  persistence:
    size: {{ .Values.persistence.size.redis | quote }}
+  podAnnotations: {}
  resources:
    {{ .Values.resources.redis | toYaml | nindent 4 }}

--- a/helmfile/apps/univention-management-stack/helmfile-child.yaml
+++ b/helmfile/apps/univention-management-stack/helmfile-child.yaml
@@ -1,48 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
---
-repositories:
-  # Univention Management Stack Umbrella Chart
-  - name: "ums"
-    keyring: "../../files/gpg-pubkeys/univention-de.gpg"
-    verify: {{ .Values.charts.ums.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url:
-      "{{ .Values.global.helmRegistry | default .Values.charts.ums.registry }}/\
-      {{ .Values.charts.ums.repository }}"
-  # OpenDesk Keycloak Bootstrap Chart
-  - name: "opendesk-keycloak-bootstrap-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/\
-      {{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
-
-releases:
-  # Univention Management Stack Umbrella Chart
-  - name: "ums"
-    chart: "ums/{{ .Values.charts.ums.name }}"
-    version: "{{ .Values.charts.ums.version }}"
-    values:
-      - "values-umbrella.yaml.gotmpl"
-    installed: {{ .Values.univentionManagementStack.enabled }}
-    timeout: 900
-  # OpenDesk Keycloak Bootstrap Chart
-  - name: "opendesk-keycloak-bootstrap"
-    chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.opendeskKeycloakBootstrap.name }}"
-    version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
-    values:
-      - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
-    needs:
-      - "ums"
-    installed: {{ .Values.univentionManagementStack.enabled }}
-    timeout: 900
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "univention-management-stack"
-...
--- a/helmfile/apps/univention-management-stack/helmfile.yaml
+++ b/helmfile/apps/univention-management-stack/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Milton Moura	f320da4bf8	fix(element): Bump NeoBoard Widget to v1.20.0 Signed-off-by: Milton Moura <miltonmoura@gmail.com>	2024-10-03 14:34:25 +00:00
Milton Moura	b4c70ad1ee	Move guest flag to defaults	2024-10-03 13:46:22 +00:00
Milton Moura	908423373b	fix(element): Disable Guest Users Signed-off-by: Milton Moura <miltonmoura@gmail.com>	2024-10-03 12:58:17 +00:00
Milton Moura	0e5c93ab64	fix(element): Fix license headers Signed-off-by: Milton Moura <miltonmoura@gmail.com>	2024-10-03 12:56:09 +00:00
Milton Moura	d8eb5d4838	fix(element): Update to Element Web v1.11.76 and NeoBoard v1.19.1 Signed-off-by: Milton Moura <miltonmoura@gmail.com>	2024-10-03 12:26:39 +00:00
Milton Moura	8a8dc5f5a7	fix(element): Reintroduce Widgets into Element Web Signed-off-by: Milton Moura <miltonmoura@gmail.com>	2024-10-03 12:26:39 +00:00
Thorsten Roßner	b1946d0c1d	fix(open-xchange): Update cluster internal Nextcloud URL.	2024-10-03 10:03:39 +02:00
Thorsten Roßner	3baf37c509	fix(nextcloud): Remove `/index.php`.	2024-10-03 10:03:39 +02:00
Dominik Kaminski	81f5969653	feat(nextcloud): Use nextcloud image with bundled nginx	2024-10-03 10:03:31 +02:00
Thorsten Roßner	a7ea701cc6	fix(collabora): Reduce Collabora's securityContext capabilities.	2024-10-02 14:17:42 +00:00
Thorsten Roßner	b9db81f69d	fix(nubus): Update customization for improved UX.	2024-10-02 10:39:57 +02:00
Thorsten Roßner	ef1dad7433	fix(helmfile): Move Intercom-Service to Nubus component.	2024-09-30 19:05:01 +02:00
Thorsten Roßner	751f5783d0	fix(helmfile): Move OX-Connector to Open-Xchange component.	2024-09-30 19:03:21 +02:00
Dominik Kaminski	13e0bb8d68	fix(helmfile): Check imagePullSecrets templates for all resources	2024-09-30 12:17:10 +02:00
openDesk Bot	8229949b47	fix(nubus): Update to Nubus 0.62.2.	2024-09-27 16:39:07 +00:00
openDesk Bot	dcb6e15e90	chore(renovate): Update Open-Xchange	2024-09-27 09:05:26 +00:00
Dominik Kaminski	a7d3d2585c	fix(nubus): Remove superfluous variables	2024-09-27 08:55:02 +00:00
Dominik Kaminski	e923468cd6	fix(nubus): Reduce lint failures, especially take care of pullSecrets	2024-09-27 08:55:02 +00:00
Thorsten Roßner	4ff720d36f	fix(element): Set Synapse rate limit.	2024-09-27 09:34:23 +02:00
Thorsten Roßner	fa8572f785	fix(xwiki): Enable IAM controlled functional admin role.	2024-09-26 18:31:27 +02:00
Dominik Kaminski	9eb854616c	chore(nubus): Reduce nubus lint issues	2024-09-26 05:44:58 +00:00
Johannes Bornhold	6a60c6dd43	fix(nubus): Add interim ingress configuration fixing UMC in German	2024-09-26 05:11:49 +00:00
Johannes Bornhold	8cd2f3a993	fix(nubus): Remove duplicated "nubusPortalFrontend"	2024-09-26 05:11:49 +00:00
Luis Lürenbaum	9d7d89f74f	fix(ci): Trigger e2e tests for multiple languages.	2024-09-25 21:23:00 +02:00
Dominik Kaminski	180ccddfaa	feat(helmfile): Add customization.yaml to define custom files for helmfile releases	2024-09-25 11:43:39 +00:00
Thorsten Roßner	11f750e1d6	fix(nubus): Update to version 0.57.3.	2024-09-25 09:25:51 +02:00
Thorsten Roßner	91e34aabaa	fix(openproject): Update Helm chart to v8.0.0 and explicitly template resources.	2024-09-25 09:18:28 +02:00
Oliver Günther	deacbc9db5	fix(openproject): Bump OpenProject to 14.5.1.	2024-09-24 18:27:24 +02:00
Thorsten Roßner	cbe6b1ae6c	fix(ci): Remove K8s secret creation for `EXTERNAL_REGISTRY_USERNAME` / `EXTERNAL_REGISTRY_PASSWORD`.	2024-09-24 11:29:08 +00:00
Thorsten Roßner	67d52c771e	fix(jitsi): Updated branding and new option `functional.dataProtection.jitsiRoomHistory.enabled` defaulting to `false`.	2024-09-24 11:15:50 +00:00
Luis Lürenbaum	1023f3d081	fix(ci): Add TESTS_GRACE_PERIOD variable for run-tests job.	2024-09-24 11:15:16 +02:00
Thorsten Roßner	12680e5c1a	fix(element): Update Synapse to v0.1150.	2024-09-23 14:44:55 +00:00
Thorsten Roßner	592f03135f	fix(helmfile): Switch fom dep5 to REUSE.toml.	2024-09-23 11:27:33 +02:00
Thorsten Roßner	bdc6ad2864	fix(element): Use Element upstream without widgets.	2024-09-19 12:12:55 +00:00
Dominik Kaminski	57f70b876a	chore(helmfile): Add test environment to gitignore	2024-09-19 13:23:42 +02:00
Dominik Kaminski	e9f779049c	ci(gitlab): Update to openDesk CLI v2.5.0	2024-09-19 13:22:06 +02:00
Dominik Kaminski	9f081d8567	feat(helmfile): Add support for argocd git-ops deployment	2024-09-18 23:30:33 +02:00
Thorsten Roßner	603b102f41	fix(ci): Re-enable e2e test trigger.	2024-09-18 15:59:35 +00:00
Thorsten Roßner	f297d8c0b7	fix(jitsi): Update chart for improved openDesk look & feel.	2024-09-18 09:22:04 +00:00
Thorsten Roßner	f4b9395b41	fix(helmfile): Update to support Helmfile 1.0.0-rc5.	2024-09-17 16:33:21 +02:00
Johannes Lohmer	31753ffb19	fix(nubus): Only use one LDAP Primary and make replica count of Secondary and Proxy others configurable	2024-09-16 17:15:25 +02:00
Johannes Bornhold	73455630fd	feat(nubus): Update to Nubus 0.39.2 chart	2024-09-16 17:14:00 +02:00
openDesk Bot	5f72da4e57	fix(collabora): Update to 24.04.7.2.	2024-09-16 09:26:24 +02:00
Thorsten Roßner	dd80abe622	fix(helmfile): Add `sample.yaml.gotmpl` to `dev` and `prod` env directories.	2024-09-10 16:26:18 +02:00
Thorsten Roßner	9950b73ae3	fix(nextcloud): Update to 29.0.6 including latest app updates.	2024-09-05 07:43:56 +00:00
Thorsten Roßner	6b88f731eb	fix(helmfile): Add new settings to `functional.yaml` for fileshare expiry dates.	2024-09-05 07:43:56 +00:00
openDesk Bot	11ebb80494	fix(collabora): Update to 24.04.7.1.2.	2024-09-05 07:43:56 +00:00
Milton Moura	ade8535c44	fix(element): Update 'capabilities_approved' for NeoBoard Widget Signed-off-by: Milton Moura <miltonmoura@gmail.com>	2024-09-04 15:16:47 +00:00
Dominik Kaminski	3d84e804c2	feat(helmfile): Change default subdomain names. Attention, consult docs/migrations.md for upgrade deployments.	2024-09-03 12:30:58 +02:00
Thorsten Roßner	8bca56d4ac	fix(jitsi): Improve handling of non authorized users.	2024-09-03 07:22:26 +02:00
Thorsten Roßner	df9380b924	fix(openproject): Remove `OPENPROJECT_PER__PAGE__OPTIONS` to enable functional administration of the setting.	2024-08-30 12:51:08 +02:00
Dominik Kaminski	7348547d96	feat(helmfile): Add fine-granular registry overwrites	2024-08-29 10:43:55 +00:00
Thomas Kaltenbrunner	8ef69ecaf2	fix(helmfile): Update replicas.yaml.	2024-08-28 15:45:07 +00:00
Oliver Günther	fa04f88370	chore(openproject): Bump version to 14.4.1	2024-08-28 13:57:09 +02:00
Thorsten Roßner	efc41cb3aa	fix(element): Feature toggle for user controlled updates of their Element display name; new default for generating MatrixID, check docs/migrations.md for details.	2024-08-28 08:08:01 +02:00
Thorsten Roßner	370c7cd836	fix(collabora): Set Nextcloud URL for custom font support.	2024-08-23 09:53:56 +02:00
Thorsten Roßner	ac148d0c28	fix(nextcloud): Update to 29.0.5 and support for new functional settings regarding sharing of files. See the options related to `functional.filestore.sharing` in `functional.yaml` and also `migrations.md` regarding their defaults that differ from the previous standard behaviour of openDesk.	2024-08-22 13:04:20 +00:00
openDesk Bot	3d441933ca	fix(collabora): Update to 24.04.6.2.1.	2024-08-22 09:08:02 +02:00
Thorsten Roßner	b60fe39b5c	fix(helmfile): Remove toggle `functional.email.systemGenerated.useComponentInSenderdomain`. Mails will no longer use a component subdomain in their sender address.	2024-08-20 17:25:07 +02:00
Thorsten Roßner	c03566dd63	fix(services): Support application based connection limits and password updates for PostgreSQL and MariaDB.	2024-08-20 15:12:35 +00:00
openDesk Bot	fbe4909a8e	feat(services): [bmi/opendesk/deployment/opendesk#66] Add dkimpy-milter to sign outgoing emails with DKIM and use local postfix as mail relay in all components.	2024-08-20 16:13:03 +02:00
Oliver Günther	e1d15e4bc6	chore(openproject): Bump version to 14.4	2024-08-16 09:04:32 +02:00
Thorsten Roßner	c63e725525	fix(nubus): Update LDAP to openLDAP 2.5.	2024-08-14 19:05:53 +02:00
Thorsten Roßner	45715a2059	fix(docs): Update `replicas.yaml` and `docs/scaling.md`.	2024-08-14 13:15:05 +02:00
Thorsten Roßner	3ad81e6b92	fix(jitsi): Update Helm chart and Keycloak Adapter image.	2024-08-12 08:48:24 +00:00
Thorsten Roßner	a395759551	fix(helmfile): Add `cluster.networking.proxies`. Deployments need to set this if their load balancer or reverse proxy IPs are not part of the `cluster.networking.cidr`.	2024-08-12 08:47:00 +00:00
Thorsten Roßner	8aa1a7fa7d	fix(docs): Various updates.	2024-08-09 10:03:17 +02:00
Thorsten Roßner	ce03400043	feat(nubus): Update IAM components.	2024-08-08 07:13:43 +02:00
openDesk Bot	61d74966d0	fix(open-xchange): Update OX AppSuite to 8.26 and improve configuration including server-side Element integration.	2024-08-07 16:45:37 +02:00
openDesk Bot	97f7a1cafd	fix(collabora): Update to 24.04.6.1.1.	2024-08-07 15:39:20 +02:00
emrah	49ad36ef4e	fix(jitsi): Update images to `9646-stable`.	2024-08-06 10:57:08 +02:00
Thorsten Roßner	7d0d6ea8d1	fix(openproject): Updated bootstrap image does not fail on rerun.	2024-08-02 12:55:58 +00:00
Thorsten Roßner	a46a632616	feat(helmfile): Support feature toggle `email.systemGenerated.useComponentInSenderdomain`. Allows to chose if system generated mails are sent from `@<domain>` or from `@<component>.<domain>`.	2024-08-02 06:08:20 +00:00
openDesk Bot	4b99357b21	feat(element): Add feature flag `functional.dataProtection.matrixPresence.enabled` that defaults to `false` to avoid that openDesk provides presence information on users unintended. We include the hardcoded configuration in openDesk Synapse that users cannot change their displayname.	2024-07-31 08:18:51 +00:00
Sven Andersen	f194f24845	fix(services): Bump Postfix Helm chart to 2.2.0.	2024-07-25 05:22:23 +00:00
Thorsten Roßner	be6806f62f	chore(release): 0.9.0 [skip ci] # [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24) ### Bug Fixes * collabora: Update to 24.04.5.1.1. ([`8a2d951`](`8a2d951c3b`)) * collabora: Update to 24.04.5.1.2. ([`74d444e`](`74d444e2d6`)) * docs: Update workflow.md. ([`fd3df7d`](`fd3df7df67`)) * docu: Update documentation on integration uses cases ([#95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/95)). ([`382af1d`](`382af1dfb9`)) * helmfile: Add S3 bucket for migrations. ([`972020f`](`972020f946`)) * helmfile: Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details. ([`26a7641`](`26a7641a5a`)) * jitsi: Raise memory limit for jicofo and jvb as required by upstream product. ([`fe923bb`](`fe923bb9cd`)) * keycloak: Support for custom OIDC Clients and ClientScopes. ([`46412d1`](`46412d1a9e`)) * nextcloud: Support templating of default quota and `_retention_obligation` settings ([#93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/93)). ([`23ef1d5`](`23ef1d557b`)) nextcloud: Update to 28.0.7 including latest apps for 28. ([`671f57a`](`671f57a809`)) * nextcloud: Update to 28.0.7 including the apps, fix admin panel warnings ([#94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/94)). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details. ([`63f8394`](`63f8394e04`)) * openproject: Bump to 14.3.0 and update Helm chart to 7.0.0. ([`6b609ed`](`6b609edc4a`)) * openproject: Support for adding token to enable OpenProject Premium. ([`dfaf4be`](`dfaf4be640`)) * xwiki: Add email address mapping to LDAP sync; Fix hostname `null` value in notification links. ([`1067e72`](`1067e725b3`)) * xwiki: Remove .rtf and .odt export options as they are currently non functional. ([`b806d51`](`b806d51311`)) * xwiki: Update to 16.4. ([`db7f5d6`](`db7f5d60bd`)) * xwiki: Update to 16.4.1. ([`e54aaab`](`e54aaab072`)) ### Features * authentication: Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage. ([`b4570a9`](`b4570a9a87`))	2024-07-24 12:06:38 +00:00
Thorsten Roßner	fd3df7df67	fix(docs): Update workflow.md.	2024-07-24 10:14:06 +00:00
Oliver Günther	6b609edc4a	fix(openproject): Bump to 14.3.0 and update Helm chart to 7.0.0.	2024-07-24 08:27:30 +00:00
Thorsten Roßner	63f8394e04	fix(nextcloud): Update to 28.0.7 including the apps, fix admin panel warnings (#94 ). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details.	2024-07-24 09:01:08 +02:00
openDesk Bot	74d444e2d6	fix(collabora): Update to 24.04.5.1.2.	2024-07-18 07:53:49 +02:00
openDesk Bot	8a2d951c3b	fix(collabora): Update to 24.04.5.1.1.	2024-07-17 10:39:37 +02:00
Thorsten Roßner	46412d1a9e	fix(keycloak): Support for custom OIDC Clients and ClientScopes.	2024-07-17 10:39:37 +02:00
Thorsten Roßner	26a7641a5a	fix(helmfile): Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details.	2024-07-17 10:39:16 +02:00
Thorsten Roßner	671f57a809	fix(nextcloud): Update to 28.0.7 including latest apps for 28.	2024-07-16 08:25:55 +00:00
Thorsten Roßner	fe923bb9cd	fix(jitsi): Raise memory limit for jicofo and jvb as required by upstream product.	2024-07-16 04:35:43 +00:00
Thorsten Roßner	b4570a9a87	feat(authentication): Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage.	2024-07-15 17:50:35 +02:00
Thorsten Roßner	1067e725b3	fix(xwiki): Add email address mapping to LDAP sync; Fix hostname `null` value in notification links.	2024-07-10 16:31:04 +00:00
Thorsten Roßner	dfaf4be640	fix(openproject): Support for adding token to enable OpenProject Premium.	2024-07-10 06:27:27 +02:00
openDesk Bot	e54aaab072	fix(xwiki): Update to 16.4.1.	2024-07-08 08:27:13 +02:00
Thorsten Roßner	b806d51311	fix(xwiki): Remove .rtf and .odt export options as they are currently non functional.	2024-07-05 15:18:42 +02:00
openDesk Bot	db7f5d60bd	fix(xwiki): Update to 16.4.	2024-07-05 09:21:16 +02:00
Thorsten Roßner	972020f946	fix(helmfile): Add S3 bucket for migrations.	2024-07-04 09:17:56 +02:00
Thorsten Roßner	23ef1d557b	fix(nextcloud): Support templating of default quota and `*_retention_obligation` settings (#93 ).	2024-07-03 14:48:05 +02:00
Thorsten Roßner	382af1dfb9	fix(docu): Update documentation on integration uses cases (#95 ).	2024-07-03 09:54:43 +02:00