fix(open-xchange): Apply resources configuration to the init-middleware container

chore(open-xchange): Update Open-Xchange to 8.31
fix(helmfile): Allow usage of pre-defined CA certificates.
2025-12-06 07:21:36 +01:00 · 2024-11-21 12:41:06 +01:00 · 2024-11-21 11:30:42 +01:00 · 2024-11-20 16:01:45 +00:00 · 2024-11-20 14:53:32 +01:00 · 2024-11-19 16:48:43 +01:00
179 changed files with 6477 additions and 4418 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,7 +6,11 @@

 # Ignore changes to sample environments
 helmfile/environments/dev/*.yaml.gotmpl
+helmfile/environments/test/*.yaml.gotmpl
 helmfile/environments/prod/*.yaml.gotmpl
+!helmfile/environments/dev/sample.yaml.gotmpl
+!helmfile/environments/test/sample.yaml.gotmpl
+!helmfile/environments/prod/sample.yaml.gotmpl

 # Ignore in CI generated files
 .kyverno/opendesk.yaml
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,7 +4,7 @@
 ---
 include:
  - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "v2.3.3"
+    ref: "v2.4.3"
    file:
      - "ci/common/automr.yml"
      - "ci/common/lint.yml"
@@ -92,13 +92,7 @@ variables:
      - "yes"
      - "no"
  DEPLOY_UMS:
-    description: "Enable Univention Management Stack deployment."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
-  DEPLOY_PROVISIONING:
-    description: "Enable Provisioning Components."
+    description: "Enable Nubus deployment."
    value: "no"
    options:
      - "yes"
@@ -127,12 +121,6 @@ variables:
    options:
      - "yes"
      - "no"
-  DEPLOY_ICS:
-    description: "Enable ICS deployment."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
  DEPLOY_XWIKI:
    description: "Enable XWiki deployment."
    value: "no"
@@ -159,7 +147,7 @@ variables:
      - "no"
  RUN_TESTS:
    description: "Triggers execution of E2E-tests."
-    value: "yes"
+    value: "no"
    options:
      - "yes"
      - "no"
@@ -171,14 +159,26 @@ variables:
      - "no"
  TESTS_BRANCH:
    description: "Branch of E2E-tests on which the test pipeline is triggered"
-    value: "main"
+    value: "develop"
+  TESTS_PROJECT_URL:
+    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
+    value: "gitlab.opencode.de/api/v4/projects/1506"
+  TESTS_TESTSET:
+    description: "Selects testset for E2E-tests"
+    value: "Smoke"
+    options:
+      - "Regression"
+      - "Smoke"
+  TESTS_GRACE_PERIOD:
+    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail. GRACE_PERIOD is the period in seconds that should be waited before running the tests."
+    value: "0"

 .deploy-common:
  cache: {}
  dependencies: []
  extends: ".environments"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.0.1\
-          @sha256:d38f41b88374e055332860018f2936db8807b763caf6089735db0484cbb2842a"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.1.0\
+          @sha256:74f349066ac5d20e3afaa6abd28781b4c8dc086f67e3d3c1b8345e4a9c3371b1"
  script:
    - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
    # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD
@@ -223,9 +223,6 @@ env-cleanup:
  stage: "env-cleanup"

 env-start:
-  environment:
-    name: "${NAMESPACE}"
-    on_stop: "env-stop"
  extends: ".deploy-common"
  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
  rules:
@@ -236,14 +233,34 @@ env-start:
  script:
    - "echo \"Deploying to Environment ${NAMESPACE} in ${CLUSTER} Cluster\""
    - "kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -"
-    - >
-      kubectl create secret
-      --namespace "${NAMESPACE}"
-      docker-registry external-registry
-      --docker-server "${EXTERNAL_REGISTRY}"
-      --docker-username "${EXTERNAL_REGISTRY_USERNAME}"
-      --docker-password "${EXTERNAL_REGISTRY_PASSWORD}"
-      --dry-run=client -o yaml | kubectl apply -f -
+    - "export FILENAME_CERT_SECRET=cert_to_import.yaml"
+    # from self-signed-certificates.md:
+    # "Copy this cert's secret into the/each namespace you want to make use of the cert."
+    - |
+      kubectl get secret opendesk-root-cert-secret -n cert-manager -o yaml | \
+        grep -v \ uid\: | \
+        grep -v \ resourceVersion\: | \
+        grep -v \ creationTimestamp\: | \
+        sed --expression 's/namespace\:\ cert-manager/namespace: '"${NAMESPACE}"'/g' \
+        >${FILENAME_CERT_SECRET} || true
+    - |
+      if [ -s ${FILENAME_CERT_SECRET} ]; then
+        echo "Applying ${FILENAME_CERT_SECRET}"
+        kubectl apply -f ${FILENAME_CERT_SECRET}
+      fi
+    # from self-signed-certificates.md:
+    # "Create issuer in the/each namespace you want to make use of the cert."
+    - |
+      kubectl apply -f - <<EOF
+      apiVersion: cert-manager.io/v1
+      kind: Issuer
+      metadata:
+        name: "selfsigned-issuer"
+        namespace: ${NAMESPACE}
+      spec:
+        ca:
+          secretName: opendesk-root-cert-secret
+      EOF
  stage: "env"

 policies-deploy:
@@ -295,19 +312,7 @@ services-deploy:
  variables:
    COMPONENT: "services"

-provisioning-deploy:
-  stage: "component-deploy-stage-2"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no" || $DEPLOY_PROVISIONING != "no")
-      when: "on_success"
-  variables:
-    COMPONENT: "provisioning"
-
-ums-deploy:
+nubus-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
@@ -317,7 +322,7 @@ ums-deploy:
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no")
      when: "on_success"
  variables:
-    COMPONENT: "univention-management-stack"
+    COMPONENT: "nubus"

 ox-deploy:
  stage: "component-deploy-stage-1"
@@ -332,18 +337,6 @@ ox-deploy:
  variables:
    COMPONENT: "open-xchange"

-ics-deploy:
-  stage: "component-deploy-stage-1"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ICS != "no")
-      when: "on_success"
-  variables:
-    COMPONENT: "intercom-service"
-
 xwiki-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
@@ -440,36 +433,13 @@ element-deploy:
  variables:
    COMPONENT: "element"

-env-stop:
-  extends: ".deploy-common"
-  environment:
-    name: "${NAMESPACE}"
-    action: "stop"
-  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
-  needs: []
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/
-      when: "manual"
-  script:
-    - "echo 'We do not stop the env (delete the namespace) at the moment in this stage, as deleting a branches also
-      triggers this env-stop stage and we do not want this to happen.'"
-    # - kubectl delete namespace "${NAMESPACE}"
-  stage: "env-stop"
-  variables:
-    GIT_STRATEGY: "none"
-
 .ums-default-password: &ums-default-password
  - |
-    UMS_PASSWORDS=$( \
-      kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}' \
-      | yq '.properties.password' > passwords.txt \
-    )
-    DEFAULT_USER_PASSWORD=$( \
-      awk 'NR==1{print $1}' passwords.txt \
-    )
-    DEFAULT_ADMIN_PASSWORD=$(
-      awk 'NR==3{print $1}' passwords.txt \
+    DEFAULT_ADMINISTRATOR_PASSWORD=$(
+       kubectl \
+         -n ${NAMESPACE} \
+         get secret ums-nubus-credentials \
+         -o jsonpath='{.data.administrator_password}' | base64 -d \
    )

 run-tests:
@@ -481,6 +451,11 @@ run-tests:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
      when: "on_success"
+  parallel:
+    matrix:
+      - LANGUAGE:
+          - "de"
+          - "en"
  script:
    - *ums-default-password
    - |
@@ -490,27 +465,27 @@ run-tests:
        \"ref\": \"${TESTS_BRANCH}\", \
        \"token\": \"${CI_JOB_TOKEN}\", \
        \"variables\": { \
-          \"url\": \"https://portal.${DOMAIN}\", \
-          \"user_name\": \"${DEFAULT_USER_NAME}\", \
-          \"user_password\": \"${DEFAULT_USER_PASSWORD}\", \
-          \"admin_name\": \"${DEFAULT_ADMIN_NAME}\", \
-          \"admin_password\": \"${DEFAULT_ADMIN_PASSWORD}\", \
-          \"DEPLOY_ALL_COMPONENTS\": \"${DEPLOY_ALL_COMPONENTS}\", \
-          \"DEPLOY_COLLABORA\": \"${DEPLOY_COLLABORA}\", \
-          \"DEPLOY_ELEMENT\": \"${DEPLOY_ELEMENT}\", \
-          \"DEPLOY_ICS\": \"${DEPLOY_ICS}\", \
-          \"DEPLOY_JITSI\": \"${DEPLOY_JITSI}\", \
-          \"DEPLOY_KEYCLOAK\": \"${DEPLOY_UMS}\", \
-          \"DEPLOY_NEXTCLOUD\": \"${DEPLOY_NEXTCLOUD}\", \
-          \"DEPLOY_OPENPROJECT\": \"${DEPLOY_OPENPROJECT}\", \
-          \"DEPLOY_OX\": \"${DEPLOY_OX}\", \
-          \"DEPLOY_SERVICES\": \"${DEPLOY_SERVICES}\", \
-          \"DEPLOY_UCS\": \"${DEPLOY_UMS}\", \
-          \"DEPLOY_XWIKI\": \"${DEPLOY_XWIKI}\", \
-          \"DEPLOY_PROVISIONING\": \"${DEPLOY_PROVISIONING}\" \
+          \"operator\": \"${OPERATOR}\", \
+          \"cluster\": \"${CLUSTER}\", \
+          \"namespace\": \"${NAMESPACE}\", \
+          \"url\": \"https://portal.${DOMAIN}/\", \
+          \"language\": \"${LANGUAGE}\", \
+          \"udm_api_username\": \"Administrator\", \
+          \"udm_api_password\": \"${DEFAULT_ADMINISTRATOR_PASSWORD}\", \
+          \"screenshot_test\": \"yes\", \
+          \"screenshot_before_step\": \"yes\", \
+          \"screenshot_after_step\": \"yes\", \
+          \"screenshot_redirect_step\": \"yes\", \
+          \"testset\": \"${TESTS_TESTSET}\", \
+          \"testprofile\": \"Namespace\", \
+          \"gitlab_functional_yaml\": \"https://gitlab.opencode.de/api/v4/projects/1317/repository/files/helmfile%2Fenvironments%2Fdefault%2Ffunctional.yaml?ref=develop\", \
+          \"gitlab_env_namespace_template\": \"https://gitlab.opencode.de/api/v4/projects/1564/repository/files/environments%2F{operator}%2F{cluster}%2F{namespace}.yaml.gotmpl?ref=main\", \
+          \"gitlab_default_env_namespace\": \"values\", \
+          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\" \
        } \
      }" \
      "https://${TESTS_PROJECT_URL}/trigger/pipeline"
+  retry: 1

 avscan-prepare:
  stage: ".pre"
@@ -537,7 +512,7 @@ avscan-prepare:
          - "freshclam"
          - "mkdir /scan"
        script:
-          - "export IMAGE=${EXTERNAL_REGISTRY:-${CONTAINER_REGISTRY}}/${CONTAINER_IMAGE}:${CONTAINER_TAG}"
+          - "export IMAGE=${AV_SCAN_PROXY:-${CONTAINER_REGISTRY}}/${CONTAINER_IMAGE}:${CONTAINER_TAG}"
          - "echo Pulling and scanning $IMAGE..."
          - "crane pull $IMAGE /scan/image.tar"
          - "clamscan /scan"
@@ -545,7 +520,7 @@ avscan-prepare:
          CONTAINER_IMAGE: ""
          CONTAINER_REGISTRY: ""
          CONTAINER_TAG: ""
-          DATABASE_MIRROR: "https://nexus.souvap-univention.de/repository/ClamAV"
+          DATABASE_MIRROR: "https://gitlab.opencode.de/bmi/opendesk/tooling/clamav-db-mirror/-/raw/main"
      EOF
    - >
      yq '.images
@@ -584,7 +559,7 @@ avscan-start:

 # Overwrite shared settings
 .common-semantic-release:
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release-patched:latest"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
  tags: []

 conventional-commits-linter:
@@ -687,5 +662,4 @@ renovate:
  script:
    - "renovate ${RENOVATE_EXTRA_FLAGS}"
  stage: "renovate"
-
 ...
--- a/.gitlab/common/common.yml
+++ b/.gitlab/common/common.yml
@@ -2,10 +2,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.4.4\
-    @sha256:4120fe717071876f4c9ff128f26019d089fda158a4fb1912911e09af2fd3875f"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.5\
-    @sha256:60870adb64b0503d4a6efd16cef4e074b91a4ca52b48811cfcea057bcccd07e4"
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.5.2\
+    @sha256:8445978facabf1526cdb4434e7da8b9c8b9b930337c247ea811b1a53765817e3"
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.7\
+    @sha256:632ea46d4ff70d39a627404576ea3b14a1cf96d04ea0701cbea6b771765d1769"

 .common:
  cache: {}
--- a/.gitlab/lint/lint-kyverno.yml
+++ b/.gitlab/lint/lint-kyverno.yml
@@ -14,19 +14,32 @@ lint-kyverno:
          - "collabora"
          - "cryptpad"
          - "element"
-          - "intercom-service"
          - "jitsi"
          - "nextcloud"
+          - "nubus"
          - "open-xchange"
          - "openproject"
          - "openproject-bootstrap"
-          - "provisioning"
          - "services"
-          - "univention-management-stack"
          - "xwiki"
  script:
    - "cd ${CI_PROJECT_DIR}/helmfile/apps/${APP}"
-    - "helmfile template -e test --include-needs > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-env
+      -d ${CI_PROJECT_DIR}/helmfile/environments
+    - "helmfile template -e test --include-needs --skip-tests > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
+    - "cd ${CI_PROJECT_DIR}/.kyverno"
+    # Test optional
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
+      -d ${CI_PROJECT_DIR}/.kyverno
+      -t optional
+      -s manifest
+      -f opendesk.yaml
+      --skip-tests true
+      ${APP}
+    - "kyverno test . || true"
+    # Test required
    - >
      node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
      -d ${CI_PROJECT_DIR}/.kyverno
@@ -35,8 +48,5 @@ lint-kyverno:
      -f opendesk.yaml
      --skip-tests true
      ${APP}
-    - "node /app/opendesk-ci-cli/src/index.js filter-for-kinds -f ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
-    - "cd ${CI_PROJECT_DIR}/.kyverno"
    - "kyverno test ."
-
 ...
--- a/.kyverno/policies/_policies.yaml
+++ b/.kyverno/policies/_policies.yaml
@@ -13,7 +13,7 @@ pod:
      - "DaemonSet"
  - name: "disallow-default-serviceaccount"
    rule: "disallow-default-serviceAccountName"
-    type: "required"
+    type: "optional"
    kinds:
      - "StatefulSet"
      - "Deployment"
@@ -58,7 +58,7 @@ pod:
      - "DaemonSet"
  - name: "require-health-and-liveness-check"
    rule: "require-health-and-liveness-check"
-    type: "required"
+    type: "optional"
    kinds:
      - "StatefulSet"
      - "Deployment"
@@ -158,7 +158,7 @@ pod:
      - "DaemonSet"
  - name: "require-containersecuritycontext"
    rule: "require-seccomp-profile"
-    type: "required"
+    type: "optional"
    kinds:
      - "StatefulSet"
      - "Deployment"
@@ -176,7 +176,7 @@ pod:
      - "DaemonSet"
  - name: "require-containersecuritycontext"
    rule: "require-empty-seLinuxOptions"
-    type: "required"
+    type: "optional"
    kinds:
      - "StatefulSet"
      - "Deployment"
@@ -285,7 +285,7 @@ pod:
      - "Ingress"
  - name: "template-replicas"
    rule: "template-replicas"
-    type: "required"
+    type: "optional"
    kinds:
      - "StatefulSet"
      - "Deployment"
--- a/.kyverno/policies/require-requests-limits.yaml
+++ b/.kyverno/policies/require-requests-limits.yaml
@@ -27,6 +27,20 @@ spec:
        message: "CPU and memory resource requests and limits are required."
        pattern:
          spec:
+            =(ephemeralContainers):
+              - resources:
+                  limits:
+                    memory: "?*"
+                  requests:
+                    cpu: "?*"
+                    memory: "?*"
+            =(initContainers):
+              - resources:
+                  limits:
+                    memory: "?*"
+                  requests:
+                    cpu: "?*"
+                    memory: "?*"
            containers:
              - resources:
                  limits:
--- a/.reuse/dep5
+++ b/.reuse/dep5
@@ -1,16 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: openDesk - der Souveräne Arbeitsplatz
-Upstream-Contact: <opendesk@zendis.de>
-Source: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk
-
-Files: helmfile/environments/default/theme/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: Apache-2.0
-
-Files: helmfile/files/gpg-pubkeys/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: CC0-1.0
-
-Files: cspell.json
-Copyright: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-License: Apache-2.0
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,105 @@
+# [1.0.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.9.0...v1.0.0) (2024-10-14)
+
+
+### Bug Fixes
+
+* **ci:** Add TESTS_GRACE_PERIOD variable for run-tests job. ([1023f3d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1023f3d081a980a794850399f133cf817448c431))
+* **ci:** Re-enable e2e test trigger. ([603b102](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/603b102f41b8a7e3bfab1c7d45cd05da96c455f6))
+* **ci:** Remove K8s secret creation for `EXTERNAL_REGISTRY_USERNAME` / `EXTERNAL_REGISTRY_PASSWORD`. ([cbe6b1a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cbe6b1ae6c01beb68ae3bcc0d2444f4b48c8e2ea))
+* **ci:** Trigger e2e tests for multiple languages. ([9d7d89f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d7d89f74f49c384e9632b74cbe20a641725caa7))
+* **collabora:** Add ipFamilies cluster.networking option ([add2ab1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/add2ab1a41e422295ccd58c09aa9fab9b45f18cb))
+* **collabora:** Reduce Collabora's securityContext capabilities. ([a7ea701](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7ea701cc65ab230d269e4f6b91b39a03c126fad))
+* **collabora:** Set Nextcloud URL for custom font support. ([370c7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/370c7cd836b46fb31c79b59d76297abd8748a711))
+* **collabora:** Update to 24.04.6.1.1. ([97f7a1c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/97f7a1cafd743c5e91f9cce6d028c54281afda81))
+* **collabora:** Update to 24.04.6.2.1. ([3d44193](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d441933ca1c28911218ebc073e7b1d39e402325))
+* **collabora:** Update to 24.04.7.1.2. ([11ebb80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11ebb80494d181b8ef4793e3e59f3e6ac225b072))
+* **collabora:** Update to 24.04.7.2. ([5f72da4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5f72da4e579aeb749c045bb7f25355b3e12b411a))
+* **docs:** Update `replicas.yaml` and  `docs/scaling.md`. ([45715a2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/45715a20594dafe833041d5843c857bc0e23dcbc))
+* **docs:** Various updates. ([8aa1a7f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8aa1a7fa7d106d2e70b1e31b6bda5febb3afec66))
+* **element:** Feature toggle for user controlled updates of their Element display name; new default for generating MatrixID, check docs/migrations.md for details. ([efc41cb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/efc41cb3aa0294d79f6cad3d9e879380745fef57))
+* **element:** Set Synapse rate limit. ([4ff720d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4ff720d36fa30f5f3a7328edd3bfc7edf89cf48f))
+* **element:** Update 'capabilities_approved' for NeoBoard Widget ([ade8535](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ade8535c4456ef9db8c8ef7915bcc4c5ae215f6a))
+* **element:** Update NeoBoard to 1.20.0 and `synapse-guest-module` to 2.0.0. ([11b0d44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11b0d441e0c886b5360690d23bf266a4ccb57a10))
+* **element:** Update NeoDateFix translations. ([71f21dc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/71f21dc4333765f4bdaf7cfd8910b9b6982b0340))
+* **element:** Update Synapse to v0.1150. ([12680e5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/12680e5c1ae40a7722db0417751b014229bdd559))
+* **element:** Use Element upstream without widgets. ([bdc6ad2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bdc6ad286425e429c8195014251046ac0cfe6424))
+* **helmfile:** Add `cluster.networking.proxies`. Deployments need to set this if their load balancer or reverse proxy IPs are not part of the `cluster.networking.cidr`. ([a395759](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a3957595516e6864c762fbeedb9fdc50c02920cb))
+* **helmfile:** Add `sample.yaml.gotmpl` to `dev` and `prod` env directories. ([dd80abe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd80abe622fd824b8af358a8923d6fb47715825d))
+* **helmfile:** Add new settings to `functional.yaml` for fileshare expiry dates. ([6b88f73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6b88f731eb2b6c8ceebc9a7a0c96e63d13743b24))
+* **helmfile:** Check imagePullSecrets templates for all resources ([13e0bb8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13e0bb8d68df12b8451b7318059d35f7eaa018b8))
+* **helmfile:** Move Intercom-Service to Nubus component. ([ef1dad7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ef1dad7433bbf64b9d021bd581d9016ffc68e610))
+* **helmfile:** Move OX-Connector to Open-Xchange component. ([751f578](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/751f5783d05ec4577e563d135c04d2925a14da47))
+* **helmfile:** Remove NET_RAW capabilities ([e512486](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e512486e74545449a0e3dca5254ffb44f2d1790f))
+* **helmfile:** Remove some YAML linter warnings. ([d641359](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d641359c29c81c774880196febaf4e979b98e5d6))
+* **helmfile:** Remove toggle `functional.email.systemGenerated.useComponentInSenderdomain`. Mails will no longer use a component subdomain in their sender address. ([b60fe39](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b60fe39b5c7f6479180495eb76a52b77385fb92d))
+* **helmfile:** Switch fom dep5 to REUSE.toml. ([592f031](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/592f03135f226a18038dff534c5b8f8dfc327670))
+* **helmfile:** Update portal and branding. ([6ba6923](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6ba69236129e2176afd14d05060f6db1671df863))
+* **helmfile:** Update replicas.yaml. ([8ef69ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8ef69ecaf22a8cee51ea4029173d30ff5f1213a0))
+* **helmfile:** Update to support Helmfile 1.0.0-rc5. ([f4b9395](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f4b9395b4134b28eb969e71bc2321eae3054da00))
+* **intercom-service:** Customizable user mapper. ([a7e5f64](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7e5f64b50f102855bd15568ff698160f2b616e3))
+* **jitsi:** Improve handling of non authorized users. ([8bca56d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8bca56d4acb1e8baf1d9bd6e640080b15aac35df))
+* **jitsi:** Update chart for improved openDesk look & feel. ([f297d8c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f297d8c0b70bd923670a6107471dafe750d8a352))
+* **jitsi:** Update Helm chart and Keycloak Adapter image. ([3ad81e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3ad81e6b92ac652fbf20f56f2cc85e6d8eb5d0d4))
+* **jitsi:** Update images to `9646-stable`. ([49ad36e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/49ad36ef4e04640493373e0ba9f4d596968e5412))
+* **jitsi:** Updated branding and new option `functional.dataProtection.jitsiRoomHistory.enabled` defaulting to `[secure]`. ([67d52c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/67d52c771ef596e444d021886cf5554e12fc1a65))
+* **nextcloud:** Add support for secret keys for administrator and ldap credentials ([7aee88e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7aee88ec94be75f096c31bbb08246c563736b5bc))
+* **nextcloud:** Bump image to incorporate latest PHP fixes. ([c9ae039](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c9ae0391b07e18f22c91f4eb6ac746f43210a3f3))
+* **nextcloud:** Remove `/index.php`. ([3baf37c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3baf37c5097e763069ad66163362e19a90bd5d4e))
+* **nextcloud:** Update to 29.0.5 and support for new functional settings regarding sharing of files. See the options related to `functional.filestore.sharing` in `functional.yaml` and also `migrations.md` regarding their defaults that differ from the previous standard behaviour of openDesk. ([ac148d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ac148d0c28cf8382c8b96dbedddeccdd0fcd762b))
+* **nextcloud:** Update to 29.0.6 including latest app updates. ([9950b73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9950b73ae3789fbae31e98a6ad9845822797cb78))
+* **nubus:** Add interim ingress configuration fixing UMC in German ([6a60c6d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6a60c6dd43a31e6e972d7149977638d077cbe77b))
+* **nubus:** Only use one LDAP Primary and make replica count of Secondary and Proxy others configurable ([31753ff](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31753ffb19dcd4a82766ed39e7584cbba46b57b0))
+* **nubus:** Reduce lint failures, especially take care of pullSecrets ([e923468](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e923468cd6070615c5ba776bb223759988283ecd))
+* **nubus:** Remove duplicated "nubusPortalFrontend" ([8cd2f3a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8cd2f3a993af673eba3c931a2a9e5a9756943a5d))
+* **nubus:** Remove superfluous variables ([a7d3d25](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7d3d2585ca73543902d5240f3629bc4e1bc4fe8))
+* **nubus:** Update "openDesk Standard" OX profile. ([fdb37c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fdb37c3943b08a49badf15da93f4d07abf8f7706))
+* **nubus:** Update customization for improved UX. ([b9db81f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b9db81f69d19985571486aaa4cc11077e0a2abc2))
+* **nubus:** Update LDAP openDesk schemas and add related openDesk config options to user. ([e3238f9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e3238f96f74bfea0b52125d0b5c384aacb75287c))
+* **nubus:** Update LDAP to openLDAP 2.5. ([c63e725](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c63e7255254db140d622b658603b99dee5af9879))
+* **nubus:** Update opendesk-nubus to set default OXContext and improved OXProfile, update migrations to (optionally) ldap-patch OXContext for `Administrator`/`default.admin` as well as patch the OXProfile to 1.0 default state. ([e619db6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e619db6da20710a9c1f3df6d8777a370be90c697))
+* **nubus:** Update to 0.63.2 ([28dd762](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/28dd762db397f47f0741087fd376be9e3e194dbe))
+* **nubus:** Update to 0.64.2. ([fc7099a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fc7099a8a6d71f10be1e9ac92279cfdb5f0ebb7d))
+* **nubus:** Update to Nubus 0.62.2. ([8229949](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8229949b47b15933fd4bcc198ec8b27302e2ea32))
+* **nubus:** Update to version 0.57.3. ([11f750e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11f750e1d603c44fdcbc9711fbe66cbf15ff0c10))
+* **open-xchange:** DisplayName settings for OX-Connector. ([b7faa24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b7faa24d76d6078336d222b195fb83f0860e7e35))
+* **open-xchange:** Update cluster internal Nextcloud URL. ([b1946d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b1946d0c1df6a8825bb5ba6ce61bb8d51d8eefa5))
+* **open-xchange:** Update Migrations for OX-Connector. ([6325b69](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6325b69a9145d90328237c359315d057bb187fc5))
+* **open-xchange:** Update OpenXchange Appsuite Bootstrap to v2.1.0 ([fb8f7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fb8f7cd28a82025be5bdc1f9eb92cb2497e22e16))
+* **open-xchange:** Update OX AppSuite to 8.26 and improve configuration including server-side Element integration. ([61d7496](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/61d74966d0427ed9214858af2126f250117a8962))
+* **openproject:** Bump OpenProject to 14.5.1. ([deacbc9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/deacbc9db5f30a492e77eb1516182a40427b0c02))
+* **openproject:** Remove `OPENPROJECT_PER__PAGE__OPTIONS` to enable functional administration of the setting. ([df9380b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/df9380b92445b992dc3917c63f1d3ce02f9c6633))
+* **openproject:** Update Helm chart to v8.0.0 and explicitly template resources. ([91e34aa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/91e34aabaae8e72b0edb6afe466d4de028dc6a38))
+* **openproject:** Update to 14.6.0. ([560aa30](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/560aa30cba2e528094231cb41474a2554f535438))
+* **openproject:** Update to 14.6.1. ([cc4b359](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cc4b35912428b6f4f5541500020f7a4aaff1674e))
+* **openproject:** Updated bootstrap image does not fail on rerun. ([7d0d6ea](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7d0d6ea8d15a226d34a0605daf6d635f6c1caae9))
+* **services:** Bump Postfix Helm chart to 2.2.0. ([f194f24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f194f248459ac0bd39246c72f937672ed24e5f14))
+* **services:** Support application based connection limits and password updates for PostgreSQL and MariaDB. ([c03566d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c03566dd63afd0c66de4627880b33ae359cba54f))
+* **xwiki:** Disable check for local Office component. ([a91f181](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a91f181c463a5feaa3ac04b4b39fcd27a55fe4a1))
+* **xwiki:** Enable IAM controlled functional admin role. ([fa8572f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fa8572f785e59b0797c0e5fee12776d0fdc66361))
+* **xwiki:** Update to 16.4.4 - updated. ([6347966](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6347966765c3a1caeec0840d2132c8c41a5d1237))
+* **xwiki:** Update to 16.4.4. ([d693ff9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d693ff94f4f79ee26df661f738c843bd4d887716))
+
+
+### Features
+
+* **element:** Add feature flag `functional.dataProtection.matrixPresence.enabled` that defaults to `[secure]` to avoid that openDesk provides presence information on users unintended. We include the hardcoded configuration in openDesk Synapse that users cannot change their displayname. ([4b99357](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4b99357b21176f57b75b745a9e3fa04d3cba9d9a))
+* **helmfile:** Add customization.yaml to define custom files for helmfile releases ([180ccdd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/180ccddfaa71e6dcf5f0383bbf1175e6568fc7ee))
+* **helmfile:** Add fine-granular registry overwrites ([7348547](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7348547d9602edb2f52c73d26749c4a4d8aadd91))
+* **helmfile:** Add support for argocd git-ops deployment ([9f081d8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9f081d856724c06928dbb3d6119fd7a090bb4048))
+* **helmfile:** Change default subdomain names. Attention, consult docs/migrations.md for upgrade deployments. ([3d84e80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d84e804c2e93d758e42a477888faf681aa56e7e))
+* **helmfile:** Full ArgoCD support ([7bf8e69](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7bf8e6976a14a1bb3d1a06135c17211d6530a1c3))
+* **helmfile:** Support feature toggle `email.systemGenerated.useComponentInSenderdomain`. ([a46a632](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a46a6326164e2462cd95a7421c7785e7d529e9c0))
+* **nextcloud:** Use nextcloud image with bundled nginx ([81f5969](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/81f5969653388b6ce4ef4d15f4fe1cbd61a17e10))
+* **nubus:** Update IAM components. ([ce03400](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ce03400043414ce0d13e2a0f90909d65d7b6eb99))
+* **nubus:** Update to Nubus 0.39.2 chart ([7345563](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/73455630fdfada47d0f4895d3f2969c7e80b8847))
+* **open-xchange:** Support for email migration feature toggle enabling masterpassword authentication in Dovecot and AppSuite. Requires openDesk Enterprise. ([356d8df](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/356d8dfbfd3825f30fc6c0786551d239e1c5e02e))
+* **services:** [bmi/opendesk/deployment/opendesk[#66](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/66)] Add dkimpy-milter to sign outgoing emails with DKIM and use local postfix as mail relay in all components. ([fbe4909](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fbe4909a8e4c78fd541facea4bd052d10100ea71))
+
+
+### BREAKING CHANGES
+
+* **helmfile:** Upgrading from previous releases requires manual steps, read `./docs/migrations.md` carefully.
+
 # [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24)


--- a/README.md
+++ b/README.md
@@ -8,17 +8,16 @@ SPDX-License-Identifier: Apache-2.0

 <!-- TOC -->
 * [Overview](#overview)
-* [Disclaimer](#disclaimer)
+* [Upgrades](#upgrades)
 * [Requirements](#requirements)
 * [Getting started](#getting-started)
 * [Advanced customization](#advanced-customization)
-* [Development](#development)
-* [Releases](#releases)
 * [Components](#components)
+* [Releases](#releases)
 * [Feedback](#feedback)
+* [Development](#development)
 * [License](#license)
 * [Copyright](#copyright)
-* [Footnotes](#footnotes)
 <!-- TOC -->

 # Overview
@@ -28,17 +27,17 @@ openDesk is a Kubernetes based, open-source and cloud-native digital workplace s

 openDesk currently features the following functional main components:

-| Function             | Functional Component        | Component<br/>Version                                                                 | Upstream Documentation                                                                                                                       |
-| -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
-| Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                                 |
-| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                                 |
-| File management      | Nextcloud                   | [28.0.5](https://nextcloud.com/de/changelog/#28-0-5)                                  | [Nextcloud 28](https://docs.nextcloud.com/)                                                                                                  |
-| Groupware            | OX App Suite                | [8.23](https://documentation.open-xchange.com/appsuite/releases/8.23/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
-| Knowledge management | XWiki                       | [16.4.1](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.1/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                            |
-| Portal & IAM         | Nubus                       | Product Preview[^1]                                                                   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html)                                                    |
-| Project management   | OpenProject                 | [14.3.0](https://www.openproject.org/docs/release-notes/14-3-0/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
-| Videoconferencing    | Jitsi                       | [2.0.9457](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9457) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
-| Weboffice            | Collabora                   | [24.04.5.2.1](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
+| Function             | Functional Component        | Component<br/>Version                                                                 | Upstream Documentation                                                                                                               |
+| -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
+| Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                         |
+| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                         |
+| File management      | Nextcloud                   | [29.0.9](https://nextcloud.com/de/changelog/#29-0-9)                                  | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                         |
+| Groupware            | OX App Suite                | [8.31](https://documentation.open-xchange.com/appsuite/releases/8.31/)                | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                    |
+| Portal & IAM         | Nubus                       | [1.0](https://www.univention.de/produkte/nubus/)                                      | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                            |
+| Project management   | OpenProject                 | [15.0.2](https://www.openproject.org/docs/release-notes/15-0-2/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                          |
+| Videoconferencing    | Jitsi                       | [2.0.9779](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9779) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                           |
+| Weboffice            | Collabora                   | [24.04.7.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)       |

 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
@@ -47,28 +46,23 @@ This documentation aims to give you all that is needed to set up your own instan

 Basic knowledge of Kubernetes and DevOps processes is required though.

-# Disclaimer
+# Upgrades

-openDesk will face breaking changes in the near future without upgrade paths before
-[technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
-v1.0.0 is reached.
+You want to upgrade an existing openDesk installation?

-While most components support upgrades, major configuration or component changes may occur, therefore we recommend
-from scratch installations for now.
-
-In the next months, we not only expect to integrate upstream updates of the functional components to include their
-most recent feature and security sets, but also to address operational topics like scalability for the openDesk
-platform.
-
-Of course, further development also includes enhancing the documentation itself.
+⟶ Visit our detailed documentation about [Updates & Upgrades](./docs/migrations.md).

 # Requirements

-⟶ Visit our detailed [Requirements](./docs/requirements.md) overview.
+You want to understand what is required to install openDesk yourself?
+
+⟶ Visit our [Requirements](./docs/requirements.md) overview.

 # Getting started

-⟶ Visit our detailed [Getting started](./docs/getting-started.md) guide.
+You would like to install openDesk in your own infrastructure?
+
+⟶ Visit our detailed [Getting started guide](./docs/getting-started.md).

 # Advanced customization

@@ -79,9 +73,9 @@ Of course, further development also includes enhancing the documentation itself.
 - [Monitoring](./docs/monitoring.md)
 - [Theming](./docs/theming.md)

-# Development
+# Components

-⟶ To understand the repository contents from a developer perspective please read the [Development](./docs/development.md) guide.
+More information on openDesk's components and their integration can be found in our detailed [Component docs](./docs/components.md).

 # Releases

@@ -96,11 +90,7 @@ in the files from the release's git-tag:
 - `./helmfile/environments/default/images.yaml`
 - `./helmfile/environments/default/charts.yaml`

-⟶ Visit our detailed [Workflow](./docs/workflow.md) docs.
-
-# Components
-
-⟶ Visit our detailed [Component](./docs/components.md) docs.
+Find more information in our [Workflow documentation](./docs/workflow.md).

 # Feedback

@@ -112,6 +102,10 @@ please use the [issues within this project](https://gitlab.opencode.de/bmi/opend
 If you want to address other topics, please check the section
 ["Rückmeldungen und Beteiligung" in the OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung) of the [openDesk Info Repository](https://gitlab.opencode.de/bmi/opendesk/info).

+# Development
+
+If you want to join or contribute to the development of openDesk please read the [Development guide](./docs/development.md).
+
 # License

 This project uses the following license: Apache-2.0
@@ -119,11 +113,3 @@ This project uses the following license: Apache-2.0
 # Copyright

 Copyright (C) 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-
-# Footnotes
-
-[^1]: Nubus is the Cloud Portal and IAM from Univention.
-It is currently integrated as a product preview within openDesk therefore, not all resources like documentation
-and structured release notes are available, while the
-[source code can already be found on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/component-code/crossfunctional/univention).
-Please find updates regarding the Nubus at https://nubus.io.
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+
+version = 1
+
+[[annotations]]
+path = "cspell.json"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/gpg-pubkeys/*"
+SPDX-FileCopyrightText = "2023 Bundesministerium des Innern und für Heimat, PG ZenDiS \"Projektgruppe für Aufbau ZenDiS\""
+SPDX-License-Identifier = "CC0-1.0"
+
+[[annotations]]
+path = "helmfile/files/theme/*"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/portal-tiles/*"
+SPDX-FileCopyrightText = "2024 Google LLC"
+SPDX-License-Identifier = "Apache-2.0"
--- a/cspell.json
+++ b/cspell.json
@@ -73,7 +73,10 @@
        "Addressbooks",
        "filestore",
        "trashbin",
-        "bootstrap"
+        "bootstrap",
+        "configurability",
+        "selfsigned",
+        "truststore"
    ],
    "ignoreWords": [],
    "import": []
--- a/dev/charts-local.py
+++ b/dev/charts-local.py
@@ -25,7 +25,7 @@ script_path = os.path.dirname(os.path.realpath(__file__))
 log_path = script_path+'/../logs'
 charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml'
 base_repo_path = script_path+'/..'
-base_helmfile = base_repo_path+'/helmfile_generic.yaml'
+base_helmfile = base_repo_path+'/helmfile_generic.yaml.gotmpl'
 helmfile_backup_extension = '.bak'

 Path(log_path).mkdir(parents=True, exist_ok=True)
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -2,6 +2,7 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>CI/CD</h1>

 This page covers openDesk deployment automation via Gitlab CI.
@@ -17,26 +18,22 @@ The project includes a `.gitlab-ci.yml` that allows you to execute the deploymen

 When starting the pipeline through the GitLab UI, you will be queried for some variables plus the following ones:

- `DOMAIN`: Primary domain for your deployment making the openDesk services available e.g. as `https://portal.DOMAIN`.
- `MAIL_DOMAIN`: (optional) Domain for the users mail addresses, defaults to `DOMAIN`.
- `MATRIX_DOMAIN`: (optional) Domain for the users Matrix IDs, defaults to `DOMAIN`.
- `NAMESPACE`: Namespace of your K8s cluster openDesk will be installed to.
+- `DOMAIN`: The primary domain for your deployment, making the openDesk services available, e.g., as `https://portal.DOMAIN`.
+- `MAIL_DOMAIN` (optional): The domain for the users' email addresses; it defaults to `DOMAIN`.
+- `MATRIX_DOMAIN` (optional): The domain for the users' Matrix IDs; it defaults to `DOMAIN`.
+- `NAMESPACE`: Namespace of your K8s cluster openDesk will be installed.
 - `MASTER_PASSWORD_WEB_VAR`: Overwrites value of `MASTER_PASSWORD`.

-Based on your input, the following variables will be set:
- `MASTER_PASSWORD:`: `MASTER_PASSWORD_WEB_VAR`. If `MASTER_PASSWORD_WEB_VAR`
-  is not set, the default for `MASTER_PASSWORD` will be used, unless you set
-  `MASTER_PASSWORD` as a masked CI/CD variable in GitLab to supersede the default.
-
 You might want to set credential variables in the GitLab project at `Settings` > `CI/CD` > `Variables`.

 # Tests

 The GitLab CI pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another GitLab project.
-The `DEPLOY_`-variables are used to determine which components should be tested.
-In order for the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this GitLab project's CI variables
-that can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
+For the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this GitLab project's CI variables,
+which can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
 `<domain of gitlab>/api/v4/projects/<id>`.
-
-If the branch of the test pipeline is not `main` this can be set with the `.gitlab-ci.yml` variable
+To select the current test set, use the variable `TESTS_TESTSET`. Default: `Smoke`.
+If the branch of the test pipeline is not `main`, this can be set with the `.gitlab-ci.yml` variable
 `TESTS_BRANCH` while creating a new pipeline.
+
+The variable `testprofile` within the job is set to `Namespace`, which tells the e2e tests to use environment-specific settings that will be read from the cluster and namespace-specific file to be found in the project internal `opendesk-env` repository.
--- a/docs/components.md
+++ b/docs/components.md
@@ -3,9 +3,10 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Components</h1>

-This section covers the internal system requirements as well as external service requirements for productive use.
+This section covers the internal system requirements and external service requirements for productive use.

 <!-- TOC -->
 * [Overview](#overview)
@@ -21,89 +22,88 @@ This section covers the internal system requirements as well as external service

 # Overview

-openDesk consists out of a variety of open-source projects. Here is a list with the description and type.
+openDesk consists of a variety of open-source projects. Here is a list with the description and type.

 Components of type `Eval` are used for development and evaluation purposes only,
 they need to be replaced in production deployments.

-| Component                   | Description                    | Type       |
+| Component                   | Description                    | Type       |
 |-----------------------------|--------------------------------|------------|
-| Certificates                | TLS certificates               | Eval       |
-| ClamAV (Distributed)        | Antivirus engine               | Eval       |
-| ClamAV (Simple)             | Antivirus engine               | Eval       |
-| Collabora                   | Weboffice                      | Functional |
-| CryptPad                    | Weboffice                      | Functional |
-| Element                     | Secure communications platform | Functional |
-| Intercom Service            | Cross service data exchange    | Functional |
-| Jitsi                       | Videoconferencing              | Functional |
-| MariaDB                     | Database                       | Eval       |
-| Memcached                   | Cache Database                 | Eval       |
-| MinIO                       | Object Storage                 | Eval       |
-| Nextcloud                   | File share                     | Functional |
-| OpenProject                 | Project management             | Functional |
-| OX Appsuite                 | Groupware                      | Functional |
-| OX Dovecot                  | Mail backend (IMAP)            | Functional |
-| Provisioning (OX Connector) | Groupware provisioning         | Functional |
-| Postfix                     | MTA                            | Eval       |
-| PostgreSQL                  | Database                       | Eval       |
-| Redis                       | Cache Database                 | Eval       |
-| Univention Management Stack | Identity Management & Portal   | Functional |
-| XWiki                       | Knowledge Management           | Functional |
+| Certificates                | TLS certificates               | Eval       |
+| ClamAV (Distributed)        | Antivirus engine               | Eval       |
+| ClamAV (Simple)             | Antivirus engine               | Eval       |
+| Collabora                   | Weboffice                      | Functional |
+| CryptPad                    | Weboffice                      | Functional |
+| dkimpy-milter               | DKIM milter for Postfix        | Eval       |
+| Element                     | Secure communications platform | Functional |
+| Jitsi                       | Videoconferencing              | Functional |
+| MariaDB                     | Database                       | Eval       |
+| Memcached                   | Cache Database                 | Eval       |
+| MinIO                       | Object Storage                 | Eval       |
+| Nextcloud                   | File share                     | Functional |
+| Nubus (UMS)                 | Identity Management & Portal   | Functional |
+| OpenProject                 | Project management             | Functional |
+| OX Appsuite                 | Groupware                      | Functional |
+| OX Dovecot                  | Mail backend (IMAP)            | Functional |
+| Postfix                     | MTA                            | Eval       |
+| PostgreSQL                  | Database                       | Eval       |
+| Redis                       | Cache Database                 | Eval       |
+| XWiki                       | Knowledge Management           | Functional |

 # Component integration

-Some use cases require inter component integration.
+Some use cases require inter-component integration.

 ```mermaid
 flowchart TD
-  OX-AppSuite_Frontend-->|Silent Login, Filepicker, Central Navigation|Intercom_Service
-  Element-->|Silent Login, Central Navigation|Intercom_Service
-  Intercom_Service-->|Silent Login, Token Exchange|IdP
-  Intercom_Service-->|Filepicker|Nextcloud
-  Intercom_Service-->|Central Navigation|Portal
-  OX-AppSuite_Backend-->|Filepicker|Nextcloud
-  Nextcloud-->|Central Navigation|Portal
-  OpenProject-->|Central Navigation|Portal
-  OpenProject-->|File Store|Nextcloud
-  XWiki-->|Central Navigation|Portal
-  Nextcloud-->|Central Contacts|OX-AppSuite_Backend
-  OX-AppSuite_Frontend-->|Filepicker|OX-AppSuite_Backend
+ OX-AppSuite_Frontend-->|Silent Login, Filepicker, Central Navigation|Intercom_Service
+ Element-->|Silent Login, Central Navigation|Intercom_Service
+ Intercom_Service-->|Silent Login, Token Exchange|IdP
+ Intercom_Service-->|Filepicker|Nextcloud
+ Intercom_Service-->|Central Navigation|Portal
+ OX-AppSuite_Backend-->|Filepicker|Nextcloud
+ Nextcloud-->|Central Navigation|Portal
+ OpenProject-->|Central Navigation|Portal
+ OpenProject-->|File Store|Nextcloud
+ XWiki-->|Central Navigation|Portal
+ Nextcloud-->|Central Contacts|OX-AppSuite_Backend
+ OX-AppSuite_Frontend-->|Filepicker|OX-AppSuite_Backend
 ```

 Most details can be found in the upstream documentation that is linked in the respective sections.

 ## Intercom Service / Silent Login

-The Intercom Service's role is to enable cross-application integration based on the user's browser interaction as handling
-authentication when the frontend of an application has to call the API from another application is often a
-challenge.
+The Intercom Service is deployed in the context of Nubus/UMS. Its role is to enable cross-application integration
+based on the user's browser interaction as handling authentication when the frontend of an application has to call
+the API from another application is often a challenge.

-To establish a session with the Intercom Service an application can use the silent login feature within an iframe.
+To establish a session with the Intercom Service, applications can use the silent login feature within an iframe.

-Currently only OX AppSuite and Element are using the frontend based integration.
+Currently, only OX AppSuite and Element are using the frontend-based integration.

 **Links**
 - [Intercom Service upstream documentation](https://docs.software-univention.de/intercom-service/latest/index.html).

 ## Filepicker

-The Nextcloud filepicker is integrated into the OX AppSuite supporting the following use cases against the respective openDesk instance's Nextcloud:
- Attaching files from Nextcloud to emails.
- Adding links of Nextcloud files to emails.
- Saving attachments from emails into Nextcloud.
- Attaching files from Nextcloud to calendar entries.
+The Nextcloud Filepicker is integrated into the OX AppSuite, supporting the following use cases against the respective openDesk instance's Nextcloud:
+- Attach files from Nextcloud to emails.
+- Create and add links to Nextcloud files into emails.
+- Save attachments from emails into Nextcloud.
+- Attach files from Nextcloud to calendar entries.

-The filepicker is using frontend and backend based integration:
- For frontend based integration the OX AppSuite frontend uses the Intercom Service.
- Backend based integration is coming from OX AppSuite middleware. The middleware is communicating directly with Nextcloud,
-which is used when adding a file to an email or storing a file into Nextcloud, to avoid passing these files through the user's browser.
+The Filepicker uses frontend and backend-based integration:
+- For frontend-based integration, the OX AppSuite frontend uses the Intercom Service.
+- Backend-based integration is coming from OX AppSuite middleware. The middleware communicates directly with Nextcloud
+when adding a file to an email or storing a file into Nextcloud to avoid passing these files through the user's browser.

 **Links**
 - [OX AppSuite Nextcloud Integration upstream documentation](https://gitlab.open-xchange.com/extensions/nextcloud-integration/-/tree/main/documentation).

 ## Central Navigation

-Central navigation is based on an API endpoint in the Nubus portal that returns a JSON containing the contents of the portal for
+Central navigation is based on an API endpoint in the Nubus portal that returns a JSON containing the portal's contents for
 a given user. The response from the API endpoint is used in the openDesk applications to render the central navigation.

 The API can be called by
@@ -121,8 +121,8 @@ curl 'https://portal.<DOMAIN>/univention/portal/navigation.json?base=https%3A//p

 ## Central Contacts

-OX App Suite is managing contacts in openDesk. Therefore Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
- create a new contact in the user's contacts folder when a file is shared with a yet unknown email address.
+OX App Suite is managing contacts in openDesk. Therefore, Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
+- create a new contact in the user's contacts folder when a file is shared with an unknown email address.
 - retrieve contacts from the user's contacts folder to support search-as-you-type when starting to share a file.

 **Links:**
@@ -134,9 +134,9 @@ OX App Suite is managing contacts in openDesk. Therefore Nextcloud's PHP backend
 While OpenProject allows you to attach files to work packages directly, it is often preferred that the files are
 stored within Nextcloud or to link an existing file from your openDesk Nextcloud to a work package.

-Therefore openDesk pre-configures the trust between the openDesk instance's OpenProject and Nextcloud during the `openproject-boostrap` deployment step. As prerequisite for that openDesk's Nextcloud contains the `integration_openproject` app.
+Therefore, openDesk pre-configures the trust between the openDesk instance's OpenProject and Nextcloud during the `openproject-boostrap` deployment step. As a prerequisite for that, openDesk's Nextcloud contains the `integration_openproject` app.

-The file store still needs to be enabled on a per-project level in OpenProject's project admin section.
+The file store must still be enabled per project in OpenProject's project admin section.

 **Links:**
 - [OpenProject's documentation on Nextcloud integration](https://www.openproject.org/docs/system-admin-guide/integrations/nextcloud/)
@@ -146,42 +146,41 @@ The file store still needs to be enabled on a per-project level in OpenProject's

 An overview of
 - components that consume the LDAP service.
-  - The components accessing the LDAP using a component specific LDAP search account.
- components using Univention Keycloak as identity provider (IdP).
-  - If not otherwise denoted the components make use of OAuth2 / OIDC flows.
-  - All components have a client configured in Keycloak, except for Jitsi which is using authentication with the
-    [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) that does not
-    require an OIDC client to be configured in Keycloak.
+  - The components access the LDAP using a component-specific LDAP search account.
+- components using Univention Keycloak as an identity provider (IdP).
+  - The components should use OAuth2 / OIDC flows if not otherwise denoted.
+  - All components have a client configured in Keycloak, except for Jitsi, which is using authentication with the
+ [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) that does not
+ require an OIDC client to be configured in Keycloak.

 Some components trust others to handle authentication for them.

 ```mermaid
 flowchart TD
-    K[IdP]-->L[LDAP]
-    N[Nextcloud]-->L
-    O[OpenProject] --> L
-    A[OX AppSuite]-->L
-    D[OX Dovecot]-->L
-    P[Portal/Admin]-->L
-    X[XWiki]-->L
-    A-->K
-    N-->K
-    D-->K
-    O-->K
-    X-->K
-    P-->|SAML|K
-    E[Element]-->K
-    J[Jitsi]-->K
-    I[IntercomService]-->K
-    C[Collabora]-->N
-    R[CryptPad]-->N
-    F[Postfix]-->D
+ K[IdP]-->L[LDAP]
+ N[Nextcloud]-->L
+ O[OpenProject] --> L
+ A[OX AppSuite]-->L
+ D[OX Dovecot]-->L
+ P[Portal/Admin]-->L
+ X[XWiki]-->L
+ A-->K
+ N-->K
+ D-->K
+ O-->K
+ X-->K
+ P-->|SAML|K
+ E[Element]-->K
+ J[Jitsi]-->K
+ I[IntercomService]-->K
+ C[Collabora]-->N
+ R[CryptPad]-->N
+ F[Postfix]-->D
 ```

 # Provisioning

-Currently, active provisioning is only done for OX AppSuite. The OX-Connector is synchronizing, creating, modifying and
-deleting activities for the following objects to the OX AppSuite using the AppSuite's SOAP API:
+Currently, active provisioning is only done for OX AppSuite. The OX-Connector synchronizes the following objects to the OX AppSuite using the AppSuite's SOAP API:

 - Contexts
 - Users
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -2,8 +2,10 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Debugging</h1>

+<!-- TOC -->
 * [Disclaimer](#disclaimer)
 * [Enable debugging](#enable-debugging)
 * [Adding containers to a pod for debugging purposes](#adding-containers-to-a-pod-for-debugging-purposes)
@@ -14,53 +16,65 @@ SPDX-License-Identifier: Apache-2.0
  * [Nextcloud](#nextcloud)
  * [OpenProject](#openproject)
  * [PostgreSQL](#postgresql)
+  * [Keycloak](#keycloak)
+<!-- TOC -->

 # Disclaimer

-This document collects information how to deal with debugging an openDesk deployment.
+This document collects information on how to deal with debugging an openDesk deployment.

-It will be extended over time as we have to deal with debugging cases.
+It will be extended over time as we deal with debugging cases.

 We for sure do not want to reinvent the wheel, so we might link to external sources that contain helpful
 information where available.

-**Note:** You should never enable debug in production environments! By looking up `debug.enable` in the deployment you
-will find the various places changes are applied when enabling debugging. So outside of development and test
-environments you may want to make use of them in a very thoughtful and selective manner if needed.
+> **Warning**<br>
+> You should never enable the debug option in production environments! By looking up `debug.enable` in the deployment, you
+will find the various places changes are applied when enabling debugging. So, outside of development and test
+environments, you should use them thoughtfully and carefully if needed.

 # Enable debugging

-Set `debug.enable` to `true` in [`debug.yaml`](../helmfile/environments/default/debug.yaml) to set the
-component's log level to debug and it get some features like:
- The `/admin` console is routed for Keycloak.
- An ingress for `http://minio-console.<your_domain>` is configured.
-and set the log level for components to "Debug".
+Check the openDesk [`debug.yaml`](../helmfile/environments/default/debug.yaml) and set for your deployment
+```
+debug:
+  enable: true
+```

-**Note:** All containers should write their log output to STDOUT, if you find (valuable) logs inside a container, please let us know!
+This will result in:
+- setting most component's log level to debug
+- making the Keycloak admin console available by default at `https://id.<your_domain>/admin/`
+- configured the ingress for `http://minio-console.<your_domain>`
+
+> **Note**<br>
+> When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.
+
+> **Note**<br>
+> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container, please let us know!

 # Adding containers to a pod for debugging purposes

-During test or development you come across the need to execute tools, browse or even change things in the filesystem of another container.
+During testing or development, you may need to execute tools, browse, or even change things in the filesystem of another container.

-This can be a challenge the more security hardened container images are, because there are no debugging tools available and sometimes not even a shell.
+This can be a challenge the more security-hardened the container images are because there are no debugging tools available, and sometimes, there is not even a shell.

 Adding a container to a Pod can ease the pain.

-Below you will find some wrap-up notes when it comes to debugging openDesk by adding debug containers. Of course there are a lot of more detailed resources out in the wild.
+Below are some wrap-up notes on debugging openDesk by adding debug containers. Of course, there are many more detailed resources out there.

 ## Adding a container to a pod/deployment - Dev/Test only

 You can add a container by editing and updating an existing deployment, which is quite comfortable with tools like [Lens](https://k8slens.dev/).

- Select the container you want to make use of as debugging container, in the example below it's `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
+- Select the container you want to make use of as a debugging container; in the example below, it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
 - Ensure the `shareProcessNamespace` option is enabled for the Pod.
 - Reference the selected container within the `containers` array of the deployment.
- In case you want to access another containers filesystem, ensure the user/group settings of both containers match.
+- If you want to access another container's filesystem, ensure both containers' user/group settings match.
 - Save & update the deployment.

-The following example can e.g. be used to debug the `openDesk-Nextcloud-PHP` container, in case you want to modify files, don't forget to set `readOnlyRootFilesystem` to `true` on the PHP container.
+The following example can be used to debug the `openDesk-Nextcloud-PHP` container; if you want to modify files, remember to set `readOnlyRootFilesystem` to `true` on the PHP container.

-```
+```yaml
      shareProcessNamespace: true
      containers:
        - name: debugging
@@ -80,36 +94,36 @@ The following example can e.g. be used to debug the `openDesk-Nextcloud-PHP` con
              type: RuntimeDefault
 ```

- After the deployment was reloaded open the shell of the debugging container.
- When you've been successful you will see the processes of both/all containers in the pod when doing a `ps aux`.
- To access another containers filesystem just select the PID of a process from the other container an do a `cd /proc/<selected_process_id>/root`
+- After the deployment has been reloaded, open the shell of the debugging container.
+- When you've succeeded, you will see the processes of both/all containers in the Pod when doing a `ps aux`.
+- To access other containers' filesystems, select the PID of a process from the other container and do a `cd /proc/<selected_process_id>/root`.

 ## Temporary/ephemeral containers

-Interesting read we picked most of the details below from: https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/
+An interesting read we picked most of the details below from: https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/

-Sometimes you do not want to add a container permanently to your existing deployment. In that case you could use [ephemeral containers](https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/).
+Sometimes, you do not want to add a container permanently to your existing deployment. In that case, you could use [ephemeral containers](https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/).

-For the commands further down this section we set some environment variables first:
- `NAMESPACE`: The namespace the Pod you want to inspects is running in.
- `DEPLOYMENT_NAME`: The name of the deployment responsible for spawning the Pod you want to inspect within the pre-mentioned namespace.
+For the commands further down this section, we set some environment variables first:
+- `NAMESPACE`: The namespace in which the Pod you want to inspect is running.
+- `DEPLOYMENT_NAME`: The deployment's name responsible for spawning the Pod you want to inspect within the pre-mentioned namespace.
 - `POD_NAME`: The name of the Pod you want to inspect within the pre-mentioned namespace.
- `EPH_CONTAINER_NAME`: Chose the name for the container, "debugging" seem obvious.
- `DEBUG_IMAGE`: The image you want to make use of for debugging purposes.
+- `EPH_CONTAINER_NAME`: Choose the name for the container, and "debugging" seems obvious.
+- `DEBUG_IMAGE`: The image you want to use for debugging purposes.

 e.g.

-```
+```shell
 export EPH_CONTAINER_NAME=debugging
 export NAMESPACE=my_test_deployment
 export DEPLOYMENT_NAME=opendesk-nextcloud-php
 export POD_NAME=opendesk-nextcloud-php-6686d47cfb-7642f
-export DEBUG_IMAGE=registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:1.0.0
+export DEBUG_IMAGE=registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest
 ```

 You still need to ensure that your deployment supports process namespace sharing:

-```
+```shell
 kubectl -n ${NAMESPACE} patch deployment ${DEPLOYMENT_NAME} --patch '
 spec:
  template:
@@ -117,12 +131,12 @@ spec:
      shareProcessNamespace: true'
 ```

-Now you can add the ephemeral container with:
-```
+Now, you can add the ephemeral container with:
+```shell
 kubectl -n ${NAMESPACE} debug -it --attach=false -c ${EPH_CONTAINER_NAME} --image={DEBUG_IMAGE} ${POD_NAME}
 ```
-and open it's interactive terminal with
-```
+and open its interactive terminal with
+```shell
 kubectl -n ${NAMESPACE} attach -it -c ${EPH_CONTAINER_NAME} ${POD_NAME}
 ```

@@ -130,9 +144,9 @@ kubectl -n ${NAMESPACE} attach -it -c ${EPH_CONTAINER_NAME} ${POD_NAME}

 ## MariaDB

-When using the openDesk bundled MariaDB you can explore database(s) using the MariaDB interactive terminal from the pod's command line: `mariadb -u root -p`. As password provide the value for `MARIADB_ROOT_PASSWORD` set in the pod's environment.
+When using the openDesk bundled MariaDB, you can explore the database(s) using the MariaDB interactive terminal from the Pod's command line: `mariadb -u root -p`. On the password prompt, provide the value for `MARIADB_ROOT_PASSWORD` found in the Pod's environment.

-While you will find all details for the CLI tool in [the online documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some quick commands are:
+While you will find all the details for the CLI tool in [the online documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some quick commands are:

 - `help`: Get help on the psql command set
 - `show databases`: Lists all databases
@@ -142,28 +156,27 @@ While you will find all details for the CLI tool in [the online documentation](h

 ## Nextcloud

-`occ` is the CLI for Nextcloud, all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
+`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).

 You can run occ commands in the `opendesk-nextcloud-php` pod like this: `php /var/www/html/occ config:list`

 ## OpenProject

-OpenProject is a Ruby on Rails application. Therefore you can make use of the Rails console from the pod's command line `bundle exec rails console`
-
+OpenProject is a Ruby on Rails application. Therefore, you can make use of the Rails console from the Pod's command line `bundle exec rails console`
 and run debug code like this:

 ```
-uri = URI('https://nextcloud.url/index.php/apps/integration_openproject/check-config')
+uri = URI('https://nextcloud.url/apps/integration_openproject/check-config')
 Net::HTTP.start(uri.host, uri.port,
-  :use_ssl => uri.scheme == 'https') do |http|
-  request = Net::HTTP::Get.new uri
-  response = http.request request # Net::HTTPResponse object
+ :use_ssl => uri.scheme == 'https') do |http|
+ request = Net::HTTP::Get.new uri
+ response = http.request request # Net::HTTPResponse object
 end
 ```

 ## PostgreSQL

-When using the openDesk bundled PostgreSQL you can explore database(s) using the PostgreSQL interactive terminal from the pod's command line: `psql -U postgres`.
+Using the openDesk bundled PostgreSQL, you can explore database(s) using the PostgreSQL interactive terminal from the Pod's command line: `psql -U postgres`.

 While you will find all details in the [psql subsection](https://www.postgresql.org/docs/current/app-psql.html)) of the PostgreSQL documentation, some quick commands are:

@@ -172,3 +185,19 @@ While you will find all details in the [psql subsection](https://www.postgresql.
 - `\c <databasename>`: Connect to `<databasename>`
 - `\dt`: List (describe) tables within the currently connected database
 - `\q`: Quit the client
+
+## Keycloak
+
+Keycloak is the gateway to integrate other authentication management systems or applications. It can be desired to
+avoid enabling debug mode for the whole platform when you just need to look into Keycloak.
+
+That can easily be achieved in two steps:
+
+1. Updating the value for `KC_LOG_LEVEL` in the related configmap `ums-keycloak`.
+```shell
+export NAMESPACE=<your_namespace>
+export CONFIGMAP_NAME=ums-keycloak
+kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"data":{"KC_LOG_LEVEL":"DEBUG"}}'
+```
+
+2. Restart the Keycloak Pod(s).
--- a/docs/development.md
+++ b/docs/development.md
@@ -7,8 +7,9 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Developing openDesk deployment automation</h1>

 Active development on the deployment is currently only available for project members.
-But contributions will be possible soon once the CLA process is sorted out.
+However, contributions are possible using the [CLA](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md?ref_type=heads) process.

+<!-- TOC -->
 * [Overview](#overview)
 * [Default branch, `develop` and other branches](#default-branch-develop-and-other-branches)
 * [External artifacts - `charts.yaml` and `images.yaml`](#external-artifacts---chartsyaml-and-imagesyaml)
@@ -17,31 +18,32 @@ But contributions will be possible soon once the CLA process is sorted out.
  * [Renovate](#renovate)
  * [Mirroring](#mirroring)
    * [Get new artifacts mirrored](#get-new-artifacts-mirrored)
-* [Creating new charts / images](#creating-new-charts--images)
+* [Creating new charts/images](#creating-new-chartsimages)
+<!-- TOC -->

 # Overview

-The following sketch provides an high level overview to get a basic understanding of the deployment relevant
-structure of this repository. An understanding of that structure is vital if you want to contribute to
-the development of the deployment automation of openDesk.
+The following sketch provides a high-level overview to get a basic understanding of the deployment-relevant
+structure of this repository. Understanding that structure is vital if you want to contribute to
+developing the openDesk platform.

 ```mermaid
 flowchart TD
-    J[helmfile.yaml\nor a helmfile outside of this repository]-->A
-    J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor any an environment values file]
-    A[./helmfile_generic.yaml]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml\nReferences the relevant app Helm\ncharts using details from 'charts.yaml']
-    B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml`]
-    A-->D[./helmfile/environments/default/*\nwith just some examples below]
-    D-->F[charts.yaml]
-    D-->G[images.yaml]
-    D-->H[global.*]
-    D-->I[secrets.yaml\nreplicas.yaml\nresources.yaml\n...]
-    A-->|overwrite defaults with your\ndeployment/environment specific values|E[./helmfile/environments/default/values.yaml.gotmpl]
+ J[helmfile.yaml\nor a helmfile outside of this repository]-->A
+ J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor any an environment values file]
+ A[./helmfile_generic.yaml]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml\nReferences the relevant app Helm\ncharts using details from 'charts.yaml']
+ B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml`]
+ A-->D[./helmfile/environments/default/*\nwith just some examples below]
+ D-->F[charts.yaml]
+ D-->G[images.yaml]
+ D-->H[global.*]
+ D-->I[secrets.yaml\nreplicas.yaml\nresources.yaml\n...]
+ A-->|overwrite defaults with your\ndeployment/environment specific values|E[./helmfile/environments/default/values.yaml.gotmpl]
 ```

-The `helmfile.yaml` file in the root folder serves as the foundation
+The `helmfile.yaml` file in the root folder is the foundation
 for the entire deployment. It references the `helmfile_generic.yaml`
-file, which includes app-specific `helmfile.yaml` files, as well as
+file, which includes app-specific `helmfile.yaml` files and
 global values files located in `./environments/default`.

 `helmfile.yaml` also refers to three predefined environments: `dev`,
@@ -51,27 +53,26 @@ The `helmfile_generic.yaml` file is designed to be referenced from
 external repositories, where custom environments may be defined. An
 example is demonstrated in the `helmfile.yaml` file.

-Before you look into any app specific configuration it is recommended to review the contents of `./environments/default` to get an understanding of what
-details are maintained in there, as they are usually referenced by the app configurations.
+Before you investigate any app-specific configuration, it is recommended that you review the contents of `./helmfile/environments/default` to understand what configuration details are set there, as the app deployments reference them.

 # Default branch, `develop` and other branches

 The `main` branch is configured to be the default branch, as visitors of the project on Open CoDE should see that
 branch by default.

-Please use the `develop` branch to diverge your own branch(es) from. See the [workflow guide](./workflow.md)
+Please use the `develop` branch to diverge your branch(es) from. See the [workflow guide](./workflow.md)
 for more details on naming conventions.

-There is a CI bot that automatically creates a merge request once you initially pushed your branch to Open CoDE.
-The merge request will of course target the `develop` branch, be in status `draft` and have you as assignee.
+There is a CI bot that automatically creates a merge request once you initially push your branch to Open CoDE.
+Of course, the merge request will target the `develop` branch, be in status `draft`, and you are set as the assignee.

-In case you do not plan to actually merge from the branch you have pushed, please close or delete the auto-created MR.
+If you do not plan to merge from the branch you have pushed, please close the auto-created MR.

 # External artifacts - `charts.yaml` and `images.yaml`

-The `charts.yaml` and `images.yaml` are the central place to reference external artifacts that are used for the deployment.
+The `charts.yaml` and `images.yaml` files are the central place to reference external artifacts used for the deployment.

-Beside the deployment automation itself some tools work with the contents of the files:
+Besides the deployment automation itself, some tools work with the contents of the files:

 - **Linting**: Ensures consistency of the file contents for the other tools.
 - **Renovate**: Automatically create MRs that update the components to their latest version.
@@ -81,35 +82,35 @@ Please find details on these tools below.

 ## Linting

-In the project's CI there is a step dedicated to lint the two yaml files, as we want them to be in
+In the project's CI, there is a step dedicated to lint the two yaml files, as we want them to be in
 - alphabetical order regarding the components and
 - in a logical order regarding the non-commented lines (registry > repository > tag).

-In the linting step the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
-just mentioned sorting and the result is compared with the unsorted version. If there is a delta the linting fails and you probably
-want to fix it by running the CLI tool locally.
+In the linting step, the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
+just mentioned sorting, and the result is compared with the unsorted version. If there is a delta, the linting fails, and you can fix it by running the CLI tool locally, verifying and applying the result to your branch.

-**Note**: Please ensure that in component blocks you use comments only at the beginning of the block or at its end. Ideally you just stick
+> **Note**<br>
+> Please ensure that in component blocks, you use comments only at the beginning of the block or at its end. Ideally, you stick
 with the many available examples in the yaml files.

 Example:
-```
-  synapse:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Element"
-    # upstreamRegistry: "https://registry-1.docker.io"
-    # upstreamRepository: "matrixdotorg/synapse"
-    # upstreamMirrorTagFilterRegEx: '^v(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["1", "91", "2"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse"
-    tag: "v1.91.2@sha256:1d19508db417bb2b911c8e086bd3dc3b719ee75c6f6194d58af59b4c32b11322"
+```yaml
+ synapse:
+ # providerCategory: "Supplier"
+ # providerResponsible: "Element"
+ # upstreamRegistry: "https://registry-1.docker.io"
+ # upstreamRepository: "matrixdotorg/synapse"
+ # upstreamMirrorTagFilterRegEx: '^v(\d+)\.(\d+)\.(\d+)$'
+ # upstreamMirrorStartFrom: ["1", "91", "2"]
+ registry: "registry.opencode.de"
+ repository: "BMI/opendesk/components/supplier/element/images-mirror/synapse"
+ tag: "v1.91.2@sha256:1d19508db417bb2b911c8e086bd3dc3b719ee75c6f6194d58af59b4c32b11322"
 ```

 ### Disable linting selectively

-If you follow the "push early, push often" paradigm to save your work to the central Git instance or you just fix a typo in the text
-of an existing documentation you might want to avoid the CI with its linting to be executed, as it might not offer additional value.
+If you follow the "push early, push often" paradigm to save your work to the central Git instance, or you just fix a typo in
+existing documentation, you can avoid the CI and its linting being executed, as it might not offer additional value.

 GitLab offers two options to skip the CI on a commit/push:
 - Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
@@ -124,40 +125,42 @@ Uses a regular expression to match the values of the following attributes:
 - `# upstreamRepository` *required*
 - `tag` *required*

-Checks for newer versions of the given artefact and creates a MR containing the newest version's tag (and digest).
+Checks for newer versions of the given artifact and creates an MR containing the newest version's tag (and digest).

 ## Mirroring

 - See also: https://gitlab.opencode.de/bmi/opendesk/tooling/oci-pull-mirror

-**Note:** The mirror is scheduled to run every hour at 42 minutes past the hour.
+> **Note:**<br>
+> The mirror is scheduled to run every hour at 42 minutes past the hour.

-openDesk strives to make all relevant artifacts available on Open CoDE so there is the mirroring process
+openDesk strives to make all relevant artifacts available on Open CoDE so there is a mirroring process
 configured to pull artifacts that do not originate from Open CoDE into projects called `*-Mirror` within the
 [openDesk Components section](https://gitlab.opencode.de/bmi/opendesk/components).

 The mirror script takes the information on what artifacts to mirror from the annotation inside the two yaml files:
 - `# upstreamRegistry` *required*: To identify the source registry
+- `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public, the access credentials have to be specified as ENV variables containing the value of this key in their name, so you want to specify that key all uppercase:
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORT`
 - `# upstreamRepository` *required*: To identify the source repository
- `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set it activates the mirror for the component. Only tags are being mirrored that match the given regular expression. **Note:** You have to use single quotes for this attribute's value in case you use backslash leading regex notation like `\d`.
- `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing groups
-  in `# upstreamMirrorTagFilterRegEx` to identify the single numeric elements of the version within the tag and use per capturing group (left to right) one numeric array
-  element here to define the version the mirror should start with.
+- `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set, the mirror for the component will be activated. Only tags that match the given regular expression are being mirrored. **Note:** You must use single quotes for this attribute's value if you use backslash leading regex notation like `\d`.
+- `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing group
+ in `# upstreamMirrorTagFilterRegEx` to identify the single numeric elements of the version within the tag and use per capturing group (left to right) one numeric array
+ element here to define the version the mirror should start with.

 ### Get new artifacts mirrored

-If you want new images or charts to be mirrored that are not yet included in one of the yaml files there are two options:
+If you want new images or charts mirrored that are not yet included in one of the yaml files, you can add them in your branch, including the aforementioned mirror annotations, and ask somebody from the platform development team to trigger the mirror's CI based on your branch.

-You include them in your branch with all required annotations and either
-1. ask somebody from the platform development team to trigger the mirror's CI based on your branch or
-2. you get your branch merged to `develop` already.
+Once your branch is merged into develop, your artifacts are mirrored hourly.

-# Creating new charts / images
+# Creating new charts/images

-When you create new Helm charts please check out the
+When you create new Helm charts, please check out the
 [openDesk Best Practices](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-best-practises)
 for Helm charts.

 You may also want to make use of our [standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) to
-easily get Charts and Images that are signed, linted, scanned and released.
+quickly get Helm charts and container images that are signed, linted, scanned, and released.
 Check out the `.gitlab-ci.yaml` files in the project's [Charts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts) or [Images](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images) to get an idea how little you need to do yourself.
--- a/docs/enhanced-configuration.md
+++ b/docs/enhanced-configuration.md
@@ -9,6 +9,8 @@ SPDX-License-Identifier: Apache-2.0

 The following enhanced configuration use cases are described in separate documents.

- [Separate mail & Matrix domain](enhanced-configuration/separate-mail-matrix-domain.md)
- [Federation with external identity provider](enhanced-configuration/idp-federation.md)
- [Matrix federation](enhanced-configuration/matrix-federation.md)
+- [Separate mail & Matrix domain](./enhanced-configuration/separate-mail-matrix-domain.md)
+- [Federation with external identity provider](./enhanced-configuration/idp-federation.md)
+- [Matrix federation](./enhanced-configuration/matrix-federation.md)
+- [Groupware migration from M365 to openDesk](./enhanced-configuration/groupware-migration.md)
+- [Self-signed certificate and custom Certificate Authority (CA)](enhanced-configuration/self-signed-certificates.md)
--- a/docs/enhanced-configuration/groupware-migration.md
+++ b/docs/enhanced-configuration/groupware-migration.md
@@ -0,0 +1,185 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Migration from M365 with audriga migration service and master authentication</h1>
+
+<!-- TOC -->
+* [Context](#context)
+* [Prerequisites](#prerequisites)
+  * [Prepare M365 tenant for access](#prepare-m365-tenant-for-access)
+  * [Provisioning user accounts in openDesk](#provisioning-user-accounts-in-opendesk)
+  * [Deploy openDesk with master authentication](#deploy-opendesk-with-master-authentication)
+* [Migration configuration](#migration-configuration)
+  * [Select the source provider and configure your openDesk instance](#select-the-source-provider-and-configure-your-opendesk-instance)
+  * [Adding accounts](#adding-accounts)
+    * [Add user accounts individually](#add-user-accounts-individually)
+    * [Add multiple user accounts via CSV file](#add-multiple-user-accounts-via-csv-file)
+  * [Start the migration](#start-the-migration)
+  * [Monitor migration status](#monitor-migration-status)
+<!-- TOC -->
+
+Most organizations already have email accounts on various platforms that need to be migrated to openDesk. This document describes the migration from M365 accounts to openDesk using the [audriga Migration Service](https://www.audriga.com) in combination with the master authentication option in openDesk. Other source platforms are also supported, and their migrations work in a similar manner.
+
+The migration can be configured on audriga's self-service website, accessed with most common web browsers (e.g. IE, Firefox, Safari or Chrome). No software needs to be installed on your machine. The service connects to your mailbox similarly to what your email client does. Emails, attachments, folders, and, depending on the source systems, contacts, tasks, notes, and calendar data are being copied to your destination account. See [M365 to OX Migration Guide](https://audriga.com/fileadmin/guides/en/MS365-OX.pdf) for the scope and limitations of the process.
+
+The data in the source mailbox will not be deleted or altered. To configure a migration, only three simple steps in audriga's self-service portal have to be completed. After the migration has started, its status can be continuously monitored on the website.
+
+It may not be possible to complete especially large or complex migrations with only this guide. If you identify issues related to I/O, bandwidth, timeline constraints, or anything else that makes the migration more complicated than you feel comfortable handling on your own using the self-service, please get in touch with contact [audriga's support](mailto:support@audriga.com).
+
+# Prerequisites
+
+## Prepare M365 tenant for access
+
+The following instructions provide information on how to authenticate Microsoft 365 / Exchange Online accounts in the audriga migration service with "modern authentication" using a service account without the need to provide a username and password for each mailbox that will be migrated.
+
+You will have to select an existing user account that will be used as a service account for the migration. You have to register the audriga application and create an M365 email group known only to you as described in the following steps:
+
+***1. Select one account to serve as a service account***
+
+Please note that the account that shall serve as the service account requires a Microsoft 365/Exchange online license (mailbox).
+
+> **Notes**<br>
+> If you want to designate your admin account as a service account, you have to provide the admin with a license.
+
+***2. Register the audriga app in your tenant***
+
+To register the audriga app in your tenant, log into your admin account and access the following URL:
+
+ https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=3cd27a72-a19e-4945-9715-fc24d940428f&redirect_uri=https://umzug.audriga.com/SMESwitchWebApp/oauth_complete.jsp&scope=https://outlook.office.com/.default
+
+- Accept the App "audriga CloudMovr migration"
+- You will be redirected to an audriga page, which you can close without requiring additional interaction.
+
+> **Note**<br>
+> The audriga application is created under the "Enterprise application" tab in the AzureAD console.
+
+***3. Create a "secret" group in the M365 tenant***
+
+Create a "secret" group in the customer tenant.
+
+- Go to <https://aad.portal.azure.com> > Azure Active Directory > Groups > New Group
+- Choose a group name and group email address that includes the word "audriga" in lowercase ("Audriga" will not work), like *audriga-migration@your-maildomain.tld*
+- Choose the group type "Microsoft 365"
+- Appoint your service account (see 1.) as the owner of this group
+
+
+## Provisioning user accounts in openDesk
+
+In openDesk, you have to have all user accounts with mailboxes pre-defined before running the migration. You can either manually create your accounts using an IAM administrator or use the [user import tool](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) to batch import user accounts to your openDesk deployment.
+
+## Deploy openDesk with master authentication
+
+With openDesk 1.0 Enterprise, you can set openDesk's email components (OX AppSuite and OX Dovecot) into master authentication mode to run the migration as described in this document using the following two settings for your deployment:
+
+```
+secrets:
+  oxAppsuite:
+    adminPassword: "your_temporary_master_password"
+functional:
+  migration:
+    oxAppsuite:
+      enabled: true
+```
+
+1. You must specify the master password referenced in the document's following sections.
+2. You need to enable the actual master authentication mode.
+
+Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppsuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppsuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
+
+> **Note**<br>
+> For the changes to take effect, it is sufficient to deploy the `open-xchange` component.
+
+> **Note**<br>
+> While in master authentication mode, regular users cannot log in to the webmail module of openDesk or access the mail using IMAP, as it is not recommended that users interact with the target mail infrastructure during the migration scenario described in this document.
+
+# Migration configuration
+
+The migration is configured in 3 steps using the [audriga migration self-service](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware).
+
+Ensure you meet the prerequisites. For example, this document does not support using the standard username/password-based authentication option for M365.
+
+## Select the source provider and configure your openDesk instance
+
+Choose [Microsoft 365 / Exchange Online (Admin)](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware#src=onmicrosoft.com) as your current provider.
+
+> **Note**<br>
+> You may need to start typing in "Microsoft Office 365/Exchange Online" for it to appear in the list.
+
+Configure openDesk as your destination server:
+- Select "Configure provider or server" in the provider selection box of the migration application.
+- In the following dialog, select "Open-Xchange" as protocol.
+- On the tab "IMAP"
+  - For "Mailserver (host name or IP address)" enter your IMAP host, e.g. "webmail.your-opendesk-domain.tld".
+  - If your IMAP server is not running on default port 993, enter your nonstandard IMAP port under Details -> Port.
+  - Press check.
+- On the tab "Open-Xchange"
+  - Set the hostname of your OX AppSuite installation, e.g. "webmail.your-opendesk-domain.tld".
+  - Press check.
+- If you receive a green checkmark on both tabs, click "Save". Otherwise, check your settings until you get the green checkmark.
+
+## Adding accounts
+
+You can add accounts one by one, which seems only feasible for test scenarios, or when you migrate a handful of mailboxes, or you can add accounts using CSV upload. Both options are described in the following subsections.
+
+### Add user accounts individually
+
+By default, you will enter the "Add Mailbox" tab where you can add individual accounts for M365:
+
+```
+Username:             enter the username of the service account, e.g. eva@your-maildomain.tld
+Password:             enter the particular group email address, e.g. audriga-migration@your-maildomain.tld
+Details -> mailbox:   enter the user's mailbox you want to migrate, e.g. pia@your-maildomain.tld
+```
+
+On the openDesk site, please provide:
+```
+Username:             enter the username of the mailbox you want to migrate to, e.g. pia@your-maildomain.tld
+Password:             enter the master password
+```
+
+Click on check to verify the credentials. If the data is correct, a green checkmark will appear. A red cross will be displayed if the credentials need to be corrected.
+
+After checking and confirming, you can use the same procedure to add further mailboxes.
+
+Alternatively, you can add multiple accounts via CSV upload. Find information in the following.
+
+### Add multiple user accounts via CSV file
+
+Prepare a CSV file with all necessary information. Unsurprisingly, this is the same information as described in the "Add User Accounts Individually" section above.
+
+The CSV requires the following column order with a closing semicolon after the last value - but no headline is expected; the first line must be your migration data already:
+```
+M365ServiceAccount;M365GroupEmailAddress;M365Mailbox;openDeskMailbox;openDeskMasterPassword;
+```
+
+Example CSV:
+```
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;eva@your-maildomain.tld;eva;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;max@your-maildomain.tld;max;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;pia@your-maildomain.tld;pia;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;ida@your-maildomain.tld;ida;YourMasterPassword;
+```
+
+Select the "Add multiple accounts" tab to configure up to 50 user accounts by uploading a CSV file. If you need to migrate more accounts, you can execute the migration multiple times.
+
+Click "Check" and save afterwards.
+
+## Start the migration
+
+You will see a summary of the migration, including the number of accounts and the amount of data. Even if the analysis of the source accounts has not yet been completed, you can proceed.
+
+Ensure you have a valid voucher; otherwise, you must complete the payment process.
+
+Press "Start Migration" to proceed.
+
+## Monitor migration status
+
+The migration process may take some time to start. For large amounts of data, it may take a couple of hours.
+
+Click on "Details" to get further information about the migration.
+
+You can access a detailed log for each account by clicking "Protocol" on the right-hand side. Here, you can see detected duplicates or encountered errors (e.g., if emails cannot be transferred due to your provider's size limitations).
+
+You will receive status emails for the migration job's submission and start, as well as when the migration job is finished. The emails are sent to the email address you have entered during the configuration. Those emails include a link to the status website so you can easily track and monitor your migration. Once the migration has been started, you can safely close the status website and shut down your computer; the migration will continue. You can re-open the status website anytime.
--- a/docs/enhanced-configuration/idp-federation.md
+++ b/docs/enhanced-configuration/idp-federation.md
@@ -5,6 +5,7 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Federation with external identity provider (IdP)</h1>

+<!-- TOC -->
 * [Context](#context)
 * [Prerequisites](#prerequisites)
  * [User accounts](#user-accounts)
@@ -17,112 +18,109 @@ SPDX-License-Identifier: Apache-2.0
    * [Separate realm](#separate-realm)
    * [OIDC Client](#oidc-client)
  * [openDesk IdP](#opendesk-idp)
+<!-- TOC -->

-# Context
+Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on to internal or external web applications.

-Most organizations already have an Identity and Access Management (IAM) of their own that includes an identity provider (IdP) for single-sign-on to internal or external web applications.
-
-This document shows how to configure your organizations IdP as well as the openDesk IdP to allow account federation to support single-sign-on to openDesk based on your organization's login.
+This document shows how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk single sign-on based on your organization's login.

 # Prerequisites

 ## User accounts

-Beside the configuration it is required that the user accounts with the same name exist within openDesk. This prerequisite is outside the scope of this document.
-
-We will provide additional documents regarding user provisioning in the future, so here's just an overview regarding potential scenarios:
+In addition to the configuration, it is required that user accounts with the same name exist within openDesk. While this prerequisite is outside the scope of this document, the following approaches are feasible:

 - Manual user management
-  - That is a lightweight way for testing your IdP federation setup or in case you just have a small amount of users to manage.
-  - Just create and maintain you user(s) in openDesk and ensure the username in your IAM and openDesk is identical.
+  - A lightweight option to test your IdP federation setup or if you have only a small number of users to manage.
+  - Create and maintain your user(s) in openDesk and ensure the username in your IAM and openDesk is identical.
 - User import
-  - If you need to create more than just a couple of test accounts you can use the [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/tooling/user-import) that utilizes the UDM REST API for user account creation.
+  - If you need to create more than just a couple of test accounts, you can use the [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) that utilizes the UDM REST API for user account creation.
  - Downsides: Managing groups and deleting accounts needs to be done manually.
 - Automated Pre-provisioning:
-  - Pre-provisioning users and groups including de-provisioning (deleting) accounts is the best practice as it ensures that openDesk is in sync with your organization's IAM.
+  - Pre-provisioning users and groups, including de-provisioning (deleting) accounts, is the best practice to ensure that openDesk is in sync with your organization's IAM.
  - There are at least two ways of implementing the pre-provisioning:
  - UDM REST API:
-    - Build a provisioning solution by yourself using the [UDM REST API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html).
-    - The API gives you full control over the contents of the IAM in order to create, update or delete users and groups.
-  - Directory Connector:
+    - Build a provisioning solution using the [UDM REST API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html).
+    - The API gives you complete control over the contents of the IAM to create, update, or delete users and groups.
+  - Nubus Directory Importer:
    - It is based on a Python one-way directory synchronization for users and groups.
-    - We will provide more details on this approach soon one the tool is made publicly available.
+    - Please find more details in the [upstream product's documentation](https://docs.software-univention.de/nubus-kubernetes-operation/latest/en/howto-connect-external-iam.html).
 - Ad-hoc provisioning (AHP)
-  - This feature is currently not available in the openDesk Keycloak, but there are plans by the Supplier Univention to make it available.
-  - Ad-hoc provisioning creates an user account on the fly during a users first login.
-  - While AHP this is a nice approach for a quick start with openDesk it has various downsides:
-    - Users are just created after their first login, so you cannot find your colleagues in the openDesk apps unless they already logged in.
+  - This feature is currently unavailable in openDesk's Keycloak, but Univention plans to make it available in the future.
+  - Ad-hoc provisioning creates a user account on the fly during a user's first login.
+  - While ad-hoc provisioning is an excellent approach for a quick start with openDesk, it has various downsides:
+    - Users are created after their first login, so you cannot find your colleagues in the openDesk apps unless they have already logged in.
    - A user account would never be deactivated or deleted in openDesk.
    - Group memberships are not transferred.

 ## External IdP with OIDC

-This document focusses on the OIDC federation between an external IdP and the openDesk IdP. It makes use of the OpenID Connect (OIDC) protocol, so your external IdP must support OIDC.
+This document focuses on the OIDC federation between an external IdP and the openDesk IdP. It uses the OpenID Connect (OIDC) protocol, so your external IdP must support OIDC.

 # Example configuration

 ## Versions

-The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3, as external IdP we also used an openDesk deployment of the same version but created a separate realm for proper separation of the configuration.
+The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3. As external IdP, we also used an openDesk deployment of the same version but created a separate realm for proper configuration separation.

 ## Example values

-The following values are used in this example documentation. Please ensure when you come across such a value even if it is part of a URL hostname or path that you adapt it where needed to your setup:
+The following values are used in this example documentation. Please ensure when you come across such a value, even if it is part of a URL hostname or path, that you adapt it where needed to your setup:

- `idp.organization.tld`: hostname for your organization's IdP
- `id.opendesk.tld`: hostname for the openDesk IdP, so openDesk is obviously deployed at `opendesk.tld`
- `fed-test-idp-realm`: realm name for your organizations IdP
- `opendesk-federation-client`: OIDC client for the openDesk federation that is defined in your organizations IdP
- `auto-federate-idp`: Identifier of your organizations IdP's configuration within the openDesk Keycloak.
+- `idp.organization.tld`: hostname for your organization's IdP.
+- `id.opendesk.tld`: hostname for the openDesk IdP, so openDesk is deployed at `opendesk.tld`.
+- `fed-test-idp-realm`: realm name for your organization's IdP.
+- `opendesk-federation-client`: OIDC client for the openDesk federation defined in your organization's IdP.
+- `auto-federate-idp`: Identifier of your organization IdP's configuration within the openDesk Keycloak.
 - `auto-federate-flow`: Identifier of the required additional login flow to be created and referenced in the openDesk Keycloak.

 ## Keycloak admin console access

-To access the admin console of Keycloak in an openDesk deployment you need to add a route for `/admin` to the Keycloak's ingress. This is done automatically if you deploy openDesk with `debug.enabled: true` but beware that this will also cause a lot of log output across all openDesk pods.
+To access Keycloak's admin console in an openDesk deployment, you must add a route for `/admin` to the Keycloak's ingress. This is done automatically if you deploy openDesk with `debug.enabled: true`, but beware that this will also cause a lot of log output across all openDesk pods.

 The admin console will be available at:
 - Organization's IdP: https://idp.organization.tld/admin/master/console/
 - openDesk IdP: https://id.opendesk.tld/admin/master/console/

-For the following configuration steps login with user `kcadmin` and grab the password from the `ums-keycloak` pod's `KEYCLOAK_ADMIN_PASSWORD` variable.
+For the following configuration steps, log in with user `kcadmin` and grab the password from the `ums-keycloak` pod's `KEYCLOAK_ADMIN_PASSWORD` variable.

 ## Your organizations IdP

-As we use the Keycloak of another openDesk instance to simulate your organization's IdP in this example, especially URL paths within the Keycloak might differ if you use different products.
+In this example, we use the Keycloak of another openDesk instance to simulate your organization's IdP. However, URL paths differ if you use another product.

 Please let us know about your experiences or differences you came across.

 ### Separate realm

-To not interfere with an existing configuration for our test scenario we create a separate realm:
+To not interfere with an existing configuration for our test scenario, we create a separate realm:

- `Create realm` (from realm selection drop down menu in the left upper corner)
+- `Create realm` (from the realm selection drop-down menu in the left upper corner)
 - *Realm name*: `fed-test-idp-realm`
 - `Create`

 ### OIDC Client

-If you just created the `fed-test-idp-realm` your are already in the admin screen for the realm, if not use the realm selection drop down menu in the left upper corner to switch to the realm.
+If you just created the `fed-test-idp-realm`, you are already in the admin screen for the realm; if not, use the realm selection drop-down menu in the upper left corner to switch to the realm.

 - *Clients* > *Create Client*
  - Client create wizard page 1:
    - *Client type*: `OpenID Connect`
    - *Client-ID*: `opendesk-federation-client`
-    - *Name*: `openDesk @ your organization` (is the descriptive text of the client that might show up in you IdP's UI and therefore should explain what the client is used for)
+    - *Name*: `openDesk @ your organization` (is the descriptive text of the client that might show up in your IdP's UI and therefore should explain what the client is used for)
  - Client create wizard page 2:
    - *Client authentication*: `On`
    - *Authorization*: `Off` (default)
    - *Authentication flow*: leave defaults
-	    - `Standard flow`
-	    - `Direct access grants`
+      - `Standard flow`
+      - `Direct access grants`
  - Client create wizard page 3:
    - *Valid Redirect URLs*: `https://id.opendesk.tld/realms/opendesk/broker/auto-federate-idp/endpoint`
-  - When completed with *Save* you get to the detailed client configured that also needs some updates:
+  - When completed with *Save*, you get to the detailed client configured that also needs some updates:
    - Tab *Settings* > Section *Logout settings*
      - *Front channel logout*: `Off`
      - *Back channel logout URL*: `https://id.opendesk.tld/realms/opendesk/protocol/openid-connect/logout/backchannel-logout`
    - Tab *Credentials*
-      - Copy the *Client Secret* as we need it for the configuration of the openDesk IdP to be used in the openDesk IdP, as well as the *Client-ID*.
+      - Copy the *Client Secret* and the *Client-ID* as we need them to configure the openDesk IdP.

 ## openDesk IdP

@@ -137,20 +135,20 @@ The following configuration is taking place in the Keycloak realm `opendesk`.

 - *Identity providers* > *User-defined* > *OpenID Connect 1.0*
  - *Alias*: `auto-federate-idp` (used in our example)
-  - *Display Name*: Descriptive Name in case you do not forcefully redirect the user to the IdP that name is shown in the login screen for manual selection.
+  - *Display Name*: A descriptive Name, in case you do not forcefully redirect the user to the IdP, that name is shown on the login screen for manual selection.
  - *Use discovery endpoint*: `On` (default)
  - *Discovery endpoint*: `https://idp.organization.tld/realms/fed-test-idp-realm/.well-known/openid-configuration` - this URL may look different if you do not use Keycloak or a different Keycloak version as IdP in your organization
-    - In case the IdP metadata could not be auto-discovered you will get an error.
-    - If everything is fine you can review the discovered metadata for your IdP by clicking on *Show metadata*.
+    - You will get an error if the IdP metadata cannot be auto-discovered.
+    - If everything is fine, you can review the discovered metadata for your IdP by clicking on *Show metadata*.
  - *Client authentication*: `Client secret sent as post` (default)
-  - *Client ID*: Use the client ID you took form your organization's IdP config (`opendesk-federation-client` in this example)
-  - *Client Secret*: Use the secret you took form your organization's IdP config
-  - When completed with *Add* you get to the detailed IdP configured that also needs some updates (you may need to open the *Advanced* section to access some settings)
-	- *Back-channel logout*: `On`
-	- *Disable user info*: `On`
+  - *Client ID*: Use the client ID you took from your organization's IdP config (`opendesk-federation-client` in this example)
+  - *Client Secret*: Use the secret you took from your organization's IdP config
+  - When completed with *Add*, you get to the detailed IdP configured that also needs some updates (you may need to open the *Advanced* section to access some settings)
+    - *Back-channel logout*: `On`
+    - *Disable user info*: `On`
    - *First login flow override*: `auto-federate-flow`

- In case you want to forcefully redirect all users to your organizations IdP (disabling login with local openDesk accounts):
+- In case you want to forcefully redirect all users to your organization's IdP (disabling login with local openDesk accounts):
  - *Authentication* > `2fa-browser`
    - Click on the cogwheel next to the *Identity Provider Re-director*
      - *Alias*: `auto-federate-idp`
--- a/docs/enhanced-configuration/matrix-federation.md
+++ b/docs/enhanced-configuration/matrix-federation.md
@@ -6,20 +6,18 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Matrix federation</h1>

 <!-- TOC -->
-* [Use case](#use-case)
+* [Context](#context)
 * [Example configuration](#example-configuration)
  * [Disable federation](#disable-federation)
  * [Separate Matrix domain](#separate-matrix-domain)
 <!-- TOC -->

-# Use case
-
 The Element chat application and its server component Synapse are based on the Matrix protocol,
 that supports federation with other Matrix servers to communicate with the users with accounts on these servers.

-By default, you can chat with users that have an account within your openDesk installation and federate with other
+By default, you can chat with users who have an account within your openDesk installation and federate with other
 matrix-based servers.
-Federation support can be disabled.
+Federation support can be turned off.

 # Example configuration

@@ -28,36 +26,35 @@ Please ensure when you come across such a value,
 even if it is part of a URL hostname or path, that you adapt it where needed to your setup:

 - `opendesk.domain.tld`: the mandatory `DOMAIN` setting for your deployment resulting in
-`https://chat.opendesk.domain.tld` to access the Element chat.
+`https://chat.opendesk.domain.tld` for access to the Element chat.
 - `my_organization.tld`: an optional alternative domain used for mail and/or Matrix.
-If not used it is also set to `opendesk.domain.tld`.
+It is also set to `opendesk.domain.tld` if not used.

 ## Disable federation

-The following setting can disable federation:
+The following setting can turn off federation:

 ```yaml
 functional:
-  externalServices:
-    matrix:
-      federation:
-        enabled: false
+  externalServices:
+    matrix:
+      federation:
+        enabled: false
 ```

 ## Separate Matrix domain

 If you want to federate with other Matrix instances and use a separate Matrix domain, you need to provide a JSON file on
-the Matrix domain to use delegation.
-This is not included inside openDesk.
+the Matrix domain to use delegation. It is not part of your openDesk deployment.

 Domain path: `https://my_organization.tld/.well-known/matrix/server`

 Content:
 ```JSON
 {
-    "m.server": "matrix-federation.opendesk.domain.tld:443"
+    "m.server": "matrix-federation.opendesk.domain.tld:443"
 }
 ```

 More detailed information can be found in Matrix/Synapse documentation:
-[Matrix Delegation](https://matrix-org.github.io/synapse/v1.98/delegate.html)
+[Matrix Delegation](https://element-hq.github.io/synapse/latest/delegate.html)
--- a/docs/enhanced-configuration/self-signed-certificates.md
+++ b/docs/enhanced-configuration/self-signed-certificates.md
@@ -0,0 +1,107 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Self-signed certificate and custom Certificate Authority (CA)</h1>
+
+<!-- TOC -->
+* [Configuration](#configuration)
+  * [Option 1: Bring Your Own Certificate](#option-1-bring-your-own-certificate)
+  * [Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate](#option-2a-use-cert-managerio-with-auto-generated-namespace-based-root-certificate)
+  * [Option 2b: Use cert-manager.io with pre-defined/shared root-certificate](#option-2b-use-cert-managerio-with-pre-definedshared-root-certificate)
+<!-- TOC -->
+
+Deploying openDesk into an environment with custom public key infrastructure (PKI) that is usually not part of
+public certificate authority chains or deploying openDesk into a local cluster without ACME challenge.
+
+# Configuration
+
+There are two options to address the use case.
+
+## Option 1: Bring Your Own Certificate
+
+This option is useful, when you have your own PKI in your environment which is trusted by all clients that should
+access openDesk.
+
+1. Disable cert-manager.io certificate resource creation:
+
+    ```yaml
+    certificates:
+      enabled: false
+    ```
+
+1. Enable mount of self-signed certificates:
+
+    ```yaml
+    certificate:
+      selfSigned: true
+    ```
+
+1. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
+wildcard certificate or a certificate with [all required subdomains](../../helmfile/environments/default/global.yaml)
+set as SANs (Subject Alternative Name).
+
+1. Create a Kubernetes secret with name `opendesk-certificates-ca-tls` of type `kubernetes.io/tls` containing the custom
+CA certificate as X.509 encoded (`ca.crt`) and as jks trust store (`truststore.jks`).
+
+1. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
+trust store password.
+
+## Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate
+
+This option is useful, when you do not have a trusted certificate available and can't fetch a certificate from
+Let’s Encrypt. It will result in a cert-manager managed root certificate in the namespace you deploy openDesk into.
+
+1. Create self-signed cert-manager.io Cluster Issuer:
+    ```yaml
+    apiVersion: "cert-manager.io/v1"
+    kind: "ClusterIssuer"
+    metadata:
+      name: "selfsigned-issuer"
+    spec:
+      selfSigned: {}
+    ```
+
+1. Enable mount and creation of self-signed certificates:
+    ```yaml
+    certificate:
+      issuerRef:
+        name: "selfsigned-issuer"
+      selfSigned: true
+    ```
+
+## Option 2b: Use cert-manager.io with pre-defined/shared root-certificate
+
+Use this approach if you like to use a pre-created CA root certificate that can be "shared" (as copy) between
+multiple namespaces in a cluster.
+
+1. Create self-signed cert-manager.io Cluster Issuer root certificate the same was as in *Option 2a*.
+
+1. Create the root certificate for the previously created CA, in the example it is placed into the namespace `cert-manager`.
+    ```yaml
+    apiVersion: cert-manager.io/v1
+    kind: Certificate
+    metadata:
+      name: opendesk-root
+      namespace: cert-manager
+    spec:
+      isCA: true
+      commonName: opendesk.eu
+      secretName: opendesk-root-cert-secret
+      subject:
+        organizations: "openDesk cluster root certificate organization"
+      privateKey:
+        algorithm: ECDSA
+        size: 256
+      issuerRef:
+        name: selfsigned-issuer
+        kind: ClusterIssuer
+        group: cert-manager.io
+    ```
+
+1. Copy this cert's secret into the/each namespace you want to make use of the cert.
+
+1. Create issuer in the/each namespace you want to make use of the cert.
+
+The latter two steps are part of the `env-start:` section within [`.gitlab-ci.yml`](../../.gitlab-ci.yml).
--- a/docs/enhanced-configuration/separate-mail-matrix-domain.md
+++ b/docs/enhanced-configuration/separate-mail-matrix-domain.md
@@ -3,31 +3,35 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 -->

-<h1>Separate domains for mail and or matrix</h1>
+<h1>Separate domains for mail and or Matrix </h1>

-* [Use case](#use-case)
+<!-- TOC -->
+* [Context](#context)
 * [Example configuration](#example-configuration)
  * [Mail domain](#mail-domain)
  * [Matrix domain](#matrix-domain)
+    * [DNS](#dns)
+    * [Webserver](#webserver)
+      * [Content Security Policy](#content-security-policy)
+      * [.well-known](#well-known)
+<!-- TOC -->

-# Use case
-
-As communication over mail and chat can go beyond the borders of your openDesk installation you may want to use different domains for the mail and/or matrix.
+As communication over mail and chat can go beyond the borders of your openDesk installation, you may want to use different domains for the mail and/or Matrix.

 # Example configuration

-The following values are used in this example documentation. Please ensure when you come across such a value even if it is part of a URL hostname or path that you adapt it where needed to your setup:
+The following values are used in this example documentation. Please ensure when you come across such a value, even if it is part of a URL hostname or path, that you adapt it where needed to your setup:

 - `opendesk.domain.tld`: the mandatory `DOMAIN` setting for your deployment resulting in `https://mail.opendesk.domain.tld` to access emails and `https://chat.opendesk.domain.tld` to access the Element chat that is based on the Matrix protocol.
 - `my_organization.tld`: the alternative domain used for mail and/or Matrix.

 ## Mail domain

-By default all email addresses in openDesk are created based on the `DOMAIN` you specified for your deployment. In our example resulting in the users having `<username>@opendesk.domain.tld` as mail addresses. In case you prefer the users to send and receive emails with another domain you can set that one using the optional `MAIL_DOMAIN` in the deployment:
+By default, all email addresses in openDesk are created based on the `DOMAIN` you specified for your deployment. In our example, the users have `<username>@opendesk.domain.tld` as their mail addresses. In case you prefer the users to send and receive emails with another domain, you can set that one using the optional `MAIL_DOMAIN` in the deployment:

 ```yaml
 global:
-  mailDomain: "my_organization.tld"
+  mailDomain: "my_organization.tld"
 ```

 or via environment variable
@@ -36,21 +40,21 @@ or via environment variable
 export MAIL_DOMAIN=my_organization.tld
 ```

-This of course requires the MX record for the domain to point to the mail host for your openDesk deployment. Optionally add the SPF and DMARC records.
+Of course, this requires the domain's MX record to point to the mail host for your openDesk deployment. You can optionally add the SPF and DMARC records.

-| Record name                | Type | Value                                            |
+| Record name                | Type | Value                                            |
 | -------------------------- | ---- | ------------------------------------------------ |
-| my_organization.tld        | MX   | `10 mail.opendesk.domain.tld`                    |
-| my_organization.tld        | TXT  | `v=spf1 +a +mx +a:mail.opendesk.domain.tld ~all` |
-| _dmarc.my_organization.tld | TXT  | `v=DMARC1; p=quarantine`                         |
+| my_organization.tld        | MX   | `10 mail.opendesk.domain.tld` |
+| my_organization.tld        | TXT  | `v=spf1 +a +mx +a:mail.opendesk.domain.tld ~all` |
+| _dmarc.my_organization.tld | TXT  | `v=DMARC1; p=quarantine` |

 ## Matrix domain

-Similar to the specific domain for email addresses you may want to specify a domain that differs from your deployment's default `DOMAIN` to define your users Matrix IDs. Use the `MATRIX_DOMAIN` to do so:
+Similar to the specific domain for email addresses, you may want to specify a domain that differs from your deployment's default `DOMAIN` to define your user's Matrix IDs. Use the `MATRIX_DOMAIN` to do so:

 ```yaml
 global:
-  matrixDomain: "my_organization.tld"
+  matrixDomain: "my_organization.tld"
 ```

 or via environment variable
@@ -59,13 +63,23 @@ or via environment variable
 export MATRIX_DOMAIN=my_organization.tld
 ```

-This setup requires also a different DNS setup:
+### DNS

-| Record name                      | Type | Value                                  | Comment                                                                            |
-| -------------------------------- | ---- | -------------------------------------- | ---------------------------------------------------------------------------------- |
-| _matrix._tcp.my_organization.tld | SRV  | `1 10 PORT matrix.opendesk.domain.tld` | `PORT` is your NodePort/LoadBalancer port of `opendesk-synapse-federation` service |
+The following changes apply to the standard DNS:

-*Note:* `matrix.opendesk.domain.tld` in the "Value" column can also be the IP address where synapse TLS port is listening to.
+| Record name                      | Type | Value                                  | Comment                                                                                |
+| -------------------------------- | ---- | -------------------------------------- | -------------------------------------------------------------------------------------- |
+| _matrix._tcp.my_organization.tld | SRV  | `1 10 PORT matrix.opendesk.domain.tld` | `PORT` is your NodePort/LoadBalancer port of the `opendesk-synapse-federation` service |
+
+*Note:* `matrix.opendesk.domain.tld` in the "Value" column can also be the IP address synapse TLS port listens to.
+
+### Webserver
+
+#### Content Security Policy
+
+The `my_organization.tld` webserver should add `*.opendesk.domain.tld` to its CSP header.
+
+#### .well-known

 If you want to use other Matrix clients,
 e.g., Element Messenger for [iOS](https://apps.apple.com/de/app/element-messenger/id1083446067)
@@ -75,11 +89,11 @@ you need to create a JSON file with the following contents that is served from

 ```json
 {
-  "m.homeserver": {
-    "base_url": "https://matrix.opendesk.domain.tld"
+  "m.homeserver": {
+    "base_url": "https://matrix.opendesk.domain.tld"
  }
 }
 ```

-This ensures clients know where to find the Matrix protocol endpoint when users specify `my_organization.tld`
+The above configuration ensures clients know where to find the Matrix protocol endpoint when users specify `my_organization.tld`
 as their homeserver.
--- a/docs/external-services.md
+++ b/docs/external-services.md
@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0

 <h1>External services</h1>

-This document will cover the additional configuration to use external services like databases, caches or buckets.
+This document will cover the additional configuration for external services like databases, caches, or buckets.

 <!-- TOC -->
 * [Database](#database)
@@ -15,96 +15,96 @@ This document will cover the additional configuration to use external services l

 # Database

-When deploying this suite to production, you need to configure the applications to use your production grade database
+When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.

-| Component   | Name               | Type       | Parameter | Key                                      | Default                    |
+| Component   | Name               | Type       | Parameter | Key                                      | Default                    |
 |-------------|--------------------|------------|-----------|------------------------------------------|----------------------------|
-| Element     | Synapse            | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
-|             |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
-|             |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
-|             |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
-|             |                    |            | Password  | `databases.synapse.password`             |                            |
-| Keycloak    | Keycloak           | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
-|             |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
-|             |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
-|             |                    |            | Password  | `databases.keycloak.password`            |                            |
-|             | Keycloak Extension | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
-|             |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
-|             |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
-|             |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
-| UMS         | Notifications API  | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
-|             |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
-|             |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
-|             |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
-|             |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
-|             | Self Service       | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
-|             |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
-|             |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
-|             |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
-|             |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
-| Nextcloud   | Nextcloud          | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
-|             |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
-|             |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
-|             |                    |            | Password  | `databases.nextcloud.password`           |                            |
-| OpenProject | OpenProject        | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
-|             |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
-|             |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
-|             |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
-|             |                    |            | Password  | `databases.openproject.password`         |                            |
-| OX Appsuite | OX Appsuite        | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.oxAppsuite.name`              | `CONFIGDB`                 |
-|             |                    |            | Host      | `databases.oxAppsuite.host`              | `mariadb`                  |
-|             |                    |            | Username  | `databases.oxAppsuite.username`          | `root`                     |
-|             |                    |            | Password  | `databases.oxAppsuite.password`          |                            |
-| XWiki       | XWiki              | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
-|             |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
-|             |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
-|             |                    |            | Password  | `databases.xwiki.password`               |                            |
+| Element     | Synapse            | PostgreSQL |           |                                          |                            |
+|             |                    |            | Name      | `databases.synapse.name` | `matrix` |
+|             |                    |            | Host      | `databases.synapse.host` | `postgresql` |
+|             |                    |            | Port      | `databases.synapse.port` | `5432` |
+|             |                    |            | Username  | `databases.synapse.username` | `matrix_user` |
+|             |                    |            | Password  | `databases.synapse.password` |                            |
+| Keycloak    | Keycloak           | PostgreSQL |           |                                          |                            |
+|             |                    |            | Name      | `databases.keycloak.name` | `keycloak` |
+|             |                    |            | Host      | `databases.keycloak.host` | `postgresql` |
+|             |                    |            | Port      | `databases.keycloak.port` | `5432` |
+|             |                    |            | Username  | `databases.keycloak.username` | `keycloak_user` |
+|             |                    |            | Password  | `databases.keycloak.password` |                            |
+|             | Keycloak Extension | PostgreSQL |           |                                          |                            |
+|             |                    |            | Name      | `databases.keycloakExtension.name` | `keycloak_extensions` |
+|             |                    |            | Host      | `databases.keycloakExtension.host` | `postgresql` |
+|             |                    |            | Port      | `databases.keycloakExtension.port` | `5432` |
+|             |                    |            | Username  | `databases.keycloakExtension.username` | `keycloak_extensions_user` |
+|             |                    |            | Password  | `databases.keycloakExtension.password` |                            |
+| UMS         | Notifications API  | PostgreSQL |           |                                          |                            |
+|             |                    |            | Name      | `databases.umsNotificationsApi.name` | `notificationsapi` |
+|             |                    |            | Host      | `databases.umsNotificationsApi.host` | `postgresql` |
+|             |                    |            | Port      | `databases.umsNotificationsApi.port` | `5432` |
+|             |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user` |
+|             |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
+|             | Self Service       | PostgreSQL |           |                                          |                            |
+|             |                    |            | Name      | `databases.umsSelfservice.name` | `selfservice` |
+|             |                    |            | Host      | `databases.umsSelfservice.host` | `postgresql` |
+|             |                    |            | Port      | `databases.umsSelfservice.port` | `5432` |
+|             |                    |            | Username  | `databases.umsSelfservice.username` | `selfservice_user` |
+|             |                    |            | Password  | `databases.umsSelfservice.password` |                            |
+| Nextcloud   | Nextcloud          | MariaDB    |           |                                          |                            |
+|             |                    |            | Name      | `databases.nextcloud.name` | `nextcloud` |
+|             |                    |            | Host      | `databases.nextcloud.host` | `mariadb` |
+|             |                    |            | Username  | `databases.nextcloud.username` | `nextcloud_user` |
+|             |                    |            | Password  | `databases.nextcloud.password` |                            |
+| OpenProject | OpenProject        | PostgreSQL |           |                                          |                            |
+|             |                    |            | Name      | `databases.openproject.name` | `openproject` |
+|             |                    |            | Host      | `databases.openproject.host` | `postgresql` |
+|             |                    |            | Port      | `databases.openproject.port` | `5432` |
+|             |                    |            | Username  | `databases.openproject.username` | `openproject_user` |
+|             |                    |            | Password  | `databases.openproject.password` |                            |
+| OX Appsuite | OX Appsuite        | MariaDB    |           |                                          |                            |
+|             |                    |            | Name      | `databases.oxAppsuite.name` | `CONFIGDB` |
+|             |                    |            | Host      | `databases.oxAppsuite.host` | `mariadb` |
+|             |                    |            | Username  | `databases.oxAppsuite.username` | `root` |
+|             |                    |            | Password  | `databases.oxAppsuite.password` |                            |
+| XWiki       | XWiki              | MariaDB    |           |                                          |                            |
+|             |                    |            | Name      | `databases.xwiki.name` | `xwiki` |
+|             |                    |            | Host      | `databases.xwiki.host` | `mariadb` |
+|             |                    |            | Username  | `databases.xwiki.username` | `xwiki_user` |
+|             |                    |            | Password  | `databases.xwiki.password` |                            |

 # Object storage

-When deploying this suite to production, you need to configure the applications to use your production grade object
+When deploying this suite to production, you need to configure the applications to use your production-grade object
 storage service.

-| Component   | Name        | Parameter       | Key                                      | Default            |
+| Component   | Name        | Parameter       | Key                                      | Default            |
 |-------------|-------------|-----------------|------------------------------------------|--------------------|
-| OpenProject | OpenProject |                 |                                          |                    |
-|             |             | Backend         | `objectstores.openproject.backend`       | `minio`            |
-|             |             | Bucket          | `objectstores.openproject.bucket`        | `openproject`      |
-|             |             | Endpoint        | `objectstores.openproject.endpoint`      |                    |
-|             |             | Provider        | `objectstores.openproject.provider`      | `AWS`              |
-|             |             | Region          | `objectstores.openproject.region`        |                    |
-|             |             | Secret          | `objectstores.openproject.secret`        |                    |
-|             |             | Username        | `objectstores.openproject.username`      | `openproject_user` |
-|             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |
+| OpenProject | OpenProject |                 |                                          |                    |
+|             |             | Backend         | `objectstores.openproject.backend` | `minio` |
+|             |             | Bucket          | `objectstores.openproject.bucket` | `openproject` |
+|             |             | Endpoint        | `objectstores.openproject.endpoint` |                    |
+|             |             | Provider        | `objectstores.openproject.provider` | `AWS` |
+|             |             | Region          | `objectstores.openproject.region` |                    |
+|             |             | Secret          | `objectstores.openproject.secret` |                    |
+|             |             | Username        | `objectstores.openproject.username` | `openproject_user` |
+|             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |

 # Cache

-When deploying this suite to production, you need to configure the applications to use your production grade cache
+When deploying this suite to production, you need to configure the applications to use your production-grade cache
 service.

-| Component        | Name             | Type      | Parameter | Key                          | Default          |
+| Component        | Name             | Type      | Parameter | Key                          | Default          |
 |------------------|------------------|-----------|-----------|------------------------------|------------------|
-| Intercom Service | Intercom Service | Redis     |           |                              |                  |
-|                  |                  |           | Host      | `cache.intercomService.host` | `redis-headless` |
-|                  |                  |           | Port      | `cache.intercomService.port` | `6379`           |
-| Nextcloud        | Nextcloud        | Redis     |           |                              |                  |
-|                  |                  |           | Host      | `cache.nextcloud.host`       | `redis-headless` |
-|                  |                  |           | Port      | `cache.nextcloud.port`       | `6379`           |
-| OpenProject      | OpenProject      | Memcached |           |                              |                  |
-|                  |                  |           | Host      | `cache.openproject.host`     | `memcached`      |
-|                  |                  |           | Port      | `cache.openproject.port`     | `11211`          |
-| UMS              | Self Service     | Memcached |           |                              |                  |
-|                  |                  |           | Host      | `cache.umsSelfservice.host`  | `memcached`      |
-|                  |                  |           | Port      | `cache.umsSelfservice.port`  | `11211`          |
+| Intercom Service | Intercom Service | Redis     |           |                              |                  |
+|                  |                  |           | Host      | `cache.intercomService.host` | `redis-headless` |
+|                  |                  |           | Port      | `cache.intercomService.port` | `6379` |
+| Nextcloud        | Nextcloud        | Redis     |           |                              |                  |
+|                  |                  |           | Host      | `cache.nextcloud.host` | `redis-headless` |
+|                  |                  |           | Port      | `cache.nextcloud.port` | `6379` |
+| OpenProject      | OpenProject      | Memcached |           |                              |                  |
+|                  |                  |           | Host      | `cache.openproject.host` | `memcached` |
+|                  |                  |           | Port      | `cache.openproject.port` | `11211` |
+| UMS              | Self Service     | Memcached |           |                              |                  |
+|                  |                  |           | Host      | `cache.umsSelfservice.host` | `memcached` |
+|                  |                  |           | Port      | `cache.umsSelfservice.port` | `11211` |
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Getting started</h1>

-This documentation should enable you to create your own evaluation instance of openDesk on your Kubernetes cluster.
+This documentation lets you create an openDesk evaluation instance on your Kubernetes cluster.

 <!-- TOC -->
 * [Requirements](#requirements)
@@ -22,7 +22,7 @@ This documentation should enable you to create your own evaluation instance of o
    * [Volumes](#volumes)
  * [Connectivity](#connectivity)
    * [Ports](#ports)
-      * [Web based user interface](#web-based-user-interface)
+      * [Web-based user interface](#web-based-user-interface)
      * [Mail clients](#mail-clients)
    * [Mail/SMTP configuration](#mailsmtp-configuration)
    * [TURN configuration](#turn-configuration)
@@ -36,58 +36,57 @@ This documentation should enable you to create your own evaluation instance of o
 * [Uninstall](#uninstall)
 <!-- TOC -->

-Thanks for looking into the openDesk Getting started guide. This documents covers essentials configuration steps to
-deploy openDesk onto your kubernetes infrastructure.
+Thanks for looking into the openDesk Getting Started guide. This document covers essential configuration steps to
+deploy openDesk onto your Kubernetes infrastructure.

 # Requirements

-Detailed system requirements are covered on [requirements](requirements.md) page.
+Detailed system requirements are covered on the [requirements](requirements.md) page.

 # Customize environment

-Before deploying openDesk, you have to configure the deployment to suit your environment.
-To keep your deployment up to date, we recommend customizing in `dev`, `test` or `prod` and not in `default` environment
+Before deploying openDesk, you must configure the deployment to fit your environment.
+To keep your deployment up to date, we recommend customizing in `dev`, `test`, or `prod` and not in `default` environment
 files.

 > All configuration options and their default values can be found in files at `helmfile/environments/default/`

-For the following guide, we will use `dev` as environment, where variables can be set in
-`helmfile/environments/dev/values.yaml`.
+For the following guide, we will use `dev` as environment where variables can be set in
+`helmfile/environments/dev/values.yaml.gotmpl`.

 ## DNS

 The deployment is designed to deploy each application/service under a dedicated subdomain.
-For your convenience, we recommend to create a `*.domain.tld` A-Record to your cluster ingress controller,
-otherwise you need to create an A-Record for each subdomain.
+For your convenience, we recommend creating a `*.domain.tld` A-Record to your cluster ingress controller; otherwise, you must create an A-Record for each subdomain.

-| Record name             | Type | Value                                              | Additional information                                                             |
-| ----------------------- | ---- | -------------------------------------------------- | ---------------------------------------------------------------------------------- |
-| *.domain.tld            | A    | IPv4 address of your Ingress Controller            |                                                                                    |
-| *.domain.tld            | AAAA | IPv6 address of your Ingress Controller            |                                                                                    |
-| mail.domain.tld         | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| mail.domain.tld         | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| domain.tld              | MX   | `10 mail.domain.tld`                               |                                                                                    |
-| domain.tld              | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                                         |
-| _dmarc.domain.tld       | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                                           |
-| _matrix._tcp.domain.tld | SRV  | `1 10 PORT matrix.domain.tld`                      | `PORT` is your NodePort/LoadBalancer port of `opendesk-synapse-federation` service |
+| Record name                   | Type | Value                                              | Additional information                                           |
+|-------------------------------|------|----------------------------------------------------|------------------------------------------------------------------|
+| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                  |
+| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                  |
+| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| domain.tld                    | MX   | `10 mail.domain.tld` |                                                                  |
+| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all` | Optional, use proper MTA record if present                       |
+| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine` | Optional                                                         |
+| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...` | Optional DKIM settings                                           |

 ## Domain

-A list of all subdomains can be found in `helmfile/environments/default/global.yaml`.
+A list of all subdomains can be found in `helmfile/environments/default/global.gotmpl`.

 All subdomains can be customized. For example, _Nextcloud_ can be changed to `files.domain.tld` in `dev` environment:

 ```yaml
 global:
-  hosts:
-    nextcloud: "files"
+  hosts:
+    nextcloud: "files"
 ```

-The domain have to be set either via `dev` environment
+The domain has to be set either via `dev` environment

 ```yaml
 global:
-  domain: "domain.tld"
+  domain: "domain.tld"
 ```

 or via environment variable
@@ -98,70 +97,77 @@ export DOMAIN=domain.tld

 ### Apps

-All available apps and their default value can be found in `helmfile/environments/default/workplace.yaml`.
+All available apps and their default value are in `helmfile/environments/default/workplace.yaml`.

-| Component                   | Name                                | Default | Description                    |
-| --------------------------- | ----------------------------------- | ------- | ------------------------------ |
-| Certificates                | `certificates.enabled`              | `true`  | TLS certificates               |
-| ClamAV (Distributed)        | `clamavDistributed.enabled`         | `false` | Antivirus engine               |
-| ClamAV (Simple)             | `clamavSimple.enabled`              | `true`  | Antivirus engine               |
-| Collabora                   | `collabora.enabled`                 | `true`  | Weboffice                      |
-| CryptPad                    | `cryptpad.enabled`                  | `true`  | Weboffice                      |
-| Dovecot                     | `dovecot.enabled`                   | `true`  | Mail backend                   |
-| Element                     | `element.enabled`                   | `true`  | Secure communications platform |
-| Intercom Service            | `intercom.enabled`                  | `true`  | Cross service data exchange    |
-| Jitsi                       | `jitsi.enabled`                     | `true`  | Videoconferencing              |
-| MariaDB                     | `mariadb.enabled`                   | `true`  | Database                       |
-| Memcached                   | `memcached.enabled`                 | `true`  | Cache Database                 |
-| MinIO                       | `minio.enabled`                     | `true`  | Object Storage                 |
-| Nextcloud                   | `nextcloud.enabled`                 | `true`  | File share                     |
-| OpenProject                 | `openproject.enabled`               | `true`  | Project management             |
-| OX Appsuite                 | `oxAppsuite.enabled`                | `true`  | Groupware                      |
-| Provisioning                | `oxConnector.enabled`               | `true`  | Backend provisioning           |
-| Postfix                     | `postfix.enabled`                   | `true`  | MTA                            |
-| PostgreSQL                  | `postgresql.enabled`                | `true`  | Database                       |
-| Redis                       | `redis.enabled`                     | `true`  | Cache Database                 |
-| Univention Management Stack | `univentionManagementStack.enabled` | `true`  | Identity Management & Portal   |
-| XWiki                       | `xwiki.enabled`                     | `true`  | Knowledge management           |
+| Component            | Name                        | Default | Description                    |
+| -------------------- | --------------------------- | ------- | ------------------------------ |
+| Certificates         | `certificates.enabled` | `true` | TLS certificates               |
+| ClamAV (Distributed) | `clamavDistributed.enabled` | `false` | Antivirus engine               |
+| ClamAV (Simple)      | `clamavSimple.enabled` | `true` | Antivirus engine               |
+| Collabora            | `collabora.enabled` | `true` | Weboffice                      |
+| CryptPad             | `cryptpad.enabled` | `true` | Weboffice                      |
+| Dovecot              | `dovecot.enabled` | `true` | Mail backend                   |
+| Element              | `element.enabled` | `true` | Secure communications platform |
+| Jitsi                | `jitsi.enabled` | `true` | Videoconferencing              |
+| MariaDB              | `mariadb.enabled` | `true` | Database                       |
+| Memcached            | `memcached.enabled` | `true` | Cache Database                 |
+| MinIO                | `minio.enabled` | `true` | Object Storage                 |
+| Nextcloud            | `nextcloud.enabled` | `true` | File share                     |
+| Nubus                | `nubus.enabled` | `true` | Identity Management & Portal   |
+| OpenProject          | `openproject.enabled` | `true` | Project management             |
+| OX Appsuite          | `oxAppsuite.enabled` | `true` | Groupware                      |
+| Postfix              | `postfix.enabled` | `true` | MTA                            |
+| PostgreSQL           | `postgresql.enabled` | `true` | Database                       |
+| Redis                | `redis.enabled` | `true` | Cache Database                 |
+| XWiki                | `xwiki.enabled` | `true` | Knowledge management           |

 Exemplary, Jitsi can be disabled like:

 ```yaml
 jitsi:
-  enabled: false
+  enabled: false
 ```

 ## Private registries

-By default Helm charts and container images are fetched from OCI registries. These registries can be found for most cases
+By default, Helm charts and container images are fetched from OCI registries. These registries can be found in most cases
 in the [openDesk/component section on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/components).

-For untouched upstream artifacts that do not belong to a functional component's core we use upstream registries
+For untouched upstream artifacts that do not belong to a functional component's core, we use upstream registries
 like Docker Hub.

-Doing a test deployment will most likely be fine with this setup. In case you want to deploy multiple times a day
-and fetch from the same IP address you might run into rate limits at Docker Hub. In that case and in cases you
-prefer the use of a private image registry anyway you can configure such for
+Doing a test deployment will be fine with this setup. In case you want to deploy multiple times a day
+and fetch from the same IP address, you might run into rate limits at Docker Hub. In that case and in cases you
+prefer the use of a private image registry, you can configure such for
 [your target environment](./../helmfile/environments/dev/values.yaml.gotmpl.sample) by setting
 - `global.imageRegistry` for a private image registry and
 - `global.helmRegistry` for a private Helm chart registry.

 ```yaml
 global:
-  imageRegistry: "my_private_registry.domain.tld"
+  imageRegistry: "my_private_registry.domain.tld"
 ```

-alternatively you can use an environment variable:
+alternatively, you can use an environment variable:

 ```shell
 export PRIVATE_IMAGE_REGISTRY_URL=my_private_registry.domain.tld
 ```

-If authentication is required, you can reference imagePullSecrets as following:
+or control repository override fine-granular per registry:
+
+```yaml
+repositories:
+  image:
+    dockerHub: "my_private_registry.domain.tld/docker.io/"
+    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
+```
+
+If authentication is required, you can reference `imagePullSecrets` as follows:

 ```yaml
 global:
-  imagePullSecrets:
+  imagePullSecrets:
    - "external-registry"
 ```

@@ -171,13 +177,13 @@ global:

 Some apps, like Jitsi or Dovecot, require HTTP and external TCP connections.
 These apps create a Kubernetes service object.
-You can configure, whether `NodePort` (for on-premise), `LoadBalancer` (for cloud) or `ClusterIP` (to disable) should be
+You can configure whether `NodePort` (for on-premise), `LoadBalancer` (for cloud), or `ClusterIP` (to disable) should be
 used:

 ```yaml
 cluster:
-  service:
-    type: "NodePort"
+  service:
+    type: "NodePort"
 ```

 ### Networking
@@ -186,125 +192,149 @@ If your cluster has not the default `cluster.local` domain configured, you need

 ```yaml
 cluster:
-  networking:
-    domain: "acme.internal"
+  networking:
+    domain: "acme.internal"
 ```

-If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via:
+If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via the following:

 ```yaml
 cluster:
-  networking:
-    cidr:
+  networking:
+    cidr:
      - "127.0.0.0/8"
 ```

+If your load balancer / reverse proxy IPs are not already covered by the above `cidr` you need to
+explicitly configure the related IPs or IP ranges:
+
+```yaml
+cluster:
+  networking:
+    incomingCIDR:
+      - "172.16.0.0/12"
+```
+
 ### Ingress

-By default, the `ingressClassName` is empty to choose your default ingress controller, you may want to customize it by
-setting:
+By default, the `ingressClassName` is empty to select your default ingress controller. You may want to customize it by
+setting the following attribute to the name of the currently only supported ingress controller `ingress-nginx` (see
+[requirements.md](./requirements.md)) for reference) within your deployment if that is not the cluster's default ingress.

 ```yaml
 ingress:
-  ingressClassName: "cilium"
+  ingressClassName: "name-of-my-nginx-ingress"
 ```

-**Note:** Please check the [requirements.md](./requirements.md) for the supported Ingress controllers.
-
 ### Container runtime

-Some apps require specific configuration for the container runtime. You can set your container runtime like `cri-o`,
+Some apps require specific configurations for the container runtime. You can set your container runtime like `cri-o`,
 `containerd` or `docker` by:

 ```yaml
 cluster:
-  container:
-    engine: "containerd"
+  container:
+    engine: "containerd"
 ```

 ### Volumes

-When your cluster has a `ReadWriteMany` volume provisioner, you can benefit from distributed or scaling of apps. By
+When your cluster has a `ReadWriteMany` volume provisioner, you can benefit from the distribution or scaling of apps. By
 default, only `ReadWriteOnce` is enabled. To enable `ReadWriteMany` you can set:

 ```yaml
 cluster:
-  persistence:
-    readWriteMany: true
+  persistence:
+    readWriteMany: true
 ```

 The **StorageClass** can be set by:

 ```yaml
 persistence:
-  storageClassNames:
-    RWX: "my-read-write-many-class"
-    RWO: "my-read-write-once-class"
+  storageClassNames:
+    RWX: "my-read-write-many-class"
+    RWO: "my-read-write-once-class"
 ```

 ## Connectivity

 ### Ports

-**Note:** If you use `NodePort` for service exposure, you need to check your deployment for the actual ports.
+**Note:** If you use `NodePort` for service exposure, you must check your deployment for the actual ports.

-#### Web based user interface
+#### Web-based user interface

-To use the openDesk functionality with its web based user interface you need to publicly expose the following ports:
+To use the openDesk functionality with its web-based user interface, you need to expose the following ports publicly:

-| Component          | Description             |  Port | Type |
+| Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
-| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
+| openDesk           | Kubernetes Ingress      |    80 |  TCP |
+| openDesk           | Kubernetes Ingress      |   443 |  TCP |
+| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |

 #### Mail clients

 To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need public exposure:

-| Component          | Description             |  Port | Type |
+| Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
-| Dovecot            | IMAPS                   |   993 |  TCP |
-|                    | POP3S                   |   995 |  TCP |
-| Postfix            | SMTP                    |    25 |  TCP |
-|                    | SMTPS                   |   587 |  TCP |
+| Dovecot            | IMAPS                   |   993 |  TCP |
+|                    | POP3S                   |   995 |  TCP |
+| Postfix            | SMTP                    |    25 |  TCP |
+|                    | SMTPS                   |   587 |  TCP |

 ### Mail/SMTP configuration

-To use the full potential of the openDesk, you need to set up an SMTP relay which allows sending emails from
+To use the full potential of the openDesk, you need to set up an SMTP relay that allows sending emails from
 the whole subdomain.

 ```yaml
 smtp:
-  host: "mail.open.desk"
-  username: "openDesk"
-  password: "secret"
+  host: "mail.open.desk"
+  username: "openDesk"
+  password: "secret"
+```
+
+Enabling DKIM signing of emails helps to reduce spam and increases trust.
+openDesk ships dkimpy-milter as Postfix milter for signing emails.
+
+```yaml
+dkimpy:
+  enable: true
+  dkim:
+    key:
+      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
+    selector: "default"
+    useED25519: true # when false, RSA is used
 ```

 ### TURN configuration

-Some components (Jitsi, Element) use for direct communication a TURN server. You can configure your own TURN server with
+Some components (Jitsi, Element) use a TURN server for direct communication. You can configure your own TURN server with
 these options:

 ```yaml
 turn:
-  transport: "udp" # or tcp
-  credentials: "secret"
-  server:
-    host: "turn.open.desk"
-    port: "3478"
-  tls:
-    host: "turns.open.desk"
-    port: "5349"
+  transport: "udp" # or tcp
+  credentials: "secret"
+  server:
+    host: "turn.open.desk"
+    port: "3478"
+  tls:
+    host: "turns.open.desk"
+    port: "5349"
 ```

 ### Certificate issuer

-As mentioned in [requirements](requirements.md#certificate-management) you can provide your own valid certificate. A TLS
-secret with name `opendesk-certificates-tls` needs to be present in application namespace. For deployment, you can
-disable `Certificate` resource creation by:
+As mentioned in [requirements](requirements.md#certificate-management), you can provide your own valid certificate. A TLS
+secret named `opendesk-certificates-tls` must be present in the application namespace. For deployment, you can
+turn off `Certificate` resource creation by:

 ```yaml
 certificates:
-  enabled: false
+  enabled: false
 ```

 If you want to leverage the `cert-manager.io` to handle certificates, like `Let's encrypt`, you need to provide the
@@ -312,29 +342,29 @@ configured cluster issuer:

 ```yaml
 certificate:
-  issuerRef:
-    name: "letsencrypt-prod"
+  issuerRef:
+    name: "letsencrypt-prod"
 ```

 Additionally, it is possible to request wildcard certificates by:

 ```yaml
 certificate:
-  wildcard: true
+  wildcard: true
 ```

 ## Password seed

-All secrets are generated from a single master password via Master Password (algorithm).
-To prevent others from using your openDesk instance, we highly recommend setting an individual master password via:
+All secrets are generated from a master password via [Master Password (algorithm)](https://en.wikipedia.org/wiki/Master_Password_(algorithm)).
+To prevent others from using your openDesk instance, you must set your individual master password via:

 ```shell
-export MASTER_PASSWORD="openDesk"
+export MASTER_PASSWORD="your_individual_master_password"
 ```

 ## Install

-After setting your environment specific values in `dev` environment, you can start deployment by:
+After setting your environment-specific values in `dev` environment, you can start deployment by:

 ```shell
 helmfile apply -e dev -n <NAMESPACE> [-l <label>] [--suppress-diff]
@@ -364,7 +394,7 @@ helmfile apply -e dev -n <NAMESPACE>

 ## Install single release/chart

-Instead of iteration through all services, you can also deploy a single release like mariadb by:
+Instead of iteration through all services, you can also deploy a single release like `mariadb` by:

 ```shell
 helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
@@ -372,39 +402,36 @@ helmfile apply -e dev -n <NAMESPACE> -l name=mariadb

 # Access deployment

-When all apps are successfully deployed and pod status' went to `Running` or `Succeeded`, you can navigate to
+When all apps are successfully deployed, and their Pod's status is `Running` or `Succeeded`, you can navigate to

 ```text
 https://portal.domain.tld
 ```

-If you change the subdomain of `univentionManagementStack`, you need to replace `portal`
-by your specified subdomain.
+If you change the subdomain of `nubus`, you must replace `portal` with the specified subdomain.

 **Credentials:**

+openDesk deploys with the standard user account `Administrator`, which password you get retrieved as follows:
+
 ```shell
 # Replace with your namespace
 NAMESPACE=your-namespace

-# Get ConfigMap with credentials
-kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}'
+# Get password for IAM "Administrator" account
+kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.administrator_password}' | base64 -d
 ```

-Renders you a two part ConfigMap where the `username` and `password` attributes in the `properties`
-section provide you with the desired information to login with the two default user roles:
-
-| Username        | Password                                   | Description      |
-|-----------------|--------------------------------------------|------------------|
-| `default.user`  | `40615..............................e9e2f` | Application user |
-| `default.admin` | `17027..............................04db6` | Administrator    |
+In openDesk Community Edition, you get two more default accounts:
+- `default.admin`: `kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.admin_password}' | base64 -d`
+- `default.user`: `kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.user_password}' | base64 -d`

 ## Using from external repository

-It is possible to refer to `./helmfile_generic.yaml` from an external
-directory or repository. The `helmfile.yaml` that refers to
+Referring to `./helmfile_generic.yaml` from an external
+directory or repository is possible. The `helmfile.yaml` that refers to
 `./helmfile_generic.yaml` may define custom environments. These custom
-environments may overwrite certain configuration values. These
+environments may overwrite specific configuration values. These
 configuration values are:

 * `global.domain`
@@ -419,8 +446,8 @@ You can uninstall the deployment by:
 helmfile destroy -n <NAMESPACE>
 ```

-> **Note**
-> Not all Jobs, PersistentVolumeClaims or Certificates are deleted; you have to delete them manually
+> **Note**<br>
+> Not all Jobs, PersistentVolumeClaims, or Certificates are deleted; you have to delete them manually

 **'Sledgehammer destroy'** - for fast development turn-around times (at your own risk):

@@ -429,7 +456,7 @@ NAMESPACE=your-namespace

 # Uninstall all Helm charts
 for OPENDESK_RELEASE in $(helm ls -n ${NAMESPACE} -aq); do
-  helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
+  helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
 done

 # Delete leftover resources
@@ -437,5 +464,5 @@ kubectl delete pvc --all --namespace ${NAMESPACE};
 kubectl delete jobs --all --namespace ${NAMESPACE};
 ```

-> **Warning**
+> **Warning**<br>
 > Without specifying or empty `--namespace` flag, cluster-wide components get deleted!
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -3,37 +3,311 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 -->

-<h1>Upgrade migrations</h1>
+<h1>Updates & Upgrades</h1>

+<!-- TOC -->
 * [Disclaimer](#disclaimer)
-* [From v0.8.1](#from-v081)
-  * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
-  * [Updated customizable template attributes](#updated-customizable-template-attributes)
-  * [`migrations` S3 bucket](#migrations-s3-bucket)
+* [openDesk supported upgrade path](#opendesk-supported-upgrade-path)
+* [Releases upgrade details](#releases-upgrade-details)
+  * [From v0.9.0](#from-v090)
+    * [Pre-upgrade: Manual steps](#pre-upgrade-manual-steps)
+      * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
+      * [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
+      * [Changed openDesk defaults: Matrix ID](#changed-opendesk-defaults-matrix-id)
+      * [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
+      * [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
+      * [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
+    * [Automated migrations](#automated-migrations)
+    * [Post-upgrade: Manual steps](#post-upgrade-manual-steps)
+      * [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
+      * [Optional Cleanup](#optional-cleanup)
+  * [From v0.8.1](#from-v081)
+    * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
+    * [Updated customizable template attributes](#updated-customizable-template-attributes)
+    * [`migrations` S3 bucket](#migrations-s3-bucket)
+* [Related components and artifacts](#related-components-and-artifacts)
+  * [Development](#development)
+<!-- TOC -->

 # Disclaimer

-We do not offer support for upgrades before we reach openDesk 1.0.
+With openDesk 1.0, we aim to offer hassle-free updates/upgrades.

-Though we try to ease the pain when it comes to 0.x upgrades. That is what this document is for.
+But openDesk requires a defined upgrade path that is described in the section [openDesk supported upgrade path](#opendesk-supported-upgrade-path).

-# From v0.8.1
+Some upgrades even require manual interaction, which are referenced in the aforementioned section and described further down this document.

-## Updated `cluster.networking.cidr`
+> **Known limitations:**<br>
+> We assume that the PV reclaim policy is set to `delete`, resulting in PVs getting deleted as soon as the related PVC was deleted; we will not address explicit deletion for PVs.

- Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1), please update your setup accordingly if you explicitly set this value.
+# openDesk supported upgrade path
+
+When updating your openDesk installation you have to install the releases listed below in the sequential order from
+the lowest version number you are already on to the more current version you are looking to install.
+
+Explanation of the table's columns:
+- *Coming from*: Check the column for the release you are currently on.
+- *Mandatory release*: Defines which release(s) support the upgrade from your currently installed version.
+- *Automatic migration*: Summary of, or link to openDesk's automatic migration details.
+- *Manual activities*: Reference to required manual steps to upgrade your openDesk installation to the *Mandatory release*.
+
+| Coming from   | Mandatory (minimum) release | Automatic migration                                                                                                                                           | Manual activities             |
+| ------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
+| v0.9.0        | v1.x.x                      | [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_2.py) | See [From v0.9.0](#from-v090) |
+| v0.8.1        | v0.9.0                      | Initializes migration system                                                                                                                                  | See [From v0.8.1](#from-v081)     |
+| not supported | v0.8.1                      | First release that supporting updates                                                                                                                         |                               |
+
+# Releases upgrade details
+
+## From v0.9.0
+
+### Pre-upgrade: Manual steps
+
+#### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus
+
+> **Warning**<br>
+> The upgrade will fail if you do not address this section for your current deployment.
+
+The update will remove unnecessary OX-Profiles in Nubus, but it can not as long as these profiles are in use.
+
+So please ensure that only the following two supported profiles are assigned to your users:
+- `opendesk_standard`: "opendesk Standard"
+- `none`: "Login disabled"
+
+You can review and update other accounts as follows:
+- Login as IAM admin.
+- Open the user module.
+- Open the extended search by clicking the funnel (DE: "Trichter") icon next to the search input field.
+- Open the "Property" (DE: "Eigenschaft") list and select "OX Access" (DE: "OX-Berechtigung").
+- Enter an asterisk (*) in the input field next to the list.
+- Start the search by clicking once more on the funnel icon.
+- Sort the result list for the "OX Access" column.
+- Edit every user that has a value different to `opendesk_standard` or `none`:
+  - Open the user.
+  - Go to section "OX App Suite".
+  - Change the value in the dropdown "OX Access" to either:
+    - "openDesk Standard" if the user should be able to use the Groupware module or
+    - "Login disabled" if the user should not use the Groupware module.
+  - Update the user account with the green "SAVE" button at the top of the page.
+
+#### Configuration Cleanup: Updated `global.imagePullSecrets`
+
+Without using a custom registry, you can pull all the openDesk images without authentication.
+Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them.
+
+You can keep the current settings by setting the `external-registry` in your custom environment values:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "external-registry"
+```
+
+#### Changed openDesk defaults: Matrix ID
+
+Until 0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's Matrix ID. Due to restrictions on the
+Matrix protocol, an update of a Matrix ID is not possible; therefore, it was technically convenient to use the UUID
+as it is immutable (see https://de.wikipedia.org/wiki/Universally_Unique_Identifier for more details on UUIDs.)
+
+From the user experience perspective, that was a flawed approach, so from openDesk 1.0 on, by default, the username which
+is also used for logging into openDesk is used to define the localpart of the Matrix ID.
+
+For existing installations: The changed setting only affects users who log in to Element for the first time. Existing
+user accounts will not be harmed. If you want existing users to get new Matrix IDs based on the new setting, you
+must update their external ID in Synapse and deactivate the old user afterward. The user will get a new
+Matrix account from scratch, losing the existing contacts, chats, and rooms.
+
+The following Admin API calls are helpful:
+- `GET /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` to get the user's existing external_id (auth_provider: "oidc")
+- `PUT /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` to update user's external_id with JSON payload:
+  `{ "external_ids": [ { "auth_provider": "oidc", "external_id": "<old_id>+deprecated" } ] }`
+- `POST /_synapse/admin/v1/deactivate/@<entryuuid>:<matrixdomain>` to deactivate old user with JSON payload:
+  `{ "erase": true }`
+
+For more details, check the Admin API documentation:
+https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html
+
+You can enforce the old standard with the following setting:
+```yaml
+functional:
+ chat:
+   matrix:
+     profile:
+       useImmutableIdentifierForLocalpart: true
+```
+
+#### Changed openDesk defaults: File-share configurability
+
+Now, we provide some configurability regarding the sharing capabilities of the Nextcloud component.
+
+See the settings under `functional.filestore` in [functional.yaml](../helmfile/environments/default/functional.yaml).
+
+For the following settings, the default in openDesk 1.0 has changed, so you might want to update
+the settings for your deployment to keep its current behavior:
+
+```yaml
+functional:
+ filestore:
+   sharing:
+     external:
+       enabled: true
+       expiry:
+         activeByDefault: false
+```
+
+#### Changed openDesk defaults: Updated default subdomains in `global.hosts`
+
+We have streamlined the subdomain names in openDesk to be more user-friendly and to avoid the use of specific
+product names.
+
+This results in the following changes to the default subdomain naming:
+
+- **collabora**: `collabora` → `office`
+- **cryptpad**: `cryptpad` → `pad`
+- **minioApi**: `minio` → `objectstore`
+- **minioConsole**: `minio-console` → `objectstore-ui`
+- **nextcloud**: `fs` → `files`
+- **openproject**: `project` → `projects`
+
+Existing deployments should keep the old subdomains cause URL/link changes are not supported through all components.
+
+If you have not already defined the entire `global.hosts` dictionary in your custom environments values, please set it
+to the defaults that were used before the upgrade:
+
+```yaml
+global:
+  hosts:
+    collabora: "collabora"
+    cryptpad: "cryptpad"
+    element: "chat"
+    intercomService: "ics"
+    jitsi: "meet"
+    keycloak: "id"
+    matrixNeoBoardWidget: "matrix-neoboard-widget"
+    matrixNeoChoiceWidget: "matrix-neochoice-widget"
+    matrixNeoDateFixBot: "matrix-neodatefix-bot"
+    matrixNeoDateFixWidget: "matrix-neodatefix-widget"
+    minioApi: "minio"
+    minioConsole: "minio-console"
+    nextcloud: "fs"
+    openproject: "project"
+    openxchange: "webmail"
+    synapse: "matrix"
+    synapseFederation: "matrix-federation"
+    univentionManagementStack: "portal"
+    whiteboard: "whiteboard"
+    xwiki: "wiki"
+```
+
+In case you would like to update an existing deployment to the new hostnames, please check the following list:
+
+- Do this at your own risk.
+- Some of your user's bookmarks and links will stop working.
+- Portal links are getting updated automatically.
+- The update of the OpenProject <-> Nextcloud file integration needs to be updated manually as follows:
+  - Use an account with functional admin permissions on both components
+  - In OpenProject: *Administration* > *Files* > *External file storages* > Select `Nextcloud at [your_domain]`
+    - Edit *Details* - *General Information* - *Storage provider* and update the *hostname* to `files.<your_domain>`
+  - In Nextcloud: *Administration* > *OpenProject* > *OpenProject server*
+    - Update the *OpenProject host* to `projects.<your_domain>`
+
+#### Changed openDesk defaults: Dedicated group for access to the UDM REST API
+
+Prerequisite: You allow the use of the [IAM's API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html)
+with the following settings:
+
+```yaml
+functional:
+  externalServices:
+    nubus:
+      udmRestApi:
+        enabled: true
+```
+
+With 0.9.0, all members of the group "Domain Admins" could successfully authenticate with the API.
+
+With openDesk 1.0, we introduced a specific group for permission to use the API: `IAM API - Full Access`.
+
+The IAMs admin account `Administrator` is a member of this group by default, but no other user is.
+
+If you need other accounts to use the API, please assign them to the aforementioned group.
+
+### Automated migrations
+
+The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.
+
+The permissions required to execute the migrations can be found in the migration's Helm chart [`role.yaml'](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/v1.3.5/charts/opendesk-migrations/templates/role.yaml?ref_type=tags#L29)
+
+The actual actions are described as code comments in the related run module [`run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_2.py).
+
+### Post-upgrade: Manual steps
+
+#### Configuration Improvement: Separate user permission for using Video Conference component
+
+With openDesk 1.0 the user permission for authenticated access to the Chat and Video Conference components was split into two separate permissions.
+
+Therefore the newly added *Video Conference* permission has to be added to users that should have continued access to the component.
+
+This can be done as IAM admin:
+- Open the *user* module.
+- Select all users that should get the permission for *Video Conference* using the select box left from the users entry.
+- In top bar of the user table click on *Edit*.
+- Select the *openDesk* section the the left-hand menu.
+- Check the check box for *Video Conference* and the directly below check box for *Overwrite*.
+- Click on the green *Save* button on top of the screen to apply the change.
+
+> **Hint**<br>
+> If you have a lot of users andd want to update (almost) all them, you can select all users by clicking the check box in the user's table header and then de-selecting the users you do not want to update.
+
+#### Optional Cleanup
+
+We do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the no longer used PVCs after a successful upgrade:
+
+```shell
+NAMESPACE=<your_namespace>
+kubectl -n ${NAMESPACE} delete pvc shared-data-ums-ldap-server-0
+kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
+kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
+```
+
+## From v0.8.1
+
+### Updated `cluster.networking.cidr`
+
+- Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1); please update your setup accordingly if you explicitly set this value.
 - Reference:[cluster.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/cluster.yaml)

-## Updated customizable template attributes
+### Updated customizable template attributes

- Action: Please ensure you update you custom deployment values according with the updated default value structure.
+- Action: Please update your custom deployment values according to the updated default value structure.
 - References:
  - `functional.` prefix for `authentication.*`, `externalServices.*`, `admin.*` and `filestore.*`, see [functional.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/functional.yaml).
  - `debug.` prefix for `cleanup.*`, see [debug.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/debug.yaml).
  - `monitoring.` prefix for `prometheus.*` and `graphana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
  - `smtp.` prefix for `localpartNoReply`, see [smtp.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/smtp.yaml).

-## `migrations` S3 bucket
+### `migrations` S3 bucket

- Action: For self managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
+- Action: For self-managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
 - Reference: `objectstores.migrations` in [objectstores.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/objectstores.yaml)
+
+# Related components and artifacts
+
+openDesk comes with two upgrade steps as part of the deployment; they can be found in the folder [/helmfile/apps](../helmfile/apps/) as all other components:
+
+- `migrations-pre`: Is the very first app that gets deployed.
+- `migrations-post`: Is the last app that gets deployed.
+
+Both migrations must be deployed exclusively at their first/last position and not parallel with other components.
+
+The status of the upgrade migrations is tracked in the ConfigMap `migrations-status`, more details can be found in the [README.md of the related container image](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/README.md).
+
+## Development
+
+When a new upgrade migration is required, ensure to address the following list:
+
+- Update the generated release version file [`global.generated.yaml`](../helmfile/environments/default/global.generated.yaml) at least on the patch level to test the upgrade in your feature branch and trigger it in the `develop` branch after the feature branch was merged. During the release process, the value is overwritten by the release's version number.
+- You have to implement the migration logic as a runner script in the [`opendesk-migrations`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations) image. Please find more instructions in the linked repository.
+- You most likely have to update the [`opendesk-migrations` Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations) within the `rules` section of the [`role.yaml`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/templates/role.yaml) to provide the permissions required for the execution of your migration's logic.
+- You must set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
+- Update the [`charts.yaml`](../helmfile/environments/default/charts.yaml) and [`images.yaml`](../helmfile/environments/default/images.yaml) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
--- a/docs/monitoring.md
+++ b/docs/monitoring.md
@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Monitoring</h1>

-This document will cover how you can enable observability with Prometheus based monitoring and Grafana dashboards, as
+This document will cover how you can enable observability with Prometheus-based monitoring and Grafana dashboards as
 well as the overall status of monitoring integration.

 <!-- TOC -->
@@ -19,13 +19,13 @@ well as the overall status of monitoring integration.

 # Technology

-We provide integration into the Prometheus based monitoring.
+We provide integration into the Prometheus-based monitoring.
 Together with
 [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) you
-easily leverage the full potential of open-source cloud-native observability stack.
+easily leverage the full potential of the open-source cloud-native observability stack.

 Before enabling the following options, you need to install the respective CRDs from the kube-prometheus-stack
-repository or prometheus operator.
+repository or Prometheus operator.

 # Defaults

@@ -34,24 +34,24 @@ All configurable options and their defaults can be found in

 # Metrics

-To deploy podMonitor and serviceMonitor custom resources, enable it by:
+To deploy `podMonitor` and `serviceMonitor` custom resources, enable it by:

 ```yaml
 prometheus:
-  serviceMonitors:
-    enabled: true
-  podMonitors:
-    enabled: true
+  serviceMonitors:
+    enabled: true
+  podMonitors:
+    enabled: true
 ```

 # Alerts

-Some helm-charts provide a default set of prometheusRules for alerting, enable it by:
+Some Helm charts provide a default set of prometheusRules for alerting; enable it by:

 ```yaml
 prometheus:
-  prometheusRules:
-    enabled: true
+  prometheusRules:
+    enabled: true
 ```

 # Dashboards for Grafana
@@ -60,13 +60,13 @@ To deploy optional ConfigMaps with Grafana dashboards, enable it by:

 ```yaml
 grafana:
-  dashboards:
-    enabled: true
+  dashboards:
+    enabled: true
 ```

 # Components

-| Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
+| Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
 |:----------|-----------------------------------|-------------------------|---------------------|
-| Collabora | :white_check_mark:                | :white_check_mark:      | :white_check_mark:  |
-| Nextcloud | :white_check_mark:                | :x:                     | :x:                 |
+| Collabora | :white_check_mark:                | :white_check_mark:      | :white_check_mark:  |
+| Nextcloud | :white_check_mark:                | :x:                     | :x:                 |
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -2,9 +2,10 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Requirements</h1>

-This section covers the internal system requirements as well as external service requirements for productive use.
+This section covers the internal system requirements and external service requirements for productive use.

 <!-- TOC -->
 * [tl;dr](#tldr)
@@ -18,13 +19,14 @@ This section covers the internal system requirements as well as external service
 <!-- TOC -->

 # tl;dr
-openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s) cluster.
+
+openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s) cluster.

 - K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
 - Ingress controller (Ingress NGINX)
 - [Helm](https://helm.sh/) >= v3.9.0
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v0.157.0**
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc5**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
 - Volume provisioner supporting RWO (read-write-once)
 - Certificate handling with [cert-manager](https://cert-manager.io/)
@@ -33,11 +35,11 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)

 The following minimal requirements are thought for initial evaluation deployment:

-| Spec | Value                                                 |
+| Spec | Value                                                 |
 | ---- | ----------------------------------------------------- |
-| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
-| RAM  | 32 GB, more recommended                               |
-| Disk | HDD or SSD, >10 GB                                    |
+| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
+| RAM  | 32 GB, more recommended                               |
+| Disk | HDD or SSD, >10 GB                                    |

 # Kubernetes

@@ -50,53 +52,54 @@ The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/

 # Ingress controller

-The deployment is intended to use only over HTTPS via a configured FQDN, therefor it is required to have a proper
+The deployment is intended to be used only over HTTPS via a configured FQDN, therefore it is required to have a proper
 configured ingress controller deployed.

 **Supported controllers:**
 - [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx)

-Note: The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/).
-If you have feedback on that topic, please share it with us.
+> **Note**<br>
+> The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/). If you have feedback on that topic, please share it with us.

 # Volume provisioner

-Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment a local- or hostPath-
+Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment, a local- or hostPath-
 provisioner is sufficient.

-> **Note:** Some components requiring a `ReadWriteMany` volume provisioner for distributed mode or scaling.
+> **Note**<br>
+> Some components require a `ReadWriteMany` volume provisioner for distributed mode or scaling.

 # Certificate management

 This deployment leverages [cert-manager](https://cert-manager.io/) to generate valid certificates. This is **optional**,
 but a secret containing a valid TLS certificate is required.

-Only `Certificate` resources will be deployed, the `cert-manager` including its CRD must be installed prior to this or
-openDesk certificate management disabled.
+Only `Certificate` resources will be deployed; the `cert-manager`, including its CRD must be installed before this or
+openDesk certificate management switched off.

 # External services

-For development and evaluation of openDesk we bundle some service to start with. Be aware that for production
-deployments you need to make use of your own production grade services, see the
+For the development and evaluation of openDesk, we bundle some services. Be aware that for production
+deployments, you need to make use of your own production-grade services; see the
 [external-services.md](./external-services.md) for configuration details.

-| Group    | Type                | Version | Tested against        |
+| Group    | Type                | Version | Tested against        |
 | -------- | ------------------- | ------- | --------------------- |
-| Cache    | Memcached           | `1.6.x` | Memcached             |
-|          | Redis               | `7.x.x` | Redis                 |
-| Database | MariaDB             | `10.x`  | MariaDB               |
-|          | PostgreSQL          | `15.x`  | PostgreSQL            |
-| Mail     | Mail Transfer Agent |         | Postfix               |
-|          | PKI/CI (S/MIME)     |         |                       |
-| Security | AntiVirus/ICAP      |         | ClamAV                |
-| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
-|          | K8s ReadWriteMany   |         | Ceph / NFS            |
-|          | Object Storage      |         | MinIO                 |
-| Voice    | TURN                |         | Coturn                |
+| Cache    | Memcached           | `1.6.x` | Memcached             |
+|          | Redis               | `7.x.x` | Redis                 |
+| Database | MariaDB             | `10.x` | MariaDB               |
+|          | PostgreSQL          | `15.x` | PostgreSQL            |
+| Mail     | Mail Transfer Agent |         | Postfix               |
+|          | PKI/CI (S/MIME)     |         |                       |
+| Security | AntiVirus/ICAP      |         | ClamAV                |
+| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
+|          | K8s ReadWriteMany   |         | Ceph / NFS            |
+|          | Object Storage      |         | MinIO                 |
+| Voice    | TURN                |         | Coturn                |

 # Deployment

-The deployment of each individual component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
+The deployment of each component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
 templated via [Helmfile](https://helmfile.readthedocs.io/en/latest/) to provide a streamlined deployment experience.

-Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare desired against deployed state.
+Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare the desired against the deployed state.
--- a/docs/scaling.md
+++ b/docs/scaling.md
@@ -5,57 +5,19 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Scaling</h1>

-This document should cover the abilities to scale apps.
+This document covers the ability to scale applications.

-<!-- TOC -->
-* [Replicas](#replicas)
-<!-- TOC -->
+# Horizontal scalability

-# Replicas
+We are working on generating this document automatically based on the file
+[`replicas.yaml`](../helmfile/environments/default/replicas.yaml) that contains necessary annotations.
+In the meantime, this file can be used to check the components scaling support/capabilities.

-The Replicas can be increased of almost any component, but is only effective for high-availability or load-balancing for
-apps with a check-mark in `Scaling (effective)` column.
+# Upstream information

-Verified positive effects are marked with a check-mark in `Scaling (verified)` column, apps which are not yet tested are
-marked with a gear.
+While scaling services horizontally is the ideal solution, information about vertical scaling is helpful
+when defining the application's resources, see [`resources.yaml`](../helmfile/environments/default/resources.yaml) for references.

+Please find below links to the application's upstream resources about scaling:

-| Component                   | Name                                     | Scaling (effective) | Scaling (verified) |
-|-----------------------------|------------------------------------------|:-------------------:|:------------------:|
-| ClamAV                      | `replicas.clamav`                        | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.clamd`                         | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.freshclam`                     |         :x:         |        :x:         |
-|                             | `replicas.icap`                          | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.milter`                        | :white_check_mark:  | :white_check_mark: |
-| Collabora                   | `replicas.collabora`                     | :white_check_mark:  |       :gear:       |
-| CryptPad                    | `replicas.cryptpad`                      | :white_check_mark:  |       :gear:       |
-| Dovecot                     | `replicas.dovecot`                       |         :x:         |       :gear:       |
-| Element                     | `replicas.element`                       | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.matrixNeoBoardWidget`          | :white_check_mark:  |       :gear:       |
-|                             | `replicas.matrixNeoChoiceWidget`         | :white_check_mark:  |       :gear:       |
-|                             | `replicas.matrixNeoDateFixBot`           | :white_check_mark:  |       :gear:       |
-|                             | `replicas.matrixNeoDateFixWidget`        | :white_check_mark:  |       :gear:       |
-|                             | `replicas.matrixUserVerificationService` | :white_check_mark:  |       :gear:       |
-|                             | `replicas.synapse`                       |         :x:         |       :gear:       |
-|                             | `replicas.synapseWeb`                    | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.wellKnown`                     | :white_check_mark:  | :white_check_mark: |
-| Intercom Service            | `replicas.intercomService`               | :white_check_mark:  | :white_check_mark: |
-| Jitsi                       | `replicas.jibri`                         | :white_check_mark:  |       :gear:       |
-|                             | `replicas.jicofo`                        | :white_check_mark:  |       :gear:       |
-|                             | `replicas.jitsi `                        | :white_check_mark:  |       :gear:       |
-|                             | `replicas.jitsiKeycloakAdapter`          | :white_check_mark:  |       :gear:       |
-|                             | `replicas.jvb `                          |         :x:         |        :x:         |
-| Keycloak                    | `replicas.keycloak`                      | :white_check_mark:  |       :gear:       |
-| Memcached                   | `replicas.memcached`                     |       :gear:        |       :gear:       |
-| Minio                       | `replicas.minioDistributed`              | :white_check_mark:  | :white_check_mark: |
-| Nextcloud                   | `replicas.nextcloudApache2`              | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.nextcloudExporter`             | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.nextcloudPHP`                  | :white_check_mark:  | :white_check_mark: |
-| OpenProject                 | `replicas.openproject`                   | :white_check_mark:  | :white_check_mark: |
-| Postfix                     | `replicas.postfix`                       |         :x:         |       :gear:       |
-| Redis                       | `replicas.redis`                         |       :gear:        |       :gear:       |
-| Univention Management Stack |                                          |       :gear:        |       :gear:       |
-|                             | `replicas.umsPortalFrontend`             | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.umsPortalServer`               | :white_check_mark:  | :white_check_mark: |
-|                             | `replicas.umsUdmRestApi`                 | :white_check_mark:  | :white_check_mark: |
-| XWiki                       | `replicas.xwiki`                         |         :x:         |       :gear:       |
+- [OpenProject system requirements](https://www.openproject.org/docs/installation-and-operations/system-requirements/)
--- a/docs/security-context.md
+++ b/docs/security-context.md
@@ -2,8 +2,10 @@
 SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Kubernetes Security Context</h1>

+<!-- TOC -->
 * [Container Security Context](#container-security-context)
  * [allowPrivilegeEscalation](#allowprivilegeescalation)
  * [capabilities](#capabilities)
@@ -14,6 +16,7 @@ SPDX-License-Identifier: Apache-2.0
  * [readOnlyRootFilesystem](#readonlyrootfilesystem)
  * [runAsNonRoot](#runasnonroot)
 * [Status quo](#status-quo)
+<!-- TOC -->

 # Container Security Context

@@ -158,7 +161,6 @@ This list gives you an overview of templated security settings and if they compl
 | **element**/opendesk-synapse | :white_check_mark: | no | no | yes | yes | 10991 | 10991 | yes | yes |
 | **element**/opendesk-synapse-web | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-well-known | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
-| **intercom-service**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **jitsi**/jitsi | :white_check_mark: | no | no | yes | yes | 1993 | 1993 | yes | yes |
 | **jitsi**/jitsi/jitsi/jibri | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no ["SYS_ADMIN"] |
 | **jitsi**/jitsi/jitsi/jicofo | :x: | no | no | no | no | 0 | 0 | yes | no |
@@ -183,7 +185,7 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **provisioning**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **open-xchange**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
 | **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
 | **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
@@ -196,6 +198,7 @@ This list gives you an overview of templated security settings and if they compl
 | **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
 | **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **univention-management-stack**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
--- a/docs/security.md
+++ b/docs/security.md
@@ -15,37 +15,37 @@ This document should cover the current status of security measurements.

 # Helm Chart Trust Chain

-Helm charts are signed and validated against GPG keys which can be found in `helmfile/files/gpg-pubkeys`.
+Helm charts are signed and validated against GPG keys in `helmfile/files/gpg-pubkeys`.

-For more details on Chart validation please visit: https://helm.sh/docs/topics/provenance/
+For more details on Chart validation, please visit: https://helm.sh/docs/topics/provenance/

 All charts except the ones mentioned below are verifiable:

-| Repository        | Verifiable |
+| Repository        | Verifiable |
 |-------------------|:----------:|
-| open-xchange-repo |     no     |
+| open-xchange-repo |     no     |

 # Kubernetes Security Enforcements

-This list gives you an overview of default security settings and if they comply with security standards:
+This list gives you an overview of default security settings and whether they comply with security standards:

 ⟶ Visit our generated detailed [Security Context](./security-context.md) overview.

 # NetworkPolicies

-Kubernetes NetworkPolicies are an important measure to secure your kubernetes apps and clusters.
+Kubernetes NetworkPolicies are an essential measure to secure your Kubernetes apps and clusters.
 When applied, they restrict the traffic to your services.
-This protects other deployments in your cluster or other services in your deployment to get compromised when one
+This protects other deployments in your cluster or other services in your deployment from getting compromised when one
 component is compromised.

 We ship a default set of Otterize ClientIntents via
 [Otterize intents operator](https://github.com/otterize/intents-operator) which translates intent-based access control
-(IBAC) into kubernetes native NetworkPolicies.
+(IBAC) into Kubernetes native NetworkPolicies.

 This requires the Otterize intents operator to be installed.

 ```yaml
 security:
-  otterizeIntents:
-    enabled: true
+  otterizeIntents:
+    enabled: true
 ```
--- a/docs/theming.md
+++ b/docs/theming.md
@@ -5,53 +5,26 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Theming</h1>

-This document will cover the theming and customization of your openDesk deployment.
+This document covers the theming options for an openDesk deployment.

 <!-- TOC -->
-* [Strings and texts](#strings-and-texts)
-* [Colors](#colors)
-  * [Images and Logos](#images-and-logos)
-* [Known limits](#known-limits)
+* [Settings](#settings)
+* [Known limitations](#known-limitations)
 <!-- TOC -->

-# Strings and texts
+# Settings

-The deployment name can be changed by:
+All default settings can be found in the [`theme.gotmpl`](../helmfile/environments/default/theme.gotmpl). Most of the components adhere to these settings.

-```yaml
-theme:
-  texts:
-    productName: "openDesk Cloud"
-```
+Please review the default configuration that is applied to understand your customization options.

-# Colors
+You can just update the files in:
+- [helmfile/files/theme](../helmfile/files/theme): To change logos, favicons etc.
+- [helmfile/files/portal-tiles](../helmfile/files/portal-tiles): To change the icons in the portal.

-The primary color and their derives with lesser opacity be customized by:
-
-```yaml
-theme:
-  colors:
-    primary: "#5e27dd"
-    primary65: "#9673e9"
-    primary35: "#c7b3f3"
-    primary15: "#e7dffa"
-```
-
-## Images and Logos
-
-You can customize the logo and favicon by providing SVG or icon as inline value:
-
-```yaml
-theme:
-  imagery:
-    logoHeaderSvg: '<?xml version="1.0" encoding="UTF-8"?>...</svg>'
-    logoHeaderSvgWhite: '<?xml version="1.0" encoding="UTF-8"?>...</svg>'
-    logoPortalBackgroundSvg: '<?xml version="1.0" encoding="UTF-8"?>...</svg>'
-    faviconIco: "..."
-```
-
-# Known limits
+# Known limitations

 Not all applications support theming. Known exceptions are:
-  - OpenProject
-  - Jitsi
+- OpenProject, comes with a build in openDesk theming that can be modified in the Enterprise version's OpenProject web interface.
+- The portal background logo can (currently) only be set on initial deployment.
+- Portal and Keycloak screen styles must be applied in the [`portalStylesheets.css`](../helmfile/files/theme/portalStylesheet.css).
--- a/docs/workflow.md
+++ b/docs/workflow.md
@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Technical development and release workflow</h1>

+<!-- TOC -->
 * [Scope](#scope)
 * [Roles and responsibilities](#roles-and-responsibilities)
 * [Deployment automation](#deployment-automation)
@@ -29,6 +30,7 @@ SPDX-License-Identifier: Apache-2.0
      * [Commit messages / Conventional Commits](#commit-messages--conventional-commits)
      * [Verified commits](#verified-commits)
 * [Footnotes](#footnotes)
+<!-- TOC -->

 # Scope

@@ -63,7 +65,7 @@ The following section should provide a high-level view of the involved parties i
 - **Operator**
  - Focus areas
    - Providing production-grade required services (e.g. persistence layer) to operate openDesk
-    - Rollout, operate, and support openDesk
+    - Rollout, operate and support openDesk
    - Further develop the deployment automation to meet extended operational requirements, ideally providing these developments upstream to openDesk platform development to adopt them into the standard
  - The operator can either use a self-operated Kubernetes cluster to deploy openDesk or make use of managed Kubernetes offerings of a **Cloud Provider**.

@@ -71,52 +73,53 @@ The following section should provide a high-level view of the involved parties i

 The openDesk deployment automation is the core outcome of the platform development process.

-The openDesk platform development team created and maintains the deployment automation to allow interested parties to deploy openDesk into their cloud infrastructure with a low entry barrier. The core technology for the automation are [Helm charts](https://helm.sh/) which are orchestrated using [Helmfile](https://github.com/helmfile/helmfile). Of course this deployment is also used in the everyday work by the suppliers and the platform team.
+The openDesk platform development team created and maintains the deployment automation to allow interested parties to deploy openDesk into their cloud infrastructure with a low entry barrier. The core technology for the automation is [Helm](https://helm.sh/), which is orchestrated using [Helmfile](https://github.com/helmfile/helmfile). Of course, this deployment is also used by the suppliers and the platform team in everyday work.

-Please find the deployment automation including the relevant documentation here: https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace
+Please find the deployment automation, including its documentation, in the following project: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk

-The automation supports Gitlab CI/CD execution as well as local execution triggering the Helmfile deployment for the whole platform or single applications.
+The automation supports Gitlab CI/CD and local execution, triggering the Helmfile deployment for the whole platform or single applications.

 ## openDesk technical component classes

 The below rendering in class diagram notation shows the three component classes openDesk consists of. In each of these:
- the first section below the name of the class shows the required **characteristics** of each component of the given class, and
- the second section shows the **methods** like linting that have to be applied to artifacts of that class.
+- the first section below the name of the class shows the required **characteristics** of each component of the given class and
+- the second section shows the **methods** like linting that must be applied to that class's artifacts.

-**Note:** The methods prefixed with '-' are not yet available in `gitlab-config` you will learn about them later.
+> **Note**<br>
+> The methods prefixed with '-' are not yet available in `gitlab-config`. You will learn about them later.

 ```mermaid
 classDiagram
-    Images <|-- Helm_charts
-    Images <|-- Helmfile_based_deployment_automation
-    Helm_charts <|-- Helmfile_based_deployment_automation
-    class Images{
-        SBOM
-        SBOM signature
-        Image signature
-        reuseLint()
-        CVE analysis()
-        hadolint()
-        Malware scan()
-    }
-    class Helm_charts{
-        HelmDocs
-        Helm chart signature
-        reuseLint()
-        KubeLinter()
-        YamlLint()
-        -Kubescape()
-    }
-    class Helmfile_based_deployment_automation{
-        reuseLint()
-        YamlLint()
-        -markdownlint()
-    }
+ Images <|-- Helm_charts
+ Images <|-- Helmfile_based_deployment_automation
+ Helm_charts <|-- Helmfile_based_deployment_automation
+ class Images{
+ SBOM
+ SBOM signature
+ Image signature
+ reuseLint()
+ CVE analysis()
+ hadolint()
+ Malware scan()
+ }
+ class Helm_charts{
+ HelmDocs
+ Helm chart signature
+ reuseLint()
+ KubeLinter()
+ YamlLint()
+ -Kubescape()
+ }
+ class Helmfile_based_deployment_automation{
+ reuseLint()
+ YamlLint()
+ -markdownlint()
+ }
 ```

 ## Functional vs. service components

-The focus of openDesk is to provide an integrated functional productivity platform based on the functional components (products) of the involved suppliers. These functional components usually rely on certain service components, e.g. database services for persistence. When running openDesk in production the operator is responsible for providing these services production grade. For evaluation and development purposes the openDesk deployment automation includes these services.
+The focus of openDesk is to provide an integrated functional productivity platform based on the involved suppliers' functional components (products). These functional components usually rely on specific service components, e.g. database services for persistence. When running openDesk in production, the operator is responsible for providing these services in production-grade. For evaluation and development purposes, the openDesk deployment automation includes these services.

 Find the list of functional and service components in the [deployment automation's components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/blob/main/docs/components.md).

@@ -124,9 +127,9 @@ Find the list of functional and service components in the [deployment automation

 The openDesk platform consolidates the technical components from various origins:

-1) Supplier - for functional components: Provide their upstream product including sometimes openDesk-specific builds or extensions and also the deployment of the product (Helm charts).
-2) 3rd party upstream - for service components: The platform development tries to use as many as possible community upstream components for the services they have to provide within openDesk.
-3) Platform development - filling the gap: Some suppliers might not provide Helm charts or images for their product that fit the needs of openDesk and some 3rd party upstream components are not built to fit into openDesk. In these cases, the platform development team creates their own Helm charts and images.
+1) *Supplier* for functional components: Provide their upstream product, sometimes including openDesk-specific builds or extensions and product deployment (Helm charts).
+2) *Third-party upstream* for service components: The platform development team tries to use as many community upstream components as possible for the services they have to provide within openDesk.
+3) Platform development* filling the gap: Some suppliers might not provide Helm charts or images for their products that fit the needs of openDesk, and some third-party upstream components are not built to fit into openDesk. In these cases, the platform development team creates its own Helm charts and images.

 ## Reference CI for creating Images and Helm charts (gitlab-config)

@@ -143,9 +146,10 @@ openDesk uses Apache 2.0 as the license for their work. A typical reuse copyrigh
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ```
-As the way to mark the license header as a comment differs between the various filetypes, please find matching examples for the types all across the [deployment automation repository](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace).
+The way to mark the license header as a comment differs between the various file types. Please find matching examples for all types across the [deployment automation repository](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace).

-**Remark**: If there is already an existing `SPDX-FileCopyrightText` please just add the one from the above example.
+> **Note**<br>
+> If an `SPDX-FileCopyrightText` already exists, do not replace but add an additional line based on the above example.

 ## Development workflow

@@ -153,11 +157,11 @@ As the way to mark the license header as a comment differs between the various f

 openDesk consists only of community products, so there is no SLA to receive service updates or backport of critical security fixes. This has two consequences:
 - In production scenarios, you should replace the community versions of the functional components with supported, SLA-backed paid versions.
- openDesk aims to always update to the latest available releases of the community components and we therefore have rolling technical releases.
+- openDesk aims to update the community components' latest available releases continually; therefore, we have rolling technical releases.

 ### Workflow

-This chapter describes the development workflow of the deployment automation. The suppliers have their development processes and workflows. While we aim to update always to the most recent community version(s) available, openDesk also sponsors development done by the suppliers. As the openDesk team has to take a closer look at these sponsored features, they are referred to as *supplier deliverables* within the platform development workflow.
+This chapter describes the deployment automation's development workflow. The suppliers have their own development processes and workflows. While we aim to always update to the most recent community version(s) available, openDesk also sponsors the development done by the suppliers. As the openDesk team has to take a closer look at these sponsored features, they are referred to as *supplier deliverables* within the platform development workflow.

 #### Branching concept

@@ -165,7 +169,7 @@ The picture below uses Gitflow notation to give an overview of the different typ

 The basic facts for the flow are:
 - When the `develop` branch is merged into `main` a technical release is created (except when the merge commit(s) are of type `chore` or `docs`)
- Changes that will be applied to openDesk have to branch off from `develop`, we call these branches *feature* branches.
+- Changes that will be applied to openDesk have to branch off from `develop`; we call these branches *feature* branches.
  - Developers can create sub-branches from their feature branch(es) as needed.
 - When a *feature* branch gets pushed a Merge Request in `Draft` state is automatically created.
 - We know three types of *feature* branches:
@@ -175,53 +179,53 @@ The basic facts for the flow are:
    - supplier deliverables and
    - configurational changes that have a significant impact on openDesk users or require migrations[^1]
 - The *QG* entries in the workflow refer to quality gates that are explained in more detail later
- All merges into `develop` or `main` require two approvals from the platform development team[^2]. The approvers have to ensure that the defined quality gates have been passed successfully.
+- All merges into `develop` or `main` require two approvals from the platform development team[^2]. The approvers must ensure that the defined quality gates have been passed successfully.

 ```mermaid
 gitGraph
-    commit id: "QA 'nightly main'"
-    commit id: " "
-    branch "develop"
-    checkout "develop"
-    commit id: "QA 'nightly develop'"
-    commit id: "  "
-    branch "docs"
-    checkout "docs"
-    commit id: "Documentation commits" type: HIGHLIGHT
-    checkout "develop"
-    merge "docs"
-    checkout "main"
-    merge "develop" tag: "No release"
-    checkout "develop"
-    commit id: "   "
-    branch "fix"
-    checkout "fix"
-    commit id: "Maintenance commits" type: HIGHLIGHT
-    commit id: "QG 'fix'" type: REVERSE
-    checkout "develop"
-    merge "fix"
-    commit id: "QA 'release merge'" type: REVERSE
-    checkout "main"
-    merge "develop" tag: "Patch or minor release"
-    checkout "develop"
-    commit id: "    "
-    branch "feat"
-    checkout "feat"
-    commit id: "Feature commits" type: HIGHLIGHT
-    commit id: "QG 'feat'" type: REVERSE
-    commit id: "Manual Feature QA" type: REVERSE
-    commit id: "Develop Tests"
-    commit id: "Documentation"
-    checkout "develop"
-    merge "feat"
-    commit id: "QA 'release merge' " type: REVERSE
-    checkout "main"
-    merge "develop" tag: "Minor or major release"
-    checkout "develop"
-    checkout "main"
-    commit id: "     "
-    commit id: "Manual Functional Release Activities" type: HIGHLIGHT
-    commit id: "      "
+ commit id: "QA 'nightly main'"
+ commit id: " "
+ branch "develop"
+ checkout "develop"
+ commit id: "QA 'nightly develop'"
+ commit id: "  "
+ branch "docs"
+ checkout "docs"
+ commit id: "Documentation commits" type: HIGHLIGHT
+ checkout "develop"
+ merge "docs"
+ checkout "main"
+ merge "develop" tag: "No release"
+ checkout "develop"
+ commit id: "   "
+ branch "fix"
+ checkout "fix"
+ commit id: "Maintenance commits" type: HIGHLIGHT
+ commit id: "QG 'fix'" type: REVERSE
+ checkout "develop"
+ merge "fix"
+ commit id: "QA 'release merge'" type: REVERSE
+ checkout "main"
+ merge "develop" tag: "Patch or minor release"
+ checkout "develop"
+ commit id: "    "
+ branch "feat"
+ checkout "feat"
+ commit id: "Feature commits" type: HIGHLIGHT
+ commit id: "QG 'feat'" type: REVERSE
+ commit id: "Manual Feature QA" type: REVERSE
+ commit id: "Develop Tests"
+ commit id: "Documentation"
+ checkout "develop"
+ merge "feat"
+ commit id: "QA 'release merge' " type: REVERSE
+ checkout "main"
+ merge "develop" tag: "Minor or major release"
+ checkout "develop"
+ checkout "main"
+ commit id: "     "
+ commit id: "Manual Functional Release Activities" type: HIGHLIGHT
+ commit id: "      "
 ```

 #### Standard Quality Gate (SQG)
@@ -232,7 +236,7 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
   - Blocking
     - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in [development.md](./development.md).
-   - Non Blocking
+   - Non-Blocking
     - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
     - Formal: Yaml
 1. Deploy the full openDesk stack from scratch:
@@ -247,26 +251,26 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
   - CVE check[^5]
   - Kubescape scan[^5]

-Steps #1 to #3 from above are executed as GitLab CI and therefore documented within GitLab.
+Steps #1 to #3 from above are executed as GitLab CI and documented within GitLab.

-Step #4 is focussed on security and was not fully implemented yet. Its main objective is to check for regressions. That step is just the second step of a security check and monitoring chain as shown below. While some checks can be executed against the static artifacts (e.g. container images) other might require an up-and-running instance. These are especially located in the third step below which is not yet implemented.
+Step #4 is focused on security and has not been fully implemented yet. Its main objective is to check for regressions. That step is just the second step of a security check and monitoring chain, as shown below. While some checks can be executed against static artifacts (e.g., container images), others might require an up-and-running instance. These are especially located in the third step below, which has not yet been implemented.

 ```mermaid
 flowchart TD
-    A[<u><b>Container image</b></u>
-    checks during build time
-    e.g. based on openDesk
-    reference implementation 'gitlab-config'.
-    >> Can the artefact be integrated? <<
-    ] -->|integrate artifacts| B[<u><b>Deployment automation</b></u> SQG
-    based on GitLab CI during
-    technical release process.
-    >> Can the platform be released? <<
-    ]
-    B-->|release| C[<u><b>openDesk release</b></u> monitoring
-    on a regular e.g. daily or live basis.
-    >> Do we need to fix something? <<
-    ]
+ A[<u><b>Container image</b></u>
+ checks during build time
+ e.g. based on openDesk
+ reference implementation 'gitlab-config'.
+ >> Can the artifact be integrated? <<
+ ] -->|integrate artifacts| B[<u><b>Deployment automation</b></u> SQG
+ based on GitLab CI, during
+ technical release process.
+ >> Can the platform be released? <<
+ ]
+ B-->|release| C[<u><b>openDesk release</b></u> monitoring
+ on a regular e.g. daily or live basis.
+ >> Do we need to fix something? <<
+ ]
 ```

 #### Branch workflows
@@ -276,55 +280,54 @@ This section will explain the workflow for each branch (type) based on the Gitfl
 ##### `main`

 - `QA 'nightly main'`: Execute the SQG based on the most recent release. The upgrade test environment should be a long-standing environment that only gets built from scratch with the previous technical release when something breaks the environment.
- Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release) which itself is based on the [Semantic Versioning (SemVer) notation](https://semver.org) to automatically create technical releases on the merge points.
-  - "No release": When a merge from `develop` includes only changes from `docs` branches the merge into `main` will only consist of `docs` or `chore` commits. No new release will be generated by that merge.
-  - "Patch or minor release": When changes from `fix` branches get merged these might contain `fix` or `feat` commits causing a new technical release to be built with an updated version on Patch or Minor level.
-  - "Minor or major release": When changes from `feat` branches get merged these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on Minor or Major level.
+Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release), which is based on the [Semantic Versioning (SemVer) notation](https://semver.org), to automatically create technical releases on the merge points.
+  - "No release": When a merge from `develop` includes only changes from `docs` branches, the merge into `main` will only consist of `docs` or `chore` commits. That merge will generate no new release.
+  - "Patch or minor release": When changes from `fix` branches get merged, these might contain `fix` or `feat` commits, causing a new technical release to be built with an updated version on the Patch or Minor level.
+  - "Minor or major release": When changes from `feat` branches get merged, these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on the Minor or Major level.
 - "Manual Functional Release Activities": Technical releases are loosely coupled to functional releases. The additional activities for a functional release select an existing technical release as a basis to generate the artifacts required for a functional release, for example:
  - Conduct additional manual explorative and regression tests.
  - Perform checks like IT Grundschutz, Accessibility, or Data Protection.

 ##### `develop`

- `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based in this case on the head revision of the `develop` branch.
+- `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based on the head revision of the `develop` branch.
 - `QA 'release merge'`: The Merge Request for this merge has to be created manually by members of the platform development team. It should document:
  - That the SQG was successfully executed upon the to-be merged state - it could be done explicitly or based on a `QA 'nightly develop'`
-  - In case of `fix` changes that usually how no test automation: Changes have been verified by a member of the platform development team.
-  - That the changes have been reviewed by at least two members of the platform development team giving their approval on the Merge Request.
+  - In case of `fix` changes that usually have no test automation, Changes have been verified by a member of the platform development team.
+  - That the changes have been reviewed by at least two members of the platform development team, giving their approval on the Merge Request.
 - Merge points (from `docs`, `fix`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.

 ##### `docs`

-Branches of type `docs` only contain the commits themselves and have to adhere to the workflow basic fact that:
-> All merges into `develop` or `main` require two approvals from the platform development team.
+Branches of type `docs` only contain the commits themselves and have to adhere to the workflow basic fact that: All merges into `develop` or `main` require two approvals from the platform development team.

 ##### `fix`

-Besides the actual changes being committed in an `fix` branch there is only the:
- `QG 'fix'`: In addition to validating the actual change the owner of the branch has to ensure the successful execution of the SQG.
+Besides the actual changes being committed in an `fix` branch, there is only the:
+- `QG 'fix'`: Besides validating the actual change, the branch's owner has to ensure the successful execution of the SQG.

 ##### `feat`

 This branch type requires the most activities on top of the actual development:
- `QG 'feat'`: The owner of the branch has to validate the implemented functionality and has to ensure the SQG is passed successfully.
+- `QG 'feat'`: The branch owner has to validate the implemented functionality and ensure the SQG is passed successfully.
 - `Manual Feature QA`:
-  - This is the actual interface between the platform development workflow and the supplier work package workflow.
+  - This is the interface between the platform development workflow and the supplier work package workflow.
  - The openDesk QA team validates the change, ideally based on the acceptance criteria defined in the supplier's work package definition.
-    - If improvements are needed QA passes on the feedback to the developer/supplier.
-    - If the QA was successful test cases for the test automation of the feature are defined.
+    - QA passes on the feedback to the developer/supplier if improvements are needed.
+    - Test cases for the feature's test automation are defined if the QA was successful.
    - QA should also evaluate if there is a need for end-user documentation of the feature.
 - `Develop Test`: The test cases are implemented by the openDesk platform development and added to the openDesk end-to-end test suite.
- `Documentation`: When required the documentation team has to update the end-user documentation.
+- `Documentation`: When required, the documentation team has to update the end-user documentation.

 #### Branch names

-Branches created from the `develop` branch have to adhere to the following notation: `<type>/<responsible_developer>/<details>`:
+Branches created from the `develop` branch have to adhere to the following notation: `<responsible_developer>/<type>_<details>`:

+- `<responsible_developer>`: Something that makes you identifiable as the owner of the branch, e.g. the first letter of your first name followed by your family name.
 - `<type>`: From the list of branch types explained above:
  - `docs`
  - `fix`
  - `feat`
- `<responsible_developer>`: Something that makes you identifiable as owner of the branch, e.g. the first letter of your first name followed by your family name.
 - `<details>`: A very short note about what is going to happen in the branch and ideally what component is affected from the following list of components:
  - `helmfile`
  - `ci`
@@ -340,9 +343,10 @@ Branches created from the `develop` branch have to adhere to the following notat
  - `services`
  - `xwiki`

-Example: `feat/tmueller/bump_nextcloud_to_29.0.0`.
+Example: `tmueller/fix_jitsi_theming`.

-**Note**: The above naming convention is not enforced yet, but please ensure you make use of it.
+> **Note**<br>
+> The above naming convention has yet to be enforced, but please ensure you use it.

 #### Commit messages / Conventional Commits

@@ -350,23 +354,24 @@ Commit messages must adhere to the [Conventional Commit standard](https://www.co

 ```text
 <type>(<scope>): [path/to/issue#1] <short summary>.
-  │       │              │                │
-  │       │              |                └─> Summary in present tense, sentence case, with no period at the end
-  │       │              |
-  │       │              └─> Issue reference (optional)
-  │       │
-  │       └─> Commit Scope: helmfile, docs, collabora, intercom-service, ...
-  │
-  └─> Commit Type: chore, ci, docs, feat, fix
+ │       │              │                │
+ │       │              |                └─> Summary in present tense, sentence case, with no period at the end
+ │       │              |
+ │       │              └─> Issue reference (optional)
+ │       │
+ │       └─> Commit Scope: helmfile, docs, collabora, nextcloud, open-xchange, etc.
+ │
+ └─> Commit Type: chore, ci, docs, feat, fix
 ```

 Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`

-**Beware**: The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.
+> **Note**<br>
+> The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.

 #### Verified commits

-We only allow verified commits, please read on about the options you have to make your commits verified:
+We only allow verified commits; please read on about the options you have to make your commits verified:
 - https://docs.gitlab.com/ee/user/project/repository/ssh_signed_commits/
 - https://docs.gitlab.com/ee/user/project/repository/gpg_signed_commits/
 - https://docs.gitlab.com/ee/user/project/repository/x509_signed_commits/
@@ -375,10 +380,10 @@ We only allow verified commits, please read on about the options you have to mak

 [^1]: Migrations are in general not supported before openDesk hits [technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) v1.0.0

-[^2]: These approval rules are not available in the Gitlab Free Tier which is one of the main reasons why the deployment automation is not developed on Open CoDE.
+[2]: These approval rules are not available in the Gitlab Free Tier, which is one of the main reasons why deployment automation is not developed on Open CoDE.

 [^3]: As long as migrations/upgrade paths are not provided - see also footnote #1 - this step is optional.

-[^4]: The SBOM process is currently executed asynchronously to the development process and tests the most current technical release from main. The process is not fully automated yet.
+[^4]: The SBOM process is executed asynchronously with the development process and tests the most current technical release from the `main` branch. The process still needs to be fully automated.

-[^5]: The quality gate is not yet implemented especially when it comes to identifying regressions.
+[^5]: The quality gate needs to be implemented primarily when identifying regressions.
--- a/helmfile.yaml.gotmpl
+++ b/helmfile.yaml.gotmpl
@@ -15,7 +15,7 @@ environments:
 ---
 # yamllint disable
 helmfiles:
-  - path: "./helmfile_generic.yaml"
+  - path: "./helmfile_generic.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 # {{/*
--- a/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/\
-      {{ .Values.charts.collabora.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"

 releases:
  - name: "collabora-online"
@@ -19,6 +18,7 @@ releases:
    version: "{{ .Values.charts.collabora.version }}"
    values:
      - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.collaboraOnline | default "additionalValues: false" }}
    installed: {{ .Values.collabora.enabled }}

 commonLabels:
--- a/helmfile/apps/collabora/helmfile.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile.yaml.gotmpl
@@ -6,7 +6,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/collabora/values.yaml.gotmpl
+++ b/helmfile/apps/collabora/values.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,7 +8,13 @@ autoscaling:
  enabled: false

 collabora:
-  extra_params: "--o:ssl.enable=false --o:ssl.termination=true --o:fetch_update_check=0"
+  extra_params: >
+    --o:ssl.enable=false
+    --o:ssl.termination=true
+    --o:fetch_update_check=0
+    --o:remote_font_config.url=https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/richdocuments/settings/fonts.json
+    --o:net.proto={{ if eq .Values.cluster.networking.ipFamilies "DualStack" }}all{{ else }}{{ .Values.cluster.networking.ipFamilies }}{{ end }}
+
  username: "collabora-internal-admin"
  password: {{ .Values.secrets.collabora.adminPassword | quote }}
  aliasgroups:
@@ -24,7 +31,7 @@ grafana:
      {{ .Values.monitoring.grafana.dashboards.annotations | toYaml | nindent 6 }}

 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
  tag: {{ .Values.images.collabora.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}

@@ -83,6 +90,8 @@ ingress:
      hosts:
        - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"

+podAnnotations: {}
+
 podSecurityContext:
  fsGroup: 100

@@ -115,17 +124,9 @@ securityContext:
      - "ALL"
    add:
      - "CHOWN"
-      - "DAC_OVERRIDE"
      - "FOWNER"
-      - "FSETID"
-      - "KILL"
-      - "SETGID"
-      - "SETUID"
-      - "SETPCAP"
-      - "NET_BIND_SERVICE"
-      - "NET_RAW"
      - "SYS_CHROOT"
-      - "MKNOD"
+
  seLinuxOptions:
    {{ .Values.seLinuxOptions.collabora | toYaml | nindent 4 }}
 serviceAccount:
--- a/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/\
-      {{ .Values.charts.cryptpad.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"

 releases:
  - name: "cryptpad"
@@ -19,6 +18,7 @@ releases:
    version: "{{ .Values.charts.cryptpad.version }}"
    values:
      - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.cryptpad | default "additionalValues: false" }}
    installed: {{ .Values.cryptpad.enabled }}

 commonLabels:
--- a/helmfile/apps/cryptpad/helmfile.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile.yaml.gotmpl
@@ -6,7 +6,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/cryptpad/values.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/values.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/README.md or
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/values.yaml
@@ -23,7 +26,7 @@ enableEmbedding: true
 fullnameOverride: "cryptpad"

 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
  tag: {{ .Values.images.cryptpad.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}

@@ -50,6 +53,8 @@ ingress:
 persistence:
  enabled: false

+podAnnotations: {}
+
 podSecurityContext:
  fsGroup: 4001

--- a/helmfile/apps/element/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/element/helmfile-child.yaml.gotmpl
@@ -10,40 +10,36 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/\
-      {{ .Values.charts.element.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
  - name: "element-well-known-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.elementWellKnown.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/\
-      {{ .Values.charts.elementWellKnown.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
  - name: "synapse-web-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseWeb.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/\
-      {{ .Values.charts.synapseWeb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
  - name: "synapse-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapse.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/\
-      {{ .Values.charts.synapse.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+
  - name: "synapse-create-account-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseCreateAccount.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/\
-      {{ .Values.charts.synapseCreateAccount.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"

  # openDesk Matrix Widgets
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
@@ -53,41 +49,35 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/\
-      {{ .Values.charts.matrixUserVerificationService.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
  - name: "matrix-neoboard-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
-      {{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neochoice-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
-      {{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neodatefix-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/\
-      {{ .Values.charts.matrixNeodatefixWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
  - name: "matrix-neodatefix-bot-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/\
-      {{ .Values.charts.matrixNeodatefixBot.repository }}"
-
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"

 releases:
  - name: "opendesk-element"
@@ -95,6 +85,7 @@ releases:
    version: "{{ .Values.charts.element.version }}"
    values:
      - "values-element.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskElement | default "additionalValues: false" }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -103,6 +94,7 @@ releases:
    version: "{{ .Values.charts.elementWellKnown.version }}"
    values:
      - "values-well-known.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskWellKnown | default "additionalValues: false" }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -111,6 +103,7 @@ releases:
    version: "{{ .Values.charts.synapseWeb.version }}"
    values:
      - "values-synapse-web.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskSynapseWeb | default "additionalValues: false" }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -119,6 +112,7 @@ releases:
    version: "{{ .Values.charts.synapse.version }}"
    values:
      - "values-synapse.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskSynapse | default "additionalValues: false" }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

--- a/helmfile/apps/intercom-service/helmfile.yaml
+++ b/helmfile/apps/intercom-service/helmfile.yaml
@@ -6,7 +6,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/element/values-element.yaml.gotmpl
+++ b/helmfile/apps/element/values-element.yaml.gotmpl
@@ -1,19 +1,21 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
  endToEndEncryption: true
  additionalConfiguration:
-    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=opendesk-matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"

    "net.nordeck.element_web.module.opendesk":
      config:
        banner:
          ics_navigation_json_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/navigation.json"
          ics_silent_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/silent"
-          portal_logo_svg_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
-          portal_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/"
+          portal_logo_svg_url: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
+          portal_url: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/"
        custom_css_variables:
          --cpd-color-bg-action-primary-rest: {{ .Values.theme.colors.primary | quote }}
          --cpd-color-text-action-accent: {{ .Values.theme.colors.primary | quote }}
@@ -42,6 +44,8 @@ configuration:
            - org.matrix.msc3819.send.to_device:net.nordeck.whiteboard.connection_signaling
            - org.matrix.msc3819.receive.to_device:net.nordeck.whiteboard.connection_signaling
            - town.robin.msc3846.turn_servers
+            - org.matrix.msc4039.upload_file
+            - org.matrix.msc4039.download_file
        "https://{{ .Values.global.hosts.matrixNeoChoiceWidget }}.{{ .Values.global.domain }}/*":
          preload_approved: true
          capabilities_approved:
@@ -121,7 +125,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.element.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.element.registry | quote }}
  repository: {{ .Values.images.element.repository | quote }}
  tag: {{ .Values.images.element.tag | quote }}

@@ -133,6 +137,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -26,7 +29,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoBoardWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoBoardWidget.registry | quote }}
  repository: {{ .Values.images.matrixNeoBoardWidget.repository | quote }}
  tag: {{ .Values.images.matrixNeoBoardWidget.tag | quote }}

@@ -37,6 +40,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -26,7 +29,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoChoiceWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoChoiceWidget.registry | quote }}
  repository: {{ .Values.images.matrixNeoChoiceWidget.repository | quote }}
  tag: {{ .Values.images.matrixNeoChoiceWidget.tag | quote }}

@@ -37,6 +40,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
@@ -16,13 +19,15 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
  url: {{ .Values.images.synapseCreateUser.repository | quote }}
  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 fullnameOverride: "matrix-neodatefix-bot-bootstrap"

+podAnnotations: {}
+
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
--- a/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
@@ -11,7 +14,7 @@ global:
 configuration:
  bot:
    username: "meetings-bot"
-    displayname: "Terminplaner Bot"
+    display name: "Terminplaner Bot"
  openxchangeBaseUrl: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
  strings:
    breakoutSessionWidgetName: "Breakoutsessions"
@@ -44,10 +47,26 @@ extraEnvVars:
      secretKeyRef:
        name: "matrix-neodatefix-bot-account"
        key: "access_token"
+{{- if .Values.certificate.selfSigned }}
+  - name: "NODE_EXTRA_CA_CERTS"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixBot.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoDateFixBot.registry | quote }}
  repository: {{ .Values.images.matrixNeoDateFixBot.repository | quote }}
  tag: {{ .Values.images.matrixNeoDateFixBot.tag | quote }}

@@ -58,13 +77,15 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

-livenessProbe:
+liveness sample:
  enabled: true

 persistence:
  size: {{ .Values.persistence.size.matrixNeoDateFixBot | quote }}
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
  bot:
@@ -31,7 +34,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoDateFixWidget.registry | quote }}
  repository: {{ .Values.images.matrixNeoDateFixWidget.repository | quote }}
  tag: {{ .Values.images.matrixNeoDateFixWidget.tag | quote }}

@@ -42,6 +45,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
@@ -16,13 +19,15 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
  url: {{ .Values.images.synapseCreateUser.repository | quote }}
  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 fullnameOverride: "opendesk-matrix-user-verification-service-bootstrap"

+podAnnotations: {}
+
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
--- a/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -35,10 +38,12 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixUserVerificationService.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixUserVerificationService.registry | quote }}
  repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
  tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-synapse-web.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-web.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 clusterDomain: {{ .Values.cluster.networking.domain }}

@@ -29,7 +32,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseWeb.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseWeb.registry | quote }}
  repository: {{ .Values.images.synapseWeb.repository | quote }}
  tag: {{ .Values.images.synapseWeb.tag | quote }}

@@ -48,6 +51,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
  additionalConfiguration:
@@ -11,8 +14,8 @@ configuration:
        - "m.space.parent"
        - "net.nordeck.meetings.metadata"
        - "m.room.power_levels"
-    # When a user logs into Element a parallel request is done through Intercom Service to allow Synapse API
-    # interaction, to avoid (temporary) blocking of the user for followup logins we want to raise the limits.
+    # To allow intercom service logins for the users and also allow proper testautomation we want to raise the
+    # ratelimit in a reasonable manner.
    # https://matrix-org.github.io/synapse/v1.59/usage/configuration/config_documentation.html#ratelimiting
    rc_login:
      account:
@@ -40,18 +43,36 @@ configuration:
              regex: "@.*"
        url: null
        sender_localpart: intercom-service
+      - as_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+        id: ox-appsuite
+        namespaces:
+          users:
+            - exclusive: false
+              regex: "@.*"
+        url: null
+        sender_localpart: ox-appsuite
+
+    presence:
+      enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
+
+    profile:
+      allowUsersToUpdateDisplayname: {{ .Values.functional.chat.matrix.profile.allowUsersToUpdateDisplayname }}

    smtp:
-      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}"
-      host: {{ .Values.smtp.host | quote }}
-      port: {{ .Values.smtp.port }}
-      username: {{ .Values.smtp.username | quote }}
-      password: {{ .Values.smtp.password | quote }}
+      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      port: 25
+      tls: false
+      starttls: false
+      username: ""
+      password: ""

    oidc:
      clientId: "opendesk-matrix"
      clientSecret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
      issuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+      matrixIdLocalpart: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
      scopes:
        - "openid"
        - "opendesk-matrix-scope"
@@ -73,7 +94,7 @@ configuration:
      enabled: true
      image:
        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-        registry: {{ .Values.global.imageRegistry | default .Values.images.synapseGuestModule.registry | quote }}
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapseGuestModule.registry | quote }}
        repository: {{ .Values.images.synapseGuestModule.repository | quote }}
        tag: {{ .Values.images.synapseGuestModule.tag | quote }}

@@ -93,6 +114,27 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.synapse | toYaml | nindent 4 }}

+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "REQUESTS_CA_BUNDLE"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  - name: "SSL_CERT_FILE"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  - name: "SSL_CERT_DIR"
+    value: "/etc/ssl/certs"
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 federation:
  enabled: {{ .Values.functional.externalServices.matrix.federation.enabled }}
  ingress:
@@ -112,7 +154,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapse.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapse.registry | quote }}
  repository: {{ .Values.images.synapse.repository | quote }}
  tag: {{ .Values.images.synapse.tag | quote }}

@@ -120,6 +162,8 @@ persistence:
  size: {{ .Values.persistence.size.synapse | quote }}
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 10991
--- a/helmfile/apps/element/values-well-known.yaml.gotmpl
+++ b/helmfile/apps/element/values-well-known.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
  e2ee:
@@ -30,7 +33,7 @@ global:

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.wellKnown.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.wellKnown.registry | quote }}
  repository: {{ .Values.images.wellKnown.repository | quote }}
  tag: {{ .Values.images.wellKnown.tag | quote }}

@@ -42,6 +45,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
--- a/helmfile/apps/intercom-service/helmfile-child.yaml
+++ b/helmfile/apps/intercom-service/helmfile-child.yaml
@@ -1,27 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
---
-repositories:
-  # Intercom Service
-  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
-  - name: "intercom-service-repo"
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.intercomService.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/\
-      {{ .Values.charts.intercomService.repository }}"
-
-releases:
-  - name: "intercom-service"
-    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
-    version: "{{ .Values.charts.intercomService.version }}"
-    values:
-      - "values.yaml.gotmpl"
-    installed: {{ .Values.intercom.enabled }}
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "intercom-service"
-...
--- a/helmfile/apps/intercom-service/values.yaml.gotmpl
+++ b/helmfile/apps/intercom-service/values.yaml.gotmpl
@@ -1,80 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  enabled: true
-  privileged: false
-  runAsUser: 1000
-  runAsGroup: 1000
-  seccompProfile:
-    type: "RuntimeDefault"
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.intercom | toYaml | nindent 4 }}
-
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-ics:
-  secret: {{ .Values.secrets.intercom.secret | quote }}
-  issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
-  originRegex: "{{ .Values.global.domain }}"
-  keycloak:
-    realm: {{ .Values.platform.realm | quote }}
-  default:
-    domain: {{ .Values.global.domain | quote }}
-  oidc:
-    id: "opendesk-intercom"
-    secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
-  matrix:
-    asSecret: {{ .Values.secrets.intercom.synapseAsToken | quote }}
-    subdomain: {{ .Values.global.hosts.synapse | quote }}
-    serverName: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
-  nordeck:
-    subdomain: {{ .Values.global.hosts.matrixNeoDateFixBot | quote }}
-  portal:
-    apiKey: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-  redis:
-    host: {{ .Values.cache.intercomService.host | quote }}
-    port: {{ .Values.cache.intercomService.port }}
-    password: {{ .Values.cache.intercomService.password | default .Values.secrets.redis.password | quote }}
-  openxchange:
-    oci: true
-    url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
-    audience: "opendesk-oxappsuite"
-  nextcloud:
-    audience: "opendesk-nextcloud"
-image:
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.intercom.registry | quote }}
-  repository: {{ .Values.images.intercom.repository | quote }}
-  tag: {{ .Values.images.intercom.tag | quote }}
-
-ingress:
-  host: "{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
-  enabled: {{ .Values.ingress.enabled }}
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
-  tls:
-    enabled: {{ .Values.ingress.tls.enabled }}
-    secretName: {{ .Values.ingress.tls.secretName | quote }}
-
-podSecurityContext:
-  enabled: true
-  fsGroup: 1000
-  fsGroupChangePolicy: "Always"
-
-replicaCount: {{ .Values.replicas.intercomService }}
-
-resources:
-  {{ .Values.resources.intercomService | toYaml | nindent 2 }}
-
-...
--- a/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/\
-      {{ .Values.charts.jitsi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"

 releases:
  - name: "jitsi"
@@ -19,6 +18,7 @@ releases:
    version: "{{ .Values.charts.jitsi.version }}"
    values:
      - "values-jitsi.yaml.gotmpl"
+      - {{ .Values.customization.release.jitsi | default "additionalValues: false" }}
    installed: {{ .Values.jitsi.enabled }}
    timeout: 900

--- a/helmfile/apps/jitsi/helmfile.yaml
+++ b/helmfile/apps/jitsi/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/jitsi/helmfile.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile.yaml.gotmpl
@@ -6,7 +6,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -9,6 +10,7 @@ global:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations: {}

 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -26,17 +28,37 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.jitsiKeycloakAdapter | toYaml | nindent 4 }}

+
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "DENO_CERT"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiKeycloakAdapter.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsiKeycloakAdapter.registry | quote }}
  repository: {{ .Values.images.jitsiKeycloakAdapter.repository | quote }}
  tag: {{ .Values.images.jitsiKeycloakAdapter.tag | quote }}

 settings:
-  jwtAppSecret: {{ .Values.secrets.jitsi.jwtAppSecret | quote }}
+  jwtAppSecret:
+    value: {{ .Values.secrets.jitsi.jwtAppSecret | quote }}
  keycloakRealm: {{ .Values.platform.realm | quote }}
  keycloakClientId: "opendesk-jitsi"

@@ -48,8 +70,9 @@ jitsi:
  web:
    replicaCount: {{ .Values.replicas.jitsi }}
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
      tag: {{ .Values.images.jitsi.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    ingress:
      enabled: {{ .Values.ingress.enabled }}
      ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -61,6 +84,8 @@ jitsi:
        - secretName: {{ .Values.ingress.tls.secretName | quote }}
          hosts:
            - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
+    extraConfigJs:
+      doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
    extraEnvs:
      TURN_ENABLE: "1"
    resources:
@@ -79,8 +104,9 @@ jitsi:
        {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
  prosody:
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
      tag: {{ .Values.images.prosody.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    imagePullSecrets:
    {{- range .Values.global.imagePullSecrets }}
      - name: {{ . | quote }}
@@ -128,8 +154,9 @@ jitsi:
  jicofo:
    replicaCount: {{ .Values.replicas.jicofo }}
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
      tag: {{ .Values.images.jicofo.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    xmpp:
      password: {{ .Values.secrets.jitsi.jicofoAuthPassword | quote }}
      componentSecret: {{ .Values.secrets.jitsi.jicofoComponentPassword | quote }}
@@ -149,9 +176,14 @@ jitsi:
        {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
  jvb:
    replicaCount: {{ .Values.replicas.jvb }}
+    # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
+    # upstream charts v1.4.0 a value for `publicIPs` is required. We set a dummy value as we anyway update it
+    # later with the `patchJVB` job.
+    publicIPs: [ 0.0.0.0 ]
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
      tag: {{ .Values.images.jvb.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    xmpp:
      password: {{ .Values.secrets.jitsi.jvbAuthPassword | quote }}
    resources:
@@ -173,8 +205,9 @@ jitsi:
  jibri:
    replicaCount: {{ .Values.replicas.jibri }}
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
      tag: {{ .Values.images.jibri.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    recorder:
      password: {{ .Values.secrets.jitsi.jibriRecorderPassword | quote }}
    xmpp:
@@ -211,9 +244,12 @@ patchJVB:
      {{ .Values.seLinuxOptions.jitsiPatchJVB | toYaml | nindent 6 }}
  image:
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiPatchJVB.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.jitsiPatchJVB.registry | quote }}
    repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
    tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
+
+podAnnotations: {}
+
 replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}

 resources:
--- a/helmfile/apps/migrations-post/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/migrations-post/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/\
-      {{ .Values.charts.migrations.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"

 releases:
  - name: "opendesk-migrations-post"
@@ -22,6 +21,7 @@ releases:
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
+      - {{ .Values.customization.release.migrationsPost | default "additionalValues: false" }}
    installed: {{ .Values.migrations.enabled }}
    timeout: 900

--- a/helmfile/apps/migrations-post/helmfile.yaml.gotmpl
+++ b/helmfile/apps/migrations-post/helmfile.yaml.gotmpl
@@ -5,7 +5,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/migrations-post/values.yaml.gotmpl
+++ b/helmfile/apps/migrations-post/values.yaml.gotmpl
@@ -3,6 +3,8 @@
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+podAnnotations: {}
+
 migrations:
  stage: "POST"
 ...
--- a/helmfile/apps/migrations-pre/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/migrations-pre/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/\
-      {{ .Values.charts.migrations.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"

 releases:
  - name: "opendesk-migrations-pre"
@@ -22,6 +21,7 @@ releases:
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
+      - {{ .Values.customization.release.migrationsPre | default "additionalValues: false" }}
    installed: {{ .Values.migrations.enabled }}
    timeout: 900

--- a/helmfile/apps/migrations-pre/helmfile.yaml.gotmpl
+++ b/helmfile/apps/migrations-pre/helmfile.yaml.gotmpl
@@ -5,7 +5,7 @@ bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/migrations-pre/values.yaml.gotmpl
+++ b/helmfile/apps/migrations-pre/values.yaml.gotmpl
@@ -3,6 +3,8 @@
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+podAnnotations: {}
+
 migrations:
  stage: "PRE"
 ...
--- a/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
@@ -10,16 +10,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/\
-      {{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
  - name: "nextcloud-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.nextcloud.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/\
-      {{ .Values.charts.nextcloud.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"

 releases:
  - name: "opendesk-nextcloud-management"
@@ -27,6 +25,7 @@ releases:
    version: "{{ .Values.charts.nextcloudManagement.version }}"
    values:
      - "values-nextcloud-mgmt.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskNextcloudManagement | default "additionalValues: false" }}
    waitForJobs: true
    wait: true
    installed: {{ .Values.nextcloud.enabled }}
@@ -36,6 +35,7 @@ releases:
    version: "{{ .Values.charts.nextcloud.version }}"
    values:
      - "values-nextcloud.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskNextcloud | default "additionalValues: false" }}
    needs:
      - "opendesk-nextcloud-management"
    installed: {{ .Values.nextcloud.enabled }}
--- a/helmfile/apps/nextcloud/helmfile.yaml
+++ b/helmfile/apps/nextcloud/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/nextcloud/helmfile.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -18,8 +19,10 @@ cleanup:

 configuration:
  administrator:
-    username: "nextcloud"
-    password: {{ .Values.secrets.nextcloud.adminPassword | quote }}
+    username:
+      value: "nextcloud"
+    password:
+      value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
  antivirus:
    {{- if .Values.clamavDistributed.enabled }}
    host: "clamav-icap"
@@ -37,7 +40,7 @@ configuration:
    port: {{ .Values.cache.nextcloud.port | quote }}
  collabora:
    # internalWopiUrl: ""
-    wopiAllowlist: {{ join " " .Values.cluster.networking.cidr | quote }}
+    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
  database:
    host: {{ .Values.databases.nextcloud.host | quote }}
    port: {{ .Values.databases.nextcloud.port | quote }}
@@ -48,7 +51,8 @@ configuration:
        value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
  ldap:
    host: {{ .Values.ldap.host | quote }}
-    password: {{ .Values.secrets.univentionManagementStack.ldapSearch.nextcloud | quote }}
+    password:
+      value: {{ .Values.secrets.nubus.ldapSearch.nextcloud | quote }}
    adminGroupName: "managed-by-attribute-FileshareAdmin"
  objectstore:
    auth:
@@ -73,16 +77,31 @@ configuration:
      value: "opendesk_username"
    password:
      value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  sharing:
+    allowLinks: {{ .Values.functional.filestore.sharing.external.enabled }}
+    allowMailNotification: {{ .Values.functional.filestore.sharing.external.enabled }}
+    allowPublicUpload: {{ .Values.functional.filestore.sharing.external.enabled }}
+    enforceLinksPassword: {{ .Values.functional.filestore.sharing.external.enforcePasswords }}
+    enforcePasswordProtection: {{ .Values.functional.filestore.sharing.external.enforcePasswords }}
+    defaultInternalExpireEnabled: {{ .Values.functional.filestore.sharing.internal.expiry.activeByDefault }}
+    defaultInternalExpireEnforced: {{ .Values.functional.filestore.sharing.internal.expiry.enforced }}
+    defaultInternalExpireDays: {{ .Values.functional.filestore.sharing.internal.expiry.defaultDays | quote }}
+    defaultExternalExpireEnabled: {{ .Values.functional.filestore.sharing.external.expiry.activeByDefault }}
+    defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
+    defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
  smtp:
    auth:
+      enabled: false
      username:
-        value: {{ .Values.smtp.username | quote }}
+        value: ""
      password:
-        value: {{ .Values.smtp.password | quote }}
-    host: {{ .Values.smtp.host | quote }}
-    port: {{ .Values.smtp.port | quote }}
+        value: ""
+    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    port: 25
    fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
-    mailDomain: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
+    mailDomain: "{{ .Values.global.domain }}"
+    security: ""
+    skipVerifyPeer: true
  quota:
    default: "{{ .Values.functional.filestore.quota.default }} GB"
    retentionObligation:
@@ -99,28 +118,47 @@ containerSecurityContext:
      - "ALL"
  enabled: true
  privileged: false
-  runAsUser: 65532
-  runAsGroup: 65532
+  runAsUser: 101
+  runAsGroup: 101
  seccompProfile:
    type: "RuntimeDefault"
  readOnlyRootFilesystem: false
  runAsNonRoot: true
  seLinuxOptions:
    {{ .Values.seLinuxOptions.nextcloudManagement | toYaml | nindent 4 }}
+podSecurityContext:
+  fsGroup: 101

 debug:
  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}

+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "FS_IMPORT_CA_CERTIFICATES"
+    value: "true"
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudManagement.registry | quote }}
-  repository: {{ .Values.images.nextcloudManagement.repository | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
+  repository: {{ .Values.images.nextcloud.repository | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  tag: {{ .Values.images.nextcloudManagement.tag | quote }}
+  tag: {{ .Values.images.nextcloud.tag | quote }}

 theme:
  {{ .Values.theme | toYaml | nindent 2 }}

 resources:
-  {{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
+  {{ .Values.resources.nextcloud | toYaml | nindent 4 }}

 ...
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -28,10 +29,11 @@ exporter:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.nextcloudExporter | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudExporter.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloudExporter.registry | quote }}
    repository: "{{ .Values.images.nextcloudExporter.repository }}"
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    tag: {{ .Values.images.nextcloudExporter.tag | quote }}
+  podAnnotations: {}
  prometheus:
    serviceMonitor:
      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
@@ -45,9 +47,9 @@ exporter:
  resources:
    {{ .Values.resources.nextcloudExporter | toYaml | nindent 4 }}

-php:
+aio:
  additionalAnnotations:
-    intents.otterize.com/service-name: "opendesk-nextcloud-php"
+    intents.otterize.com/service-name: "opendesk-nextcloud"
  configuration:
    cache:
      auth:
@@ -66,7 +68,7 @@ php:
          value: "nextcloud_user"
        password:
          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
-    trustedProxies: {{ join " " .Values.cluster.networking.cidr | quote }}
+    trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
@@ -74,56 +76,41 @@ php:
        - "ALL"
    enabled: true
    privileged: false
-    runAsUser: 65532
-    runAsGroup: 65532
+    runAsUser: 101
+    runAsGroup: 101
    seccompProfile:
      type: "RuntimeDefault"
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    seLinuxOptions:
-      {{ .Values.seLinuxOptions.nextcloudPHP | toYaml | nindent 6 }}
+      {{ .Values.seLinuxOptions.nextcloud | toYaml | nindent 6 }}
  cron:
    successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
  debug:
    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
+  {{- if .Values.certificate.selfSigned }}
+  extraEnvVars:
+    - name: "FS_IMPORT_CA_CERTIFICATES"
+      value: "true"
+  {{- end }}
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+  extraVolumeMounts:
+    - name: "trusted-cert-secret-volume"
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+  {{- end }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudPHP.registry | quote }}
-    repository: "{{ .Values.images.nextcloudPHP.repository }}"
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
+    repository: {{ .Values.images.nextcloud.repository | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    tag: {{ .Values.images.nextcloudPHP.tag | quote }}
-  prometheus:
-    serviceMonitor:
-      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
-      labels:
-        {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
-    prometheusRule:
-      enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
-      additionalLabels:
-        {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
-  replicaCount: {{ .Values.replicas.nextcloudPHP }}
-  resources:
-    {{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
-
-apache2:
-  configuration:
-    php:
-      host: "opendesk-nextcloud-php.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}"
-    trustedProxies: {{ join " " .Values.cluster.networking.cidr | quote }}
-  containerSecurityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - "ALL"
-    enabled: true
-    privileged: false
-    runAsUser: 65532
-    runAsGroup: 65532
-    seccompProfile:
-      type: "RuntimeDefault"
-    readOnlyRootFilesystem: true
-    runAsNonRoot: true
-    seLinuxOptions:
-      {{ .Values.seLinuxOptions.nextcloudApache2 | toYaml | nindent 6 }}
+    tag: {{ .Values.images.nextcloud.tag | quote }}
  ingress:
    enabled: {{ .Values.ingress.enabled }}
    annotations:
@@ -137,13 +124,20 @@ apache2:
    host: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
    tls:
      secretName: {{ .Values.ingress.tls.secretName | quote }}
-  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudApache2.registry | quote }}
-    repository: {{ .Values.images.nextcloudApache2.repository | quote }}
-    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    tag: {{ .Values.images.nextcloudApache2.tag | quote }}
-  replicaCount: {{ .Values.replicas.nextcloudApache2 }}
+  podAnnotations: {}
+  podSecurityContext:
+    fsGroup: 101
+  prometheus:
+    serviceMonitor:
+      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
+      labels:
+        {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
+    prometheusRule:
+      enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
+      additionalLabels:
+        {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
+  replicaCount: {{ .Values.replicas.nextcloud }}
  resources:
-    {{ .Values.resources.nextcloudApache2 | toYaml | nindent 4 }}
+    {{ .Values.resources.nextcloud | toYaml | nindent 4 }}

 ...
--- a/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
@@ -0,0 +1,68 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # Univention Management Stack Umbrella Chart
+  - name: "nubus"
+    keyring: "../../files/gpg-pubkeys/univention-de.gpg"
+    verify: {{ .Values.charts.nubus.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url:
+      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
+  # Intercom Service
+  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
+  - name: "intercom-service-repo"
+    keyring: "../../files/gpg-pubkeys/univention-de.gpg"
+    verify: {{ .Values.charts.intercomService.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+  # openDesk Keycloak Bootstrap Chart
+  - name: "opendesk-keycloak-bootstrap-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+
+releases:
+  # Univention Management Stack Umbrella Chart
+  - name: "ums"
+    chart: "nubus/{{ .Values.charts.nubus.name }}"
+    version: "{{ .Values.charts.nubus.version }}"
+    values:
+      - "values-nubus.yaml.gotmpl"
+      - "values-opendesk-customization.yaml.gotmpl"
+      - "values-opendesk-images.yaml.gotmpl"
+      - {{ .Values.customization.release.ums | default "additionalValues: false" }}
+    installed: {{ .Values.nubus.enabled }}
+    timeout: 900
+  # Intercom-Service
+  - name: "intercom-service"
+    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
+    version: "{{ .Values.charts.intercomService.version }}"
+    values:
+      - "values-intercom-service.yaml.gotmpl"
+      - {{ .Values.customization.release.intercomService | default "additionalValues: false" }}
+    installed: {{ .Values.nubus.enabled }}
+
+  # openDesk Keycloak Bootstrap Chart
+  - name: "opendesk-keycloak-bootstrap"
+    chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.opendeskKeycloakBootstrap.name }}"
+    version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
+    values:
+      - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskKeycloakBootstrap | default "additionalValues: false" }}
+    needs:
+      - "ums"
+    installed: {{ .Values.nubus.enabled }}
+    timeout: 900
+
+commonLabels:
+  deploy-stage: "component-1"
+  component: "nubus"
+...
--- a/helmfile/apps/nubus/helmfile.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
@@ -0,0 +1,139 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  enabled: true
+  privileged: false
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.intercom | toYaml | nindent 4 }}
+
+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+extraEnvVars:
+  - name: "NODE_EXTRA_CA_CERTS"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+{{- end }}
+
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+ics:
+  secret: {{ .Values.secrets.intercom.secret | quote }}
+  issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+  originRegex: "{{ .Values.global.domain }}"
+  userUniqueMapper: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"entryuuid"{{ else }}"phoenixusername"{{ end }}
+  keycloak:
+    realm: {{ .Values.platform.realm | quote }}
+  default:
+    domain: {{ .Values.global.domain | quote }}
+  oidc:
+    id: "opendesk-intercom"
+    secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
+  matrix:
+    asSecret: {{ .Values.secrets.intercom.synapseAsToken | quote }}
+    subdomain: {{ .Values.global.hosts.synapse | quote }}
+    serverName: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
+  nordeck:
+    subdomain: {{ .Values.global.hosts.matrixNeoDateFixBot | quote }}
+  portal:
+    apiKey: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  redis:
+    host: {{ .Values.cache.intercomService.host | quote }}
+    port: {{ .Values.cache.intercomService.port }}
+    password: {{ .Values.cache.intercomService.password | default .Values.secrets.redis.password | quote }}
+  openxchange:
+    oci: true
+    url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
+    audience: "opendesk-oxappsuite"
+  nextcloud:
+    origin: {{ .Values.global.hosts.nextcloud | quote }}
+    subdomain: {{ .Values.global.hosts.nextcloud | quote }}
+    audience: "opendesk-nextcloud"
+image:
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.intercom.registry | quote }}
+  repository: {{ .Values.images.intercom.repository | quote }}
+  tag: {{ .Values.images.intercom.tag | quote }}
+
+ingress:
+  host: "{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
+  enabled: {{ .Values.ingress.enabled }}
+  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+  tls:
+    enabled: {{ .Values.ingress.tls.enabled }}
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+podAnnotations: {}
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 1000
+  fsGroupChangePolicy: "Always"
+
+provisioning:
+  enabled: true
+  config:
+    nubusBaseUrl: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
+    keycloak:
+      url: "http://ums-keycloak:8080/realms/{{ .Values.platform.realm }}/"
+      username: "kcadmin"
+      realm: {{ .Values.platform.realm | quote }}
+      connection:
+        host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
+        baseUrl: "http://ums-keycloak:8080"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+    ics_client:
+      clientSecret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
+      credentialSecret:
+        key: "ics_secret"
+  image:
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository | quote }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag | quote }}
+  provisioningImage:
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakBootstrap.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloakBootstrap.repository | quote }}
+    tag: {{ .Values.images.nubusKeycloakBootstrap.tag | quote }}
+  securityContext:
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.intercom | toYaml | nindent 6 }}
+
+replicaCount: {{ .Values.replicas.intercomService }}
+
+resources:
+  {{ .Values.resources.intercomService | toYaml | nindent 2 }}
+
+...
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -0,0 +1,557 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  nubusDeployment: true
+  ldap:
+    baseDn: {{ .Values.ldap.baseDn | quote }}
+    domainName: {{ .Values.global.domain | quote }}
+  domain: {{ .Values.global.domain | quote }}
+  subDomains:
+    portal: {{ .Values.global.hosts.nubus | quote }}
+    keycloak: {{ .Values.global.hosts.keycloak | quote }}
+  ingressClass: {{ .Values.ingress.ingressClassName | default "nginx" | quote }}
+  certManagerIssuer: {{ .Values.certificate.issuerRef.name | quote }}
+  nubusMasterPassword: {{ env "MASTER_PASSWORD" | default "sovereign-workplace" | quote }}
+  keycloak:
+    realm: {{ .Values.platform.realm | quote }}
+  objectStorage:
+    bucket: {{ .Values.objectstores.nubus.bucket | quote }}
+    connection:
+      host: "minio"
+      port: "9000"
+      protocol: "http"
+  credentialOverride:
+    ldapServer:
+      adminPassword: {{ .Values.secrets.nubus.ldapSecret | quote}}
+    defaultUsers:
+      defaultAdminPassword: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote}}
+      defaultUserPassword: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote}}
+      defaultAdministratorPassword: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote}}
+    portalConsumer:
+      minio:
+        accessKey: {{ .Values.objectstores.nubus.username | quote }}
+        secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+      provisioningApi:
+        password: {{ .Values.secrets.nubus.portalConsumer.provisioningApiPassword | quote}}
+    provisioning:
+      api:
+        adminPassword: {{ .Values.secrets.nubus.provisioning.api.adminPassword | quote}}
+        natsPassword: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
+        prefillPassword: {{ .Values.secrets.nubus.provisioning.api.prefillPassword | quote}}
+        udmTransformerPassword: {{ .Values.secrets.nubus.provisioning.api.udmTransformerPassword | quote}}
+      dispatcher:
+        natsPassword: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
+      nats:
+        adminPassword: {{ .Values.secrets.nats.natsAdminPassword | quote}}
+      prefill:
+        natsPassword: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
+      udmTransformer:
+        natsPassword: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
+    selfserviceConsumer:
+      provisioningApi:
+        password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}
+
+  # -- Extensions to load. Add entries to load additional extensions into Nubus.
+  extensions:
+    - name: "ox"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOxExtension.registry | quote }}
+        repository: {{ .Values.images.nubusOxExtension.repository }}
+        tag: {{ .Values.images.nubusOxExtension.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+    - name: "opendesk"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpendeskExtension.registry | quote }}
+        repository: {{ .Values.images.nubusOpendeskExtension.repository }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        tag: {{ .Values.images.nubusOpendeskExtension.tag }}
+
+  # -- Allows to configure the system extensions to load. This is intended for
+  # internal usage, prefer to use `global.extensions` for user configured
+  # extensions.
+  systemExtensions:
+    - name: "portal"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalExtension.registry | quote }}
+        repository: {{ .Values.images.nubusPortalExtension.repository }}
+        tag: {{ .Values.images.nubusPortalExtension.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+  configUcr:
+    directory:
+      manager:
+        rest:
+          authorized-groups:
+            domain-admins: __DELETE_KEY__
+            iam-api-full-access: "cn=IAM API - Full Access,cn=groups,{{ .Values.ldap.baseDn }}"
+        web:
+          modules:
+            users:
+              user:
+                add:
+                  default: "cn=openDesk User,cn=templates,cn=univention,{{ .Values.ldap.baseDn }}"
+                properties:
+                  description:
+                    syntax: "TextArea"
+                  firstname:
+                    required: "true"
+                  mailPrimaryAddress:
+                    required: "true"
+                  username:
+                    syntax: "uid"
+                search:
+                  autosearch: "True"
+                wizard:
+                  property:
+                    invite:
+                      default: "True"
+                    overridePWLength:
+                      default: "False"
+                      visible: "False"
+                    pwdChangeNextLogin:
+                      default: "True"
+                      visible: "False"
+            wizard:
+              disabled: "No"
+
+    ucs:
+      web:
+        theme: "light"
+
+    umc:
+      cookie-banner:
+        show: "false"
+      login:
+        password-complexity-message:
+          de: "Das Passwort muss mindestens 8 Zeichen lang sein und darf keine Zahlenabfolge oder ganze Worte enthalten, wie  '1234Test'."
+          en: "Password must be at least 8 characters long and cannot include a number series or regular words, like '1234Test'."
+      module:
+        udm:
+          oxmail:
+            oxcontext:
+              disabled: "True"
+          portals:
+            all:
+              disabled: "True"
+      self-service:
+        account-registration:
+          usertemplate: __DELETE_KEY__
+        passwordreset:
+          token_validity_period: 172800
+          blacklist:
+            groups: __DELETE_KEY__
+
+ingress:
+  certManager:
+    enabled: false
+  tls:
+    enabled: {{ .Values.ingress.tls.enabled }}
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+# Nubus bundled services
+postgresql:
+  enabled: false
+  provisioning:
+    enabled: false
+
+minio:
+  enabled: false
+
+# Nubus services which use customer supplied services
+keycloak:
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-crt-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+    - name: "trusted-cert-jks-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "truststore.jks"
+            path: "truststore.jks"
+  extraVolumeMounts:
+    - name: "trusted-cert-crt-secret-volume"
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+    - name: "trusted-cert-jks-secret-volume"
+      mountPath: "/etc/ssl/certs/truststore.jks"
+      subPath: "truststore.jks"
+  extraEnvVars:
+    - name: "KC_HTTPS_TRUST_STORE_FILE"
+      value: "/etc/ssl/certs/truststore.jks"
+    - name: "KC_HTTPS_TRUST_STORE_PASSWORD"
+      value: {{ .Values.secrets.certificates.password | quote }}
+    - name: "KC_HTTPS_TRUST_STORE_TYPE"
+      value: "jks"
+  {{- end }}
+  keycloak:
+    auth:
+      username: "kcadmin"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+  postgresql:
+    connection:
+      host: {{ .Values.databases.keycloak.host | quote }}
+      port: {{ .Values.databases.keycloak.port | quote }}
+    auth:
+      username: {{ .Values.databases.keycloak.username | quote }}
+      database: {{ .Values.databases.keycloak.name | quote }}
+      credentialSecret:
+        name: "ums-keycloak-postgresql-opendesk-credentials"
+        key: "keycloakDatabasePassword"
+  config:
+    exposeAdminConsole: {{ .Values.debug.enabled }}
+    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
+
+nubusGuardian:
+  provisioning:
+    enabled: false
+    config:
+      nubusBaseUrl: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain }}
+      keycloak:
+        realm: {{ .Values.platform.realm | quote }}
+        username: "kcadmin"
+        connection:
+          host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
+          baseUrl: "http://ums-keycloak:8080"
+        credentialSecret:
+          name: "ums-opendesk-keycloak-credentials"
+          key: "admin_password"
+      managementApi:
+        credentialSecret:
+          name: "ums-opendesk-guardian-client-secret"
+          key: "managementApiClientSecret"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+  postgresql:
+    connection:
+      host: {{ .Values.databases.umsGuardianManagementApi.host | quote }}
+      port: {{ .Values.databases.umsGuardianManagementApi.port | quote }}
+    auth:
+      username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
+      database: {{ .Values.databases.umsGuardianManagementApi.name | quote }}
+      credentialSecret:
+        name: "ums-guardian-postgresql-opendesk-credentials"
+        key: "guardianDatabasePassword"
+
+nubusNotificationsApi:
+  postgresql:
+    connection:
+      host: {{ .Values.databases.umsNotificationsApi.host | quote }}
+      port: {{ .Values.databases.umsNotificationsApi.port | quote }}
+    auth:
+      username: {{ .Values.databases.umsNotificationsApi.username | quote }}
+      database: {{ .Values.databases.umsNotificationsApi.name | quote }}
+      existingSecret: "ums-notifications-api-postgresql-opendesk-credentials"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusPortalFrontend:
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName }}
+
+nubusKeycloakExtensions:
+  keycloak:
+    auth:
+      username: "kcadmin"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+  proxy:
+    ingress:
+      paths:
+        {{- if .Values.debug.enabled }}
+        - pathType: "Prefix"
+          path: "/admin/"
+        {{- end }}
+        - pathType: "Prefix"
+          path: "/realms/"
+        - pathType: "Prefix"
+          path: "/js/"
+        - pathType: "Prefix"
+          path: "/resources/"
+        - pathType: "Prefix"
+          path: "/fingerprintjs"
+      certManager:
+        enabled: false
+      tls:
+        enabled: {{ .Values.ingress.tls.enabled }}
+        secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+
+  postgresql:
+    connection:
+      host: {{ .Values.databases.keycloakExtension.host | quote }}
+      port: {{ .Values.databases.keycloakExtension.port | quote }}
+    auth:
+      database: {{ .Values.databases.keycloakExtension.name | quote }}
+      username: {{ .Values.databases.keycloakExtension.username | quote }}
+      credentialSecret:
+        name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
+        key: "umcKeycloakExtensionsDatabasePassword"
+  smtp:
+    connection:
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      port: 25
+      ssl: false
+      starttls: false
+    auth:
+      enabled: false
+      username: ""
+      credentialSecret:
+        name: "ums-keycloak-extensions-smtp-opendesk-credentials"
+        key: "umcKeycloakExtensionsSmtpPassword"
+  handler:
+    appConfig:
+      logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
+      newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
+      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+
+nubusPortalListener:
+  enabled: false
+
+nubusPortalConsumer:
+  enabled: true
+  portalConsumer:
+    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
+    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
+  provisioningApi:
+    auth:
+      username: "portal-consumer"
+
+nubusPortalServer:
+  portalServer:
+    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
+    objectStorageCredentialSecret:
+      name: "ums-portal-server-minio-opendesk-credentials"
+      accessKeyKey: "access-key-id"
+      secretKeyKey: "secret-key-id"
+    centralNavigation:
+      enabled: true
+      authenticatorSecretName: "ums-opendesk-portal-server-central-navigation"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusUdmRestApi:
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusProvisioning:
+  enabled: true
+
+nubusUdmListener:
+  enabled: true
+
+nubusSelfServiceListener:
+  enabled: false
+
+nubusSelfServiceConsumer:
+  enabled: true
+
+# Nubus services
+nubusStackDataUms:
+  additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
+    argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
+  stackDataContext:
+    umcPostgresqlHostname: {{ .Values.databases.umsSelfservice.host | quote }}
+    umcPostgresqlUsername: {{ .Values.databases.umsSelfservice.username | quote }}
+    umcMemcachedHostname: {{ .Values.cache.umsSelfservice.host | quote }}
+    umcMemcachedUsername: ""
+    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
+    umcHtmlTitle: "openDesk Portal"
+    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    smtpPort: 25
+    smtpUser: ""
+    smtpStartTls: false
+    ldapBase: {{ .Values.ldap.baseDn }}
+  templateContext:
+    # creates the default.user and default.admin
+    loadDevData: true
+    portalHeaderLogo: {{ toYaml .Values.theme.imagery.logoHeaderSvgB64 | quote }}
+    portalTiles: {{ toYaml .Values.theme.imagery.portalTiles | nindent 6 }}
+    portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }}
+    portalRealtimeVideoconferenceLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.jitsi .Values.global.domain }}
+    portalManagementProjectLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openproject .Values.global.domain }}
+    portalManagementKnowledgeLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.xwiki .Values.global.domain }}
+    portalGroupwareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
+    portalFileshareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.nextcloud .Values.global.domain }}
+    portalTitleDE: "openDesk Portal"
+    portalTitleEN: "openDesk Portal"
+    oxDefaultContext: "1"
+    ldapSearchUsers:
+      {{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
+      - username: {{ printf "ldapsearch_%s" $username | quote }}
+        password: {{ $password | quote }}
+        lastname: "LDAP-Search-User"
+      {{- end }}
+    ldapSystemUsers: []
+    portaltileGroupUserStandard:
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupUserAdmin:
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Support,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupUserAll:
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupGroupware:
+      - 'cn=managed-by-attribute-Groupware,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupFileshare:
+      - 'cn=managed-by-attribute-Fileshare,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementProject:
+      - 'cn=managed-by-attribute-Projectmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementKnowledge:
+      - 'cn=managed-by-attribute-Knowledgemanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementLearn:
+      - 'cn=managed-by-attribute-Learnmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupLiveCollaboration:
+      - 'cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupVideoconference:
+      - 'cn=managed-by-attribute-Videoconference,cn=groups,{{ .Values.ldap.baseDn }}'
+    systemInformation:
+      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
+      {{- if .Values.functional.admin.portal.deploymentTimestamp.enabled }}
+      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
+      {{- else }}
+      deployDate: false
+      {{- end }}
+  # In openDesk the external memcache does not expect a username to be set. Overwriting
+  # the default username of `selfservice` is part of the customizing:
+  nubusUmcServer:
+    memcached:
+      auth:
+        username: ""
+
+nubusUmcServer:
+  postgresql:
+    bundled: false
+    connection:
+      host: {{ .Values.databases.umsSelfservice.host | quote }}
+      port: {{ .Values.databases.umsSelfservice.port | quote }}
+    auth:
+      username: {{ .Values.databases.umsSelfservice.username | quote }}
+      database: {{ .Values.databases.umsSelfservice.name | quote }}
+      credentialSecret:
+        name: "ums-umc-server-postgresql-opendesk-credentials"
+        key: "umcServerDatabasePassword"
+  memcached:
+    bundled: false
+    server: {{ .Values.cache.umsSelfservice.host | quote }}
+    auth:
+      credentialSecret:
+        name: "ums-umc-server-memcached-opendesk-credentials"
+        key: "umcServerMemcachedPassword"
+  smtp:
+    credentialSecret:
+      name: "ums-umc-server-smtp-credentials-custom"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusUmcGateway:
+  umcGateway:
+    umcHtmlTitle: "openDesk Portal"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusKeycloakBootstrap:
+  additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
+  keycloak:
+    auth:
+      username: "kcadmin"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+  bootstrap:
+    ldapMappers:
+      - ldapAndUserModelAttributeName: "opendeskProjectmanagementAdmin"
+      - ldapAndUserModelAttributeName: "oxContextIDNum"
+    twoFactorAuthentication:
+      enabled: true
+      group: "2fa-users"
+  ldap:
+    auth:
+      bindDn: {{ printf "uid=ldapsearch_keycloak,cn=users,%s" .Values.ldap.baseDn }}
+      credentialSecret:
+        name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
+
+# Credential secrets for accessing customer supplied services
+extraSecrets:
+  - name: "ums-opendesk-portal-server-central-navigation"
+    stringData:
+      authenticator.secret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  - name: "ums-opendesk-guardian-client-secret"
+    stringData:
+      managementApiClientSecret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
+  - name: "ums-opendesk-keycloak-credentials"
+    stringData:
+      admin_password: {{ .Values.secrets.keycloak.adminPassword | quote }}
+  - name: "ums-keycloak-postgresql-opendesk-credentials"
+    stringData:
+      keycloakDatabasePassword: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
+  - name: "ums-guardian-postgresql-opendesk-credentials"
+    stringData:
+      guardianDatabasePassword: {{ .Values.databases.umsGuardianManagementApi.password | default .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
+  - name: "ums-notifications-api-postgresql-opendesk-credentials"
+    stringData:
+      password: {{ .Values.databases.umsNotificationsApi.password | default .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
+  - name: "ums-umc-server-postgresql-opendesk-credentials"
+    stringData:
+      umcServerDatabasePassword: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
+  - name: "ums-umc-server-memcached-opendesk-credentials"
+    stringData:
+      umcServerMemcachedPassword: ""
+  - name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
+    stringData:
+      umcKeycloakExtensionsDatabasePassword: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
+  - name: "ums-keycloak-extensions-smtp-opendesk-credentials"
+    stringData:
+      umcKeycloakExtensionsSmtpPassword: ""
+  - name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
+    stringData:
+      password: {{ .Values.secrets.nubus.ldapSearch.keycloak | quote }}
+  - name: "ums-portal-server-minio-opendesk-credentials"
+    stringData:
+      access-key-id: {{ .Values.objectstores.nubus.username | quote }}
+      secret-key-id: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+  - name: "ums-umc-server-smtp-credentials-custom"
+    stringData:
+      password: ""
--- a/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
@@ -0,0 +1,719 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+keycloak:
+  enabled: true
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: false
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsKeycloak | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-keycloak"
+  replicaCount: {{ .Values.replicas.keycloak }}
+  resources:
+    {{ .Values.resources.umsKeycloak | toYaml | nindent 4 }}
+
+nubusGuardian:
+  authorizationApi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-guardian-authorization-api"
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    replicaCount: {{ .Values.replicas.umsGuardianAuthorizationApi }}
+    resources:
+      {{ .Values.resources.umsGuardianAuthorizationApi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianAuthorizationApi | toYaml | nindent 8 }}
+  managementApi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-guardian-management-api"
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    replicaCount: {{ .Values.replicas.umsGuardianManagementApi }}
+    resources:
+      {{ .Values.resources.umsGuardianManagementApi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianManagementApi | toYaml | nindent 8 }}
+  managementUi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-guardian-management-ui"
+    replicaCount: {{ .Values.replicas.umsGuardianManagementUi }}
+    resources:
+      {{ .Values.resources.umsGuardianManagementUi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianManagementUi | toYaml | nindent 8 }}
+  openPolicyAgent:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-ums-open-policy-agent"
+    replicaCount: {{ .Values.replicas.umsGuardianOpenPolicyAgent }}
+    resources:
+      {{ .Values.resources.umsOpenPolicyAgent | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsGuardianOpenPolicyAgent | toYaml | nindent 8 }}
+  provisioning:
+    # Using openDesk keycloak provisioning
+    enabled: false
+
+nubusNotificationsApi:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-notifications-api"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsNotificationsApi | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    create: true
+  replicaCount: {{ .Values.replicas.umsNotificationsApi }}
+  resources:
+    {{ .Values.resources.umsNotificationsApi | toYaml | nindent 4 }}
+
+nubusUmcServer:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-umc-server"
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  containerSecurityContextInit:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  containerSecurityContextSssd:
+    enabled: true
+    allowPrivilegeEscalation: true
+    capabilities:
+      drop:
+        - "ALL"
+      add:
+        - "DAC_OVERRIDE"
+        - "SETGID"
+        - "AUDIT_WRITE"
+        - "SETUID"
+        - "CHOWN"
+        - "SETPCAP"
+        - "FOWNER"
+        - "FSETID"
+        - "KILL"
+        - "MKNOD"
+        - "NET_BIND_SERVICE"
+        - "SYS_CHROOT"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  proxy:
+    replicaCount: {{ .Values.replicas.umsUmcServerProxy }}
+  replicaCount: {{ .Values.replicas.umsUmcServer }}
+
+  resources:
+    {{ .Values.resources.umsUmcServer | toYaml | nindent 4 }}
+  selfService:
+    passwordresetEmailBody: |
+        Sehr geehrte Benutzerin, sehr geehrter Benutzer,
+
+        Ihr Benutzername für {domainname} lautet: {username}
+
+        Sie erhalten diese Nachricht, da Sie Ihr Passwort zurücksetzen möchten oder weil Ihr Benutzer neu im System angelegt wurde.
+
+        Klicken Sie bitte auf den folgenden Link, um Ihr Passwort zu setzen:
+        https://{fqdn}/univention/portal/#/selfservice/newpassword/?token={token}&username={username}
+
+        Der genannte Link ist nur 48 Stunden gültig, danach fordern Sie ihn bitte erneut an unter:
+        https://{fqdn}/univention/portal/#/selfservice/passwordforgotten
+
+        Mit freundlichen Grüßen
+        Ihr {domainname} Passwort-Service
+
+nubusKeycloakExtensions:
+  handler:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    replicaCount: {{ .Values.replicas.umsKeycloakExtensionsHandler }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-keycloak-extensions-handler"
+    resources:
+      {{ .Values.resources.umsKeycloakExtensionHandler | toYaml | nindent 6 }}
+    securityContext:
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler | toYaml | nindent 8 }}
+  proxy:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    replicaCount: {{ .Values.replicas.umsKeycloakExtensionsProxy }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-keycloak-extensions-proxy"
+    resources:
+      {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 6 }}
+    securityContext:
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler | toYaml | nindent 8 }}
+
+nubusPortalConsumer:
+  portalConsumer:
+    image:
+      pullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . | quote }}
+        {{- end }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-portal-consumer"
+  replicaCount: {{ .Values.replicas.umsPortalConsumer }}
+  resources:
+    {{ .Values.resources.umsPortalConsumer | toYaml | nindent 4 }}
+  resourcesWaitForDependency:
+    {{ .Values.resources.umsPortalConsumerDependencies | toYaml | nindent 4 }}
+  persistence:
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.portalConsumer | quote }}
+  securityContext:
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalConsumer | toYaml | nindent 6 }}
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+          - key: "ca.crt"
+            path: "cacert.pem"
+  extraVolumeMounts:
+    - name: "trusted-cert-secret-volume"
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+  waitForDependency:
+    extraVolumeMounts:
+      - name: "trusted-cert-secret-volume"
+        readOnly: true
+        mountPath: "/etc/ssl/certs/ca-certificates.crt"
+        subPath: "ca-certificates.crt"
+      - name: "trusted-cert-secret-volume"
+        readOnly: true
+        mountPath: "/usr/local/lib/python3.7/dist-packages/certifi/cacert.pem"
+        subPath: "cacert.pem"
+    extraEnvVars:
+      - name: "REQUESTS_CA_BUNDLE"
+        value: "/etc/ssl/certs/ca-certificates.crt"
+      - name: "DEFAULT_CA_BUNDLE_PATH"
+        value: "/etc/ssl/certs/ca-certificates.crt"
+      - name: "SSL_CERT_FILE"
+        value: "/etc/ssl/certs/ca-certificates.crt"
+  {{- end }}
+
+nubusUdmListener:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 102
+    runAsGroup: 65534
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUdmListener | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUdmListener }}
+  resources:
+    {{ .Values.resources.umsUdmListener | toYaml | nindent 4 }}
+
+nubusPortalServer:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-portal-server"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalServer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    create: true
+  replicaCount: {{ .Values.replicas.umsPortalServer }}
+  resources:
+    {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-crt-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+          - key: "ca.crt"
+            path: "cacert.pem"
+  extraVolumeMounts:
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/usr/local/lib/python3.7/dist-packages/certifi/cacert.pem"
+      subPath: "cacert.pem"
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/usr/lib/python3/dist-packages/botocore/cacert.pem"
+      subPath: "cacert.pem"
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/usr/lib/python3/dist-packages/certifi/cacert.pem"
+      subPath: "cacert.pem"
+  {{- end }}
+
+nubusLdapNotifier:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 101
+    runAsGroup: 102
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsLdapNotifier | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-ldap-notifier"
+  replicaCount: {{ .Values.replicas.umsLdapNotifier }}
+  resources:
+    {{ .Values.resources.umsLdapNotifier | toYaml | nindent 4 }}
+
+nubusLdapServer:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  highAvailabilityMode: false
+  replicaCountPrimary: 1
+  replicaCountSecondary: 0 # {{ .Values.replicas.umsLdapServerSecondary }}
+  replicaCountProxy: 0 # {{ .Values.replicas.umsLdapServerProxy }}
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-ldap-server"
+  serviceAccount:
+    create: true
+  initResources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
+  resources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
+  persistence:
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.ldapServerData | quote }}
+  extraVolumes:
+    - name: "migration-scripts"
+      secret:
+        secretName: "ums-ldap-server-migration"
+        defaultMode: 0555
+  extraVolumeMounts:
+    - name: "migration-scripts"
+      mountPath: "/entrypoint.d/30-purge.sh"
+      subPath: "30-purge.sh"
+    - name: "migration-scripts"
+      mountPath: "/entrypoint.d/95-slapadd-24-ldiff.sh"
+      subPath: "95-slapadd-24-ldif.sh"
+  extraSecrets:
+    - name: "ums-ldap-server-migration"
+      stringData:
+        30-purge.sh: |
+          #!/usr/bin/env bash
+          me=$(basename "$0")
+          echo "- Running ${me}"
+          if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
+            echo "- Cleaning up /var/lib/univention-ldap."
+            cd /var/lib/univention-ldap
+            rm -rf internal
+            rm -rf ldap
+            ls -l
+          else
+            echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
+          fi
+        95-slapadd-24-ldif.sh: |
+          #!/usr/bin/env bash
+          me=$(basename "$0")
+          echo "- Running ${me}"
+          ls -l /var/lib/univention-ldap
+          if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
+            echo "- slapadd-ing /var/lib/univention-ldap/ldap-24-export.ldif"
+            ls -l /var/lib/univention-ldap/
+            rm -rf /var/lib/univention-ldap/ldap
+            rm -rf /var/lib/univention-ldap/internal
+            echo "- deleted /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
+            ls -l /var/lib/univention-ldap/
+            mkdir /var/lib/univention-ldap/ldap
+            mkdir /var/lib/univention-ldap/internal
+            echo "- created /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
+            ls -l /var/lib/univention-ldap/
+            /usr/sbin/slapadd -v -l /var/lib/univention-ldap/ldap-24-export.ldif
+            echo "- slapadd executed"
+            ls -l /var/lib/univention-ldap/
+            mv /var/lib/univention-ldap/ldap-24-export.ldif /var/lib/univention-ldap/ldap-24-export.ldif-imported
+            echo "- import file renamed"
+            ls -l /var/lib/univention-ldap/
+          else
+            echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
+          fi
+nubusPortalFrontend:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-portal-frontend"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalFrontend | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    create: true
+  replicaCount: {{ .Values.replicas.umsPortalFrontend }}
+  resources:
+    {{ .Values.resources.umsPortalFrontend | toYaml | nindent 4 }}
+  portalFrontend:
+    branding:
+      css: {{ .Values.theme.styles.portalCss | toJson }}
+      # Requires .ico, .svg does not work.
+      favicon: {{ .Values.theme.imagery.faviconIcoB64 | toJson }}
+      # The actual `logo` is set in customizing image, the logo down here is for for waiting spinner.
+      logo: {{ .Values.theme.imagery.portalWaitingSpinnerSvgB64 | toJson }}
+      backgroundImage: {{ .Values.theme.imagery.portalLogoBackgroundSvgB64 | toJson }}
+
+nubusStackDataUms:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsStackDataUms | toYaml | nindent 6 }}
+  pullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-stack-data-ums"
+  resources:
+    {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}
+
+nubusSelfServiceConsumer:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsSelfserviceConsumer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-selfservice-listener"
+  resources:
+    {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsSelfserviceConsumer }}
+
+nubusUdmRestApi:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-udm-rest-api"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUdmRestApi | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    annotations:
+      intended.usage: "compliance"
+  resources:
+    {{ .Values.resources.umsUdmRestApi | toYaml | nindent 4 }}
+  initResources:
+    {{ .Values.resources.umsUdmRestApiInit | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUdmRestApi }}
+
+nubusUmcGateway:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcGateway | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUmcGateway }}
+  resources:
+    {{ .Values.resources.umsUmcGateway | toYaml | nindent 4 }}
+
+nubusKeycloakBootstrap:
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    readOnlyRootFilesystem: false
+    runAsGroup: 1000
+    runAsNonRoot: true
+    runAsUser: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsKeycloakBootstrap | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-keycloak-bootstrap"
+  serviceAccount:
+    annotations:
+      intended.usage: "compliance"
+  resources:
+    {{ .Values.resources.umsKeycloakBootstrap | toYaml | nindent 4 }}
+
+nubusProvisioning:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsProvisioning | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount:
+    dispatcher: {{ .Values.replicas.umsProvisioningDispatcher }}
+    udmTransformer: {{ .Values.replicas.umsProvisioningUdmTransformer }}
+    prefill: {{ .Values.replicas.umsProvisioningPrefill }}
+    api: {{ .Values.replicas.umsProvisioningApi }}
+
+  serviceAccount:
+    create: true
+  nats:
+    config:
+      cluster:
+        replicas: {{ .Values.replicas.umsProvisioningNats }}
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - "ALL"
+      enabled: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      seccompProfile:
+        type: "RuntimeDefault"
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsProvisioningNats | toYaml | nindent 8 }}
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    persistence:
+      size: {{ .Values.persistence.size.nubus.provisioningNats }}
+    resources:
+      {{ .Values.resources.umsProvisioningNats | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-nats"
+    serviceAccount:
+      create: true
+  api:
+    resources:
+      {{ .Values.resources.umsProvisioningApi | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-api"
+  dispatcher:
+    resources:
+      {{ .Values.resources.umsProvisioningDispatcher | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-dispatcher"
+  prefill:
+    resources:
+      {{ .Values.resources.umsProvisioningPrefill | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-prefill"
+  registerConsumers:
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-register-consumers"
+  udmTransformer:
+    resources:
+      {{ .Values.resources.umsProvisioningUdmTransformer | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-udm-transformer"
+  resources:
+    registerConsumers:
+      {{ .Values.resources.umsProvisioningRegisterConsumers | toYaml | nindent 6 }}
--- a/helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl
@@ -0,0 +1,260 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+keycloak:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloak.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloak.repository }}
+    tag: {{ .Values.images.nubusKeycloak.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusKeycloakBootstrap:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakBootstrap.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloakBootstrap.repository }}
+    tag: {{ .Values.images.nubusKeycloakBootstrap.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusKeycloakExtensions:
+    handler:
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionHandler.registry | quote }}
+        repository: {{ .Values.images.nubusKeycloakExtensionHandler.repository }}
+        tag: {{ .Values.images.nubusKeycloakExtensionHandler.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+    proxy:
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionProxy.registry | quote }}
+        repository: {{ .Values.images.nubusKeycloakExtensionProxy.repository }}
+        tag: {{ .Values.images.nubusKeycloakExtensionProxy.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusLdapNotifier:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapNotifier.registry | quote }}
+    repository: {{ .Values.images.nubusLdapNotifier.repository }}
+    tag: {{ .Values.images.nubusLdapNotifier.tag }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusLdapServer:
+  ldapServer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServer.registry | quote }}
+      repository: {{ .Values.images.nubusLdapServer.repository }}
+      tag: {{ .Values.images.nubusLdapServer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  dhInitcontainer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServerDhInitContainer.registry | quote }}
+      repository: {{ .Values.images.nubusLdapServerDhInitContainer.repository }}
+      tag: {{ .Values.images.nubusLdapServerDhInitContainer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusNotificationsApi:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusNotificationsApi.registry | quote }}
+    repository: {{ .Values.images.nubusNotificationsApi.repository }}
+    tag: {{ .Values.images.nubusNotificationsApi.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalFrontend:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalFrontend.registry | quote }}
+    repository: {{ .Values.images.nubusPortalFrontend.repository }}
+    tag: {{ .Values.images.nubusPortalFrontend.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalConsumer:
+  portalConsumer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalConsumer.registry | quote }}
+      repository: {{ .Values.images.nubusPortalConsumer.repository }}
+      tag: {{ .Values.images.nubusPortalConsumer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalServer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalServer.registry | quote }}
+    repository: {{ .Values.images.nubusPortalServer.repository }}
+    tag: {{ .Values.images.nubusPortalServer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusProvisioning:
+  api:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningEventsAndConsumerApi.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
+      tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  dispatcher:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningDispatcher.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningDispatcher.repository }}
+      tag: {{ .Values.images.nubusProvisioningDispatcher.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  udmTransformer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningUdmTransformer.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningUdmTransformer.repository }}
+      tag: {{ .Values.images.nubusProvisioningUdmTransformer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  prefill:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningPrefill.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
+      tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registerConsumers:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  nats:
+    nats:
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNats.registry | quote }}
+        repository: {{ .Values.images.nubusNats.repository }}
+        tag: {{ .Values.images.nubusNats.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    reloader:
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsReloader.registry | quote }}
+        repository: {{ .Values.images.nubusNatsReloader.repository }}
+        tag: {{ .Values.images.nubusNatsReloader.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    natsBox:
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsBox.registry | quote }}
+        repository: {{ .Values.images.nubusNatsBox.repository }}
+        tag: {{ .Values.images.nubusNatsBox.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusProvisioningEventsAndConsumerApi:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningEventsAndConsumerApi.registry | quote }}
+    repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
+    tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusProvisioningPrefill:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningPrefill.registry | quote }}
+    repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
+    tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUdmListener:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningUdmListener.registry | quote }}
+    repository: {{ .Values.images.nubusProvisioningUdmListener.repository }}
+    tag: {{ .Values.images.nubusProvisioningUdmListener.tag }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusSelfServiceConsumer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusSelfServiceConsumer.registry | quote }}
+    repository: {{ .Values.images.nubusSelfServiceConsumer.repository }}
+    tag: {{ .Values.images.nubusSelfServiceConsumer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUdmRestApi:
+  udmRestApi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUdmRestApi.registry | quote }}
+      repository: {{ .Values.images.nubusUdmRestApi.repository }}
+      tag: {{ .Values.images.nubusUdmRestApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUmcGateway:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUmcGateway.registry | quote }}
+    repository: {{ .Values.images.nubusUmcGateway.repository }}
+    tag: {{ .Values.images.nubusUmcGateway.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUmcServer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUmcServer.registry | quote }}
+    repository: {{ .Values.images.nubusUmcServer.repository }}
+    tag: {{ .Values.images.nubusUmcServer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  proxy:
+    image:
+      registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusUmcServerProxy.registry | quote }}
+      repository: {{ .Values.images.nubusUmcServerProxy.repository }}
+      tag: {{ .Values.images.nubusUmcServerProxy.tag }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusWaitForDependency:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+
+nubusGuardian:
+  provisioning:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianProvisioning.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianProvisioning.repository }}
+      tag: {{ .Values.images.nubusGuardianProvisioning.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  authorizationApi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianAuthorizationApi.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianAuthorizationApi.repository }}
+      tag: {{ .Values.images.nubusGuardianAuthorizationApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  managementApi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianManagementApi.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianManagementApi.repository }}
+      tag: {{ .Values.images.nubusGuardianManagementApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  managementUi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianManagementUi.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianManagementUi.repository }}
+      tag: {{ .Values.images.nubusGuardianManagementUi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  openPolicyAgent:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpenPolicyAgent.registry | quote }}
+      repository: {{ .Values.images.nubusOpenPolicyAgent.repository }}
+      tag: {{ .Values.images.nubusOpenPolicyAgent.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusStackDataUms:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusDataLoader.registry | quote }}
+    repository: {{ .Values.images.nubusDataLoader.repository }}
+    tag: {{ .Values.images.nubusDataLoader.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
--- a/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
@@ -11,7 +11,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.opendeskKeycloakBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.opendeskKeycloakBootstrap.registry | quote }}
  repository: {{ .Values.images.opendeskKeycloakBootstrap.repository | quote }}
  tag: {{ .Values.images.opendeskKeycloakBootstrap.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -26,6 +26,9 @@ config:
      {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
    clients:
      {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
+  managed:
+    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
+    clients: [ 'opendesk-intercom', 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
  keycloak:
    adminUser: "kcadmin"
    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
@@ -39,8 +42,7 @@ config:
    # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
    # to LDAP group membership to ensure a user cannot access an application without the required
    # group membership.
-    # ToDo:
-    # - Jitsi does currently not care if it gets scopes/claims as long as the user is authenticated.
+    # ToDo: Ensure all applications verify the token's signature to ensure it is not tampered.
    clientScopes:
      - name: "read_contacts"
        protocol: "openid-connect"
@@ -386,60 +388,6 @@ config:
          backchannel.logout.session.required: false
        defaultClientScopes:
          - "opendesk-dovecot-scope"
-      - name: "opendesk-intercom"
-        clientId: "opendesk-intercom"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/callback"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.revoke.offline.tokens: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
-        protocolMappers:
-          - name: "intercom-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "opendesk-intercom"
-              id.token.claim: false
-              access.token.claim: true
-          # temporary additional claim while entryuuid is a hardcoded attribute in IntercomService and we cannot set
-          # it to `opendesk_useruuid` standard claim. For reference:
-          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/app.js#L89
-          - name: "entryuuid_temp"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "entryUUID"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "entryuuid"
-              jsonType.label: "String"
-          # temporary additional claim while phoenixusername is a hardcoded attribute in IntercomService and we cannot
-          # set it to `opendesk_username` standard claim. For reference:
-          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/routes/navigation.js#L27
-          - name: "phoenixusername_temp"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "phoenixusername"
-              jsonType.label: "String"
-        defaultClientScopes:
-          - "offline_access"
      - name: "opendesk-jitsi"
        clientId: "opendesk-jitsi"
        protocol: "openid-connect"
@@ -461,7 +409,7 @@ config:
        redirectUris:
          - "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*"
          - "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        standardFlowEnabled: true
        directAccessGrantsEnabled: true
        serviceAccountsEnabled: true
@@ -472,25 +420,9 @@ config:
        attributes:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-matrix-scope"
-      # The following is a temporary OIDC client for matrix, as the OIDC logout still uses "matrix" as client ID.
-      # Unless that is solved and also is able to use "opendesk-matrix" we keep that dummy client that
-      - name: "matrix"
-        clientId: "matrix"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        standardFlowEnabled: true
-        directAccessGrantsEnabled: true
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
-        defaultClientScopes: []
-        optionalClientScopes: []
      - name: "opendesk-nextcloud"
        clientId: "opendesk-nextcloud"
        protocol: "openid-connect"
@@ -498,15 +430,15 @@ config:
        secret: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
        authorizationServicesEnabled: false
        attributes:
          backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/index.php/apps/user_oidc/backchannel-logout/opendesk"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/user_oidc/backchannel-logout/opendesk"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-nextcloud-scope"
          - "read_contacts"
@@ -518,7 +450,7 @@ config:
        secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
@@ -527,7 +459,7 @@ config:
        attributes:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-openproject-scope"
      - name: "opendesk-oxappsuite"
@@ -537,7 +469,7 @@ config:
        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
@@ -545,7 +477,7 @@ config:
        attributes:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-oxappsuite-scope"
          - "read_contacts"
@@ -557,7 +489,7 @@ config:
        secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
@@ -565,299 +497,9 @@ config:
        attributes:
          backchannel.logout.session.required: false
          backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/oidc/authenticator/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-xwiki-scope"
-      - name: "guardian-management-api"
-        clientId: "guardian-management-api"
-        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        protocol: "openid-connect"
-        publicClient: false
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
-        fullScopeAllowed: true
-        standardFlowEnabled: true
-        implicitFlowEnabled: false
-        directAccessGrantsEnabled: false
-        serviceAccountsEnabled: true
-        protocolMappers:
-          - name: "Client Host"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usersessionmodel-note-mapper"
-            consentRequired: false
-            config:
-              user.session.note: "clientHost"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "clientHost"
-              jsonType.label: "String"
-          - name: "Client ID"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usersessionmodel-note-mapper"
-            consentRequired: false
-            config:
-              user.session.note: "client_id"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "client_id"
-              jsonType.label: "String"
-          - name: "guardian-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              userinfo.token.claim: false
-              id.token.claim: false
-              access.token.claim: true
-          - name: "audiencemap"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian-cli"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-          - name: "dn"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: false
-              user.attribute: "LDAP_ENTRY_DN"
-              id.token.claim: false
-              access.token.claim: true
-              claim.name: "dn"
-              jsonType.label: "String"
-          - name: "username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "username"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "preferred_username"
-              jsonType.label: "String"
-          - name: "uid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "uid"
-              jsonType.label: "String"
-          - name: "email"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "email"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "email"
-              jsonType.label: "String"
-          - name: "Client IP Address"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usersessionmodel-note-mapper"
-            consentRequired: false
-            config:
-              user.session.note: "clientAddress"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "clientAddress"
-              jsonType.label: "String"
-      - name: "guardian-scripts"
-        clientId: "guardian-scripts"
-        description: ""
-        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        adminUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        surrogateAuthRequired: false
-        enabled: true
-        alwaysDisplayInConsole: false
-        clientAuthenticatorType: "client-secret"
-        redirectUris:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
-        webOrigins:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        bearerOnly: false
-        consentRequired: false
-        standardFlowEnabled: true
-        implicitFlowEnabled: false
-        directAccessGrantsEnabled: true
-        serviceAccountsEnabled: false
-        publicClient: true
-        frontchannelLogout: false
-        protocol: "openid-connect"
-        fullScopeAllowed: true
-        protocolMappers:
-          - name: "email"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "email"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "email"
-              jsonType.label: "String"
-          - name: "guardian-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              id.token.claim: false
-              access.token.claim: true
-              userinfo.token.claim: false
-          - name: "username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "username"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "preferred_username"
-              jsonType.label: "String"
-          - name: "uid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "uid"
-              jsonType.label: "String"
-          - name: "audiencemap"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian-scripts"
-              id.token.claim: true
-              access.token.claim: true
-              userinfo.token.claim: true
-          - name: "dn"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              aggregate.attrs: false
-              multivalued: false
-              userinfo.token.claim: false
-              user.attribute: "LDAP_ENTRY_DN"
-              id.token.claim: false
-              access.token.claim: true
-              claim.name: "dn"
-              jsonType.label: "String"
-        defaultClientScopes:
-          - "web-origins"
-          - "acr"
-          - "roles"
-          - "profile"
-          - "email"
-        optionalClientScopes:
-          - "address"
-          - "phone"
-          - "offline_access"
-          - "microprofile-jwt"
-      - name: "guardian-ui"
-        clientId: "guardian-ui"
-        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        clientAuthenticatorType: "client-secret"
-        redirectUris:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
-        standardFlowEnabled: true
-        publicClient: true
-        implicitFlowEnabled: false
-        directAccessGrantsEnabled: false
-        serviceAccountsEnabled: false
-        protocol: "openid-connect"
-        fullScopeAllowed: true
-        protocolMappers:
-          - name: "uid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "uid"
-              jsonType.label: "String"
-          - name: "username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "username"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "preferred_username"
-              jsonType.label: "String"
-          - name: "dn"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: "false"
-              user.attribute: "LDAP_ENTRY_DN"
-              id.token.claim: false
-              access.token.claim: true
-              claim.name: "dn"
-              jsonType.label: "String"
-          - name: "audiencemap"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              id.token.claim: true
-              access.token.claim: true
-              userinfo.token.claim: true
-          - name: "email"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "email"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "email"
-              jsonType.label: "String"
-          - name: "guardian-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              id.token.claim: false
-              access.token.claim: true
-              userinfo.token.claim: false

 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -875,6 +517,10 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.opendeskKeycloakBootstrap | toYaml | nindent 4 }}

+additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
+    argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
+
 podAnnotations:
  intents.otterize.com/service-name: "ums-keycloak-bootstrap"

@@ -886,4 +532,18 @@ podSecurityContext:
 resources:
  {{ .Values.resources.opendeskKeycloakBootstrap | toYaml | nindent 2 }}

+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 ...
--- a/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/\
-      {{ .Values.charts.dovecot.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"

  # Open-Xchange
  - name: "open-xchange-repo"
@@ -20,8 +19,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/\
-      {{ .Values.charts.openXchangeAppSuite.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"

  # openDesk Open-Xchange Bootstrap
  # Source:
@@ -32,8 +30,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
-      {{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/{{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
+
+  # OX Connector
+  - name: "ox-connector-repo"
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"

 releases:
  - name: "dovecot"
@@ -41,6 +45,7 @@ releases:
    version: "{{ .Values.charts.dovecot.version }}"
    values:
      - "values-dovecot.yaml.gotmpl"
+      - {{ .Values.customization.release.dovecot | default "additionalValues: false" }}
    installed: {{ .Values.dovecot.enabled }}
    timeout: 900

@@ -50,6 +55,7 @@ releases:
    values:
      - "values-openxchange.yaml.gotmpl"
      - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
+      - {{ .Values.customization.release.openXchange | default "additionalValues: false" }}
    installed: {{ .Values.oxAppsuite.enabled }}
    timeout: 900

@@ -58,9 +64,20 @@ releases:
    version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
    values:
      - "values-openxchange-bootstrap.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskOpenXchangeBootstrap | default "additionalValues: false" }}
    installed: {{ .Values.oxAppsuite.enabled }}
    timeout: 900

+  - name: "ox-connector"
+    chart: "ox-connector-repo/{{ .Values.charts.oxConnector.name }}"
+    version: "{{ .Values.charts.oxConnector.version }}"
+    values:
+      - "values-oxconnector.yaml.gotmpl"
+      - {{ .Values.customization.release.oxConnector | default "additionalValues: false" }}
+    installed: {{ .Values.oxAppsuite.enabled }}
+    needs:
+      - "open-xchange"
+
 commonLabels:
  deploy-stage: "component-1"
  component: "open-xchange"
--- a/helmfile/apps/open-xchange/helmfile.yaml
+++ b/helmfile/apps/open-xchange/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/open-xchange/helmfile.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -1,29 +1,31 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.dovecot.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.dovecot.registry | quote }}
  repository: {{ .Values.images.dovecot.repository | quote }}
  tag: {{ .Values.images.dovecot.tag | quote }}
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . | quote }}
-{{- end }}
+  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}

 dovecot:
  mailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  password: {{ .Values.secrets.dovecot.doveadm | quote }}
+  migration:
+    enabled: {{ .Values.functional.migration.oxAppsuite.enabled }}
+    masterPassword: {{ .Values.secrets.oxAppsuite.migrationsMasterPassword | quote }}
  ldap:
    enabled: true
    host: {{ .Values.ldap.host | quote }}
    port: 389
    base: "dc=swp-ldap,dc=internal"
    dn: "uid=ldapsearch_dovecot,cn=users,dc=swp-ldap,dc=internal"
-    password: {{ .Values.secrets.univentionManagementStack.ldapSearch.dovecot | quote }}
+    password: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
  oidc:
    enabled: true
    clientID: "opendesk-dovecot"
@@ -36,7 +38,7 @@ dovecot:
  submission:
    enabled: true
    ssl: "no"
-    host: "postfix:25"
+    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"

 certificate:
  secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -67,6 +69,23 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.dovecot | toYaml | nindent 4 }}

+
+podAnnotations: {}
+
+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 podSecurityContext:
  enabled: true
  fsGroup: 1000
--- a/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,14 +8,30 @@ cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}

+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.openxchangeBootstrap | toYaml | nindent 4 }}
+
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.openxchangeBootstrap.registry | quote }}
  url: {{ .Values.images.openxchangeBootstrap.repository | quote }}
  tag: {{ .Values.images.openxchangeBootstrap.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . | quote }}
-{{- end }}
+  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
+
+additionalAnnotations:
+  argocd.argoproj.io/hook: "Sync"
+  argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
 ...
--- a/helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 appsuite:
  core-mw:
@@ -23,7 +26,7 @@ appsuite:
            type: "adminDN"
            adminDN:
              dn: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
-              password: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
+              password: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}

    uiSettings:
      # Enterprise contact picker
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -19,13 +20,16 @@ global:

 nextcloud-integration-ui:
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeNextcloudIntegrationUI.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeNextcloudIntegrationUI.registry | quote }}
    repository: {{ .Values.images.openxchangeNextcloudIntegrationUI.repository | quote }}
    tag: {{ .Values.images.openxchangeNextcloudIntegrationUI.tag | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
    - name: {{ . | quote }}
  {{- end }}
+  podAnnotations: {}
+  replicaCount: {{ .Values.replicas.openxchangeNextcloudIntegrationUI }}
  resources:
    {{ .Values.resources.openxchangeNextcloudIntegrationUI | toYaml | nindent 4 }}
  securityContext:
@@ -43,17 +47,22 @@ nextcloud-integration-ui:
      type: "RuntimeDefault"
    seLinuxOptions:
      {{ .Values.seLinuxOptions.openxchangeNextcloudIntegrationUI | toYaml | nindent 6 }}
+  serviceAccount:
+    create: false

 public-sector-ui:
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangePublicSectorUI.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangePublicSectorUI.registry | quote }}
    repository: {{ .Values.images.openxchangePublicSectorUI.repository | quote }}
    tag: {{ .Values.images.openxchangePublicSectorUI.tag | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
    - name: {{ . | quote }}
  {{- end }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  replicaCount: {{ .Values.replicas.openxchangePublicSectorUI }}
+  podAnnotations: {}
  resources:
    {{ .Values.resources.openxchangePublicSectorUI | toYaml | nindent 4 }}
  securityContext:
@@ -71,6 +80,8 @@ public-sector-ui:
      type: "RuntimeDefault"
    seLinuxOptions:
      {{ .Values.seLinuxOptions.openxchangePublicSectorUI | toYaml | nindent 6 }}
+  serviceAccount:
+    create: false

 appsuite:
  appsuite-toolkit:
@@ -116,6 +127,7 @@ appsuite:
    jolokiaLogin: "jolokia"
    jolokiaPassword: {{ .Values.secrets.oxAppsuite.jolokiaPassword | quote }}
    hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
+    podAnnotations: {}
    serviceAccount:
      create: true
    features:
@@ -131,9 +143,11 @@ appsuite:
        - name: {{ . | quote }}
      {{- end }}
      image:
-        repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGotenberg.registry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
+        repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeGotenberg.registry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
        tag: {{ .Values.images.openxchangeGotenberg.tag | quote }}
        pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+      replicaCount: {{ .Values.replicas.openxchangeGotenberg }}
+      podAnnotations: {}
      resources:
        {{ .Values.resources.openxchangeGotenberg | toYaml | nindent 8 }}
      securityContext:
@@ -151,6 +165,8 @@ appsuite:
          type: "RuntimeDefault"
        seLinuxOptions:
          {{ .Values.seLinuxOptions.openxchangeGotenberg | toYaml | nindent 10 }}
+      serviceAccount:
+        create: false
    hooks:
      beforeAppsuiteStart:
        create-guard-dir.sh: |
@@ -158,9 +174,21 @@ appsuite:
          chown open-xchange:open-xchange /opt/open-xchange/guard-files
    packages:
      status:
+        {{- if .Values.functional.migration.oxAppsuite.enabled }}
+        open-xchange-authentication-masterpassword: "enabled"
+        open-xchange-authentication-ldap: "disabled"
+        open-xchange-authentication-oauth: "disabled"
+        open-xchange-oidc: "disabled"
+        {{- else }}
        open-xchange-oidc: "enabled"
        open-xchange-authentication-database: "disabled"
        open-xchange-authentication-oauth: "enabled"
+        open-xchange-authentication-ldap: "disabled"
+        {{- end }}
+        # OX Documents (office-web) is not used in openDesk
+        open-xchange-documents-backend: "disabled"
+        open-xchange-documents-monitoring: "disabled"
+        open-xchange-documents-templates: "disabled"
    properties:
      com.openexchange.UIWebPath: "/appsuite/"
      com.openexchange.showAdmin: "false"
@@ -185,7 +213,7 @@ appsuite:
      com.openexchange.oidc.opLogoutEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
      com.openexchange.oidc.opTokenEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
      com.openexchange.oidc.rpRedirectURIAuth: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/appsuite/api/oidc/auth"
-      com.openexchange.oidc.rpRedirectURILogout: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+      com.openexchange.oidc.rpRedirectURILogout: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
      com.openexchange.oidc.rpRedirectURIPostSSOLogout: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/appsuite/api/oidc/logout"
      com.openexchange.oidc.ssoLogout: "true"
      com.openexchange.oidc.startDefaultBackend: "true"
@@ -211,6 +239,9 @@ appsuite:
      com.openexchange.mail.transport.authType: "xoauth2"
      com.openexchange.mail.transportServer: "postfix"
      com.openexchange.mail.transportServerSource: "global"
+      # Requirements for OX-Connector
+      com.openexchange.user.enforceUniqueDisplayName: "false"
+      com.openexchange.folderstorage.database.preferDisplayName: "false"
      # Mailfilter
      com.openexchange.mail.filter.loginType: "global"
      com.openexchange.mail.filter.credentialSource: "mail"
@@ -238,9 +269,14 @@ appsuite:
      com.openexchange.mail.secondary.authType: "XOAUTH2"
      com.openexchange.mail.transport.secondary.authType: "xoauth2"
      # Nextcloud integration
-      com.openexchange.file.storage.nextcloud.oauth.url: "http://opendesk-nextcloud-apache2/"
+      com.openexchange.file.storage.nextcloud.oauth.url: "http://opendesk-nextcloud-aio/"
      com.openexchange.file.storage.nextcloud.oauth.webdav.username.strategy: "user"
      com.openexchange.nextcloud.filepicker.includeAccessToken: "false"
+      # Element integration
+      com.openexchange.conference.element.enabled: "true"
+      com.openexchange.conference.element.meetingHostUrl: http://matrix-neodatefix-bot
+      com.openexchange.conference.element.matrixLoginUrl: http://opendesk-synapse-web:8008/_matrix/client/v3/login
+      com.openexchange.conference.element.matrixUuidClaimName: opendesk_useruuid
      # GDPR
      com.openexchange.gdpr.dataexport.enabled: "false"
      com.openexchange.gdpr.dataexport.active: "false"
@@ -255,11 +291,38 @@ appsuite:
      com.openexchange.smime.test: "true"
      # Other
      com.openexchange.secret.secretSource: "\"<user-id> + '@' + <context-id> + '/' + <random>\""
+      {{- if .Values.certificate.selfSigned }}
+      # Selfsigned
+      com.openexchange.net.ssl.default.truststore.enabled: "false"
+      com.openexchange.net.ssl.custom.truststore.enabled: "true"
+      com.openexchange.net.ssl.custom.truststore.path: "/etc/ssl/certs/truststore.jks"
+      com.openexchange.net.ssl.custom.truststore.password: {{ .Values.secrets.certificates.password | quote }}
+      {{- end }}
+    {{- if .Values.certificate.selfSigned }}
+    extraEnv:
+    - name: "JAVA_OPTS_APPEND"
+      value: {{ printf "%s %s=%s" "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks -Djavax.net.ssl.trustStoreType=jks" "-Djavax.net.ssl.trustStorePassword" (.Values.secrets.certificates.password | quote) | quote }}
+    extraVolumes:
+      - name: "trusted-cert-secret-volume"
+        secret:
+          secretName: "opendesk-certificates-ca-tls"
+          items:
+            - key: "truststore.jks"
+              path: "truststore.jks"
+            - key: "ca.crt"
+              path: "ca-certificates.crt"
+    extraMounts:
+      - name: "trusted-cert-secret-volume"
+        mountPath: "/etc/ssl/certs/"
+    {{- end }}
    secretProperties:
      com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
      com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
      com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
+      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
    propertiesFiles:
+      /opt/open-xchange/etc/masterpassword-authentication.properties:
+        com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppsuite.migrationsMasterPassword | quote }}
      /opt/open-xchange/etc/AdminDaemon.properties:
        MASTER_ACCOUNT_OVERRIDE: "true"
      /opt/open-xchange/etc/AdminUser.properties:
@@ -269,7 +332,7 @@ appsuite:
      /opt/open-xchange/etc/ldapauth.properties:
        java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/dc=swp-ldap,dc=internal"
        bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
-        bindDNPassword: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
+        bindDNPassword: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}
        bindOnly: "false"
      /opt/open-xchange/etc/antivirus.properties:
        com.openexchange.antivirus.enabled: "true"
@@ -311,7 +374,7 @@ appsuite:
      # io.ox/mail//contactCollectOnMailAccess: "true"
      # Dynamic theme
      io.ox/dynamic-theme//mainColor: {{ .Values.theme.colors.primary | quote }}
-      io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
+      io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
      io.ox/dynamic-theme//topbarBackground: {{ .Values.theme.colors.white | quote }}
      io.ox/dynamic-theme//topbarColor: {{ .Values.theme.colors.black | quote }}
      io.ox/dynamic-theme//listSelected: {{ .Values.theme.colors.primary15 | quote }}
@@ -326,15 +389,16 @@ appsuite:
      oxguardpass: |
        {{ .Values.secrets.oxAppsuite.oxguardMC }}
        {{ .Values.secrets.oxAppsuite.oxguardRC }}
-    redis:
+    redis: &redisConfiguration
      enabled: true
      mode: "standalone"
      hosts:
-        - "redis-master"
+        - "redis-master:6379"
      auth:
+        enabled: true
        password: {{ .Values.secrets.redis.password | quote }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreMW.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreMW.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -349,8 +413,12 @@ appsuite:
    {{- range .Values.global.imagePullSecrets }}
      - name: {{ . | quote }}
    {{- end }}
+    replicas: {{ .Values.replicas.openxchangeCoreMW }}
    resources:
      {{ .Values.resources.openxchangeCoreMW | toYaml | nindent 6 }}
+    initContainer:
+      resources:
+        {{ .Values.resources.openxchangeCoreMW | toYaml | nindent 8 }}

  core-ui:
    enabled: true
@@ -359,10 +427,12 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUI.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreUI.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreUI.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreUI.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    replicaCount: {{ .Values.replicas.openxchangeCoreUI }}
+    podAnnotations: {}
    resources:
      {{ .Values.resources.openxchangeCoreUI | toYaml | nindent 6 }}
    securityContext:
@@ -379,6 +449,8 @@ appsuite:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.openxchangeCoreUI | toYaml | nindent 8 }}
+    serviceAccount:
+      create: false

  core-ui-middleware:
    enabled: true
@@ -391,20 +463,14 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUIMiddleware.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreUIMiddleware.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreUIMiddleware.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    overrides: {}
-    redis:
-      mode: "standalone"
-      hosts:
-        - "redis-master:6379"
-      auth:
-        enabled: true
-        password: {{ .Values.secrets.redis.password | quote }}
-        # Workaround for a bug in 8.23
-        ca: ""
+    podAnnotations: {}
+    redis: *redisConfiguration
+    replicaCount: {{ .Values.replicas.openxchangeCoreUIMiddleware }}
    resources:
      {{ .Values.resources.openxchangeCoreUIMiddleware | toYaml | nindent 6 }}
    updater:
@@ -424,6 +490,9 @@ appsuite:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.openxchangeCoreUIMiddleware | toYaml | nindent 8 }}
+    serviceAccount:
+      create: false
+
  core-cacheservice:
    enabled: false

@@ -438,9 +507,13 @@ appsuite:
        remoteCache:
          enabled: false
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeDocumentConverter.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeDocumentConverter.registry | quote }}
      repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
      tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    podAnnotations: {}
+    redis: *redisConfiguration
+    replicaCount: {{ .Values.replicas.openxchangeCoreDocumentConverter }}
    resources:
      {{- .Values.resources.openxchangeCoreDocumentConverter | toYaml | nindent 6 }}
    securityContext:
@@ -459,6 +532,8 @@ appsuite:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.openxchangeDocumentConverter | toYaml | nindent 8 }}
+    serviceAccount:
+      create: false

  core-documents-collaboration:
    enabled: false
@@ -482,10 +557,12 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreGuidedtours.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreGuidedtours.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreGuidedtours.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreGuidedtours.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    podAnnotations: {}
+    replicaCount: {{ .Values.replicas.openxchangeCoreGuidedtours }}
    resources:
      {{- .Values.resources.openxchangeCoreGuidedtours | toYaml | nindent 6 }}
    securityContext:
@@ -502,6 +579,8 @@ appsuite:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.openxchangeCoreGuidedtours | toYaml | nindent 8 }}
+    serviceAccount:
+      create: false

  core-imageconverter:
    enabled: true
@@ -510,15 +589,19 @@ appsuite:
    basicAuthLogin: "oxlogin"
    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeImageConverter.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeImageConverter.registry | quote }}
      repository: {{ .Values.images.openxchangeImageConverter.repository | quote }}
      tag: {{ .Values.images.openxchangeImageConverter.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    objectCache:
      s3ObjectStores:
        - id: -1
          endpoint: "."
          accessKey: "."
          secretKey: "."
+    podAnnotations: {}
+    redis: *redisConfiguration
+    replicaCount: {{ .Values.replicas.openxchangeCoreImageConverter }}
    resources:
      {{- .Values.resources.openxchangeCoreImageConverter | toYaml | nindent 6 }}
    securityContext:
@@ -537,6 +620,8 @@ appsuite:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.openxchangeImageConverter | toYaml | nindent 8 }}
+    serviceAccount:
+      create: false

  guard-ui:
    enabled: true
@@ -545,9 +630,12 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGuardUI.registry }}/{{ .Values.images.openxchangeGuardUI.repository }}"
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeGuardUI.registry | quote }}
+      repository: {{ .Values.images.openxchangeGuardUI.repository | quote }}
      tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    podAnnotations: {}
+    replicaCount: {{ .Values.replicas.openxchangeGuardUI }}
    resources:
      {{- .Values.resources.openxchangeGuardUI | toYaml | nindent 6 }}
    securityContext:
@@ -564,13 +652,15 @@ appsuite:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.openxchangeGuardUI | toYaml | nindent 8 }}
+    serviceAccount:
+      create: false
  core-spellcheck:
    enabled: false

  core-user-guide:
    enabled: true
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUserGuide.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreUserGuide.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreUserGuide.repository | quote }}
      tag: {{ .Values.images.openxchangeCoreUserGuide.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -578,6 +668,8 @@ appsuite:
    {{- range .Values.global.imagePullSecrets }}
      - name: {{ . | quote }}
    {{- end }}
+    podAnnotations: {}
+    replicaCount: {{ .Values.replicas.openxchangeCoreUserGuide }}
    resources:
      {{- .Values.resources.openxchangeCoreUserGuide | toYaml | nindent 6 }}
    securityContext:
@@ -594,4 +686,6 @@ appsuite:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.openxchangeCoreUserGuide | toYaml | nindent 8 }}
+    serviceAccount:
+      create: false
 ...
--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -1,12 +1,39 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.oxConnector.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.oxConnector.registry | quote }}
  repository: {{ .Values.images.oxConnector.repository | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  tag: {{ .Values.images.oxConnector.tag | quote }}

+  waitForDependency:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+    pullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . | quote }}
+    {{- end }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag | quote }}
+
 imagePullSecrets:
 {{- range .Values.global.imagePullSecrets }}
  - name: {{ . | quote }}
@@ -16,16 +43,8 @@ ingress:
  enabled: false

 oxConnector:
-  caCert: "ucctempldapstring"
-  debugLevel: {{ if .Values.debug.enabled }}"4"{{ else }}"1"{{ end }}
  domainName: {{ .Values.global.domain | quote }}
-  ldapHost: {{ .Values.ldap.host | quote }}
-  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
-  ldapPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
-  ldapBaseDn: "dc=swp-ldap,dc=internal"
-  ldapHostDn: "cn=admin,dc=swp-ldap,dc=internal"
-  tlsMode: "off"
-  notifierServer: {{ .Values.ldap.notifierHost | quote }}
+  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
  oxDefaultContext: "1"
  oxImapServer: "imap://127.0.0.1:143"
  oxLocalTimezone: "Europe/Berlin"
@@ -35,12 +54,21 @@ oxConnector:
  oxSmtpServer: "smtp://127.0.0.1:587"
  oxSoapServer: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"

+provisioningApi:
+  connection:
+    baseUrl: "http://ums-provisioning-api"
+  auth:
+    username: "ox-connector"
+    password: {{ .Values.secrets.oxConnector.provisioningApiPassword | quote }}
+
 resources:
  {{ .Values.resources.oxConnector | toYaml | nindent 2 }}

 persistence:
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

+podAnnotations: {}
+
 ## Container deployment probes
 probes:
  liveness:
@@ -76,7 +104,6 @@ securityContext:
      - "SETUID"
      - "SETPCAP"
      - "NET_BIND_SERVICE"
-      - "NET_RAW"
      - "SYS_CHROOT"
  privileged: false
  seccompProfile:
--- a/helmfile/apps/openproject-bootstrap/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject-bootstrap/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/\
-      {{ .Values.charts.openprojectBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"

 releases:
  - name: "opendesk-openproject-bootstrap"
@@ -21,6 +20,7 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskOpenprojectBootstrap | default "additionalValues: false" }}
    installed: {{ .Values.openproject.enabled }}
    timeout: 900

--- a/helmfile/apps/openproject-bootstrap/helmfile.yaml
+++ b/helmfile/apps/openproject-bootstrap/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/openproject-bootstrap/helmfile.yaml.gotmpl
+++ b/helmfile/apps/openproject-bootstrap/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/openproject-bootstrap/values.yaml.gotmpl
+++ b/helmfile/apps/openproject-bootstrap/values.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -15,6 +16,8 @@ cleanup:
  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}

 config:
+  debug:
+    enabled: {{ .Values.debug.enabled }}
  openproject:
    fileshareName: "Nextcloud at {{ .Values.global.domain }}"
    admin:
@@ -41,8 +44,22 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.openprojectBootstrap | toYaml | nindent 4 }}

+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openprojectBootstrap.registry | quote }}
  repository: {{ .Values.images.openprojectBootstrap.repository | quote }}
  tag: {{ .Values.images.openprojectBootstrap.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy |quote }}
--- a/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/\
-      {{ .Values.charts.openproject.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"

 releases:
  - name: "openproject"
@@ -21,8 +20,9 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.openproject | default "additionalValues: false" }}
    installed: {{ .Values.openproject.enabled }}
-    timeout: 900
+    timeout: 1800

 commonLabels:
  deploy-stage: "component-1"
--- a/helmfile/apps/openproject/helmfile.yaml
+++ b/helmfile/apps/openproject/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/openproject/helmfile.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,6 +8,10 @@ global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

+appInit:
+  resources:
+    {{ .Values.resources.openprojectAppInit | toYaml | nindent 4 }}
+
 containerSecurityContext:
  enabled: true
  privileged: false
@@ -23,6 +28,15 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.openproject | toYaml | nindent 4 }}

+dbInit:
+  image:
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.openprojectDbInit.registry | quote }}
+    repository: {{ .Values.images.openprojectDbInit.repository | quote }}
+    tag: {{ .Values.images.openprojectDbInit.tag | quote }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  resources:
+    {{ .Values.resources.openprojectDbInit | toYaml | nindent 4 }}
+
 environment:
 # For more details and more options see
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
@@ -31,13 +45,12 @@ environment:
  OPENPROJECT_USER__DEFAULT__TIMEZONE: "Europe/Berlin"
  OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
  OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"
-  OPENPROJECT_PER__PAGE__OPTIONS: "20, 50, 100, 200"
  OPENPROJECT_EMAIL__DELIVERY__METHOD: "smtp"
  OPENPROJECT_DEFAULT__COMMENT__SORT__ORDER: "desc"
  # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
  OPENPROJECT_SEED_LDAP_OPENDESK_HOST: {{ .Values.ldap.host | quote }}
  OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
-  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.univentionManagementStack.ldapSearch.openproject | quote }}
+  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.nubus.ldapSearch.openproject | quote }}
  OPENPROJECT_SEED_LDAP_OPENDESK_SECURITY: "plain_ldap"
  OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,dc=swp-ldap,dc=internal"
  OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "dc=swp-ldap,dc=internal"
@@ -57,37 +70,47 @@ environment:
  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_USER: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
  OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
  OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
-  OPENPROJECT_SMTP__USER__NAME: {{ .Values.smtp.username | quote }}
-  OPENPROJECT_SMTP__PASSWORD: {{ .Values.smtp.password | quote }}
-  OPENPROJECT_SMTP__PORT: {{ .Values.smtp.port | quote }}
+  OPENPROJECT_SMTP__USER__NAME: ""
+  OPENPROJECT_SMTP__PASSWORD: ""
+  OPENPROJECT_SMTP__PORT: 25
  OPENPROJECT_SMTP__SSL: "false" # (default=false)
-  OPENPROJECT_SMTP__ADDRESS: {{ .Values.smtp.host | quote }}
-  OPENPROJECT_SMTP__AUTHENTICATION: "plain"
-  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
-  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
-  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
-  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
+  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  OPENPROJECT_SMTP__AUTHENTICATION: "none"
+  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "false"
+  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "none"
+  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.nubus .Values.global.domain | quote }}
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
  {{- if .Values.enterprise.openproject.token }}
  OPENPROJECT_ENTERPRISE__TOKEN: {{ .Values.enterprise.openproject.token | quote }}
  {{- end }}
+  {{- if .Values.certificate.selfSigned }}
+  SSL_CERT_FILE: "/etc/ssl/certs/ca-certificates.crt"
+  {{- end }}
+
+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}

 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.openproject.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openproject.registry | quote }}
  repository: {{ .Values.images.openproject.repository | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  tag: {{ .Values.images.openproject.tag | quote }}

-initdb:
-  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectInitDb.registry | quote }}
-    repository: {{ .Values.images.openprojectInitDb.repository | quote }}
-    tag: {{ .Values.images.openprojectInitDb.tag | quote }}
-    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-
 memcached:
  bundled: false
  connection:
@@ -97,6 +120,8 @@ memcached:
 persistence:
  enabled: false

+podAnnotations: {}
+
 postgresql:
  bundled: false
  auth:
@@ -180,5 +205,14 @@ s3:
 seederJob:
  annotations:
    intents.otterize.com/service-name: "openproject-seeder"
+    argocd.argoproj.io/hook: "Sync"
+    argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
+  resources:
+    {{ .Values.resources.openprojectSeederJob | toYaml | nindent 4 }}
+
+workers:
+  default:
+    resources:
+      {{ .Values.resources.openprojectWorkers | toYaml | nindent 6 }}

 ...
--- a/helmfile/apps/provisioning/helmfile-child.yaml
+++ b/helmfile/apps/provisioning/helmfile-child.yaml
@@ -1,24 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
---
-repositories:
-  # OX Connector
-  - name: "ox-connector-repo"
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/\
-      {{ .Values.charts.oxConnector.repository }}"
-
-releases:
-  - name: "ox-connector"
-    chart: "ox-connector-repo/{{ .Values.charts.oxConnector.name }}"
-    version: "{{ .Values.charts.oxConnector.version }}"
-    values:
-      - "values-oxconnector.yaml.gotmpl"
-    installed: {{ .Values.oxConnector.enabled }}
-
-commonLabels:
-  deploy-stage: "component-2"
-  component: "provisioning"
-...
--- a/helmfile/apps/provisioning/helmfile.yaml
+++ b/helmfile/apps/provisioning/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/services/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/services/helmfile-child.yaml.gotmpl
@@ -10,8 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/\
-      {{ .Values.charts.otterize.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"

  # openDesk Home
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
@@ -21,8 +20,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/\
-      {{ .Values.charts.home.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"

  # openDesk Certificates
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
@@ -32,8 +30,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/\
-      {{ .Values.charts.certificates.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"

  # openDesk PostgreSQL
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postgresql
@@ -43,8 +40,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/\
-      {{ .Values.charts.postgresql.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"

  # openDesk MariaDB
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
@@ -54,8 +50,17 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/\
-      {{ .Values.charts.mariadb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
+
+  # openDesk dkimpy-milter
+  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter
+  - name: "dkimpy-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.dkimpy.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"

  # openDesk Postfix
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
@@ -65,8 +70,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/\
-      {{ .Values.charts.postfix.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"

  # openDesk ClamAV
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
@@ -76,16 +80,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/\
-      {{ .Values.charts.clamav.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
  - name: "clamav-simple-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.clamavSimple.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/\
-      {{ .Values.charts.clamavSimple.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"

  # VMWare Bitnami
  # Source: https://github.com/bitnami/charts/
@@ -95,24 +97,21 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/\
-      {{ .Values.charts.memcached.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
  - name: "redis-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.redis.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/\
-      {{ .Values.charts.redis.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
  - name: "minio-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.minio.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/\
-      {{ .Values.charts.minio.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"

 releases:
  - name: "opendesk-otterize"
@@ -120,6 +119,7 @@ releases:
    version: "{{ .Values.charts.otterize.version }}"
    values:
      - "values-otterize.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskOtterize | default "additionalValues: false" }}
    installed: {{ .Values.security.otterizeIntents.enabled }}
    timeout: 900

@@ -128,6 +128,7 @@ releases:
    version: "{{ .Values.charts.home.version }}"
    values:
      - "values-home.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskHome | default "additionalValues: false" }}
    installed: {{ .Values.home.enabled }}

  - name: "opendesk-certificates"
@@ -135,6 +136,7 @@ releases:
    version: "{{ .Values.charts.certificates.version }}"
    values:
      - "values-certificates.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskCertificates | default "additionalValues: false" }}
    installed: {{ .Values.certificates.enabled }}
    timeout: 900

@@ -143,6 +145,7 @@ releases:
    version: "{{ .Values.charts.redis.version }}"
    values:
      - "values-redis.yaml.gotmpl"
+      - {{ .Values.customization.release.redis | default "additionalValues: false" }}
    installed: {{ .Values.redis.enabled }}
    timeout: 900

@@ -151,6 +154,7 @@ releases:
    version: "{{ .Values.charts.memcached.version }}"
    values:
      - "values-memcached.yaml.gotmpl"
+      - {{ .Values.customization.release.memcached | default "additionalValues: false" }}
    installed: {{ .Values.memcached.enabled }}
    timeout: 900

@@ -159,6 +163,7 @@ releases:
    version: "{{ .Values.charts.postgresql.version }}"
    values:
      - "values-postgresql.yaml.gotmpl"
+      - {{ .Values.customization.release.postgresql | default "additionalValues: false" }}
    installed: {{ .Values.postgresql.enabled }}
    timeout: 900

@@ -167,6 +172,7 @@ releases:
    version: "{{ .Values.charts.mariadb.version }}"
    values:
      - "values-mariadb.yaml.gotmpl"
+      - {{ .Values.customization.release.mariadb | default "additionalValues: false" }}
    installed: {{ .Values.mariadb.enabled }}
    timeout: 900

@@ -175,14 +181,25 @@ releases:
    version: "{{ .Values.charts.postfix.version }}"
    values:
      - "values-postfix.yaml.gotmpl"
+      - {{ .Values.customization.release.postfix | default "additionalValues: false" }}
    installed: {{ .Values.postfix.enabled }}
    timeout: 900

+  - name: "opendesk-dkimpy-milter"
+    chart: "dkimpy-repo/{{ .Values.charts.dkimpy.name }}"
+    version: "{{ .Values.charts.dkimpy.version }}"
+    values:
+      - "values-dkimpy.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskDkimpyMilter | default "additionalValues: false" }}
+    installed: {{ .Values.dkimpy.enabled }}
+    timeout: 900
+
  - name: "clamav"
    chart: "clamav-repo/{{ .Values.charts.clamav.name }}"
    version: "{{ .Values.charts.clamav.version }}"
    values:
      - "values-clamav-distributed.yaml.gotmpl"
+      - {{ .Values.customization.release.clamav | default "additionalValues: false" }}
    installed: {{ .Values.clamavDistributed.enabled }}
    timeout: 900

@@ -191,6 +208,7 @@ releases:
    version: "{{ .Values.charts.clamavSimple.version }}"
    values:
      - "values-clamav-simple.yaml.gotmpl"
+      - {{ .Values.customization.release.clamavSimple | default "additionalValues: false" }}
    installed: {{ .Values.clamavSimple.enabled }}
    timeout: 900

@@ -199,6 +217,7 @@ releases:
    version: "{{ .Values.charts.minio.version }}"
    values:
      - "values-minio.yaml.gotmpl"
+      - {{ .Values.customization.release.minio | default "additionalValues: false" }}
    installed: {{ .Values.minio.enabled }}
    timeout: 900

--- a/helmfile/apps/services/helmfile.yaml
+++ b/helmfile/apps/services/helmfile.yaml
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
---
-bases:
-  - "../../bases/environments.yaml"
---
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...
--- a/helmfile/apps/services/helmfile.yaml.gotmpl
+++ b/helmfile/apps/services/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/services/values-certificates.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -6,7 +7,48 @@ SPDX-License-Identifier: Apache-2.0
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
+    {{- if .Values.collabora.enabled }}
+    collabora: {{ .Values.global.hosts.collabora }}
+    {{- end }}
+    {{- if .Values.cryptpad.enabled }}
+    cryptpad: {{ .Values.global.hosts.cryptpad }}
+    {{- end }}
+    {{- if .Values.element.enabled }}
+    element: {{ .Values.global.hosts.element }}
+    matrixNeoBoardWidget: {{ .Values.global.hosts.matrixNeoBoardWidget }}
+    matrixNeoChoiceWidget: {{ .Values.global.hosts.matrixNeoChoiceWidget }}
+    matrixNeoDateFixBot: {{ .Values.global.hosts.matrixNeoDateFixBot }}
+    matrixNeoDateFixWidget: {{ .Values.global.hosts.matrixNeoDateFixWidget }}
+    synapse: {{ .Values.global.hosts.synapse }}
+    synapseFederation: {{ .Values.global.hosts.synapseFederation }}
+    whiteboard: {{ .Values.global.hosts.whiteboard }}
+    {{- end }}
+    {{- if .Values.nubus.enabled }}
+    intercomService: {{ .Values.global.hosts.intercomService }}
+    {{- end }}
+    {{- if .Values.jitsi.enabled }}
+    jitsi: {{ .Values.global.hosts.jitsi }}
+    {{- end }}
+    {{- if .Values.minio.enabled }}
+    minioApi: {{ .Values.global.hosts.minioApi }}
+    minioConsole: {{ .Values.global.hosts.minioConsole }}
+    {{- end }}
+    {{- if .Values.nextcloud.enabled }}
+    nextcloud: {{ .Values.global.hosts.nextcloud }}
+    {{- end }}
+    {{- if .Values.openproject.enabled }}
+    openproject: {{ .Values.global.hosts.openproject }}
+    {{- end }}
+    {{- if .Values.oxAppsuite.enabled }}
+    openxchange: {{ .Values.global.hosts.openxchange }}
+    {{- end }}
+    {{- if .Values.nubus.enabled }}
+    keycloak: {{ .Values.global.hosts.keycloak }}
+    nubus: {{ .Values.global.hosts.nubus }}
+    {{- end }}
+    {{- if .Values.xwiki.enabled }}
+    xwiki: {{ .Values.global.hosts.xwiki }}
+    {{- end }}

 issuerRef:
  name: {{ .Values.certificate.issuerRef.name | quote }}
@@ -14,5 +56,13 @@ issuerRef:
 cleanup:
  keepRessourceOnDelete: {{ .Values.debug.cleanup.keepRessourceOnDelete }}

+selfSigned:
+  enabled: {{ .Values.certificate.selfSigned }}
+  keystores:
+    jks:
+      enabled: true
+      password:
+        value: {{ .Values.secrets.certificates.password | quote }}
+
 wildcard: {{ .Values.certificate.wildcard }}
 ...
--- a/helmfile/apps/services/values-clamav-distributed.yaml.gotmpl
+++ b/helmfile/apps/services/values-clamav-distributed.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 clamd:
  containerSecurityContext:
@@ -18,10 +21,11 @@ clamd:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.clamd | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.clamd.registry | quote }}
    repository: {{ .Values.images.clamd.repository | quote }}
    tag: {{ .Values.images.clamd.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
  podSecurityContext:
    enabled: true
    fsGroup: 101
@@ -62,10 +66,11 @@ freshclam:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.freshclam | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.freshclam.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.freshclam.registry | quote }}
    repository: {{ .Values.images.freshclam.repository | quote }}
    tag: {{ .Values.images.freshclam.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
  podSecurityContext:
    enabled: true
    fsGroup: 101
@@ -73,7 +78,15 @@ freshclam:
  replicaCount: {{ .Values.replicas.freshclam }}
  resources:
    {{ .Values.resources.freshclam | toYaml | nindent 4 }}
-
+  settings:
+    database:
+      auth:
+        {{ .Values.repositories.clamav.auth | toYaml | nindent 8 }}
+      mirror:
+        scheme: {{ .Values.repositories.clamav.mirror.scheme | quote }}
+        url: {{ .Values.repositories.clamav.mirror.url | quote }}
+      customURLs:
+        {{ .Values.repositories.clamav.customURLs | toYaml | nindent 8 }}
 global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
@@ -95,10 +108,11 @@ icap:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.icap | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.icap.registry | quote }}
    repository: {{ .Values.images.icap.repository | quote }}
    tag: {{ .Values.images.icap.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
  podSecurityContext:
    enabled: true
    fsGroup: 101
@@ -124,10 +138,11 @@ milter:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.milter | toYaml | nindent 6 }}
  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.milter.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.milter.registry | quote }}
    repository: {{ .Values.images.milter.repository | quote }}
    tag: {{ .Values.images.milter.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
  podSecurityContext:
    enabled: true
    fsGroup: 101
--- a/helmfile/apps/services/values-clamav-simple.yaml.gotmpl
+++ b/helmfile/apps/services/values-clamav-simple.yaml.gotmpl
@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
  allowPrivilegeEscalation: false
@@ -23,12 +26,12 @@ global:

 image:
  clamav:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.clamd.registry | quote }}
    repository: {{ .Values.images.clamd.repository | quote }}
    tag: {{ .Values.images.clamd.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  icap:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.icap.registry | quote }}
    repository: {{ .Values.images.icap.repository | quote }}
    tag: {{ .Values.images.icap.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -37,6 +40,8 @@ persistence:
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
  size: {{ .Values.persistence.size.clamav | quote }}

+podAnnotations: {}
+
 podSecurityContext:
  enabled: true
  fsGroup: 101
@@ -47,4 +52,14 @@ replicaCount: {{ .Values.replicas.clamav }}
 resources:
  {{ .Values.resources.clamd | toYaml | nindent 4 }}

+settings:
+  freshclam:
+    database:
+      auth:
+        {{ .Values.repositories.clamav.auth | toYaml | nindent 8 }}
+      mirror:
+        scheme: {{ .Values.repositories.clamav.mirror.scheme | quote }}
+        url: {{ .Values.repositories.clamav.mirror.url | quote }}
+      customURLs:
+        {{ .Values.repositories.clamav.customURLs | toYaml | nindent 8 }}
 ...
--- a/Show More
+++ b/Show More