feat(opendesk-services): Add opendesk-otterize

fix(helmfile): Streamline annotations
feat(openproject): Update OpenProject from 16.5.1 to 16.6.0
2025-12-06 07:21:36 +01:00 · 2025-11-13 17:14:31 +01:00 · 2025-11-12 11:28:49 +01:00 · 2025-11-11 10:53:50 +00:00 · 2025-11-10 15:46:13 +00:00 · 2025-11-07 09:08:52 +00:00
248 changed files with 5747 additions and 341 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -762,7 +762,7 @@ import-default-accounts:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $CREATE_DEFAULT_ACCOUNTS == "yes"
      when: "on_success"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.3.2"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.4.1"
  script:
    - "echo \"Starting default account import for ${DOMAIN}\""
    - "cd /app"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,30 @@
+# [1.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.8.0...v1.9.0) (2025-11-07)
+
+
+### Bug Fixes
+
+* **collabora:** Update from 25.04.4.3.1 to 25.04.5.3.1 ([e0128e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e0128e6ccf02eaaa68fe53f5629150f0e0863ba0))
+* **element:** Increase message and media rate limits ([13968a8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13968a8133174024dc97c5cf73e6b1e7883ce0a0))
+* **element:** Update favicon to use PNG version ([f8104f6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f8104f635862ce6c80b66c6d7fa82df7cde9d446))
+* **element:** Update Synapse from v1.137.0 to v1.141.0; fixes https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr which applies to all openDesk deployments using Element/Matrix with federation enabled ([02d3021](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02d3021c4ba97f81165e286d1ee53b7c199f5dbb))
+* **element:** Update widgets primary color theme settings ([94394a1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/94394a1e3e3da304138263de73121a62aabbee11))
+* **gitlab:** Add issue templates ([26da7e3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/26da7e366709b3888f6786b574e3b3b11f1a6fab))
+* **helmfile:** Support setting the `defaultLanguage` - relevant for OX App Suite and XWiki - in `functional.yaml.gotmpl` ([24065db](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/24065dbc7043d09dbad0d272128cfe2f33f22e48))
+* **helmfile:** Use passwords defined in `database.yaml.gotmpl` for Cassandra when available ([0268219](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/026821996a4e42ac9ef25dd62c34d1697547962c))
+* **notes:** Fix python path for self signed certs ([c4279d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c4279d11bb46c9fe65b2ccd54dc0789d11c0d0d8))
+* **notes:** Fix repeated redirects on expired session; Remove fetching of external assets ([c1012f4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c1012f4e656222750dda0668d8f81e5d1fbe02fd))
+* **open-xchange:** Don't enable sasl auth when no relay host is set ([ff3b221](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ff3b2218706a98b854c072de62105aa8352e3949))
+* **open-xchange:** Enable and configure defaults for ContactCollector, remove legacy config artifacts ([465f60d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/465f60d4a28ead7d7a715db71dad9d9992e8b89a))
+* **open-xchange:** Use masterpassword for mailfilter in migration Pods; use PLAIN instead of OAuth for SASL ([484dfaf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/484dfafe643e04a717e6bc3a8e6e6e6f5011c1c1))
+* **ox-connector:** Use FQDN for internal service URLs ([8593d5f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8593d5f2bdea685a836edc9d9034ce1976cf2e96))
+
+
+### Features
+
+* **helmfile:** Add toggle for external mail client onboarding and allow non-default FQDNs for IMAP and SMTP endpoints ([25a97ab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/25a97abba69b34c6b65a08ca7af979f3897d218b))
+* **open-xchange:** Enable XRechnung in Viewer ([08e6ec5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/08e6ec59d2abac36a8f6e5ab10fec6a5643de282))
+* **openproject:** Update from 16.4.1 to 16.5.1 ([74cf2ee](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/74cf2ee0d818b5e017b3c97f6fbedb05ab764d67))
+
 # [1.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.7.1...v1.8.0) (2025-09-25)


--- a/README.md
+++ b/README.md
@@ -41,7 +41,7 @@ openDesk currently features the following functional main components:
 | Groupware            | OX App Suite                | GPL-2.0-only (backend), AGPL-3.0-or-later (frontend)                                   | [8.41](https://documentation.open-xchange.com/appsuite/releases/8.41/)                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
 | Knowledge management | XWiki                       | LGPL-2.1-or-later                                                                      | [17.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.4.4/)                | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
 | Portal & IAM         | Nubus                       | AGPL-3.0-or-later                                                                      | [1.14.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/1.14.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | GPL-3.0-only                                                                           | [16.4.1](https://www.openproject.org/docs/release-notes/16-4-1/)                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Project management   | OpenProject                 | GPL-3.0-only                                                                           | [16.6.0](https://www.openproject.org/docs/release-notes/16-6-0/)                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
 | Videoconferencing    | Jitsi                       | Apache-2.0                                                                             | [2.0.10431](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_10431)       | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
 | Weboffice            | Collabora                   | MPL-2.0                                                                                | [25.04.5](https://www.collaboraoffice.com/code-25-04-release-notes/)                          | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |

--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -184,8 +184,10 @@ sequenceDiagram
    Note over Browser: User is authenticated
 ```

-> **Note:**<br>
-> Nubus' Portal and UMC still use [SAML 2.0](https://www.oasis-open.org/standard/saml/) to authenticate users. However, Nubus will switch to OIDC in an upcoming release, eliminating the use of SAML in openDesk altogether.
+> [!note]
+> Nubus' Portal and UMC still use [SAML 2.0](https://www.oasis-open.org/standard/saml/) to authenticate
+> users. However, Nubus will switch to OIDC in an upcoming release, eliminating the use of SAML in openDesk
+> altogether.

 ## Keycloak

@@ -245,7 +247,7 @@ To find out more, see [Roles & Permissions](./docs/permissions.md).

 In openDesk, SCIM will be used in the future to automate the process of creating, updating, and deactivating user accounts across the applications. This ensures that user data is consistent across all applications, reducing the administrative overhead and potential for errors.

-> **Note:**<br>
+> [!note]
 > SCIM support is planned in openDesk for 2025.

 # Component integration
@@ -449,4 +451,4 @@ While the IAM manages users centrally, some applications come with local account

 # Footnotes

-[^1]: We are working on a new approach to provision the OpenProject filestore, therefore the accounts are planned to be deactivated/removed with openDesk 1.2.
+[^1]: We are working on a new approach to provision the OpenProject filestore, therefore the accounts are planned to be deactivated/removed in the future.
--- a/docs/architecture/apis.md
+++ b/docs/architecture/apis.md
@@ -295,8 +295,10 @@ The following are the APIs used by the Groupware application:
 | Supported standards            | SOAP                                                                                         |
 | Documentation                  | https://software.open-xchange.com/products/appsuite/doc/SOAP/admin/OX-Admin-SOAP.html        |

-> **Note**:
-> You will find a catalogue of the available services including links to the respective URLs at `/webservices/` within the AppSuite host of your openDesk installation, e.g. https://webmail.myopendesk.tld/webservices/
+> [!note]
+> You will find a catalogue of the available services including links to the respective URLs at
+> `/webservices/` within the AppSuite host of your openDesk installation,
+> e.g. https://webmail.myopendesk.tld/webservices/

 ## REST API

@@ -648,7 +650,7 @@ The following are the APIs used by the Project management application:

 ## Jitsi Meet React SDK

-> **Note**<br>
+> [!note]
 > Additional SDKs can be found at https://jitsi.github.io/handbook/docs/category/sdks/

 | Name                           | Meet React SDK                                                      |
--- a/docs/baseline-requirements.md
+++ b/docs/baseline-requirements.md
@@ -38,7 +38,7 @@ As this is a comprehensive set of requirements most new components will not adhe

 This document can be used to assess the status and possible gaps for a component which might itself be the basis for a decision if a component should be integrated into openDesk by working on closing the identified gaps.

-> **Note**<br>
+> [!note]
 > Even an already integrated application might not adhere to all aspects of the documented requirements yet.
 > Closing the gaps for existing applications therefore is an openDesk priority.

@@ -147,8 +147,9 @@ Please find more context about the topic on the [website of the German CIO](http

 Each vendor must provide a certificate that their product - or the parts of the product relevant for openDesk - complies with at least WCAG 2.1 AA or [BITV 2.0](https://www.bundesfachstelle-barrierefreiheit.de/DE/Fachwissen/Informationstechnik/EU-Webseitenrichtlinie/BGG-und-BITV-2-0/Die-neue-BITV-2-0/die-neue-bitv-2-0_node.html). As the certification and related product improvements are time-consuming the focus of openDesk is that a supplier provides a plan and certification partner (contract) that shows the supplier is working towards the certification. While the aforementioned standard states the priority is the "A" level requirements, the "AA" level must be met at the end of the process.

-> **Note**<br>
-> Please keep in mind that WCAG 2.2 and 3.0 are work in progress. If you already work on accessibility improvements you might want to take these standards already into consideration.
+> [!note]
+> Please keep in mind that WCAG 2.2 and 3.0 are work in progress. If you already work on accessibility
+> improvements you might want to take these standards already into consideration.

 **Reference:** In the past the [accessibility evaluations](https://gitlab.opencode.de/bmi/opendesk/info/-/tree/main/24.03/Barrierefreiheit) have been executed by Dataport. But they do not do certifications.

@@ -185,7 +186,7 @@ With a central Identity- and Access Management (IAM) also the user lifecycle (UL

 The focus is to have all the account information in all applications including the account's state, profile picture ([reference](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues/27)) and - where required - the user's group memberships. This cannot be done purely by pushing that data through OIDC claims when a user logs in to an application therefore two ways of managing an account are applicable and described in the following subchapters.

-> **Note**<br>
+> [!note]
 > Allowing ad hoc updates of account data through OIDC claims during login is still encouraged.

 ### Pull: LDAP
@@ -194,8 +195,9 @@ Applications can access the IAM's LDAP to access all data necessary for managing

 **Reference:** Most applications use LDAP access as per https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/components.md?ref_type=heads#identity-data-flows

-> **Note**<br>
-> The direct access to LDAP is going to be deprecated for most use cases. openDesk is looking into active provisioning of the user/group data into the applications using [SCIM](https://scim.cloud/).
+> [!note]
+> The direct access to LDAP is going to be deprecated for most use cases. openDesk is looking into active
+> provisioning of the user/group data into the applications using [SCIM](https://scim.cloud/).

 ### Push: Provisioning

--- a/docs/data-storage.md
+++ b/docs/data-storage.md
@@ -67,7 +67,7 @@ XWiki,PersistentVolume,1
 # Details

 | Application          | Data Storage | Backup   | Content                                                                           | (Default) Identifier                           | Details                                                                                                   |
-|----------------------|--------------|----------|-----------------------------------------------------------------------------------|------------------------------------------------|-----------------------------------------------------------------------------------------------------------|
+| -------------------- | ------------ | -------- | --------------------------------------------------------------------------------- | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
 | **ClamAV**           | PVC          | No       | ClamAV Database                                                                   | `clamav-database-clamav-simple-0`              | `/var/lib/clamav`                                                                                         |
 | **Dovecot**          | PVC          | Yes      | openDesk CE only: User mail directories                                           | `dovecot`                                      | `/srv/mail`                                                                                               |
 |                      | S3           | Yes      | openDesk EE only: User mail                                                       | `dovecot`                                      | `dovecot`                                                                                                 |
@@ -105,8 +105,8 @@ XWiki,PersistentVolume,1
 |                      |              | Yes      | OX Guard related settings                                                         | `oxguard*`                                     |                                                                                                           |
 |                      | S3           | Yes      | Attachments of meetings, contacts and tasks                                       | `openxchange`                                  |                                                                                                           |
 |                      | Redis        | Optional | Cache, session related data, distributed maps                                     |                                                |                                                                                                           |
-|                      | PVC          | Yes      | OX Connector: OXAPI access details                                                | `ox-connector-appcenter-ox-connector-0`        | `/var/lib/univention-appcenter/apps/ox-connector`                                                         |
-|                      |              | Yes      | OX Connector: Application's meta data                                             | `ox-connector-ox-contexts-ox-connector-0`      | `/etc/ox-secrets`                                                                                         |
+|                      | PVC          | Optional | OX Connector: Caching of OX object data                                           | for backup        | `/var/lib/univention-appcenter/apps/ox-connector`                                                         |
+|                      |              | Yes      | OX Connector: OX SOAP API credentials                                             | `ox-connector-ox-contexts-ox-connector-0`      | `/etc/ox-secrets`                                                                                         |
 | **Postfix**          | PVC          | Yes      | Mail spool                                                                        | `postfix`                                      | `/var/spool/postfix`                                                                                      |
 | **XWiki**            | PostgreSQL   | Yes      | Application's main database                                                       | `xwiki`                                        |                                                                                                           |
 |                      | PVC          | Yes      | Attachments                                                                       | `xwiki-data-xwiki-0`                           | `/usr/local/xwiki/data`                                                                                   |
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -31,10 +31,10 @@ It will be extended over time as we deal with debugging cases.
 We for sure do not want to reinvent the wheel, so we might link to external sources that contain helpful
 information where available.

-> **Warning**<br>
-> You should never enable the debug option in production environments! By looking up `debug.enabled` in the deployment, you
-will find the various places changes are applied when enabling debugging. So, outside of development and test
-environments, you should use them thoughtfully and carefully if needed.
+> [!warning]
+> You should never enable the debug option in production environments! By looking up `debug.enabled` in the
+> deployment, you will find the various places changes are applied when enabling debugging. So, outside of
+> development and test environments, you should use them thoughtfully and carefully if needed.

 # Enable debugging

@@ -49,11 +49,13 @@ This will result in:
 - making the Keycloak admin console available by default at `https://id.<your_domain>/admin/`
 - ingress for `http://minio-console.<your_domain>` being configured

-> **Note**<br>
-> When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.
+> [!note]
+> When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In
+> debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.

-> **Note**<br>
-> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container which were not in STDOUT, please let us know!
+> [!note]
+> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container which
+> were not in STDOUT, please let us know!

 # Adding containers to a pod for debugging purposes

@@ -215,11 +217,16 @@ kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"dat

 2. Restart the Keycloak Pod(s).

-> **Note**<br>
-> Because the `ums-keycloak-extensions-handler` is sending frequent requests (one per second) to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.
+> [!note]
+> Because the `ums-keycloak-extensions-handler` is sending frequent requests (one per second) to Keycloak for
+> retrieval of the Keycloak event history, you might want to stop/remove the deployment while
+> debugging/analysing Keycloak to not get your debug output spammed by these requests.

-> **Note**<br>
-> While you can set the standard log levels like `INFO`, `DEBUG`, `TRACE` etc. you can also set class specific logs by comma separating the details in the `KC_LOG_LEVEL` environment variable like e.g. `INFO,org.keycloak.protocol.oidc.endpoints:TRACE`. The example sets the overall loglevel to `INFO` but provides trace logs for `org.keycloak.protocol.oidc.endpoints`.
+> [!note]
+> While you can set the standard log levels like `INFO`, `DEBUG`, `TRACE` etc. you can also set class specific
+> logs by comma separating the details in the `KC_LOG_LEVEL` environment variable like
+> e.g. `INFO,org.keycloak.protocol.oidc.endpoints:TRACE`. The example sets the overall loglevel to `INFO` but
+> provides trace logs for `org.keycloak.protocol.oidc.endpoints`.

 ### Accessing the Keycloak admin console

--- a/docs/developer/development.md
+++ b/docs/developer/development.md
@@ -84,9 +84,9 @@ In the project's CI, there is a step dedicated to lint the two yaml files, as we
 In the linting step, the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
 aforementioned sorting, and the result is compared with the unsorted version. If there is a delta, the linting fails, and you can fix it by running the CLI tool locally, verifying and applying the result to your branch.

-> **Note**<br>
-> Please ensure that in component blocks, you use comments only at the beginning of the block or at its end. Ideally, you stick
-with the many available examples in the yaml files.
+> [!note]
+> Please ensure that in component blocks, you use comments only at the beginning of the block or at its
+> end. Ideally, you stick with the many available examples in the yaml files.

 Example:
 ```yaml
@@ -126,7 +126,7 @@ Checks for newer versions of the given artifact and creates an MR containing the

 - See also: https://gitlab.opencode.de/bmi/opendesk/tooling/oci-pull-mirror

-> **Note:**<br>
+> [!note]
 > The mirror is scheduled to run every hour at 42 minutes past the hour.

 openDesk strives to make all relevant artifacts available on openCode so there is a mirroring process
--- a/docs/developer/workflow.md
+++ b/docs/developer/workflow.md
@@ -85,7 +85,7 @@ The below rendering in [class diagram](https://en.wikipedia.org/wiki/Class_diagr
 - the first section below the name of the class shows the required **characteristics** of each component of the given class
 - the second section shows the **methods** like linting that must be applied to that class's artifacts

-> **Note**<br>
+> [!note]
 > The methods prefixed with '-' are not yet available in `gitlab-config`. You will learn about them later.

 ```mermaid
@@ -148,11 +148,14 @@ openDesk uses Apache 2.0 as the license for their work. A typical reuse copyrigh
 ```
 The way to mark the license header as a comment differs between the various file types. Please find matching examples for all types across the [deployment automation repository](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk).

-> **Note**<br>
-> If a `SPDX-FileCopyrightText` already exists with the copyright owner described above but with a past year (e.g. 2024), please update this copyright header line to cover (up to and including) the current year, e.g. `2024-2025`.
+> [!note]
+> If a `SPDX-FileCopyrightText` already exists with the copyright owner described above but with a past year
+> (e.g. 2024), please update this copyright header line to cover (up to and including) the current year,
+> e.g. `2024-2025`.

-> **Note**<br>
-> If line(s) with `SPDX-FileCopyrightText` containing a different copyright owner exist in the file you are working on, do not replace existing one(s), but rather add another header above these.
+> [!note]
+> If line(s) with `SPDX-FileCopyrightText` containing a different copyright owner exist in the file you are
+> working on, do not replace existing one(s), but rather add another header above these.

 ## Development workflow

@@ -348,14 +351,14 @@ Branches created from the `develop` branch have to adhere to the following notat

 Example: `tmueller/fix_jitsi_theming`.

-> **Note**<br>
+> [!note]
 > The above naming convention has yet to be enforced, but please ensure you use it.

 #### Commit messages / Conventional Commits

 Commit messages must adhere to the [Conventional Commit standard](https://www.conventionalcommits.org/en/v1.0.0/#summary). Commits that do not adhere to the standard get rejected by either [Gitlab push rules](https://docs.gitlab.com/ee/user/project/repository/push_rules.html) or the CI.

-> **Note**<br>
+> [!note]
 > The first letter after the `: ` must be uppercase.

 ```text
@@ -372,7 +375,7 @@ Commit messages must adhere to the [Conventional Commit standard](https://www.co

 Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`

-> **Note**<br>
+> [!note]
 > The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases) as the release notes are generated from these messages.

 #### Verified commits
--- a/docs/enhanced-configuration/gitops.md
+++ b/docs/enhanced-configuration/gitops.md
@@ -44,9 +44,10 @@ References:

 Afterwards, you can use the resulting manifests within a standard Argo CD workflow.

-> **Note**<br>
-> When creating the Argo CD application based on the resulting manifests, you must not use the `Automated Sync Policy`
-> offered by Argo CD, as you have to manually ensure the applications are updated in the required sequence.
+> [!note]
+> When creating the Argo CD application based on the resulting manifests, you must not use the `Automated Sync
+> Policy` offered by Argo CD, as you have to manually ensure the applications are updated in the required
+> sequence.

 ## Option 2: Helmfile plugin

--- a/docs/enhanced-configuration/groupware-migration.md
+++ b/docs/enhanced-configuration/groupware-migration.md
@@ -41,8 +41,9 @@ You will have to select an existing user account that will be used as a service

 Please note that the account that shall serve as the service account requires a Microsoft 365/Exchange online license (mailbox).

-> **Note**<br>
-> If you want to designate your admin account as a service account, you have to provide the admin with a license.
+> [!note]
+> If you want to designate your admin account as a service account, you have to provide the admin with a
+> license.

 ***2. Register the audriga app in your tenant***

@@ -53,7 +54,7 @@ To register the audriga app in your tenant, log into your admin account and acce
 - Accept the App "audriga CloudMovr migration"
 - You will be redirected to an audriga page, which you can close - it does not require additional interaction.

-> **Note**<br>
+> [!note]
 > The audriga application is created under the "Enterprise application" tab in the AzureAD console.

 ***3. Create a "secret" group in the M365 tenant***
@@ -91,11 +92,15 @@ To validate the master authentication mode please read the appendix section at t

 Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppSuite.migrationsMasterPassword` and need to turn off the migration mode by setting `functional.migration.oxAppSuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.

-> **Note**<br>
-> For the changes to take effect, it is sufficient to re-deploy the `open-xchange` component alone. But you have to restart the Dovecot Pod(s) manually when switching to/from the master authentication mode for the changes to take effect.
+> [!note]
+> For the changes to take effect, it is sufficient to re-deploy the `open-xchange` component alone. But you
+> have to restart the Dovecot Pod(s) manually when switching to/from the master authentication mode for the
+> changes to take effect.

-> **Note**<br>
-> While in master authentication mode, regular users cannot log in to the webmail module of openDesk or access the mail using IMAP, as it is not recommended that users interact with the target mail infrastructure during the migration scenario described in this document.
+> [!note]
+> While in master authentication mode, regular users cannot log in to the webmail module of openDesk or access
+> the mail using IMAP, as it is not recommended that users interact with the target mail infrastructure during
+> the migration scenario described in this document.

 # Migration configuration

@@ -107,7 +112,7 @@ Ensure you meet the prerequisites. For example, this document does not support u

 Choose [Microsoft 365 / Exchange Online (Admin)](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware#src=onmicrosoft.com) as your current provider.

-> **Note**<br>
+> [!note]
 > You may need to start typing in "Microsoft Office 365/Exchange Online" for it to appear in the list.

 Configure openDesk as your destination server:
--- a/docs/enhanced-configuration/idp-federation.md
+++ b/docs/enhanced-configuration/idp-federation.md
@@ -152,7 +152,7 @@ If you just created the `fed-test-idp-realm`, you are already in the admin scree

 ## openDesk IdP

-> **Note**
+> [!note]
 > While manual configuration is possible, an SSO federation can also be configured as part of the deployment.
 > Check `functional.authentication.ssoFederation` section from the `functional.yaml.gotmpl` for details.

--- a/docs/enhanced-configuration/self-signed-certificates.md
+++ b/docs/enhanced-configuration/self-signed-certificates.md
@@ -52,9 +52,9 @@ CA certificate as X.509 encoded (`ca.crt`) and as jks trust store (`truststore.j
 5. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
 trust store password.

-> **Note**<br>
-> XWiki does not support the use of an existing secret to access the keystore. Therefore you have to set the password
-> from step 5 also as `secrets.certificates.password`.
+> [!note]
+> XWiki does not support the use of an existing secret to access the keystore. Therefore you have to set the
+> password from step 5 also as `secrets.certificates.password`.

 ## Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate

--- a/docs/external-services.md
+++ b/docs/external-services.md
@@ -19,8 +19,10 @@ This document will cover the additional configuration for external services like
 When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.

-> **Note**<br>
-> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely to become the preferred option/default in the future should MariaDB become deprecated. This would cause migration[^1] to be necessary if you do not select PostgreSQL for new installations.
+> [!note]
+> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely
+> to become the preferred option/default in the future should MariaDB become deprecated. This would cause
+> migration[^1] to be necessary if you do not select PostgreSQL for new installations.

 | Component          | Name               | Parameter | Key                                           | Default                      |
 | ------------------ | ------------------ | --------- | --------------------------------------------- | ---------------------------- |
--- a/docs/functional.md
+++ b/docs/functional.md
@@ -32,5 +32,9 @@ The following categories are available. Each category contains a set of options

 In case the options from [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl) are not sufficient, you might want to look into [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl). The customizations give you control over all templating that is being done in openDesk, but be aware it is an unsupported approach, so in case you have a strong need for customizations, please let us know by opening a ticket. We will check if it is a use case that can be supported by implementing it as part of the aforementioned [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl).

-> **Note<br>**
-> You can not directly template your own values in the structure found in [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl), rather, you need to reference your custom value files to overwrite the openDesk defaults. In the app specific `helmfile-child.yaml.gotmpl` files, the openDesk value files are referenced first, then afterwards, the files you define in the customizations are read.
+> [!note]
+> You can not directly template your own values in the structure found in
+> [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl), rather, you need
+> to reference your custom value files to overwrite the openDesk defaults. In the app specific
+> `helmfile-child.yaml.gotmpl` files, the openDesk value files are referenced first, then afterwards, the
+> files you define in the customizations are read.
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -236,9 +236,9 @@ ingress:
  ingressClassName: "nginx"
 ```

-> **Note**<br>
-> Currently, the only supported ingress controller is `ingress-nginx`
-> (see [requirements.md](./docs/requirements.md) for reference).
+> [!note]
+> Currently, the only supported ingress controller is `ingress-nginx` (see
+> [requirements.md](./docs/requirements.md) for reference).

 ### Container runtime

@@ -279,8 +279,9 @@ While openDesk configures the applications with meaningful defaults, you can che

 ### Ports

-> **Note**<br>
-> If you use `NodePort` for service exposure, you must check your deployment for the actual ports and ensure they are opened where necessary.
+> [!note]
+> If you use `NodePort` for service exposure, you must check your deployment for the actual ports and ensure
+> they are opened where necessary.

 #### Web-based user interface

@@ -385,10 +386,15 @@ To prevent others from using your openDesk instance, you must set your individua
 export MASTER_PASSWORD="your_individual_master_password"
 ```

-> **Note**<br>
-> Currently a [documented](https://docs.software-univention.de/nubus-kubernetes-operation/1.x/en/configuration/nats.html#configure-the-secrets) upstream [bug](https://forge.univention.org/bugzilla/show_bug.cgi?id=58357) causes a failure when passwords/secrets beginning with certain numbers are using for the Nubus subcomponent NATS.
-> With openDesk 1.6.0 an update-aware workaround was implemented that prefixes the affected secrets in the openDesk included `secrets.yaml.gotmpl` that derives all secrets from the previously mentioned `MASTER_PASSWORD`.
-> If you are using externally provided passwords/secrets make sure that none of the ones listed below are starting with a number:
+> [!important]
+> Currently a
+> [documented](https://docs.software-univention.de/nubus-kubernetes-operation/1.x/en/configuration/nats.html#configure-the-secrets)
+> upstream [bug](https://forge.univention.org/bugzilla/show_bug.cgi?id=58357) causes a failure when
+> passwords/secrets beginning with certain numbers are using for the Nubus subcomponent NATS. With openDesk
+> 1.6.0 an update-aware workaround was implemented that prefixes the affected secrets in the openDesk included
+> `secrets.yaml.gotmpl` that derives all secrets from the previously mentioned `MASTER_PASSWORD`. If you are
+> using externally provided passwords/secrets make sure that none of the ones listed below are starting with a
+> number:
 >
 > - `secrets.nubus.provisioning.api.natsPassword`
 > - `secrets.nubus.provisioning.dispatcherNatsPassword`
@@ -497,7 +503,7 @@ You can uninstall the deployment by executing the following:
 helmfile destroy -n <NAMESPACE>
 ```

-> **Note**<br>
+> [!note]
 > Not all Jobs, PersistentVolumeClaims, or Certificates are deleted; you have to delete them manually

 **'Sledgehammer destroy'** - for fast development turn-around times (at your own risk):
@@ -516,5 +522,5 @@ kubectl delete jobs --all --namespace ${NAMESPACE};
 kubectl delete configmaps --all --namespace ${NAMESPACE};
 ```

-> **Warning**<br>
+> [!warning]
 > Without specifying a `--namespace` flag, or by leaving it empty, cluster-wide components will get deleted!
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -10,8 +10,12 @@ SPDX-License-Identifier: Apache-2.0
 * [Deprecation warnings](#deprecation-warnings)
 * [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
 * [Manual checks/actions](#manual-checksactions)
-  * [v1.7.1+](#v171)
-    * [Pre-upgrade to v1.7.1+](#pre-upgrade-to-v171)
+  * [Versions &GreaterEqual; v1.9.0](#versions--v190)
+    * [Pre-upgrade to versions &GreaterEqual; v1.9.0](#pre-upgrade-to-versions--v190)
+      * [Helmfile fix: Cassandra passwords read from `databases.*`](#helmfile-fix-cassandra-passwords-read-from-databases)
+      * [Helmfile new feature: `functional.groupware.externalClients.*`](#helmfile-new-feature-functionalgroupwareexternalclients)
+  * [Versions &GreaterEqual; v1.8.0](#versions--v180)
+    * [Pre-upgrade to versions &GreaterEqual; v1.8.0](#pre-upgrade-to-versions--v180)
      * [New application default: Default group for two-factor authentication is now "2FA Users"](#new-application-default-default-group-for-two-factor-authentication-is-now-2fa-users)
      * [New database and secrets: Portal now uses OIDC](#new-database-and-secrets-portal-now-uses-oidc)
      * [New application default: XWiki blocks self-registration of user accounts](#new-application-default-xwiki-blocks-self-registration-of-user-accounts)
@@ -20,37 +24,39 @@ SPDX-License-Identifier: Apache-2.0
      * [Helmfile new default: New groupware settings changing current behaviour](#helmfile-new-default-new-groupware-settings-changing-current-behaviour)
      * [New application default: Nextcloud apps "Spreed" and "Comments" no longer enabled by default](#new-application-default-nextcloud-apps-spreed-and-comments-no-longer-enabled-by-default)
      * [New application default: Gravatar is switched off for Jitsi and OpenProject](#new-application-default-gravatar-is-switched-off-for-jitsi-and-openproject)
-  * [v1.7.0+](#v170)
-    * [Pre-upgrade to v1.7.0+](#pre-upgrade-to-v170)
+  * [Versions &GreaterEqual; v1.7.0](#versions--v170)
+    * [Pre-upgrade to versions &GreaterEqual; v1.7.0](#pre-upgrade-to-versions--v170)
      * [Helmfile fix: Ensure enterprise overrides apply when deploying from project root](#helmfile-fix-ensure-enterprise-overrides-apply-when-deploying-from-project-root)
      * [Replace Helm chart: New Notes Helm chart with support for self-signed deployments](#replace-helm-chart-new-notes-helm-chart-with-support-for-self-signed-deployments)
-    * [Post-upgrade to v1.7.0+](#post-upgrade-to-v170)
+    * [Post-upgrade to versions &GreaterEqual; v1.7.0](#post-upgrade-to-versions--v170)
      * [Upstream fix: Provisioning of functional mailboxes](#upstream-fix-provisioning-of-functional-mailboxes)
-  * [v1.6.0+](#v160)
-    * [Pre-upgrade to v1.6.0+](#pre-upgrade-to-v160)
+  * [Versions &GreaterEqual; v1.6.0](#versions--v160)
+    * [Pre-upgrade to versions &GreaterEqual; v1.6.0](#pre-upgrade-to-versions--v160)
      * [Upstream constraint: Nubus' external secrets](#upstream-constraint-nubus-external-secrets)
      * [Helmfile new secret: `secrets.minio.openxchangeUser`](#helmfile-new-secret-secretsminioopenxchangeuser)
      * [Helmfile new object storage: `objectstores.openxchange.*`](#helmfile-new-object-storage-objectstoresopenxchange)
      * [OX App Suite fix-up: Using S3 as storage for non mail attachments (pre-upgrade)](#ox-app-suite-fix-up-using-s3-as-storage-for-non-mail-attachments-pre-upgrade)
-    * [Post-upgrade to v1.6.0+](#post-upgrade-to-v160)
+    * [Post-upgrade to versions &GreaterEqual; v1.6.0](#post-upgrade-to-versions--v160)
      * [OX App Suite fix-up: Using S3 as storage for non mail attachments (post-upgrade)](#ox-app-suite-fix-up-using-s3-as-storage-for-non-mail-attachments-post-upgrade)
-  * [v1.4.0+](#v140)
-    * [Pre-upgrade to v1.4.0+](#pre-upgrade-to-v140)
-      * [Helmfile new feature: `functional.authentication.ssoFederation`](#helmfile-new-feature-functionalauthenticationssofederation)
+  * [Versions &GreaterEqual; v1.4.0](#versions--v140)
+    * [Pre-upgrade to versions &GreaterEqual; v1.4.0](#pre-upgrade-to-versions--v140)
      * [Helmfile cleanup: `global.additionalMailDomains` as list](#helmfile-cleanup-globaladditionalmaildomains-as-list)
-  * [v1.2.0+](#v120)
-    * [Pre-upgrade to v1.2.0+](#pre-upgrade-to-v120)
+  * [Versions &GreaterEqual; v1.3.0](#versions--v130)
+    * [Pre-upgrade to versions &GreaterEqual; v1.3.0](#pre-upgrade-to-versions--v130)
+      * [Helmfile new feature: `functional.authentication.ssoFederation`](#helmfile-new-feature-functionalauthenticationssofederation)
+  * [Versions &GreaterEqual; v1.2.0](#versions--v120)
+    * [Pre-upgrade to versions &GreaterEqual; v1.2.0](#pre-upgrade-to-versions--v120)
      * [Helmfile cleanup: Do not configure OX provisioning when no OX installed](#helmfile-cleanup-do-not-configure-ox-provisioning-when-no-ox-installed)
      * [Helmfile new default: PostgreSQL for XWiki and Nextcloud](#helmfile-new-default-postgresql-for-xwiki-and-nextcloud)
-  * [v1.1.2+](#v112)
-    * [Pre-upgrade to v1.1.2+](#pre-upgrade-to-v112)
+  * [Versions &GreaterEqual; v1.1.2](#versions--v112)
+    * [Pre-upgrade to versions &GreaterEqual; v1.1.2](#pre-upgrade-to-versions--v112)
      * [Helmfile feature update: App settings wrapped in `apps.` element](#helmfile-feature-update-app-settings-wrapped-in-apps-element)
-  * [v1.1.1+](#v111)
-    * [Pre-upgrade to v1.1.1](#pre-upgrade-to-v111)
+  * [Versions &GreaterEqual; v1.1.1](#versions--v111)
+    * [Pre-upgrade to versions &GreaterEqual; v1.1.1](#pre-upgrade-to-versions--v111)
      * [Helmfile feature update: Component specific `storageClassName`](#helmfile-feature-update-component-specific-storageclassname)
      * [Helmfile new secret: `secrets.nubus.masterpassword`](#helmfile-new-secret-secretsnubusmasterpassword)
-  * [v1.1.0+](#v110)
-    * [Pre-upgrade to v1.1.0](#pre-upgrade-to-v110)
+  * [Versions &GreaterEqual; v1.1.0](#versions--v110)
+    * [Pre-upgrade to versions &GreaterEqual; v1.1.0](#pre-upgrade-to-versions--v110)
      * [Helmfile cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
      * [Helmfile cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
      * [Helmfile cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
@@ -60,10 +66,10 @@ SPDX-License-Identifier: Apache-2.0
      * [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
      * [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
      * [External requirements: Redis 7.4](#external-requirements-redis-74)
-    * [Post-upgrade to v1.1.0+](#post-upgrade-to-v110)
+    * [Post-upgrade to versions &GreaterEqual; v1.1.0](#post-upgrade-to-versions--v110)
      * [XWiki fix-ups](#xwiki-fix-ups)
-  * [v1.1.0](#v110-1)
-    * [Pre-upgrade to v1.1.0](#pre-upgrade-to-v110-1)
+  * [Versions &GreaterEqual; v1.0.0](#versions--v100)
+    * [Pre-upgrade to versions &GreaterEqual; v1.0.0](#pre-upgrade-to-versions--v100)
      * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
      * [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
      * [Changed openDesk defaults: Matrix presence status disabled](#changed-opendesk-defaults-matrix-presence-status-disabled)
@@ -71,17 +77,17 @@ SPDX-License-Identifier: Apache-2.0
      * [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
      * [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
      * [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
-    * [Post-upgrade to v1.0.0+](#post-upgrade-to-v100)
+    * [Post-upgrade to versions &GreaterEqual; v1.0.0](#post-upgrade-to-versions--v100)
      * [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
      * [Optional Cleanup](#optional-cleanup)
 * [Automated migrations - Details](#automated-migrations---details)
-  * [v1.6.0+ (automated)](#v160-automated)
-    * [v1.6.0+ migrations-post](#v160-migrations-post)
-  * [v1.2.0+ (automated)](#v120-automated)
-    * [v1.2.0+ migrations-pre](#v120-migrations-pre)
-    * [v1.2.0+ migrations-post](#v120-migrations-post)
-  * [v1.1.0+ (automated)](#v110-automated)
-  * [v1.0.0+ (automated)](#v100-automated)
+  * [Versions &GreaterEqual; v1.6.0 (automated)](#versions--v160-automated)
+    * [Versions &GreaterEqual; v1.6.0 migrations-post](#versions--v160-migrations-post)
+  * [Versions &GreaterEqual; v1.2.0 (automated)](#versions--v120-automated)
+    * [Versions &GreaterEqual; v1.2.0 migrations-pre](#versions--v120-migrations-pre)
+    * [Versions &GreaterEqual; v1.2.0 migrations-post](#versions--v120-migrations-post)
+  * [Versions &GreaterEqual; v1.1.0 (automated)](#versions--v110-automated)
+  * [Versions &GreaterEqual; v1.0.0 (automated)](#versions--v100-automated)
  * [Related components and artifacts](#related-components-and-artifacts)
  * [Development](#development)
 <!-- TOC -->
@@ -96,12 +102,14 @@ These automated migrations have limitations in the sense that they require a cer

 Manual checks and possible activities are also required by openDesk updates, they are described in the section [Manual update steps](#manual-update-steps).

-> **Note**<br>
-> Please be sure to _thoroughly_ read / follow the requirements before you update / upgrade.
+> [!important]
+> Please be sure to _thoroughly_ read / follow the requirements before you update / upgrade and assure that
+> you are reading the correct version of this document (change branch / version if necessary).

-> **Known limitations**<br>
+> [!warning]
 > We assume that the PV reclaim policy is set to `delete`, resulting in PVs getting deleted as soon as the related PVC is deleted; we will not address explicit deletion for PVs.

+
 # Deprecation warnings

 We cannot hold back all migrations as some are required e.g. due to a change in a specific component that we want/need to update, we try to bundle others only with major releases.
@@ -115,31 +123,97 @@ This section provides an overview of potential changes to be part of the next ma
  - `persistence.storages.nubusUdmListener.storageClassName`
  - `persistence.storages.nubusProvisioningNats.storageClassName`

-# Automated migrations - Overview and mandatory upgrade path
+# Overview and mandatory upgrade path

 The following table gives an overview of the mandatory upgrade path of openDesk, required in order for the automated migrations to work as expected.

-To upgrade existing deployments, you cannot skip any version mentioned in the column *Mandatory version*. When a version number is not fully defined (e.g. `v1.1.x`), you can install any version matching that constraint.
+To upgrade existing deployments, you _cannot_ skip any version denoted with `yes` in the column
+*Mandatory*. This ensures [automated migrations](#automated-migrations---details) have the required previous
+state of openDesk. When a version number is not fully defined (e.g. `v1.1.x`), you can install any version
+matching that constraint, though our links always point to the newest patch release for that minor version.

-| Mandatory version |
-| ----------------- |
-| v1.5.0            |
-| v1.1.x            |
-| v1.0.0            |
-| v0.9.0            |
-| v0.8.1            |
-<!-- | 1.x.x        |  add the entry to the table as soon as we get new migration requiring that the former migration was executed -->
+> [!warning]
+> You must perform **all** manual pre and post upgrade steps for **any** major, minor and patch version up to your desired openDesk version!

-> **Note**<br>
+> [!note]
+> An exemplary update path for an upgrade from v1.3.2 to v1.7.1 would be:
+> 1. You are at v1.3.2 → pre steps for v1.4.0 to v1.5.0
+> 1. Upgrade to v1.5.0 → post steps for v1.4.0 to v1.5.0
+> 1. You are at v1.5.0 → pre steps for v1.6.0 to 1.7.1
+> 1. Upgrade to v1.7.1 → post steps for v1.6.0 to v1.7.1 
+
+<!-- IMPORTANT: Make sure to mark mandatory releases if an automatic migration requires a previous update to be installed -->
+| Version                                                                                 | Mandatory | Pre-Upgrade                                                                                                                 | Post-Upgrade                            | Minimum Required Previous Version            |
+|-----------------------------------------------------------------------------------------|-----------|-----------------------------------------------------------------------------------------------------------------------------|-----------------------------------------|----------------------------------------------|
+| [v1.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.9.0) | --        | [Pre](#pre-upgrade-to-versions--v190)                                                                                       | --                                      | ⬇ Install &GreaterEqual; v1.5.0 first                                           |
+| [v1.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.8.0) | --        | [Pre](#pre-upgrade-to-versions--v180)                                                                                       | --                                      | ⬇ Install &GreaterEqual; v1.5.0 first                                           |
+| [v1.7.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.7.1) | --        | [Pre](#pre-upgrade-to-versions--v170)                                                                                       | [Post](#post-upgrade-to-versions--v170) | ⬇ Install &GreaterEqual; v1.5.0 first                                           |
+| [v1.6.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.6.0) | --        | [Pre](#pre-upgrade-to-versions--v160)                                                                                       | [Post](#post-upgrade-to-versions--v160) | [⚠ Install v1.5.0 first](#versions--v160-automated) |
+| [v1.5.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.5.0) | **yes**   | --                                                                                                                          | --                                      | ⬇ Install &GreaterEqual; v1.1.x first                                           |
+| [v1.4.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.4.1) | --        | [Pre](#pre-upgrade-to-versions--v140)                                                                                       | --                                      | ⬇ Install &GreaterEqual; v1.1.x first                                           |
+| [v1.3.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.3.2) | --        | [Pre](#pre-upgrade-to-versions--v130)                                                                                       | --                                      | ⬇ Install &GreaterEqual; v1.1.x first                                           |
+| [v1.2.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.2.1) | --        | [Pre](#pre-upgrade-to-versions--v120)                                                                                       | --                                      | [⚠ Install v1.1.x first](#versions--v120-automated) |
+| [v1.1.x](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.1.2) | **yes**   | [Pre .0](#pre-upgrade-to-versions--v110) → [Pre .1](#pre-upgrade-to-versions--v111) → [Pre .2](#pre-upgrade-to-versions--v112) | [Post](#post-upgrade-to-versions--v110) | [⚠ Install v1.0.0 first](#versions--v110-automated) |
+| [v1.0.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v1.0.0) | **yes**   | [Pre](#pre-upgrade-to-versions--v100)                                                                                       | [Post](#post-upgrade-to-versions--v100) | [⚠ Install v0.9.0 first](#versions--v100-automated) |
+| [v0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases/v0.9.0) | **yes**   | --                                                                                                                          | --                                      | --                                           |
+
+> [!warning]
 > Be sure to check out the table in the release version you are going to install, and not the currently installed version.

 If you would like more details about the automated migrations, please read section [Automated migrations - Details](#automated-migrations---details).

 # Manual checks/actions

-## v1.7.1+
+> [!note]
+> We **only** use the mathematical symbol &GreaterEqual; to denote for which versions manual steps must be
+> applied. For example, "Versions &GreaterEqual; v1.7.0" refers to all openDesk versions (major, minor and
+> patch) starting from 1.7.0, e.g. 1.7.0, 1.7.1, 1.8.0, etc. Furthermore, if a version is not explicitly
+> listed no extra manual steps are required when upgrading to that version, e.g. in the case of an update from
+> version 1.7.0 to version 1.7.1.

-### Pre-upgrade to v1.7.1+
+## Versions &GreaterEqual; v1.9.0
+
+### Pre-upgrade to versions &GreaterEqual; v1.9.0
+
+#### Helmfile fix: Cassandra passwords read from `databases.*`
+
+**Target group:** All of the below must apply to your deployment:
+1. Enterprise Edition
+2. Using external Cassandra DB
+3. Defined the Cassandra passwords in `databases.*` (`database.yaml.gotmpl`) which got ignored until now
+4. Defined the Cassandra passwords then in `secrets.*` (`secrets.yaml.gotmpl`)
+
+The Cassandra passwords
+- `databases.dovecotDictmap.password`
+- `databases.dovecotACL.password`
+
+are no longer ignored. So please move the passwords from
+- `secrets.cassandra.dovecotDictmapUser`
+- `secrets.cassandra.dovecotACLUser`
+
+to the `databases.*` structure.
+
+#### Helmfile new feature: `functional.groupware.externalClients.*`
+
+**Target group:**
+Deployments that allow access to groupware emails via external mail clients (e.g. Thunderbird) using IMAP and SMTP.
+
+OX App Suite can display a dialog with configuration details for connecting external mail clients. In previous versions,
+this dialog was automatically enabled when Dovecot was deployed with a service type of `NodePort` or `LoadBalancer`.
+
+From now on, the dialog can be explicitly controlled via the setting
+`functional.groupware.externalClients.enabledOnboardingInfo`, which is set to `false` by default.
+If you want your users to see this dialog, set the attribute to `true`.
+
+Additionally, it is now possible to explicitly define the hostnames shown in the client onboarding dialog using the following values:
+- `functional.groupware.externalClients.fqdnImap`
+- `functional.groupware.externalClients.fqdnSmtp`
+
+If these values are not explicitly set, openDesk will use `.Values.global.domain` as in previous releases.
+
+## Versions &GreaterEqual; v1.8.0
+
+### Pre-upgrade to versions &GreaterEqual; v1.8.0

 #### New application default: Default group for two-factor authentication is now "2FA Users"

@@ -162,7 +236,7 @@ The portal has been migrated to use OIDC for single sign-on by default. This int
  - `secrets.keycloak.clientSecret.portal`: The OIDC client secret for the portal.
  - `secrets.postgresql.umsAuthSessionUser`: For internal databases, set the secret for the database user here. If you are using an external database, you already provide these credentials in the New database step above.

-> **Note**<br>
+> [!note]
 > The SAML Client for the Nubus portal is still preserved in Keycloak and will be removed in one of the next openDesk releases.

 #### New application default: XWiki blocks self-registration of user accounts
@@ -199,7 +273,7 @@ To preserve as much data as possible, dedicated upgrade guidelines for each of t
 - Matrix Meetings widget: https://github.com/nordeck/matrix-meetings?tab=readme-ov-file#matrix-room-upgrades
 - Matrix Poll widget: https://github.com/nordeck/matrix-poll?tab=readme-ov-file#matrix-room-upgrades

-> **Note**<br>
+> [!note]
 > These instructions apply to any room upgrades, not just upgrade to `v12`.

 #### New Helmfile default: Restricting characters for directory and filenames in fileshare module
@@ -252,7 +326,7 @@ The following options, newly introduced in `functional.yaml.gotmpl`, modify the
  The display name is centrally managed by the openDesk IAM.
  To allow users to change it within OX App Suite, set this option to `true`.

-> **Note**<br>
+> [!note]
 > openDesk v1.8.0 adds even more options under `functional.groupware.*` while retaining the current default behaviour.

 #### New application default: Nextcloud apps "Spreed" and "Comments" no longer enabled by default
@@ -294,9 +368,9 @@ Gravatar support is no longer enabled by default in Jitsi and OpenProject. In ca
    OPENPROJECT_PLUGIN__OPENPROJECT__AVATARS: '{enable_gravatars: true, enable_local_avatars: true}'
  ```

-## v1.7.0+
+## Versions &GreaterEqual; v1.7.0

-### Pre-upgrade to v1.7.0+
+### Pre-upgrade to versions &GreaterEqual; v1.7.0

 #### Helmfile fix: Ensure enterprise overrides apply when deploying from project root

@@ -327,7 +401,7 @@ annotation:
  notesYProvider: {}
 ```

-### Post-upgrade to v1.7.0+
+### Post-upgrade to versions &GreaterEqual; v1.7.0

 #### Upstream fix: Provisioning of functional mailboxes

@@ -354,16 +428,18 @@ kill ${PROVISIONING_PORT_FORWARD_PID}
 rm ${TEMPORARY_CONSUMER_JSON}
 ```

-## v1.6.0+
+## Versions &GreaterEqual; v1.6.0

-### Pre-upgrade to v1.6.0+
+### Pre-upgrade to versions &GreaterEqual; v1.6.0

 #### Upstream constraint: Nubus' external secrets

 **Target group:** Operators that use external secrets for Nubus.

-> **Note**<br>
-> External Secrets are not yet a supported feature. We are working on making it available in 2025, though it is possible to make use of the support for external secrets within single applications using the openDesk [customization](../helmfile/environments/default/customization.yaml.gotmpl) options.
+> [!note]
+> External secrets are not yet a supported feature. We are working on making it available in 2025,
+> though it is possible to make use of the support for external secrets within single applications using the
+> openDesk [customization](../helmfile/environments/default/customization.yaml.gotmpl) options.

 Please ensure you read the [Nubus 1.10.0 "Migration steps" section](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/changelog.html#v1-10-0-migration-steps) with focus on the paragraph "Operators that make use of the following UDM Listener secrets variables" and act accordingly.

@@ -409,7 +485,7 @@ kubectl cp -n ${NAMESPACE} open-xchange-core-mw-default-0:/opt/open-xchange/ox-f
 2. Run the upgrade.
 3. Continue with the [related post-upgrade steps](#ox-app-suite-fix-up-using-s3-as-storage-for-non-mail-attachments-post-upgrade)

-### Post-upgrade to v1.6.0+
+### Post-upgrade to versions &GreaterEqual; v1.6.0

 #### OX App Suite fix-up: Using S3 as storage for non mail attachments (post-upgrade)

@@ -450,15 +526,9 @@ ID    Type of Job                              Status     Further Information
 /opt/open-xchange/sbin/unregisterfilestore -A $MASTER_ADMIN_USER -P $MASTER_ADMIN_PW -i <your_old_filestore_id_from_step_3>
 ```

-## v1.4.0+
+## Versions &GreaterEqual; v1.4.0

-### Pre-upgrade to v1.4.0+
-
-#### Helmfile new feature: `functional.authentication.ssoFederation`
-
-**Target group:** Deployments that make use of IdP federation as described in [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
-
-Please ensure to configure your IdP federation config details as part of `functional.authentication.ssoFederation`. You can find more details in the "Example configuration" section of [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
+### Pre-upgrade to versions &GreaterEqual; v1.4.0

 #### Helmfile cleanup: `global.additionalMailDomains` as list

@@ -482,9 +552,19 @@ global:
    - "sub2.maildomain.de"
 ```

-## v1.2.0+
+## Versions &GreaterEqual; v1.3.0

-### Pre-upgrade to v1.2.0+
+### Pre-upgrade to versions &GreaterEqual; v1.3.0
+
+#### Helmfile new feature: `functional.authentication.ssoFederation`
+
+**Target group:** Deployments that make use of IdP federation as described in [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
+
+Please ensure to configure your IdP federation config details as part of `functional.authentication.ssoFederation`. You can find more details in the "Example configuration" section of [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
+
+## Versions &GreaterEqual; v1.2.0
+
+### Pre-upgrade to versions &GreaterEqual; v1.2.0

 #### Helmfile cleanup: Do not configure OX provisioning when no OX installed

@@ -545,9 +625,9 @@ In case you are planning to migrate an existing instance from MariaDB to Postgre
  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport

-## v1.1.2+
+## Versions &GreaterEqual; v1.1.2

-### Pre-upgrade to v1.1.2+
+### Pre-upgrade to versions &GreaterEqual; v1.1.2

 #### Helmfile feature update: App settings wrapped in `apps.` element

@@ -576,9 +656,9 @@ apps:
    enabled: true
 ```

-## v1.1.1+
+## Versions &GreaterEqual; v1.1.1

-### Pre-upgrade to v1.1.1
+### Pre-upgrade to versions &GreaterEqual; v1.1.1

 #### Helmfile feature update: Component specific `storageClassName`

@@ -631,9 +711,9 @@ persistence:

 A not yet templated secret was discovered in the Nubus deployment. It is now declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) and can be defined using: `secrets.nubus.masterpassword`. If you define your own secrets, please be sure this new secret is set to the same value as the `MASTER_PASSWORD` environment variable used in your deployment.

-## v1.1.0+
+## Versions &GreaterEqual; v1.1.0

-### Pre-upgrade to v1.1.0
+### Pre-upgrade to versions &GreaterEqual; v1.1.0

 #### Helmfile cleanup: Restructured `/helmfile/files/theme` folder

@@ -796,7 +876,7 @@ The update from openDesk v1.0.0 contains Redis 7.4.1, like the other openDesk bu

 Please ensure the Redis you are using is updated to at least version 7.4 to support the requirement of OX App Suite.

-### Post-upgrade to v1.1.0+
+### Post-upgrade to versions &GreaterEqual; v1.1.0

 #### XWiki fix-ups

@@ -822,13 +902,13 @@ Unfortunately XWiki does not upgrade itself as expected. The bug has been report

 You should have now a fully functional XWiki instance with single sign-on and full-text search.

-## v1.1.0
+## Versions &GreaterEqual; v1.0.0

-### Pre-upgrade to v1.1.0
+### Pre-upgrade to versions &GreaterEqual; v1.0.0

 #### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus

-> **Warning**<br>
+> [!warning]
 > The upgrade will fail if you do not address this section in your current deployment.

 The update will remove unnecessary OX-Profiles in Nubus, so long as these profiles are in use.
@@ -1006,7 +1086,7 @@ The IAM admin account `Administrator` is the only member of this group by defaul

 If you need other accounts to use the API, please assign them to the aforementioned group.

-### Post-upgrade to v1.0.0+
+### Post-upgrade to versions &GreaterEqual; v1.0.0

 #### Configuration Improvement: Separate user permission for using Video Conference component

@@ -1022,7 +1102,7 @@ This can be done as IAM admin:
 - Check the checkbox for *Video Conference* and the directly below check box for *Overwrite*.
 - Click on the green *Save* button at the top of the screen to apply the change.

-> **Hint**<br>
+> [!tip]
 > If you have a lot of users and want to update (almost) all them, you can select all users by clicking the checkbox in the user's table header and then de-selecting the users you do not want to update.

 #### Optional Cleanup
@@ -1038,33 +1118,33 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0

 # Automated migrations - Details

-## v1.6.0+ (automated)
+## Versions &GreaterEqual; v1.6.0 (automated)

-> **Note**<br>
+> [!note]
 > Details can be found in [run_5.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_5.py).

-### v1.6.0+ migrations-post
+### Versions &GreaterEqual; v1.6.0 migrations-post

-Restarting the StatefulSets `ums-provisioning-nats` and `ox-connector` due to a workaround applied on the NATS secrets, see the "Notes" segment of the ["Password seed" heading in getting-started.md](./docs/getting-started.md#password-seed)
+- Automatically restarts the StatefulSets `ums-provisioning-nats` and `ox-connector` due to a workaround applied on the NATS secrets, see the "Notes" segment of the ["Password seed" heading in getting-started.md](./docs/getting-started.md#password-seed)

-> **Note**<br>
+> [!note]
 > This change aims to prevent authentication failures with NATS in some Pods, which can lead to errors such as: `wait-for-nats Unavailable, waiting 2 seconds. Error: nats: 'Authorization Violation'`.

-## v1.2.0+ (automated)
+## Versions &GreaterEqual; v1.2.0 (automated)

-> **Note**<br>
+> [!note]
 > Details can be found in [run_4.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_4.py).

-### v1.2.0+ migrations-pre
+### Versions &GreaterEqual; v1.2.0 migrations-pre

- Delete PVC `group-membership-cache-ums-portal-consumer-0`: With the upgrade the Nubus Portal Consumer no longer requires to be executed with root privileges. The PVC contains files that require root permission to access them, therefore the PVC gets deleted (and re-created) during the upgrade.
- Delete StatefulSet `ums-portal-consumer`: A bug was fixed in the templating of the Portal Consumer's PVC causing the values in `persistence.storages.nubusPortalConsumer.*` to be ignored. As these values are immutable, we had to delete the whole StatefulSet.
+- Automatically deletes PVC `group-membership-cache-ums-portal-consumer-0`: With the upgrade the Nubus Portal Consumer no longer requires to be executed with root privileges. The PVC contains files that require root permission to access them, therefore the PVC gets deleted (and re-created) during the upgrade.
+- Automatically deletes StatefulSet `ums-portal-consumer`: A bug was fixed in the templating of the Portal Consumer's PVC causing the values in `persistence.storages.nubusPortalConsumer.*` to be ignored. As these values are immutable, we had to delete the whole StatefulSet.

-### v1.2.0+ migrations-post
+### Versions &GreaterEqual; v1.2.0 migrations-post

- Restarting Deployment `ums-provisioning-udm-transformer` and StatefulSet `ums-provisioning-udm-listener` as well as deleting the Nubus Provisioning consumer `durable_name:incoming` on stream `stream:incoming`: Due to a bug in Nubus 1.7.0 the `incoming` stream was blocked after the upgrade, the aforementioned measures unblock the stream.
+- Automatically restarts the Deployment `ums-provisioning-udm-transformer` and StatefulSet `ums-provisioning-udm-listener` and deletes the Nubus Provisioning consumer `durable_name:incoming` on stream `stream:incoming`: Due to a bug in Nubus 1.7.0 the `incoming` stream was blocked after the upgrade, the aforementioned measures unblock the stream.

-## v1.1.0+ (automated)
+## Versions &GreaterEqual; v1.1.0 (automated)

 With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.

@@ -1072,16 +1152,16 @@ openDesk's automated migrations takes care of this upgrade requirement described
 [Nubus 1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.5.1/en/changelog.html#migrate-existing-ldap-server-to-mirror-mode-readiness),
 creating the config map with the mentioned label.

-> **Note**<br>
+> [!note]
 > Details can be found in [run_3.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).

-## v1.0.0+ (automated)
+## Versions &GreaterEqual; v1.0.0 (automated)

 The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.

 The permissions required to execute the migrations can be found in the migration's Helm chart [`role.yaml'](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/v1.3.5/charts/opendesk-migrations/templates/role.yaml?ref_type=tags#L29).

-> **Note**<br>
+> [!note]
 > Details can be found in [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).

 ## Related components and artifacts
--- a/docs/permissions.md
+++ b/docs/permissions.md
@@ -52,8 +52,9 @@ Roles are defined sets of permissions that can be assigned to users. Each role c
 - **openDesk Administrator**: Manages openDesk-global settings, such as users and groups.
 - **openDesk User**: Can log in to openDesk to make use of defined openDesk applications.

-> **Note**<br>
-> Although it is not enforced by openDesk, it is strongly recommended that a user account is not granted both roles at the same time. This is to maintain the separation of duties.
+> [!note]
+> Although it is not enforced by openDesk, it is strongly recommended that a user account is not granted both
+> roles at the same time. This is to maintain the separation of duties.

 ### Application usage

@@ -93,15 +94,20 @@ When editing a user in the IAM, you can select if a user can access or get eleva

 To easily identify these groups, all of them are prefixed with `managed-by-Attribute-`.

-> **Note**<br>
-> The membership of these groups is automatically managed based on the user's attributes from the "openDesk" tab. Any changes directly to the groups will be overwritten, so please always use the "openDesk" tab of the respective user. The IAM supports editing user attributes across multiple accounts simultaneously.
+> [!note]
+> The membership of these groups is automatically managed based on the user's attributes from the "openDesk"
+> tab. Any changes directly to the groups will be overwritten, so please always use the "openDesk" tab of the
+> respective user. The IAM supports editing user attributes across multiple accounts simultaneously.

 #### Standard access to applications

 Unless a user is a member of a group, the respective application is not shown in the portal.

-> **Note**<br>
-> In openDesk's identity provider, the required OIDC claims to access an application are only granted when the respective group membership is available. This means that even if a user who is not a member of an application group knows the link to the application and calls it directly, the single sign-on will be unsuccessful.
+> [!note]
+> In openDesk's identity provider, the required OIDC claims to access an application are only granted when the
+> respective group membership is available. This means that even if a user who is not a member of an
+> application group knows the link to the application and calls it directly, the single sign-on will be
+> unsuccessful.

 - **managed-by-Attribute-Groupware**: Members of this group have access to the groupware applications.
 - **managed-by-Attribute-Fileshare**: Members of this group have access to the file sharing application.
@@ -130,7 +136,7 @@ Users get roles assigned based on their responsibilities and the tasks they need

 openDesk defines [templates](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/65-usertemplate.yaml) for the *User* and *Administrator* roles. The templates can be used by an *openDesk Administrator* to create users with these roles using the [administration portal](https://docs.opendesk.eu/administration/).

-> **Note**<br>
+> [!note]
 > Additional/custom templates can be created using the UDM REST API.

 ### *openDesk User*
@@ -195,8 +201,10 @@ Managing all application permissions within the IAM would require a superset of

 Within IAM groups, the visibility of openDesk applications can be configured. Like with users, this is done in the "openDesk" tab of the [group administration](https://docs.opendesk.eu/administration/gruppen/).

-> **Note**<br>
-> Currently the openDesk applications do not support nested groups. As a result only direct group memberships of users are processed in the application.<br>
-> The plan is to enable the openDesk applications to either support nested groups or to actively provision users into an application while resolving the nested group memberships for the application.
+> [!note]
+> Currently the openDesk applications do not support nested groups. As a result only direct group memberships
+> of users are processed in the application.<br> The plan is to enable the openDesk applications to either
+> support nested groups or to actively provision users into an application while resolving the nested group
+> memberships for the application.

 Within an application, each available group can have a set of application specific permissions assigned.
--- a/docs/releases.md
+++ b/docs/releases.md
@@ -34,7 +34,10 @@ openDesk follows a structured release cycle to ensure predictability and reliabi
 | **Minor**      | Monthly        | New features, enhancements, may contain breaking changes or refactors (clearly flagged in the notes)              |
 | **Patch**      | On demand      | Bug fixes, security updates, minor improvements, no intended breaking changes               |

-> **Note:** openDesk does **not** guarantee that minor releases are 100% backward‑compatible. When a breaking change is unavoidable it is announced in the release notes under a dedicated header **“Breaking Changes”** and a migration guide is provided.
+> [!note]
+> openDesk does **not** guarantee that minor releases are 100% backward‑compatible. When a breaking > change
+> is unavoidable it is announced in the release notes under a dedicated header **“Breaking Changes”** > and a
+> migration guide is provided.

 ## Release schedule

@@ -52,7 +55,7 @@ openDesk follows a structured release cycle to ensure predictability and reliabi
 - openDesk does not guarantee an in‑place upgrade between two major versions. Always consult the release notes and plan appropriate migration efforts.
 - Even within the same major line, skipping multiple monthly minor versions is not guaranteed to work without intermediate upgrade steps.
 - All breaking changes, including those in monthly minor releases, are highlighted in the release notes under Breaking Changes.
- Additional, non‑binding migration hints are collected in `migrations.md`
+- Additional, non‑binding migration hints are collected in [migrations.md](./migrations.md)

 # Patch management process

--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -55,7 +55,7 @@ Any self-hosted or managed K8s cluster >= v1.24 listed in

 The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/kubespray) based clusters.

-> **Note**<br>
+> [!note]
 > The deployment is not tested against OpenShift.

 # Ingress controller
@@ -67,7 +67,7 @@ configured ingress controller deployed in your cluster.

 - [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx)

-> **Note**<br>
+> [!note]
 > The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/).

 **Compatibility with Ingress NGINX >= 1.12.0**
@@ -79,8 +79,9 @@ controller.config.strict-validate-path-type=false
 ```
 See the [`annotations-risk-level` documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotations-risk-level) and [`strict-validate-path-type` documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#strict-validate-path-type) for details.

-> **Important Note**<br>
-> Ensure to install at least Ingress NGINX 1.11.5 or 1.12.1 due to [security issues](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) in earlier versions.
+> [!warning]
+> Ensure to install at least Ingress NGINX 1.11.5 or 1.12.1 due to [security
+> issues](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) in earlier versions.

 ## Minimal configuration

@@ -96,7 +97,7 @@ See the [`allowSnippetAnnotations` documentation](https://kubernetes.github.io/i
 Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment, a local- or hostPath-
 provisioner is sufficient.

-> **Note**<br>
+> [!note]
 > Some components require a `ReadWriteMany` volume provisioner for distributed mode or horizontal scaling.

 # Certificate management
--- a/docs/theming.md
+++ b/docs/theming.md
@@ -20,9 +20,9 @@ Please review the default configuration that is applied to understand your custo

 You can just update the files in [helmfile/files/theme](../helmfile/files/theme) to change logos, favicons etc. Note that the `.svg` versions of the favicons are also used for the portal tiles.

-> **Note**<br>
-> Theming focuses on colors, iconography and imagery. If you like to adapt the default links in the portal pointing to external
-> resources (like "Support", "Legal Notice") please check the `functional.portal` section
+> [!note]
+> Theming focuses on colors, iconography and imagery. If you like to adapt the default links in the portal
+> pointing to external resources (like "Support", "Legal Notice") please check the `functional.portal` section
 > in [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl)

 # Known limitations
--- a/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
+++ b/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
@@ -47,7 +47,10 @@ ingress:
        - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"

 podAnnotations:
-  {{ .Values.annotations.coco.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "collabora-controller"
+  {{- with .Values.annotations.coco.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 securityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/collabora/values.yaml.gotmpl
+++ b/helmfile/apps/collabora/values.yaml.gotmpl
@@ -110,7 +110,10 @@ ingress:
        - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"

 podAnnotations:
-  {{ .Values.annotations.collabora.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "collabora"
+  {{- with .Values.annotations.collabora.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  fsGroup: 1001
--- a/helmfile/apps/cryptpad/values.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/values.yaml.gotmpl
@@ -55,7 +55,10 @@ persistence:
  enabled: false

 podAnnotations:
-  {{ .Values.annotations.cryptpad.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "cryptpad"
+  {{- with .Values.annotations.cryptpad.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  fsGroup: 4001
--- a/helmfile/apps/element/values-element.yaml.gotmpl
+++ b/helmfile/apps/element/values-element.yaml.gotmpl
@@ -143,7 +143,10 @@ ingress:
    {{ .Values.annotations.element.ingress | toYaml | nindent 4 }}

 podAnnotations:
-  {{ .Values.annotations.element.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-element"
+  {{- with .Values.annotations.element.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl
@@ -44,7 +44,10 @@ ingress:
    {{ .Values.annotations.elementMatrixNeoboardWidget.ingress | toYaml | nindent 4 }}

 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeoboardWidget.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "matrix-neoboard-widget"
+  {{- with .Values.annotations.elementMatrixNeoboardWidget.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl
@@ -44,7 +44,10 @@ ingress:
    {{ .Values.annotations.elementMatrixNeochoiceWidget.ingress | toYaml | nindent 4 }}

 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeochoiceWidget.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "matrix-neochoice-widget"
+  {{- with .Values.annotations.elementMatrixNeochoiceWidget.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
@@ -25,7 +25,10 @@ image:
 fullnameOverride: "matrix-neodatefix-bot-bootstrap"

 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeodatefixBotBootstrap.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "values-matrix-neodatefix-bot-bootstrap"
+  {{- with .Values.annotations.elementMatrixNeodatefixBotBootstrap.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 securityContext:
  allowPrivilegeEscalation: false
@@ -42,7 +45,7 @@ securityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}

-podAnnotations:
-  {{ .Values.annotations.elementMatrixNeodatefixBotBootstrap.serviceAccount | toYaml | nindent 2 }}
-
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementMatrixNeodatefixBotBootstrap.serviceAccount | toYaml | nindent 4 }}
 ...
--- a/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
@@ -90,7 +90,10 @@ persistence:
    {{ .Values.annotations.elementMatrixNeodatefixBot.persistence | toYaml | nindent 4 }}

 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeodatefixBot.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "matrix-neodatefix-bot"
+  {{- with .Values.annotations.elementMatrixNeodatefixBot.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl
@@ -49,7 +49,10 @@ ingress:
    {{ .Values.annotations.elementMatrixNeodatefixWidget.ingress | toYaml | nindent 4 }}

 podAnnotations:
-  {{ .Values.annotations.elementMatrixNeodatefixWidget.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "matrix-neodatefix-widget"
+  {{- with .Values.annotations.elementMatrixNeodatefixWidget.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
@@ -25,7 +25,10 @@ image:
 fullnameOverride: "opendesk-matrix-user-verification-service-bootstrap"

 podAnnotations:
-  {{ .Values.annotations.elementMatrixUserVerificationServiceBootstrap.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-matrix-user-verification-service-bootstrap"
+  {{- with .Values.annotations.elementMatrixUserVerificationServiceBootstrap.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 securityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
@@ -44,7 +44,10 @@ image:
  tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}

 podAnnotations:
-  {{ .Values.annotations.elementMatrixUserVerificationService.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-matrix-user-verification-service"
+  {{- with .Values.annotations.elementMatrixUserVerificationService.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/element/values-synapse-admin.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-admin.yaml.gotmpl
@@ -56,7 +56,12 @@ cron:
    repository: {{ .Values.images.elementSyncAdmins.repository | quote }}
    tag: {{ .Values.images.elementSyncAdmins.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations:
+    intents.otterize.com/service-name: "opendesk-synapse-admin-cron"
 #fullnameOverride: "opendesk-synapse-admin"
+
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-admin"
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSynapseAdmin.registry | quote }}
  repository: {{ .Values.images.elementSynapseAdmin.repository | quote }}
--- a/helmfile/apps/element/values-synapse-adminbot-pipe.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-adminbot-pipe.yaml.gotmpl
@@ -16,4 +16,6 @@ image:
  tag: {{ .Values.images.elementPipe.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 fullnameOverride: "opendesk-synapse-adminbot-pipe"
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-adminbot-pipe"
 ...
--- a/helmfile/apps/element/values-synapse-adminbot-web.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-adminbot-web.yaml.gotmpl
@@ -20,4 +20,6 @@ ingress:
  enabled: {{ .Values.ingress.enabled }}
  tls:
    secretName: {{ .Values.ingress.tls.secretName | quote }}
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-adminbot-web"
 ...
--- a/helmfile/apps/element/values-synapse-auditbot-pipe.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-auditbot-pipe.yaml.gotmpl
@@ -16,4 +16,6 @@ image:
  tag: {{ .Values.images.elementPipe.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 fullnameOverride: "opendesk-synapse-auditbot-pipe"
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-auditbot-pipe"
 ...
--- a/helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl
@@ -51,4 +51,6 @@ image:
  url: {{ .Values.images.elementGroupsync.repository | quote }}
  tag: {{ .Values.images.elementGroupsync.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+podAnnotations:
+  intents.otterize.com/service-name: "opendesk-synapse-groupsync"
 ...
--- a/helmfile/apps/element/values-synapse-web.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-web.yaml.gotmpl
@@ -56,7 +56,10 @@ ingress:
    secretName: {{ .Values.ingress.tls.secretName | quote }}

 podAnnotations:
-  {{ .Values.annotations.elementSynapseWeb.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-synapse-web"
+  {{- with .Values.annotations.elementSynapseWeb.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -250,7 +250,10 @@ persistence:
    {{ .Values.annotations.elementSynapse.persistence | toYaml | nindent 4 }}

 podAnnotations:
-  {{ .Values.annotations.elementSynapse.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-synapse"
+  {{- with .Values.annotations.elementSynapse.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/element/values-well-known.yaml.gotmpl
+++ b/helmfile/apps/element/values-well-known.yaml.gotmpl
@@ -49,7 +49,10 @@ ingress:
    {{ .Values.annotations.elementWellKnown.ingress | toYaml | nindent 4 }}

 podAnnotations:
-  {{ .Values.annotations.elementWellKnown.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-well-known"
+  {{- with .Values.annotations.elementWellKnown.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -111,10 +111,11 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiWeb.pod }}
    podAnnotations:
-      {{ .Values.annotations.jitsiWeb.pod | toYaml | nindent 6 }}
-    {{- end }}
+      intents.otterize.com/service-name: "jitsi-web"
+      {{- with .Values.annotations.jitsiWeb.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
  prosody:
    image:
      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
@@ -164,10 +165,11 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.prosody | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiProsody.pod }}
    podAnnotations:
-      {{ .Values.annotations.jitsiProsody.pod | toYaml | nindent 6 }}
-    {{- end }}
+      intents.otterize.com/service-name: "jitsi-prosody"
+      {{- with .Values.annotations.jitsiProsody.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
  jicofo:
    replicaCount: {{ .Values.replicas.jicofo }}
    image:
@@ -191,10 +193,11 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiJicofo.pod }}
    podAnnotations:
-      {{ .Values.annotations.jitsiJicofo.pod | toYaml | nindent 6 }}
-    {{- end }}
+      intents.otterize.com/service-name: "jitsi-jicofo"
+      {{- with .Values.annotations.jitsiJicofo.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
  jigasi:
    replicaCount: {{ .Values.replicas.jigasi }}
    enabled: {{ .Values.sip.jigasi.enabled }}
@@ -224,10 +227,11 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jigasi | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiJigasi.pod }}
    podAnnotations:
-      {{ .Values.annotations.jitsiJigasi.pod | toYaml | nindent 6 }}
-    {{- end }}
+      intents.otterize.com/service-name: "jitsi-jigasi"
+      {{- with .Values.annotations.jitsiJigasi.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
  jvb:
    replicaCount: {{ .Values.replicas.jvb }}
    # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
@@ -260,10 +264,11 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jvb | toYaml | nindent 8 }}
-    {{- if .Values.annotations.jitsiJvb.pod }}
    podAnnotations:
-      {{ .Values.annotations.jitsiJvb.pod | toYaml | nindent 6 }}
-    {{- end }}
+      intents.otterize.com/service-name: "jitsi-jvb"
+      {{- with .Values.annotations.jitsiJvb.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    metrics:
      prometheusAnnotations:
        {{ .Values.annotations.jitsiJvb.metricsPrometheus | toYaml | nindent 8 }}
@@ -288,10 +293,11 @@ jitsi:
      # Chart does not allow to template more
      capabilities:
        add: ["SYS_ADMIN"]
-    {{- if .Values.annotations.jitsiJibri.pod }}
    podAnnotations:
-      {{ .Values.annotations.jitsiJibri.pod | toYaml | nindent 6 }}
-    {{- end }}
+      intents.otterize.com/service-name: "jitsi-jibri"
+      {{- with .Values.annotations.jitsiJibri.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
  imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
    - name: {{ . | quote }}
--- a/helmfile/apps/nextcloud/values-nextcloud-management.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-management.yaml.gotmpl
@@ -10,7 +10,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 additionalAnnotations:
-  intents.otterize.com/service-name: "opendesk-nextcloud-php"
+  intents.otterize.com/service-name: "opendesk-nextcloud-management"
  {{- with .Values.annotations.nextcloudNextcloudMgmt.additional }}
  {{ . | toYaml | nindent 2}}
  {{- end }}
--- a/helmfile/apps/nextcloud/values-nextcloud-notifypush.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-notifypush.yaml.gotmpl
@@ -10,7 +10,6 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 additionalAnnotations:
-  intents.otterize.com/service-name: "opendesk-nextcloud-notifypush"
  {{- with .Values.annotations.nextcloudNotifyPush.additional }}
  {{ . | toYaml | nindent 4 }}
  {{- end }}
@@ -114,7 +113,10 @@ metrics:
      {{ .Values.annotations.nextcloudNotifyPush.serviceMetrics | toYaml | nindent 6 }}

 podAnnotations:
-  {{ .Values.annotations.nextcloudNotifyPush.pod | toYaml | nindent 4 }}
+  intents.otterize.com/service-name: "opendesk-nextcloud-notifypush"
+  {{- with .Values.annotations.nextcloudNotifyPush.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
 podSecurityContext:
  fsGroup: 101
 # prometheus:
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -39,7 +39,10 @@ exporter:
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    tag: {{ .Values.images.nextcloudExporter.tag | quote }}
  podAnnotations:
-    {{ .Values.annotations.nextcloudExporter.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "opendesk-nextcloud-exporter"
+    {{- with .Values.annotations.nextcloudExporter.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  prometheus:
    serviceMonitor:
      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
@@ -76,7 +79,7 @@ aio:
            topologyKey: "kubernetes.io/hostname"

  additionalAnnotations:
-    intents.otterize.com/service-name: "opendesk-nextcloud-aio"
+    intents.otterize.com/service-name: "opendesk-nextcloud-aio-cron"
    {{- with .Values.annotations.nextcloudAio.additional }}
    {{ . | toYaml | nindent 4 }}
    {{- end }}
@@ -177,7 +180,10 @@ aio:
    tls:
      secretName: {{ .Values.ingress.tls.secretName | quote }}
  podAnnotations:
-    {{ .Values.annotations.nextcloudAio.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "opendesk-nextcloud-aio"
+    {{- with .Values.annotations.nextcloudAio.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  podSecurityContext:
    fsGroup: 101
  prometheus:
--- a/helmfile/apps/notes/values.yaml.gotmpl
+++ b/helmfile/apps/notes/values.yaml.gotmpl
@@ -117,11 +117,20 @@ backend:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.notesBackend | toYaml | nindent 6 }}
  podAnnotations:
-    {{ .Values.annotations.notesBackend.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-backend"
+    {{- with .Values.annotations.notesBackend.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  podAnnotationsCreateUser:
-    {{ .Values.annotations.notesBackend.createUserJob | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-create-user"
+    {{- with .Values.annotations.notesBackend.createUserJob }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  podAnnotationsMigrate:
-    {{ .Values.annotations.notesBackend.migrateJob | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-migrate"
+    {{- with .Values.annotations.notesBackend.migrateJob }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  podSecurityContext:
    enabled: true
    fsGroup: 1000
@@ -189,7 +198,10 @@ frontend:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.notesFrontend | toYaml | nindent 6 }}
  podAnnotations:
-    {{ .Values.annotations.notesFrontend.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-frontend"
+    {{- with .Values.annotations.notesFrontend.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  podSecurityContext:
    enabled: true
    fsGroup: 1000
@@ -257,7 +269,10 @@ y-provider:
      {{ .Values.annotations.notesYProvider.ingressCollaborationWS | toYaml | nindent 6 }}
    ingressClassName: {{ .Values.ingress.ingressClassName }}
  podAnnotations:
-    {{ .Values.annotations.notesYProvider.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "impress-y-provider"
+    {{- with .Values.annotations.notesYProvider.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  podSecurityContext:
    enabled: true
    fsGroup: 1001
--- a/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
@@ -109,7 +109,10 @@ ingress:
    {{ .Values.annotations.nubusIntercomService.ingress | toYaml | nindent 4 }}

 podAnnotations:
-  {{ .Values.annotations.nubusIntercomService.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "intercom-service"
+  {{- with .Values.annotations.nubusIntercomService.pod }}
+  {{ . | toYaml | nindent 2}}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
@@ -42,7 +42,10 @@ configuration:
      value: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}

 podAnnotations:
-  {{ .Values.annotations.nubusNginxS3Gateway.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "nubus-nginx-s3-gateway"
+  {{- with .Values.annotations.nubusNginxS3Gateway.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 resources:
  {{ .Values.resources.nginxS3Gateway | toYaml | nindent 2 }}
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -274,7 +274,6 @@ nubusTwofaHelpdesk:
 nubusNotificationsApi:
  enabled: false
  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-notifications-api"
    {{- with .Values.annotations.nubusNotificationsApi.additional }}
    {{ . | toYaml | nindent 4 }}
    {{- end }}
@@ -312,7 +311,10 @@ nubusNotificationsApi:
    annotations:
      {{ .Values.annotations.nubusNotificationsApi.persistence | toYaml | nindent 6 }}
  podAnnotations:
-    {{ .Values.annotations.nubusNotificationsApi.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-notifications-api"
+    {{- with .Values.annotations.nubusNotificationsApi.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  postgresql:
    connection:
      host: {{ .Values.databases.umsNotificationsApi.host | quote }}
@@ -339,7 +341,6 @@ nubusNotificationsApi:

 nubusPortalFrontend:
  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-portal-frontend"
    {{- with .Values.annotations.nubusPortalFrontend.additional }}
    {{ . | toYaml | nindent 4 }}
    {{- end }}
@@ -415,7 +416,10 @@ nubusPortalFrontend:
    annotations:
      {{ .Values.annotations.nubusPortalFrontend.persistence | toYaml | nindent 6 }}
  podAnnotations:
-    {{ .Values.annotations.nubusPortalFrontend.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-portal-frontend"
+    {{- with .Values.annotations.nubusPortalFrontend.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  portalFrontend:
    branding:
      css: {{ .Values.theme.styles.portal.main | toJson }}
@@ -666,7 +670,6 @@ nubusPortalConsumer:

 nubusPortalServer:
  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-portal-server"
    {{- with .Values.annotations.nubusPortalServer.additional }}
    {{ . | toYaml | nindent 4 }}
    {{- end }}
@@ -711,7 +714,10 @@ nubusPortalServer:
    annotations:
      {{ .Values.annotations.nubusPortalServer.persistence | toYaml | nindent 6 }}
  podAnnotations:
-    {{ .Values.annotations.nubusPortalServer.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-portal-server"
+    {{- with .Values.annotations.nubusPortalServer.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  portalServer:
    centralNavigation:
      enabled: true
@@ -839,7 +845,10 @@ nubusUdmRestApi:
    annotations:
      {{ .Values.annotations.nubusUdmRestApi.persistence | toYaml | nindent 6 }}
  podAnnotations:
-    {{ .Values.annotations.nubusUdmRestApi.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-udm-rest-api"
+    {{- with .Values.annotations.nubusUdmRestApi.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end}}
  replicaCount: {{ .Values.replicas.umsUdmRestApi }}
  resources:
    {{ .Values.resources.umsUdmRestApi | toYaml | nindent 4 }}
@@ -898,7 +907,7 @@ nubusLdapServer:
  additionalAnnotations:
    {{ .Values.annotations.nubusLdapServer.additional | toYaml | nindent 4 }}
  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-ldap-server"
+    {{ .Values.annotations.nubusLdapServer.additional | toYaml | nindent 4 }}
  dhInitcontainer:
    image:
      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServerDhInitContainer.registry | quote }}
@@ -921,7 +930,10 @@ nubusLdapServer:
    size: {{ .Values.persistence.storages.nubusLdapServerData.size | quote }}
    storageClass: {{ coalesce .Values.persistence.storages.nubusLdapServerData.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
  podAnnotations:
-    {{ .Values.annotations.nubusLdapServer.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-ldap-server"
+    {{- with .Values.annotations.nubusLdapServer.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  replicaCountPrimary: {{ .Values.replicas.umsLdapServerPrimary }}
  replicaCountSecondary: {{ .Values.replicas.umsLdapServerSecondary }}
  replicaCountProxy: {{ .Values.replicas.umsLdapServerProxy }}
@@ -947,7 +959,6 @@ nubusProvisioning:
    {{ .Values.annotations.nubusProvisioning.additional | toYaml | nindent 4 }}
  api:
    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-api"
      {{- with .Values.annotations.nubusProvisioning.apiAdditional }}
      {{ . | toYaml | nindent 6 }}
      {{- end }}
@@ -966,7 +977,10 @@ nubusProvisioning:
      auth:
        password: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
    podAnnotations:
-      {{ .Values.annotations.nubusProvisioning.apiPod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "ums-provisioning-api"
+      {{- with .Values.annotations.nubusProvisioning.apiPod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    resources:
      {{ .Values.resources.umsProvisioningApi | toYaml | nindent 6 }}
  containerSecurityContext:
@@ -985,7 +999,6 @@ nubusProvisioning:
      {{ .Values.seLinuxOptions.umsProvisioning | toYaml | nindent 6 }}
  dispatcher:
    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-dispatcher"
      {{- with .Values.annotations.nubusProvisioning.dispatcherAdditional }}
      {{ . | toYaml | nindent 6 }}
      {{- end }}
@@ -997,12 +1010,14 @@ nubusProvisioning:
      auth:
        password: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
    podAnnotations:
-      {{ .Values.annotations.nubusProvisioning.dispatcherPod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "ums-provisioning-dispatcher"
+      {{- with .Values.annotations.nubusProvisioning.dispatcherPod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    resources:
      {{ .Values.resources.umsProvisioningDispatcher | toYaml | nindent 6 }}
  nats:
    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-nats"
      {{- with .Values.annotations.nubusProvisioning.natsAdditional }}
      {{ . | toYaml | nindent 6 }}
      {{- end }}
@@ -1060,10 +1075,12 @@ nubusProvisioning:
    serviceAccount:
      create: true
  podAnnotations:
-    {{ .Values.annotations.nubusProvisioning.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-provisioning-nats"
+    {{- with .Values.annotations.nubusProvisioning.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  prefill:
    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-prefill"
      {{- with .Values.annotations.nubusProvisioning.prefillAdditional }}
      {{ . | toYaml | nindent 6 }}
      {{- end }}
@@ -1075,12 +1092,14 @@ nubusProvisioning:
      auth:
        password: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
    podAnnotations:
-      {{ .Values.annotations.nubusProvisioning.prefillPod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "ums-provisioning-prefill"
+      {{- with .Values.annotations.nubusProvisioning.prefillPod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    resources:
      {{ .Values.resources.umsProvisioningPrefill | toYaml | nindent 6 }}
  udmTransformer:
    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-udm-transformer"
      {{- with .Values.annotations.nubusProvisioning.udmTransformerAdditional }}
      {{ . | toYaml | nindent 6 }}
      {{- end }}
@@ -1092,7 +1111,10 @@ nubusProvisioning:
      auth:
        password: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
    podAnnotations:
-      {{ .Values.annotations.nubusProvisioning.udmTransformerPod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "ums-provisioning-udm-transformer"
+      {{- with .Values.annotations.nubusProvisioning.udmTransformerPod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    resources:
      {{ .Values.resources.umsProvisioningUdmTransformer | toYaml | nindent 6 }}
  replicaCount:
@@ -1163,7 +1185,10 @@ nubusUdmListener:
    size: {{ .Values.persistence.storages.nubusUdmListener.size | quote }}
 #    storageClass: -- coalesce .Values.persistence.storages.nubusUdmListener.storageClassName .Values.persistence.storageClassNames.RWO | quote --
  podAnnotations:
-    {{ .Values.annotations.nubusUdmListener.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-provisioning-udm-listener"
+    {{- with .Values.annotations.nubusUdmListener.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  replicaCount: {{ .Values.replicas.umsUdmListener }}
  resources:
    {{ .Values.resources.umsUdmListener | toYaml | nindent 4 }}
@@ -1219,9 +1244,9 @@ nubusSelfServiceConsumer:
 # Nubus services
 nubusStackDataUms:
  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-stack-data-ums"
    argocd.argoproj.io/hook: "Sync"
    argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
-    intents.otterize.com/service-name: "ums-stack-data-ums"
    {{- with .Values.annotations.nubusStackDataUms.additional }}
    {{ . | toYaml | nindent 4 }}
    {{- end }}
@@ -1270,7 +1295,10 @@ nubusStackDataUms:
      connection:
        host: {{ .Values.databases.umsSelfservice.host | quote }}
  podAnnotations:
-    {{ .Values.annotations.nubusStackDataUms.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-stack-data-ums"
+    {{- with .Values.annotations.nubusStackDataUms.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  resources:
    {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}
  stackDataContext:
@@ -1325,6 +1353,7 @@ nubusStackDataUms:
    portalLinkSupport: {{ .Values.functional.portal.linkSupport | quote }}
    portalLinkFeedback: {{ .Values.functional.portal.linkFeedback | quote }}
    oxDefaultContext: "1"
+    oxDefaultLanguage: {{ .Values.functional.internationalization.defaultLanguage | quote }}
    oxContextHidden: true
    oxSystemUserPassword: {{ .Values.secrets.nubus.ldapSearch.ox }}
    portalOxLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
@@ -1458,7 +1487,10 @@ nubusUmcServer:
    auth:
      password: ""
  podAnnotations:
-    {{ .Values.annotations.nubusUmcServer.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-umc-server"
+    {{- with .Values.annotations.nubusUmcServer.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  # Ref.: https://docs.software-univention.de/nubus-kubernetes-operation/1.x/en/reference.html#envvar-nubusUmcServer.podManagementPolicy
  podManagementPolicy: "{{ if gt .Values.replicas.umsUmcServer 4 }}Parallel{{ else }}OrderedReady{{ end }}"
  postgresql:
@@ -1554,7 +1586,10 @@ nubusUmcGateway:
  initResources:
    {{ .Values.resources.umsUmcGateway | toYaml | nindent 4 }}
  podAnnotations:
-    {{ .Values.annotations.nubusUmcGateway.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "ums-umc-gateway"
+    {{- with .Values.annotations.nubusUmcGateway.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  replicaCount: {{ .Values.replicas.umsUmcGateway }}
  serviceAccount:
    annotations:
--- a/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
@@ -23,7 +23,7 @@ dovecot:
    port: {{ .Values.databases.dovecotDictmap.port }}
    username: {{ .Values.databases.dovecotDictmap.username | quote }}
    password:
-      value: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
+      value: {{ .Values.databases.dovecotDictmap.password | default .Values.secrets.cassandra.dovecotDictmapUser | quote }}
    keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
  sharedMailboxes:
    enabled: true
@@ -31,7 +31,7 @@ dovecot:
    port: {{ .Values.databases.dovecotACL.port }}
    username: {{ .Values.databases.dovecotACL.username | quote }}
    password:
-      value: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
+      value: {{ .Values.databases.dovecotACL.password | default .Values.secrets.cassandra.dovecotACLUser | quote }}
    keyspace: {{ .Values.databases.dovecotACL.name | quote }}
  objectStorage:
    bucket: {{ .Values.objectstores.dovecot.bucket | quote }}
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -126,7 +126,10 @@ persistence:
    {{ .Values.annotations.openxchangeDovecot.persistence | toYaml | nindent 4 }}

 podAnnotations:
-  {{ .Values.annotations.openxchangeDovecot.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "open-xchange-dovecot"
+  {{- with .Values.annotations.openxchangeDovecot.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 resources:
  {{ .Values.resources.dovecot | toYaml | nindent 2 }}
--- a/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl
@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 additionalAnnotations:
+  intents.otterize.com/service-name: "open-xchange-bootstrap"
  argocd.argoproj.io/hook: "Sync"
  argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
  {{- with .Values.annotations.openxchangeBootstrap.additional }}
--- a/helmfile/apps/open-xchange/values-openxchange-contact-picker.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-contact-picker.yaml.gotmpl
@@ -5,6 +5,7 @@
 appsuite:
  core-mw:
    podAnnotations:
+      intents.otterize.com/service-name: "open-xchange-core-mw"
      logging.open-xchange.com/format: "appsuite-json"
      {{- with .Values.annotations.openxchangeEnterpriseContactPicker.appsuiteCoreMwPod }}
      {{ . | toYaml | nindent 6 }}
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -31,7 +31,10 @@ nextcloud-integration-ui:
    - name: {{ . | quote }}
  {{- end }}
  podAnnotations:
-    {{ .Values.annotations.openxchangeNextcloudIntegrationUi.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "open-xchange-nextcloud-integration-ui"
+    {{- with .Values.annotations.openxchangeNextcloudIntegrationUi.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  replicaCount: {{ .Values.replicas.openxchangeNextcloudIntegrationUI }}
  resources:
    {{ .Values.resources.openxchangeNextcloudIntegrationUI | toYaml | nindent 4 }}
@@ -66,7 +69,10 @@ public-sector-ui:
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  replicaCount: {{ .Values.replicas.openxchangePublicSectorUI }}
  podAnnotations:
-    {{ .Values.annotations.openxchangePublicSectorUi.pod | toYaml | nindent 4 }}
+    intents.otterize.com/service-name: "open-xchange-public-sector-ui"
+    {{- with .Values.annotations.openxchangePublicSectorUi.pod }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  resources:
    {{ .Values.resources.openxchangePublicSectorUI | toYaml | nindent 4 }}
  securityContext:
@@ -311,7 +317,10 @@ appsuite:
    jolokiaPassword: {{ .Values.secrets.oxAppSuite.jolokiaPassword | quote }}
    hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
    podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreMw.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-mw"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreMw.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    serviceAccount:
      annotations:
        {{ .Values.annotations.openxchangeAppsuiteCoreMw.serviceAccount | toYaml | nindent 8 }}
@@ -338,7 +347,10 @@ appsuite:
        pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
      replicaCount: {{ .Values.replicas.openxchangeGotenberg }}
      podAnnotations:
-        {{ .Values.annotations.openxchangeAppsuiteCoreMw.gotenbergPod | toYaml | nindent 8 }}
+        intents.otterize.com/service-name: "open-xchange-gotenberg"
+        {{- with .Values.annotations.openxchangeAppsuiteCoreMw.gotenbergPod }}
+        {{ . | toYaml | nindent 8 }}
+        {{- end }}
      resources:
        {{ .Values.resources.openxchangeGotenberg | toYaml | nindent 8 }}
      securityContext:
@@ -351,7 +363,6 @@ appsuite:
        runAsNonRoot: true
        runAsUser: 1001
        runAsGroup: 1001
-        privileged: false
        seccompProfile:
          type: "RuntimeDefault"
        seLinuxOptions:
@@ -397,6 +408,9 @@ appsuite:
      com.openexchange.share.guestHostname: {{ printf "%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
      com.openexchange.UIWebPath: "/appsuite/"
      com.openexchange.showAdmin: "false"
+      # Various Mail settings
+      com.openexchange.mail.deleteDraftOnTransport: "true"
+      com.openexchange.capability.document_preview_xrechnung: "true"
      # PDF Export
      com.openexchange.capability.mail_export_pdf: "true"
      com.openexchange.mail.exportpdf.gotenberg.enabled: "true"
@@ -453,6 +467,11 @@ appsuite:
      com.openexchange.mail.login.resolver.ldap.contextNameAttribute: "oxContextIDNum"
      com.openexchange.mail.login.resolver.ldap.entitySearchFilter: "(&(oxContextIDNum=[cid])(uid=[uname]))"
      com.openexchange.mail.login.resolver.ldap.mailLoginAttribute: "entryUUID"
+      # Contacts collector
+      # Ref.: https://documentation.open-xchange.com/components/middleware/config/8/#mode=search&term=contactCollect
+      com.openexchange.contactcollector.enabled: "true"
+      com.openexchange.user.contactCollectOnMailTransport: "true"
+      com.openexchange.user.contactCollectOnMailAccess: "false"
      # Requirements for OX Connector
      com.openexchange.user.enforceUniqueDisplayName: "false"
      com.openexchange.folderstorage.database.preferDisplayName: "false"
@@ -553,19 +572,16 @@ appsuite:
      # await http.POST({ module: 'oxguard/smime', params: { action: 'test' } })
      com.openexchange.smime.test: {{ .Values.debug.enabled | quote }}
      {{- end }}
-      {{- if or (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "NodePort") (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "LoadBalancer") }}
      # Client Onboarding
-      com.openexchange.client.onboarding.mail.imap.host: {{ .Values.global.domain | quote }}
+      com.openexchange.client.onboarding.enabled: {{ .Values.functional.groupware.externalClients.enabledOnboardingInfo | quote }}
+      com.openexchange.client.onboarding.mail.imap.host: {{ default .Values.global.domain .Values.functional.groupware.externalClients.fqdnImap | quote }}
      com.openexchange.client.onboarding.mail.imap.port: "993"
      com.openexchange.client.onboarding.mail.imap.secure: "true"
      com.openexchange.client.onboarding.mail.imap.requireTls: "false"
-      com.openexchange.client.onboarding.mail.smtp.host: {{ .Values.global.domain | quote }}
+      com.openexchange.client.onboarding.mail.smtp.host: {{ default .Values.global.domain .Values.functional.groupware.externalClients.fqdnSmtp | quote }}
      com.openexchange.client.onboarding.mail.smtp.port: "587"
      com.openexchange.client.onboarding.mail.smtp.secure: "false"
      com.openexchange.client.onboarding.mail.smtp.requireTls: "true"
-      {{- else }}
-      com.openexchange.client.onboarding.enabled: "false"
-      {{- end }}
      # DAV
      {{- if .Values.functional.groupware.davSupport.enabled }}
      com.openexchange.caldav.enabled: "true"
@@ -682,9 +698,6 @@ appsuite:
      io.ox/core//coloredIcons: "false"
      # Mail templates
      io.ox/core//features/templates: "true"
-      # Contact Collector
-      io.ox/mail//contactCollectOnMailTransport: "true"
-      # io.ox/mail//contactCollectOnMailAccess: "true"
      # Dynamic theme
      io.ox/dynamic-theme//mainColor: {{ .Values.theme.colors.primary | quote }}
      io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
@@ -767,7 +780,10 @@ appsuite:
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    replicaCount: {{ .Values.replicas.openxchangeCoreUI }}
    podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreUi.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-ui"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreUi.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    resources:
      {{ .Values.resources.openxchangeCoreUI | toYaml | nindent 6 }}
    securityContext:
@@ -804,7 +820,10 @@ appsuite:
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    overrides: {}
    podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreUiMiddleware.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-ui-middleware"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreUiMiddleware.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    redis: *redisConfiguration
    replicaCount: {{ .Values.replicas.openxchangeCoreUIMiddleware }}
    resources:
@@ -853,7 +872,10 @@ appsuite:
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    {{- if .Values.annotations.openxchangeAppsuiteCoreDocumentconverter.pod }}
    podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreDocumentconverter.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-documentconverter"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreDocumentconverter.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    {{- end }}
    redis: *redisConfiguration
    replicaCount: {{ .Values.replicas.openxchangeCoreDocumentConverter }}
@@ -905,7 +927,10 @@ appsuite:
      tag: {{ .Values.images.openxchangeCoreGuidedtours.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreGuidedtours.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-guidedtours"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreGuidedtours.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    replicaCount: {{ .Values.replicas.openxchangeCoreGuidedtours }}
    resources:
      {{- .Values.resources.openxchangeCoreGuidedtours | toYaml | nindent 6 }}
@@ -949,7 +974,10 @@ appsuite:
          secretKey: "."
    {{- if .Values.annotations.openxchangeAppsuiteCoreImageconverter.pod }}
    podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreImageconverter.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-imageconverter"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreImageconverter.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    {{- end }}
    redis: *redisConfiguration
    replicaCount: {{ .Values.replicas.openxchangeCoreImageConverter }}
@@ -985,7 +1013,8 @@ appsuite:
      repository: {{ .Values.images.openxchangeGuardUI.repository | quote }}
      tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    podAnnotations: {}
+    podAnnotations:
+      intents.otterize.com/service-name: "open-xchange-guard-ui"
    replicaCount: {{ .Values.replicas.openxchangeGuardUI }}
    resources:
      {{- .Values.resources.openxchangeGuardUI | toYaml | nindent 6 }}
@@ -1021,7 +1050,10 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    podAnnotations:
-      {{ .Values.annotations.openxchangeAppsuiteCoreUserGuide.pod | toYaml | nindent 6 }}
+      intents.otterize.com/service-name: "open-xchange-core-user-guide"
+      {{- with .Values.annotations.openxchangeAppsuiteCoreUserGuide.pod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
    replicaCount: {{ .Values.replicas.openxchangeCoreUserGuide }}
    resources:
      {{- .Values.resources.openxchangeCoreUserGuide | toYaml | nindent 6 }}
--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -45,7 +45,7 @@ oxConnector:
  oxDefaultContext: "1"
  oxImapServer: "imap://127.0.0.1:143"
  oxLocalTimezone: "Europe/Berlin"
-  oxLanguage: "de_DE"
+  oxLanguage: {{ .Values.functional.internationalization.defaultLanguage | quote }}
  oxMasterAdmin: "admin"
  oxMasterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
  oxSmtpServer: "smtp://127.0.0.1:587"
@@ -68,7 +68,10 @@ persistence:
  #storageClass: {{ coalesce .Values.persistence.storages.oxConnector.storageClassName .Values.persistence.storageClassNames.RWO | quote }}

 podAnnotations:
-  {{ .Values.annotations.nubusOxConnector.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "open-xchange-connector"
+  {{- with .Values.annotations.nubusOxConnector.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 replicaCount: {{ .Values.replicas.oxConnector }}

--- a/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
@@ -91,7 +91,10 @@ postfix:
  virtualTransport: "lmtps:dovecot:24"

 podAnnotations:
-  {{ .Values.annotations.openxchangePostfix.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "open-xchange-postfix"
+  {{- with .Values.annotations.openxchangePostfix.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 replicaCount: {{ .Values.replicas.postfix }}

--- a/helmfile/apps/opendesk-migrations-post/values.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-post/values.yaml.gotmpl
@@ -5,7 +5,10 @@ additionalAnnotations:
  {{ .Values.annotations.opendeskMigrationsPost.additional | toYaml | nindent 2 }}

 podAnnotations:
-  {{ .Values.annotations.opendeskMigrationsPost.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-migrations-post"
+  {{- with .Values.annotations.opendeskMigrationsPost.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 serviceAccount:
  annotations:
--- a/helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl
@@ -74,7 +74,10 @@ job:
  enabled: true

 podAnnotations:
-  {{ .Values.annotations.openprojectBootstrap.pod | toYaml | nindent 2 }}
+  intents.otterize.com/service-name: "opendesk-openproject-bootstrap"
+  {{- with .Values.annotations.openprojectBootstrap.pod }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/Chart.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/Chart.yaml
@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+annotations:
+  category: "Security"
+  licenses: "Apache-2.0"
+apiVersion: "v2"
+dependencies:
+  - name: "common"
+    version: "^2.x.x"
+    repository: "oci://registry.opencode.de/bmi/opendesk/components/external/charts/bitnami-charts"
+description: "A Helm chart deploying resources for Otterize to secure services with NetworkPolicies."
+home: "https://zendis.de"
+keywords:
+  - "security"
+name: "opendesk-otterize"
+sources:
+  - "https://gitlab.souvap-univention.de/souvap/tooling/charts/opendesk-otterize"
+type: "application"
+version: "2.1.3"
+...
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/README.md
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/README.md
@@ -0,0 +1,121 @@
+<!--
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+-->
+# opendesk-otterize
+
+A Helm chart deploying resources for Otterize to secure services with NetworkPolicies.
+
+## Installing the Chart
+
+To install the chart with the release name `my-release`, you have two options:
+
+### Install via Repository
+
+```console
+helm repo add opendesk-otterize https://gitlab.opencode.de/api/v4/projects/2293/packages/helm/stable
+helm install my-release --version 2.1.3 opendesk-otterize/opendesk-otterize
+```
+
+### Install via OCI Registry
+
+```console
+helm repo add opendesk-otterize oci://registry.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-otterize
+helm install my-release --version 2.1.3 opendesk-otterize/opendesk-otterize
+```
+
+## Requirements
+
+| Repository | Name | Version |
+|------------|------|---------|
+| oci://registry.opencode.de/bmi/opendesk/components/external/charts/bitnami-charts | common | ^2.x.x |
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| additionalAnnotations | object | `{}` | Additional custom annotations to add to all deployed objects. |
+| additionalLabels | object | `{}` | Additional custom labels to add to all deployed objects. |
+| apps.clamavDistributed.enabled | bool | `true` | Enables ClamAV (in distributed mode) related resource creation. |
+| apps.clamavDistributed.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.clamavDistributed.signatureHost | string | `"gitlab.opencode.de"` | Signature database host |
+| apps.clamavSimple.enabled | bool | `true` | Enables ClamAV (in simple mode) related resource creation. |
+| apps.clamavSimple.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.clamavSimple.signatureHost | string | `"gitlab.opencode.de"` | Signature database host |
+| apps.collabora.enabled | bool | `true` | Enables Collabora related resource creation. |
+| apps.collabora.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.cryptpad.enabled | bool | `true` | Enables Cryptpad related resource creation. |
+| apps.cryptpad.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.dkimpy.enabled | bool | `true` | Enables dkimpy related resource creation. |
+| apps.dkimpy.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.dovecot.enabled | bool | `true` | Enables Dovecot related resource creation. |
+| apps.dovecot.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.element.enabled | bool | `true` | Enables Element related resource creation. |
+| apps.element.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.intercom.enabled | bool | `true` | Enables Intercom Service related resource creation. |
+| apps.intercom.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.jitsi.enabled | bool | `true` | Enables Jitsi related resource creation. |
+| apps.jitsi.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.mariadb.enabled | bool | `true` | Enables MariaDB related resource creation. |
+| apps.mariadb.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.memcached.enabled | bool | `true` | Enables Memcached related resource creation. |
+| apps.memcached.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.minio.enabled | bool | `true` | Enables MinIO related resource creation. |
+| apps.minio.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.nextcloud.enabled | bool | `true` | Enables Nextcloud related resource creation. |
+| apps.nextcloud.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.notes.enabled | bool | `true` | Enables LaSuite Notes related resource creation. |
+| apps.notes.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.nubus.enabled | bool | `true` | Enables Univention Management Stack related resource creation. |
+| apps.nubus.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.openproject.enabled | bool | `true` | Enables OpenProject related resource creation. |
+| apps.openproject.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.oxAppSuite.enabled | bool | `true` | Enables Open-Xchange Appsuite related resource creation. |
+| apps.oxAppSuite.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.oxConnector.enabled | bool | `true` | Enables OX-Connector related resource creation. |
+| apps.oxConnector.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.postfix.enabled | bool | `true` | Enables Postfix related resource creation. |
+| apps.postfix.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.postgresql.enabled | bool | `true` | Enables PostgreSQL related resource creation. |
+| apps.postgresql.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.redis.enabled | bool | `true` | Enables Redis related resource creation. |
+| apps.redis.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| apps.xwiki.enabled | bool | `true` | Enables XWiki related resource creation. |
+| apps.xwiki.namespace | string | `""` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| clientIntents.apiVersion | string | `"k8s.otterize.com/v1alpha3"` | Choose the API version to use. |
+| clientIntents.enabled | bool | `true` | Enable creation of ClientIntents custom resource. |
+| extraApps.clusterPostfix.enabled | bool | `false` | Enables cluster-wide postfix related resource creation. |
+| extraApps.clusterPostfix.namespace | string | `"swp-cross-instance-mail"` | If omitted, resources are deployed in the same namespace as this helm chart. |
+| global.domain | string | `"example.internal"` | Deployment base domain used for egress restrictions to opendesk services via Ingress. |
+| global.hosts | object | `{"collabora":"office","cryptpad":"pad","element":"chat","intercomService":"ics","jitsi":"meet","keycloak":"id","matrixNeoBoardWidget":"matrix-neoboard-widget","matrixNeoChoiceWidget":"matrix-neochoice-widget","matrixNeoDateFixBot":"matrix-neodatefix-bot","matrixNeoDateFixWidget":"matrix-neodatefix-widget","minioApi":"objectstore","minioConsole":"objectstore-ui","nextcloud":"files","notes":"notes","nubus":"portal","openproject":"projects","openxchange":"webmail","synapse":"matrix","synapseFederation":"matrix-federation","whiteboard":"whiteboard","xwiki":"wiki"}` | A map of avaible deployment subdomains. |
+| ingressController.namespace | string | `"nginx-ingress"` | Namespace of ingress controller. |
+| ingressController.podSelector | object | `{"matchLabels":{"app.kubernetes.io/name":"nginx-ingress"}}` | Pod selector for ingress controller to match for NetworkPolicies. |
+| istioGateway.namespace | string | `"istio-system"` | Namespace of ingress controller. |
+| istioGateway.podSelector | object | `{"matchLabels":{"app":"gateway","istio":"gateway"}}` | Pod selector for ingress controller to match for NetworkPolicies. |
+| networkPolicies.enabled | bool | `true` | Enable creation of NetworkPolicies custom resource. |
+| prometheus.namespace | string | `"monitoring"` | Namespace of ingress controller. |
+| prometheus.podSelector | object | `{"matchLabels":{"app.kubernetes.io/name":"prometheus"}}` | Pod selector for ingress controller to match for NetworkPolicies. |
+| protectedServices.apiVersion | string | `"k8s.otterize.com/v1alpha3"` | Choose the API version to use. |
+| protectedServices.enabled | bool | `true` | Enable creation of ProtectedServices custom resource. |
+
+## Uninstalling the Chart
+
+To install the release with name `my-release`:
+
+```bash
+helm uninstall my-release
+```
+
+## Signing
+
+Helm charts are signed with helm native signing method.
+
+You can verify the chart against [the public GPG key](../../files/gpg-pubkeys/opendesk.gpg).
+
+## License
+
+This project uses the following license: Apache-2.0
+
+## Copyright
+
+Copyright (C) 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/README.md.gotmpl.tpl
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/README.md.gotmpl.tpl
@@ -0,0 +1,50 @@
+<!--
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+-->
+{{ template "chart.header" . }}
+{{ template "chart.description" . }}
+
+## Installing the Chart
+
+To install the chart with the release name `my-release`, you have two options:
+
+### Install via Repository
+
+```console
+helm repo add ${CI_PROJECT_NAME} ${CI_SERVER_PROTOCOL}://${CI_SERVER_HOST}/api/v4/projects/${CI_PROJECT_ID}/packages/helm/stable
+helm install my-release --version ${RELEASE_VERSION} ${CI_PROJECT_NAME}/{{ template "chart.name" . }}
+```
+
+### Install via OCI Registry
+
+```console
+helm repo add ${CI_PROJECT_NAME} oci://${CI_REGISTRY_IMAGE}
+helm install my-release --version ${RELEASE_VERSION} ${CI_PROJECT_NAME}/{{ template "chart.name" . }}
+```
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}
+
+## Uninstalling the Chart
+
+To install the release with name `my-release`:
+
+```bash
+helm uninstall my-release
+```
+
+## Signing
+
+Helm charts are signed with helm native signing method.
+
+You can verify the chart against [the public GPG key](../../files/gpg-pubkeys/opendesk.gpg).
+
+## License
+
+This project uses the following license: Apache-2.0
+
+## Copyright
+
+Copyright (C) 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/clamav-freshclam.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/clamav-freshclam.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.clamavDistributed.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "clamav-freshclam"
+  namespace: {{ .Values.apps.clamavDistributed.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "clamav-freshclam"
+  targets:
+    - internet:
+        domains:
+          - {{ .Values.apps.clamavDistributed.signatureHost | quote }}
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/clamav-icap.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/clamav-icap.yaml
@@ -0,0 +1,27 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.clamavDistributed.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "clamav-icap"
+  namespace: {{ .Values.apps.clamavDistributed.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "clamav-icap"
+  targets:
+    - kubernetes:
+        name: "clamav-clamd.{{ coalesce .Values.apps.clamavDistributed.namespace .Release.Namespace }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/clamav-milter.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/clamav-milter.yaml
@@ -0,0 +1,27 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.clamavDistributed.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "clamav-milter"
+  namespace: {{ .Values.apps.clamavDistributed.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "clamav-milter"
+  targets:
+    - kubernetes:
+        name: {{ printf "%s.%s" "clamav-clamd" (coalesce .Values.apps.clamavDistributed.namespace .Release.Namespace) | quote }}
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/clamav-simple.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/clamav-simple.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.clamavSimple.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "clamav-simple"
+  namespace: {{ .Values.apps.clamavSimple.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "clamav-simple"
+  targets:
+    - internet:
+        domains:
+          - {{ .Values.apps.clamavSimple.signatureHost | quote }}
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/collabora-controller.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/collabora-controller.yaml
@@ -0,0 +1,33 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.collabora.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "collabora-controller"
+  namespace: {{ .Values.apps.collabora.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "collabora-controller"
+  targets:
+    - kubernetes:
+        name: "collabora-controller"
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+    - internet:
+        domains:
+          - "{{ .Values.cluster.api.domain }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/collabora.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/collabora.yaml
@@ -0,0 +1,30 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.collabora.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "collabora"
+  namespace: {{ .Values.apps.collabora.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "collabora"
+  targets:
+    - kubernetes:
+        name: "collabora-controller"
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/cryptpad.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/cryptpad.yaml
@@ -0,0 +1,31 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.cryptpad.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "cryptpad"
+  namespace: {{ .Values.apps.cryptpad.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "cryptpad"
+  targets:
+    - kubernetes:
+        name: "clamav-clamd.{{ coalesce .Values.apps.clamavDistributed.namespace .Release.Namespace }}"
+    - internet:
+        domains:
+          - "registry.npmjs.org"
+          - "accounts.cryptpad.fr"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/impress-backend-init.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/impress-backend-init.yaml
@@ -0,0 +1,30 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.notes.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "impress-backend-init"
+  namespace: {{ .Values.apps.nubus.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "impress-backend-init"
+    kind: "Job"
+  targets:
+    {{- if .Values.apps.postgresql.enabled }}
+    - kubernetes:
+        name: "postgresql.{{ coalesce .Values.apps.postgresql.namespace .Release.Namespace }}"
+    {{- end }}
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/impress-backend.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/impress-backend.yaml
@@ -0,0 +1,40 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.notes.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "impress-backend"
+  namespace: {{ .Values.apps.notes.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "impress-backend"
+  targets:
+    {{- if .Values.apps.postgresql.enabled }}
+    - kubernetes:
+        name: "postgresql.{{ coalesce .Values.apps.postgresql.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.redis.enabled }}
+    - kubernetes:
+        name: "redis.{{ coalesce .Values.apps.redis.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.postfix.enabled }}
+    - kubernetes:
+        name: "postfix.{{ coalesce .Values.apps.postfix.namespace .Release.Namespace }}"
+    {{- end }}
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/impress-y-provider.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/impress-y-provider.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.notes.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "impress-y-provider"
+  namespace: {{ .Values.apps.notes.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "impress-y-provider"
+  targets:
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/intercom-service.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/intercom-service.yaml
@@ -0,0 +1,32 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.nubus.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "intercom-service"
+  namespace: {{ .Values.apps.nubus.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "intercom-service"
+  targets:
+    {{- if .Values.apps.redis.enabled }}
+    - kubernetes:
+        name: "redis.{{ coalesce .Values.apps.redis.namespace .Release.Namespace }}"
+    {{- end }}
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-jibri.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-jibri.yaml
@@ -0,0 +1,27 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.jitsi.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "jitsi-jibri"
+  namespace: {{ .Values.apps.jitsi.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "jitsi-jibri"
+  targets:
+    - kubernetes:
+        name: "jitsi-prosody.{{ coalesce .Values.apps.jitsi.namespace .Release.Namespace }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-jicofo.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-jicofo.yaml
@@ -0,0 +1,27 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.jitsi.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "jitsi-jicofo"
+  namespace: {{ .Values.apps.jitsi.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "jitsi-jicofo"
+  targets:
+    - kubernetes:
+        name: "jitsi-prosody.{{ coalesce .Values.apps.jitsi.namespace .Release.Namespace }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-jvb.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-jvb.yaml
@@ -0,0 +1,31 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.jitsi.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "jitsi-jvb"
+  namespace: {{ .Values.apps.jitsi.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "jitsi-jvb"
+  targets:
+    - kubernetes:
+        name: "jitsi-prosody.{{ coalesce .Values.apps.jitsi.namespace .Release.Namespace }}"
+    - internet:
+        ips:
+          # Cloud provider instance metadata
+          - "169.254.169.254"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-opendesk-jitsi.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-opendesk-jitsi.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.jitsi.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "jitsi-opendesk-jitsi"
+  namespace: {{ .Values.apps.jitsi.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "jitsi-opendesk-jitsi"
+  targets:
+    - internet:
+        domains:
+          - "{{ .Values.cluster.api.domain }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-prosody.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-prosody.yaml
@@ -0,0 +1,27 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.jitsi.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "jitsi-prosody"
+  namespace: {{ .Values.apps.jitsi.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "jitsi-prosody"
+  targets:
+    - kubernetes:
+        name: "opendesk-matrix-user-verification-service.{{ coalesce .Values.apps.element.namespace .Release.Namespace }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-web.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/jitsi-web.yaml
@@ -0,0 +1,30 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.jitsi.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "jitsi-web"
+  namespace: {{ .Values.apps.jitsi.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "jitsi-web"
+  targets:
+    - kubernetes:
+        name: "jitsi-prosody.{{ coalesce .Values.apps.jitsi.namespace .Release.Namespace }}"
+    - kubernetes:
+        name: "opendesk-jitsi-keycloak-adapter.{{ coalesce .Values.apps.jitsi.namespace .Release.Namespace }}"
+        kind: "Deployment"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/mariadb-bootstrap.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/mariadb-bootstrap.yaml
@@ -0,0 +1,27 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.mariadb.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "mariadb-bootstrap"
+  namespace: {{ .Values.apps.mariadb.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "mariadb-bootstrap"
+  targets:
+    - kubernetes:
+        name: "mariadb.{{ coalesce .Values.apps.mariadb.namespace .Release.Namespace }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/matrix-adminbot-bootstrap.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/matrix-adminbot-bootstrap.yaml
@@ -0,0 +1,29 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.elementAdmin.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "matrix-adminbot-bootstrap"
+  namespace: {{ .Values.apps.elementAdmin.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "matrix-adminbot-bootstrap"
+    kind: "Job"
+  targets:
+    - internet:
+        domains:
+          - "{{ .Values.cluster.api.domain }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/matrix-auditbot-bootstrap.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/matrix-auditbot-bootstrap.yaml
@@ -0,0 +1,29 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.elementAdmin.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "matrix-auditbot-bootstrap"
+  namespace: {{ .Values.apps.elementAdmin.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "matrix-auditbot-bootstrap"
+    kind: "Job"
+  targets:
+    - internet:
+        domains:
+          - "{{ .Values.cluster.api.domain }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/matrix-neodatefix-bot-bootstrap.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/matrix-neodatefix-bot-bootstrap.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.element.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "matrix-neodatefix-bot-bootstrap"
+  namespace: {{ .Values.apps.element.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "matrix-neodatefix-bot-bootstrap"
+  targets:
+    - internet:
+        domains:
+          - "{{ .Values.cluster.api.domain }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/matrix-neodatefix-bot.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/matrix-neodatefix-bot.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.element.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "matrix-neodatefix-bot"
+  namespace: {{ .Values.apps.element.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "matrix-neodatefix-bot"
+  targets:
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/minio-provisioning.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/minio-provisioning.yaml
@@ -0,0 +1,27 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.minio.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "minio-provisioning"
+  namespace: {{ .Values.apps.minio.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "minio-provisioning"
+  targets:
+    - kubernetes:
+        name: "minio.{{ coalesce .Values.apps.minio.namespace .Release.Namespace }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/nubus-nginx-s3-gateway.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/nubus-nginx-s3-gateway.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.nubus.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "nubus-nginx-s3-gateway"
+  namespace: {{ .Values.apps.nubus.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "nubus-nginx-s3-gateway"
+  targets:
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-bootstrap.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-bootstrap.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.oxAppSuite.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "open-xchange-bootstrap"
+  namespace: {{ .Values.apps.oxAppSuite.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "open-xchange-bootstrap"
+  targets:
+    - internet:
+        domains:
+          - "{{ .Values.cluster.api.domain }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-connector.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-connector.yaml
@@ -0,0 +1,36 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.oxAppSuite.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "open-xchange-connector"
+  namespace: {{ .Values.apps.oxAppSuite.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "open-xchange-connector"
+  targets:
+    - kubernetes:
+        name: "ums-provisioning-api"
+    {{- if .Values.apps.oxAppSuite.enabled }}
+    - kubernetes:
+        name: "open-xchange-core-mw.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace}}"
+    {{- end }}
+    {{- if .Values.apps.xwiki.enabled }}
+    - kubernetes:
+        name: "xwiki.{{ coalesce .Values.apps.xwiki.namespace .Release.Namespace }}"
+        kind: "StatefulSet"
+    {{- end }}
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-core-mw-groupware.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-core-mw-groupware.yaml
@@ -0,0 +1,70 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.oxAppSuite.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "open-xchange-core-mw-groupware"
+  namespace: {{ .Values.apps.oxAppSuite.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "open-xchange-core-mw"
+  targets:
+    {{- if .Values.apps.clamavSimple.enabled }}
+    - kubernetes:
+        name: "clamav-simple.{{ coalesce .Values.apps.clamavSimple.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.clamavDistributed.enabled }}
+    - kubernetes:
+        name: "clamav-distributed.{{ coalesce .Values.apps.clamavDistributed.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.mariadb.enabled }}
+    - kubernetes:
+        name: "mariadb.{{ coalesce .Values.apps.mariadb.namespace .Release.Namespace }}"
+    {{- end }}
+    - kubernetes:
+        name: "open-xchange-core-documentconverter.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+        kind: "Deployment"
+    - kubernetes:
+        name: "open-xchange-core-imageconverter.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+        kind: "Deployment"
+    - kubernetes:
+        name: "open-xchange-dovecot.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+    - kubernetes:
+        name: "open-xchange-postfix.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+    {{- if .Values.apps.element.enabled }}
+    - kubernetes:
+        name: "opendesk-synapse-web.{{ coalesce .Values.apps.element.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.nextcloud.enabled }}
+    - kubernetes:
+        name: "opendesk-nextcloud-aio.{{ coalesce .Values.apps.nextcloud.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.redis.enabled }}
+    - kubernetes:
+        name: "redis.{{ coalesce .Values.apps.redis.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.nubus.enabled }}
+    - kubernetes:
+        name: "ums-ldap-server-primary.{{ coalesce .Values.apps.nubus.namespace .Release.Namespace }}"
+        kind: "StatefulSet"
+    {{- end }}
+    - kubernetes:
+          name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+          kind: "Deployment"
+    - internet:
+        domains:
+          - "{{ .Values.cluster.api.domain }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-core-ui-middleware.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-core-ui-middleware.yaml
@@ -0,0 +1,39 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.oxAppSuite.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "open-xchange-core-ui-middleware"
+  namespace: {{ .Values.apps.oxAppSuite.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "open-xchange-core-ui-middleware"
+  targets:
+    {{- if .Values.apps.redis.enabled }}
+    - kubernetes:
+        name: "redis.{{ coalesce .Values.apps.redis.namespace .Release.Namespace }}"
+    {{- end }}
+    - kubernetes:
+        name: "open-xchange-guard-ui.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+    - kubernetes:
+        name: "open-xchange-core-ui.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+    - kubernetes:
+        name: "open-xchange-guidedtours.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+    - kubernetes:
+        name: "open-xchange-nextcloud-integration-ui.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+    - kubernetes:
+        name: "open-xchange-public-sector-ui.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-dovecot.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-dovecot.yaml
@@ -0,0 +1,41 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.oxAppSuite.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "open-xchange-dovecot"
+  namespace: {{ .Values.apps.oxAppSuite.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "open-xchange-dovecot"
+  targets:
+    {{- if .Values.apps.nubus.enabled }}
+    - kubernetes:
+        name: "ums-ldap-server-primary.{{ coalesce .Values.apps.nubus.namespace .Release.Namespace }}"
+        kind: "StatefulSet"
+    {{- end }}
+    {{- if .Values.apps.postfix.enabled }}
+    - kubernetes:
+        name: "postfix.{{ coalesce .Values.apps.postfix.namespace .Release.Namespace }}"
+    {{- end }}
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+    {{- if .Values.apps.cassandra.enabled }}
+    - kubernetes:
+        name: "cassandra.{{ coalesce .Values.apps.cassandra.namespace .Release.Namespace }}"
+    {{- end }}
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-imageconverter.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-imageconverter.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.oxAppSuite.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "open-xchange-imageconverter"
+  namespace: {{ .Values.apps.oxAppSuite.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "open-xchange-imageconverter"
+  targets:
+    - internet:
+        domains:
+          - "{{ .Values.cluster.api.domain }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-postfix.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/open-xchange-postfix.yaml
@@ -0,0 +1,40 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "open-xchange-postfix"
+  namespace: {{ .Values.apps.oxAppSuite.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "open-xchange-postfix"
+  targets:
+    {{- if .Values.apps.clamavDistributed.enabled }}
+      - kubernetes:
+          name: "clamav-milter.{{ coalesce .Values.apps.clamavDistributed.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.clamavSimple.enabled}}
+      - kubernetes:
+          name: "clamav-simple.{{ coalesce .Values.apps.clamavSimple.namespace .Release.Namespace }}"
+    {{- end }}
+      - kubernetes:
+          name: "open-xchange-dovecot.{{ coalesce .Values.apps.oxAppSuite.namespace .Release.Namespace }}"
+    {{- if .Values.apps.dkimpy.enabled }}
+      - kubernetes:
+          name: "dkimpy-milter.{{ coalesce .Values.apps.dkimpy.namespace .Release.Namespace }}"
+    {{- end }}
+      - internet:
+          domains:
+            - "{{ .Values.smtp.host }}"
+...
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-jitsi-keycloak-adapter.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-jitsi-keycloak-adapter.yaml
@@ -0,0 +1,29 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.jitsi.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "opendesk-jitsi-keycloak-adapter"
+  namespace: {{ .Values.apps.jitsi.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "opendesk-jitsi-keycloak-adapter"
+    kind: "Deployment"
+  targets:
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-keycloak-bootstrap.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-keycloak-bootstrap.yaml
@@ -0,0 +1,27 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.nubus.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "opendesk-keycloak-bootstrap"
+  namespace: {{ .Values.apps.nubus.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "opendesk-keycloak-bootstrap"
+  targets:
+    - kubernetes:
+        name: "ums-keycloak.{{ coalesce .Values.apps.nubus.namespace .Release.Namespace }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-matrix-user-verification-service-bootstrap.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-matrix-user-verification-service-bootstrap.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.element.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "opendesk-matrix-user-verification-service-bootstrap"
+  namespace: {{ .Values.apps.element.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "opendesk-matrix-user-verification-service-bootstrap"
+  targets:
+    - internet:
+        domains:
+          - "{{ .Values.cluster.api.domain }}"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-matrix-user-verification-service.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-matrix-user-verification-service.yaml
@@ -0,0 +1,31 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.element.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "opendesk-matrix-user-verification-service"
+  namespace: {{ .Values.apps.element.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "opendesk-matrix-user-verification-service"
+  targets:
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+    - internet:
+        domains:
+          - "registry.npmjs.org"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-migrations-post.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-migrations-post.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.migrations.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "opendesk-migrations-post"
+  namespace: {{ .Values.apps.migrations.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "opendesk-migrations-post"
+  targets:
+    - internet:
+        domains:
+          - {{ .Values.cluster.api.domain }}
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-migrations-pre.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-migrations-pre.yaml
@@ -0,0 +1,28 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.migrations.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "opendesk-migrations-pre"
+  namespace: {{ .Values.apps.migrations.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "opendesk-migrations-pre"
+  targets:
+    - internet:
+        domains:
+          - {{ .Values.cluster.api.domain }}
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-nextcloud-aio-cron.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-nextcloud-aio-cron.yaml
@@ -0,0 +1,52 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.nextcloud.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "opendesk-nextcloud-aio-cron"
+  namespace: {{ .Values.apps.nextcloud.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "opendesk-nextcloud-aio-cron"
+  targets:
+    {{- if .Values.apps.postgresql.enabled }}
+    - kubernetes:
+        name: "postgresql.{{ coalesce .Values.apps.postgresql.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.redis.enabled }}
+    - kubernetes:
+        name: "redis"
+    {{- end }}
+    {{- if .Values.apps.nubus.enabled }}
+    - kubernetes:
+        name: "ums-ldap-server-primary.{{ coalesce .Values.apps.nubus.namespace .Release.Namespace }}"
+        kind: "StatefulSet"
+    {{- end }}
+    {{- if .Values.apps.clamavSimple.enabled }}
+    - kubernetes:
+        name: "clamav-simple.{{ coalesce .Values.apps.clamavSimple.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.postfix.enabled }}
+    - kubernetes:
+        name: "postfix.{{ coalesce .Values.apps.postfix.namespace .Release.Namespace }}"
+    {{- end }}
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+    - internet:
+        domains:
+          - "cloud.nextcloud.com"
+...
+{{- end }}
--- a/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-nextcloud-aio.yaml
+++ b/helmfile/apps/opendesk-services/charts/opendesk-otterize/templates/ClientIntents/opendesk-nextcloud-aio.yaml
@@ -0,0 +1,53 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{- if and .Values.apps.nextcloud.enabled .Values.clientIntents.enabled }}
+---
+apiVersion: {{ .Values.clientIntents.apiVersion | quote }}
+kind: "ClientIntents"
+metadata:
+  name: "opendesk-nextcloud-aio"
+  namespace: {{ .Values.apps.nextcloud.namespace | default .Release.Namespace | quote }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.additionalLabels "context" . ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.additionalAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+spec:
+  workload:
+    name: "opendesk-nextcloud-aio"
+  targets:
+    {{- if .Values.apps.postgresql.enabled }}
+    - kubernetes:
+        name: "postgresql.{{ coalesce .Values.apps.postgresql.namespace .Release.Namespace }}"
+    {{- end }}
+    {{- if .Values.apps.redis.enabled }}
+    - kubernetes:
+        name: "redis"
+    {{- end }}
+    {{- if .Values.apps.nubus.enabled }}
+    - kubernetes:
+        name: "ums-ldap-server-primary"
+        kind: "StatefulSet"
+    - kubernetes:
+        name: "ums-portal-server"
+    {{- end }}
+    {{- if .Values.apps.clamavSimple.enabled }}
+    - kubernetes:
+        name: "clamav-simple"
+    {{- end }}
+    {{- if .Values.apps.postfix.enabled }}
+    - kubernetes:
+        name: "postfix"
+    {{- end }}
+    - kubernetes:
+        name: "opendesk-nextcloud-notifypush"
+    - kubernetes:
+        name: "{{ .Values.ingressController.name }}.{{ .Values.ingressController.namespace }}"
+        kind: "Deployment"
+...
+{{- end }}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Sven-Erik Schmidt	d778e28913	feat(opendesk-services): Add opendesk-otterize	2025-11-13 17:14:31 +01:00
Sven-Erik Schmidt	7aa717c050	fix(helmfile): Streamline annotations	2025-11-12 11:28:49 +01:00
Oliver Günther	19438c0281	feat(openproject): Update OpenProject from 16.5.1 to 16.6.0	2025-11-11 10:53:50 +00:00
Clément Aubin	02a3b77114	fix(xwiki): Update XWiki from 17.4.4 to 17.4.7	2025-11-10 15:46:13 +00:00
Thorsten Roßner	4655942762	chore(release): 1.9.0 [skip ci] # [1.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.8.0...v1.9.0) (2025-11-07) ### Bug Fixes * collabora: Update from 25.04.4.3.1 to 25.04.5.3.1 ([`e0128e6`](`e0128e6ccf`)) * element: Increase message and media rate limits ([`13968a8`](`13968a8133`)) * element: Update favicon to use PNG version ([`f8104f6`](`f8104f6358`)) * element: Update Synapse from v1.137.0 to v1.141.0; fixes https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr which applies to all openDesk deployments using Element/Matrix with federation enabled ([`02d3021`](`02d3021c4b`)) * element: Update widgets primary color theme settings ([`94394a1`](`94394a1e3e`)) * gitlab: Add issue templates ([`26da7e3`](`26da7e3667`)) * helmfile: Support setting the `defaultLanguage` - relevant for OX App Suite and XWiki - in `functional.yaml.gotmpl` ([`24065db`](`24065dbc70`)) * helmfile: Use passwords defined in `database.yaml.gotmpl` for Cassandra when available ([`0268219`](`026821996a`)) * notes: Fix python path for self signed certs ([`c4279d1`](`c4279d11bb`)) * notes: Fix repeated redirects on expired session; Remove fetching of external assets ([`c1012f4`](`c1012f4e65`)) * open-xchange: Don't enable sasl auth when no relay host is set ([`ff3b221`](`ff3b221870`)) * open-xchange: Enable and configure defaults for ContactCollector, remove legacy config artifacts ([`465f60d`](`465f60d4a2`)) * open-xchange: Use masterpassword for mailfilter in migration Pods; use PLAIN instead of OAuth for SASL ([`484dfaf`](`484dfafe64`)) * ox-connector: Use FQDN for internal service URLs ([`8593d5f`](`8593d5f2bd`)) ### Features * helmfile: Add toggle for external mail client onboarding and allow non-default FQDNs for IMAP and SMTP endpoints ([`25a97ab`](`25a97abba6`)) * open-xchange: Enable XRechnung in Viewer ([`08e6ec5`](`08e6ec59d2`)) * openproject: Update from 16.4.1 to 16.5.1 ([`74cf2ee`](`74cf2ee0d8`))	2025-11-07 09:08:52 +00:00
Thorsten Roßner	f8104f6358	fix(element): Update favicon to use PNG version	2025-11-07 05:58:42 +00:00
Thorsten Roßner	02d3021c4b	fix(element): Update Synapse from v1.137.0 to v1.141.0; fixes https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr which applies to all openDesk deployments using Element/Matrix with federation enabled	2025-11-07 05:58:42 +00:00
Thorsten Roßner	d2dc8c40b9	chore(publiccode.yml): Update for 1.9.0	2025-11-06 15:49:03 +01:00
Philip Gaber	47a1ed75e8	docs(migration.md): Further enhance version table and explanations	2025-11-06 15:41:29 +01:00
Philip Gaber	47e13e4ff9	docs(misc): Change to stylized note/warning/important banners	2025-11-06 14:02:34 +01:00
Philip Gaber	b2f1d609cb	docs(migration.md): Enhance version semantics, corrections, enhance version table	2025-11-06 13:35:13 +01:00
ulferts	74cf2ee0d8	feat(openproject): Update from 16.4.1 to 16.5.1	2025-11-04 15:12:27 +00:00
Thorsten Roßner	25a97abba6	feat(helmfile): Add toggle for external mail client onboarding and allow non-default FQDNs for IMAP and SMTP endpoints	2025-11-04 09:00:34 +01:00
Thorsten Roßner	465f60d4a2	fix(open-xchange): Enable and configure defaults for ContactCollector, remove legacy config artifacts	2025-11-03 14:58:17 +01:00
Viktor Pracht	08e6ec59d2	feat(open-xchange): Enable XRechnung in Viewer	2025-11-03 14:58:11 +01:00
Thorsten Roßner	c115a83924	docs(data-storage.md): Set `ox-connector-appcenter-ox-connector-0` PVC as optional instead of mandatory for backup	2025-11-03 10:24:49 +00:00
Thorsten Roßner	026821996a	fix(helmfile): Use passwords defined in `database.yaml.gotmpl` for Cassandra when available	2025-11-03 10:24:49 +00:00
Thorsten Roßner	24065dbc70	fix(helmfile): Support setting the `defaultLanguage` - relevant for OX App Suite and XWiki - in `functional.yaml.gotmpl`	2025-11-03 10:24:49 +00:00
Thorsten Roßner	8151896b55	docs(architecture.md): Fix footnote	2025-11-03 10:24:49 +00:00
Thorsten Roßner	0f10d363bf	ci(user-importer): Update image to 3.4.1	2025-11-03 10:24:49 +00:00
Milton Moura (Nordeck)	94394a1e3e	fix(element): Update widgets primary color theme settings Signed-off-by: Milton Moura (Nordeck) <milton.moura@nordeck.net>	2025-10-31 12:34:09 +01:00