wip: extra-env-vars definitions

# [1.2.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.2...v1.2.0) (2025-03-25)

### Bug Fixes

* **collabora:** Set proper theming for Collabora Online (openDesk EE) ([896b3c1](896b3c102c))
* **collabora:** Update to 24.04.12 ([4296db7](4296db7c90))
* **dev-tooling:** Fix path names when refencing local Helm chart copies in `helmfile-child.yaml.gotmpl` files ([60f5e36](60f5e36b7c))
* **docs:** Add `functional.md` and reference it in `getting-started.md` ([0efc0af](0efc0af761))
* **docs:** Add testing.md ([c4e4258](c4e4258162))
* **dovecot:** Update EE Helm chart to resolve issue with mandatory set `PriorityClass` ([696f2da](696f2daa9c))
* **element:** Run UVS container as a non-root user ([f262507](f26250774e))
* **element:** Update NeoChoice and NeoBoard widget to latest releases ([7456543](7456543d81))
* **helmfile:** Add missing `deletePodsOnSuccessTimeout` statements ([87144b8](87144b8fd3))
* **helmfile:** Support for `functional.externalServices.matrix.federation.domainAllowList` ([817af98](817af98fcd))
* **intercom:** Allow transient session cookies and rolling session duration configuration ([4d59d12](4d59d12a97))
* **intercom:** Update to Intercom Service v2.10.3 ([7b05213](7b05213d6e))
* **jitsi:** Update chart to v3.1.0 incl. a fix in room history toggle ([1480253](1480253a52))
* **migrations:** Explicit scoping of role required for access to the migration's ConfigMap ([02488fe](02488fe2dd))
* **nextcloud:** Disable integration with OX App Suite if groupware it is not available ([fdfe76c](fdfe76c37e))
* **nextcloud:** Update apps and support branding of the HTML title ([bc55f6a](bc55f6a366))
* **nextcloud:** Update images for improved log output ([f1147f0](f1147f0fdf))
* **nextcloud:** Update images to allow logging in environments where inotify cannot be used ([0110675](01106757da))
* **nextcloud:** Update to 30.0.6 including latest apps ([52b0b13](52b0b13e6b))
* **nubus:** Add imagePullSecrets to nginx-s3-gateway ([466b70a](466b70a9bb))
* **nubus:** Add migrations for Nubus 1.7.0; See migrations.md for details ([7d7e9e6](7d7e9e65b3))
* **nubus:** Always use S3 gateway for assets ([1e62a0d](1e62a0dfe1))
* **nubus:** Change logo URLs for apps referencing the openDesk logo provided by Nubus ([5d398f5](5d398f5d64))
* **nubus:** Cleanup of unnecessary LDAP groups; customization option to show the OX App Suite context selection in the IAM's admin UI ([4c42ed7](4c42ed76e8))
* **nubus:** Delete now legacy Ingress `ums-minio-rewrites` ([1c50aa5](1c50aa5ce2))
* **nubus:** Fix mixed up links for legal and privacy statement ([dbcc785](dbcc785134))
* **nubus:** Indent `nubusPortalConsumer.persistence.groupMembershipCache` causing `persistence.storages.nubusPortalConsumer.*` to be ignored; See migrations.md for details ([baa5b14](baa5b14551))
* **nubus:** Register OX provisioning consumer only when OX is enabled; See migrations.md for details ([adb3fa1](adb3fa18eb))
* **nubus:** Remove unnecessary inactive portal tiles and folders ([1724fa1](1724fa14a3))
* **nubus:** Update openDesk customizing: Preset openDesk specific attributes on `Administrator` account; Remove unused portal categories ([6edfe72](6edfe7239f))
* **opendesk-services:** Add notes to certificate resource ([d18abb0](d18abb0d0a))
* **openproject:** Update `opendesk-openproject-bootstrap` to support external secrets ([41e0aae](41e0aaeffe))
* **openproject:** Update to 15.3.0 including update for seeding relevant environment variables ([a6de1fe](a6de1fe694))
* **openproject:** Update to 15.3.1 ([f34a4a3](f34a4a3601))
* **openproject:** Update to 15.3.2 ([6723a34](6723a34c22))
* **openproject:** Update to 15.4.0 ([2a0f2a3](2a0f2a3333))
* **openproject:** Update to 15.4.1 ([747cae5](747cae545a))
* **openxchange:** Template HTML title from `.Values.theme.texts.productName` ([2e992fc](2e992fc236))
* **openxchange:** Update to latest 8.35 patch level ([44c2081](44c2081bd8))
* **ox-connector:** Update to v0.14.7 ([dd3b35b](dd3b35b626))
* **postfix:** Add internal authentication ([2389d59](2389d59735))
* **postfix:** Add recipient delimiter support ([f92b76b](f92b76b2b2))
* **requirements.md:** Set Ingress NGINX 1.11.5 as requirement ([2bf8e1d](2bf8e1de98))
* **synapse:** Use synapse-guest-module by Element (supplier) ([2730b03](2730b03e70))

### Features

* **helmfile:** Use PostgreSQL as default database for Nextcloud and XWiki;  follow `migrations.md` when upgrading an existing environment ([2f584bd](2f584bd8e8))
* **nextcloud:** Support external secrets for metrics token ([dbec2ec](dbec2ec36f))
* **notes:** Update to v2.4.0 ([3d35440](3d35440dc7))
* **nubus:** Support of external secrets in opendesk-keycloak-bootstrap ([3d2f751](3d2f75165a))
* **nubus:** Update to v1.7.0 ([d018385](d018385473))
* **openxchange:** Update to OX App Suite 8.35 ([037537b](037537b394))
* **xwiki:** Update to 16.10.5 ([bfd27f3](bfd27f3c39))

.gitlab-ci.yml

@@ -57,9 +57,10 @@ variables:
     description: "The name of namespaces to deploy to."
     value: ""
   CLUSTER:
-    description: "Which cluster to use. Cluster must be defined in `gitlab/environments.yaml` of the
-        repo that is included above using the env var `PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG`:
-        ${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
+    description: >
+      Which cluster to use. Cluster must be defined in `gitlab/environments.yaml` of the
+      repo that is included above using the env var `PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG`:
+      ${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}
     value: "dev"
   MASTER_PASSWORD_WEB_VAR:
     description: >
@@ -72,15 +73,25 @@ variables:
     options:
       - "yes"
       - "no"
+  FLUSH_EXTERNAL_SERVICES_BEFORE:
+    description: >
+      Recreates databases and purges objectstorage. Useful when using external services and required overrides.
+    value: "no"
+    options:
+      - "yes"
+      - "no"
   DEBUG_ENABLED:
-    description: "Allows to set `debug.enabled` to true for a deployment, needs to be supported by stage specific\
-     configuration containing: `debug.enabled: {{ env \"DEBUG_ENABLED\" | default false }}`"
+    description: >
+      Allows to set `debug.enabled` to true for a deployment, needs to be supported by stage specific
+      configuration containing: `debug.enabled: {{ env "DEBUG_ENABLED" | default false }}`
     value: "no"
     options:
       - "yes"
       - "no"
   OPENDESK_ENTERPRISE:
-    description: "Set to `true` if you want to deploy openDesk EE (but be sure you provide the required EE keys/tokens for the application)"
+    description: >
+      Set to `true` if you want to deploy openDesk EE (but be sure you provide the required EE keys/tokens
+      for the application)
     value: "false"
     options:
       - "true"
@@ -158,8 +169,9 @@ variables:
       - "yes"
       - "no"
   CREATE_DEFAULT_ACCOUNTS:
-    description: "Creates `default` and `default-admin` in the instance using the password defined as CI variable
-                 `DEFAULT_ACCOUNTS_PASSWORD`."
+    description: >
+      Creates `default` and `default-admin` in the instance using the password defined as CI variable
+      `DEFAULT_ACCOUNTS_PASSWORD`.
     value: "no"
     options:
       - "yes"
@@ -185,22 +197,29 @@ variables:
   TESTS_BRANCH:
     description: "Branch of E2E-tests on which the test pipeline is triggered"
     value: "develop"
-  TESTS_PROJECT_URL:
-    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
-    value: "gitlab.opencode.de/api/v4/projects/1506"
   TESTS_TESTSET:
-    description: "Selects test set for E2E-tests"
+    description: >
+      Selects test set for E2E-tests (Regression, Smoke or Nightly), name multiple comma separated to trigger the
+      sets in one launch, use semikolon to trigger the sets in different launches.
     value: "Smoke"
+  TESTS_BROWSER:
+    description: "Select the browser (engine) to use for the test run."
+    value: "chromium"
     options:
-      - "Regression"
-      - "Smoke"
+      - "chromium"
+      - "webkit"
+      - "firefox"
   TESTS_GRACE_PERIOD:
-    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail.
-                  GRACE_PERIOD is the period in seconds that should be waited before running the tests."
+    description: >
+      A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail. Here you
+      can set the time in seconds that should be waited before running the tests.
     value: "0"
   TESTS_NUMBER_OF_THREADS:
     description: "How many threads are used for executing the tests in parallel?"
     value: "8"
+  TESTS_PROJECT_URL:
+    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
+    value: "gitlab.opencode.de/api/v4/projects/1506"
 
 # Declare .environments which is in `opendesk-env` repository. In case it is not available
 # 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
@@ -232,9 +251,137 @@ variables:
   variables:
     HELMFILE_ENVIRONMENT: "dev"
 
+db-cleanup:
+  extends: ".deploy-common"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-ci-toolbox:1.0.0\
+          @sha256:8c00f96cbfca32e4a724c552143c7172980dd03c573fb097e57a2351db6421ab"
+  needs:
+    - job: "env-cleanup"
+      optional: true
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          $ENV_STOP_BEFORE != "no" &&
+          $FLUSH_EXTERNAL_SERVICES_BEFORE != "no"
+      when: "on_success"
+  script:
+    # yamllint disable-line rule:line-length rule:quoted-strings
+    - export FILES=(${CI_PROJECT_DIR}/helmfile/environments/default/database.yaml.gotmpl ${CI_PROJECT_DIR}/helmfile/environments/dev/write-over-values-for-environment.yaml.gotmpl)
+    # Cleanup MariaDB
+    - |
+      export DATABASES="oxAppSuite"
+      export MARIADB_HOST=""
+      export MARIADB_PORT=""
+      export MARIADB_USERNAME=""
+      export MARIADB_PASSWORD=""
+
+      for DATABASE in $DATABASES; do
+        export ENV_DATABASE=${DATABASE}
+
+        # Parse cluster values
+        for FILE in ${FILES[@]}; do
+          if [ -f ${FILE} ]; then
+            if [[ $(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)]') != "null" ]]; then
+              MARIADB_DATABASE=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].name')
+              MARIADB_USERNAME=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].username')
+              MARIADB_PASSWORD=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].password')
+              MARIADB_HOST=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].host')
+              MARIADB_PORT=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].port')
+            fi;
+          fi;
+        done;
+
+        CONNECTION="--host=${MARIADB_HOST} \
+                    --port=${MARIADB_PORT} \
+                    --user=${MARIADB_USERNAME} \
+                    --password=${MARIADB_PASSWORD} \
+                    --skip-ssl"
+
+        echo "[mysql] [${ENV_DATABASE}] DROP ${MARIADB_DATABASE} on ${MARIADB_HOST}"
+        mariadb ${CONNECTION} -e "DROP DATABASE IF EXISTS ${MARIADB_DATABASE};"
+
+        if [ "${ENV_DATABASE}" = "oxAppSuite" ]; then
+          echo "[mysql] [${ENV_DATABASE}] DROP oxguard on ${MARIADB_HOST}"
+          mariadb ${CONNECTION} -e "DROP DATABASE IF EXISTS oxguard;"
+          echo "[mysql] [${ENV_DATABASE}] DROP oxguard_1 on ${MARIADB_HOST}"
+          mariadb ${CONNECTION} -e "DROP DATABASE IF EXISTS oxguard_1;"
+          echo "[mysql] [${ENV_DATABASE}] DROP PRIMARYDB_9 on ${MARIADB_HOST}"
+          mariadb ${CONNECTION} -e "DROP DATABASE IF EXISTS PRIMARYDB_9;"
+        else
+          mariadb ${CONNECTION} -e "CREATE DATABASE ${MARIADB_DATABASE};"
+          mariadb ${CONNECTION} -e "GRANT ALL PRIVILEGES ON ${MARIADB_DATABASE}.* TO ${MARIADB_USERNAME}@\"%\";"
+          mariadb ${CONNECTION} -e "FLUSH PRIVILEGES;"
+        fi;
+      done;
+    # Cleanup PostgreSQL
+    - |
+      export DATABASES="keycloak keycloakExtension nextcloud notes openproject synapse umsGuardianManagementApi \
+      umsNotificationsApi umsSelfservice xwiki"
+      export PGDATABASE="postgres"
+      export PGHOST=""
+      export PGPORT=""
+      export PGUSER=""
+      export PGPASSWORD=""
+      export PGPARAMS=""
+
+      for DATABASE in $DATABASES; do
+        export ENV_DATABASE=${DATABASE}
+
+        # Parse cluster values
+        for FILE in ${FILES[@]}; do
+          if [ -f $FILE ]; then
+            if [[ $(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)]') != "null" ]]; then
+              POSTGRES_DATABASE=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].name')
+              PGUSER=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].username')
+              PGPASSWORD=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].password')
+              PGHOST=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].host')
+              PGPORT=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].port')
+              PGPARAMS=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].parameters')
+            fi;
+          fi;
+        done;
+
+        echo "[psql] [${ENV_DATABASE}] DROP ${POSTGRES_DATABASE} on ${PGHOST}"
+        psql -c "DROP DATABASE ${POSTGRES_DATABASE}" || true;
+        if [ "${PGPARAMS}" = "null" ]; then
+        psql -c "CREATE DATABASE \"${POSTGRES_DATABASE}\";"
+        else
+        psql -c "CREATE DATABASE \"${POSTGRES_DATABASE}\" ${PGPARAMS};"
+        fi;
+        psql -c "ALTER DATABASE \"${POSTGRES_DATABASE}\" OWNER TO \"${PGUSER}\"";
+        psql -c "GRANT ALL PRIVILEGES ON DATABASE \"${POSTGRES_DATABASE}\" TO \"${PGUSER}\"";
+      done;
+    # Cleanup Objectstore
+    - |
+      export BUCKETS="migrations nextcloud openproject nubus notes"
+      export AWS_DEFAULT_REGION=""
+      export AWS_ENDPOINT=""
+      export AWS_ACCESS_KEY_ID=""
+      export AWS_SECRET_ACCESS_KEY=""
+
+      for BUCKET in $BUCKETS; do
+        export ENV_BUCKET=${BUCKET}
+
+        # Parse cluster values
+        for FILE in ${FILES[@]}; do
+          if [ -f $FILE ]; then
+            if [[ $(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)]') != "null" ]]; then
+              AWS_BUCKET=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].bucket')
+              AWS_ENDPOINT=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].endpoint')
+              AWS_ACCESS_KEY_ID=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].username')
+              AWS_SECRET_ACCESS_KEY=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].secretKey')
+              AWS_DEFAULT_REGION=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].region')
+            fi;
+          fi;
+        done;
+
+        aws s3 --endpoint "https://${AWS_ENDPOINT}" rm s3://${AWS_BUCKET} --recursive
+      done;
+  stage: "env-cleanup"
+
 env-cleanup:
   extends: ".deploy-common"
-  needs: []
   rules:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
@@ -568,6 +715,10 @@ run-tests:
           - "de"
           - "en"
   script:
+    - |
+      if [ "${LANGUAGE}" = "en" ]; then
+        sleep 30
+      fi
     - |
       curl --request POST \
       --header "Content-Type: application/json" \
@@ -580,6 +731,7 @@ run-tests:
           \"namespace\": \"${NAMESPACE}\", \
           \"url\": \"https://portal.${DOMAIN}/\", \
           \"language\": \"${LANGUAGE}\", \
+          \"browser\": \"${TESTS_BROWSER}\", \
           \"udm_api_username\": \"Administrator\", \
           \"udm_api_password\": \"${DEFAULT_ADMINISTRATOR_PASSWORD}\", \
           \"screenshot_test\": \"yes\", \

.gitlab/lint/lint-common.yml

@@ -1,4 +1,5 @@
-# SPDX-FileCopyrightText: 2024-2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 include:

.gitlab/lint/lint-kyverno.yml

@@ -5,7 +5,7 @@ include:
   - local: "/.gitlab/lint/lint-common.yml"
 
 lint-kyverno:
-  allow_failure: true
+  allow_failure: false
   extends: ".lint-common"
   image: "${OPENDESK_LINT_IMAGE}"
   parallel:

CHANGELOG.md

@@ -1,3 +1,64 @@
+# [1.2.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.2...v1.2.0) (2025-03-25)
+
+
+### Bug Fixes
+
+* **collabora:** Set proper theming for Collabora Online (openDesk EE) ([896b3c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/896b3c102cd59a9c4d0ae28457261a4749b37a6d))
+* **collabora:** Update to 24.04.12 ([4296db7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4296db7c90c93c3c268a7642ae920d412cb70429))
+* **dev-tooling:** Fix path names when refencing local Helm chart copies in `helmfile-child.yaml.gotmpl` files ([60f5e36](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/60f5e36b7cf183ac9f15b0e56b486e642c54ac4d))
+* **docs:** Add `functional.md` and reference it in `getting-started.md` ([0efc0af](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0efc0af761703a63392034df3f34acf569174e0c))
+* **docs:** Add testing.md ([c4e4258](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c4e425816272951082fa15f1ab4ff4aee4a4598d))
+* **dovecot:** Update EE Helm chart to resolve issue with mandatory set `PriorityClass` ([696f2da](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/696f2daa9c3df6b0db744d81bd6e159b3f9be440))
+* **element:** Run UVS container as a non-root user ([f262507](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f26250774e4bdb157181c3c8fe5c51f7429771ed))
+* **element:** Update NeoChoice and NeoBoard widget to latest releases ([7456543](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7456543d81625599372f781f963fe5902f969627))
+* **helmfile:** Add missing `deletePodsOnSuccessTimeout` statements ([87144b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/87144b8fd3268ad8196673999241ed1a1bf234fa))
+* **helmfile:** Support for `functional.externalServices.matrix.federation.domainAllowList` ([817af98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/817af98fcdf9bca0028365796fb17a8cd5d9f4f9))
+* **intercom:** Allow transient session cookies and rolling session duration configuration ([4d59d12](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4d59d12a9703e05cb6bc47fe413ebcaafdcb4c8b))
+* **intercom:** Update to Intercom Service v2.10.3 ([7b05213](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7b05213d6eaa96717e368bc68b79af44c9b3d921))
+* **jitsi:** Update chart to v3.1.0 incl. a fix in room history toggle ([1480253](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1480253a52e5a9848b626f60b7fb75ad7c43c4a5))
+* **migrations:** Explicit scoping of role required for access to the migration's ConfigMap ([02488fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02488fe2dd84046735bdb9351e47d4508eaf191f))
+* **nextcloud:** Disable integration with OX App Suite if groupware it is not available ([fdfe76c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fdfe76c37e597534b2a8b4bf609e28628aabff3e))
+* **nextcloud:** Update apps and support branding of the HTML title ([bc55f6a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc55f6a366398aae497bde8d81b9663b04f992de))
+* **nextcloud:** Update images for improved log output ([f1147f0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f1147f0fdf12271c47225f81069013afdf8bd5f3))
+* **nextcloud:** Update images to allow logging in environments where inotify cannot be used ([0110675](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01106757da8d8d5a60629126a794c1d61d850f0b))
+* **nextcloud:** Update to 30.0.6 including latest apps ([52b0b13](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/52b0b13e6bf4be738bd29029d1f2940e93a99045))
+* **nubus:** Add imagePullSecrets to nginx-s3-gateway ([466b70a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/466b70a9bb9bbbaf25c920fcca965388eb4d0350))
+* **nubus:** Add migrations for Nubus 1.7.0; See migrations.md for details ([7d7e9e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7d7e9e65b32e6445b45edcb8bf15f64f79d63a2f))
+* **nubus:** Always use S3 gateway for assets ([1e62a0d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1e62a0dfe14ccd840e910d6aea79fb7beabb8da5))
+* **nubus:** Change logo URLs for apps referencing the openDesk logo provided by Nubus ([5d398f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5d398f5d64fd03ad9e9a3898424f485fef8888b1))
+* **nubus:** Cleanup of unnecessary LDAP groups; customization option to show the OX App Suite context selection in the IAM's admin UI ([4c42ed7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4c42ed76e82fc0cd517a7409e21cadb757fdac8a))
+* **nubus:** Delete now legacy Ingress `ums-minio-rewrites` ([1c50aa5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1c50aa5ce2ffef4446b28504c461faf84ef856c8))
+* **nubus:** Fix mixed up links for legal and privacy statement ([dbcc785](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dbcc785134a79ebe500724739338702c5e6772a3))
+* **nubus:** Indent `nubusPortalConsumer.persistence.groupMembershipCache` causing `persistence.storages.nubusPortalConsumer.*` to be ignored; See migrations.md for details ([baa5b14](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/baa5b14551f405a5e17ddfc62733c98868a1f205))
+* **nubus:** Register OX provisioning consumer only when OX is enabled; See migrations.md for details ([adb3fa1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/adb3fa18eb36de91927c8118493038b400ff77d5))
+* **nubus:** Remove unnecessary inactive portal tiles and folders ([1724fa1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1724fa14a3fcab9473da06f7702eb248eef334c6))
+* **nubus:** Update openDesk customizing: Preset openDesk specific attributes on `Administrator` account; Remove unused portal categories ([6edfe72](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6edfe7239fd3916be71f830543c01084100b8aba))
+* **opendesk-services:** Add notes to certificate resource ([d18abb0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d18abb0d0a2e011065a6c40f80f56bbdb5a48a90))
+* **openproject:** Update `opendesk-openproject-bootstrap` to support external secrets ([41e0aae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/41e0aaeffec3e0b4f83662b4381713d2480533fc))
+* **openproject:** Update to 15.3.0 including update for seeding relevant environment variables ([a6de1fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a6de1fe694e7cbee88db5a0688b60e7c8d8e4cff))
+* **openproject:** Update to 15.3.1 ([f34a4a3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f34a4a360178f3a54cfe45198c4717241a9c5289))
+* **openproject:** Update to 15.3.2 ([6723a34](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6723a34c229fb683d5adb1c8c900afb0c3f24087))
+* **openproject:** Update to 15.4.0 ([2a0f2a3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2a0f2a33330e149f8b4b26a3b3c5273274b2c0ca))
+* **openproject:** Update to 15.4.1 ([747cae5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/747cae545abf186b8ec19b5203cdf47c67667601))
+* **openxchange:** Template HTML title from `.Values.theme.texts.productName` ([2e992fc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2e992fc23606a497d770e44fb3afeada1f5d54dd))
+* **openxchange:** Update to latest 8.35 patch level ([44c2081](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/44c2081bd860bd66204d2648f287fc6c5b928faa))
+* **ox-connector:** Update to v0.14.7 ([dd3b35b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd3b35b626d860389fad4fc0541dc962fe51c060))
+* **postfix:** Add internal authentication ([2389d59](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2389d597358f53e43be5982e29125eabda94bf6c))
+* **postfix:** Add recipient delimiter support ([f92b76b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f92b76b2b28c7955123f83881d23f719ea8dfd5c))
+* **requirements.md:** Set Ingress NGINX 1.11.5 as requirement ([2bf8e1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2bf8e1de9873e15501b282d8e0d16350559e54dd))
+* **synapse:** Use synapse-guest-module by Element (supplier) ([2730b03](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2730b03e701922c3b14fdd5f8e8dfb64223b3edc))
+
+
+### Features
+
+* **helmfile:** Use PostgreSQL as default database for Nextcloud and XWiki;  follow `migrations.md` when upgrading an existing environment ([2f584bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2f584bd8e82ab7262659d6b24613f214f6e9ad25))
+* **nextcloud:** Support external secrets for metrics token ([dbec2ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dbec2ec36f5019bc0f5e9769ab02701ebac4aa2c))
+* **notes:** Update to v2.4.0 ([3d35440](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d35440dc76c703872488ec468649ed274099fd5))
+* **nubus:** Support of external secrets in opendesk-keycloak-bootstrap ([3d2f751](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d2f75165a571a67d08f7e9588297c70fc808179))
+* **nubus:** Update to v1.7.0 ([d018385](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d018385473df1f5154e15ca8c55145d10e713797))
+* **openxchange:** Update to OX App Suite 8.35 ([037537b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/037537b394b2e07aa05590c8bcf7c1145df7d7e9))
+* **xwiki:** Update to 16.10.5 ([bfd27f3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bfd27f3c396d6f05ed3e6dd4cd9f2ff424250da8))
+
 ## [1.1.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.1...v1.1.2) (2025-02-19)
 
 

README-EE.md

@@ -36,6 +36,11 @@ The following components have - at least partially - Enterprise specific artifac
 - OX AppSuite: oD CE and EE are using the same release version, in EE an enterprise-built container of the AppSuite's Core-Middleware is being integrated.
 - OX Dovecot Pro 3: Dovecot Pro provides support for S3 storage and this feature is used by default.
 
+If you want to check in detail which artifacts are specific to openDesk Enterprise and thereby may contain non open source code, please check the `repository:` 
+values in the image ([1](./helmfile/environments/default/images.yaml.gotmpl) / [2](./helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl)) 
+and chart ([1](./helmfile/environments/default/charts.yaml.gotmpl) / [2](./helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl)) definitions. 
+When a repository path starts with `/zendis` the artifact is only available in an openDesk Enterprise deployment.
+
 # Enabling the Enterprise deployment
 
 To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value that does not evaluate to boolean *false* for [Helm flow control](https://helm.sh/docs/chart_template_guide/control_structures/#ifelse), e.g. `"true"`, `"yes"` or `"1"`:

README.md

@@ -35,14 +35,15 @@ openDesk currently features the following functional main components:
 | Function             | Functional Component        | Component<br/>Version                                                                                | Upstream Documentation                                                                                                                |
 | -------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89)                       | [For the most recent release](https://element.io/user-guide)                                                                          |
-| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                                     | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8)                                                 | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                           |
-| Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
-| Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)                       | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
+| Collaborative notes  | Notes (aka Docs)            | [2.4.0](https://github.com/suitenumerique/docs/releases/tag/v2.4.0)                                  | Online documentation/welcome document available in installed application                                                              |
+| Diagram editor       | CryptPad ft. diagrams.net   | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                               | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
+| File management      | Nextcloud                   | [30.0.6](https://nextcloud.com/de/changelog/#30-0-6)                                                 | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
+| Groupware            | OX App Suite                | [8.35](https://documentation.open-xchange.com/appsuite/releases/8.35/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Knowledge management | XWiki                       | [16.10.5](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.5/)                     | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
 | Portal & IAM         | Nubus                       | [1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | [15.3.1](https://www.openproject.org/docs/release-notes/15-3-1/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
-| Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
-| Weboffice            | Collabora                   | [24.04.12.4](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
+| Project management   | OpenProject                 | [15.4.1](https://www.openproject.org/docs/release-notes/15-4-1/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Videoconferencing    | Jitsi                       | [2.0.9955](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9955)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
+| Weboffice            | Collabora                   | [24.04.12.4](https://www.collaboraoffice.com/code-24-04-release-notes/)                              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
 
 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.

docs/external-services.md

@@ -67,10 +67,10 @@ service.
 |                    |                    | Username  | `databases.umsSelfservice.username`           | `selfservice_user`           |
 |                    |                    | Password  | `databases.umsSelfservice.password`           |                              |
 | Nextcloud          | Nextcloud          |           |                                               |                              |
-|                    |                    | Type      | `databases.nextcloud.type`                    | `mariadb`                    |
+|                    |                    | Type      | `databases.nextcloud.type`                    | `postgresql`                 |
 |                    |                    | Name      | `databases.nextcloud.name`                    | `nextcloud`                  |
-|                    |                    | Host      | `databases.nextcloud.host`                    | `mariadb`                    |
-|                    |                    | Port      | `databases.nextcloud.port`                    | `3306`                       |
+|                    |                    | Host      | `databases.nextcloud.host`                    | `postgresql`                 |
+|                    |                    | Port      | `databases.nextcloud.port`                    | `5432`                       |
 |                    |                    | Username  | `databases.nextcloud.username`                | `nextcloud_user`             |
 |                    |                    | Password  | `databases.nextcloud.password`                |                              |
 | Notes              | Notes              |           |                                               |                              |
@@ -109,11 +109,11 @@ service.
 |                    |                    | Username  | `databases.dovecotDictmap.username`           | `dovecot_dictmap_user`       |
 |                    |                    | Password  | `databases.dovecotDictmap.password`           |                              |
 | XWiki[^4]          | XWiki              |           |                                               |                              |
-|                    |                    | Type      | `databases.xwiki.type`                        | `mariadb`                    |
+|                    |                    | Type      | `databases.xwiki.type`                        | `postgresql`                 |
 |                    |                    | Name      | `databases.xwiki.name`                        | `xwiki`                      |
-|                    |                    | Host      | `databases.xwiki.host`                        | `mariadb`                    |
-|                    |                    | Port      | `databases.xwiki.port`                        | `3306`                       |
-|                    |                    | Username  | `databases.xwiki.username`                    | `root`                       |
+|                    |                    | Host      | `databases.xwiki.host`                        | `postgresql`                 |
+|                    |                    | Port      | `databases.xwiki.port`                        | `5432`                       |
+|                    |                    | Username  | `databases.xwiki.username`                    | `xwiki_user`                 |
 |                    |                    | Password  | `databases.xwiki.password`                    |                              |
 
 # Object storage

docs/functional.md

@@ -0,0 +1,30 @@
+<!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Functional configuration</h1>
+
+This document addresses the available functional configuration options of an openDesk deployment.
+
+## Supported functional configuration
+
+While the openDesk applications allow a wide range of configuration options, only a small subset of them are supported by openDesk. This subset can be found in [`helmfile/environments/default/functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl)
+
+The following categories are available. Each category contains a set of options to tailor your openDesk deployment to your needs. Please find the actual options including inline documentation in [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl) itself.
+
+* Administrative options (`functional.admin.*`): Options affecting the IAM administrator role (users that are member of the LDAP group `Domain Admins`) of openDesk.
+* Authentication options (`functional.authentication.*`): Authentication related settings, e.g. define additional [OIDC](https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)) clients or scopes.
+* External Services options (`functional.externalServices.*`): Settings controlling externally available services like APIs.
+* Filestore options (`functional.filestore.*`): Configuration options for the filestore component of openDesk, like default storage quota or file sharing options.
+* Data Protection options (`functional.dataProtection.*`): Data protection related settings.
+* Portal options (`functional.portal.*`): Options to customize the openDesk portal, e.g. if the login dialog should be enforced.
+* Chat options (`functional.chat.*`): Configuration options for the chat component of openDesk.
+* Migration options (`functional.migration.*`): Helpful setting(s) for migration scenarios.
+
+## Customization of functional options
+
+In case the options from [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl) are not sufficient, you might want to look into [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl). The customizations give you control over all templating that is being done in openDesk, but be aware it is an unsupported approach, so in case you have a strong need for customizations, please let us know by opening a ticket. We will check if it is a use case that can be supported by implementing it as part of the aforementioned [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl).
+
+> **Note<br>**
+> You can not directly template your own values in the structure found in [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl), rather, you need to reference your custom value files to overwrite the openDesk defaults. In the app specific `helmfile-child.yaml.gotmpl` files, the openDesk value files are referenced first, then afterwards, the files you define in the customizations are read. 

docs/getting-started.md

@@ -20,6 +20,9 @@ This documentation lets you create an openDesk evaluation instance on your Kuber
     * [Ingress](#ingress)
     * [Container runtime](#container-runtime)
     * [Volumes](#volumes)
+  * [Customize deployment](#customize-deployment)
+    * [Functional features](#functional-features)
+    * [Features through Customization](#features-through-customization)
   * [Connectivity](#connectivity)
     * [Ports](#ports)
       * [Web-based user interface](#web-based-user-interface)
@@ -260,7 +263,9 @@ cluster:
     readWriteMany: true
 ```
 
+## Customize deployment
 
+While openDesk configures the applications with meaningful defaults, you can check [functional.md](functional.md) if you want to change these defaults to better match your use case.
 
 ## Connectivity
 

docs/migrations.md

@@ -75,6 +75,7 @@ To upgrade existing deployments, you cannot skip any version mentioned in the co
 
 | Mandatory version |
 | ----------------- |
+| v1.2.x            |
 | v1.1.x            |
 | v1.0.0            |
 | v0.9.0            |
@@ -89,6 +90,67 @@ When interested in more details about the automated migrations, please read sect
 
 Be sure you check all the sections for the releases your are going to update your current deployment from.
 
+## From v1.1.2
+
+#### Helmfile cleanup: Do not configure OX provisioning when no OX installed
+
+**Target group:** Installations that have no OX App Suite installed.
+
+With openDesk 1.2.0 the OX provisioning consumer will not be registered when there is no OX installed.
+
+We do not remove the consumer for existing installations, if you want to do that for your existing installation please perform the following steps:
+
+```
+export NAMESPACE=<your_namespace>
+kubectl -n ${NAMESPACE} exec -it ums-provisioning-nats-0 -c nats-box -- sh -c 'nats consumer rm stream:ox-connector durable_name:ox-connector --user=admin --password=${NATS_PASSWORD} --force'
+kubectl -n ${NAMESPACE} exec -it ums-provisioning-nats-0 -c nats-box -- sh -c 'nats stream rm stream:ox-connector --user=admin --password=${NATS_PASSWORD} --force'
+kubectl -n ${NAMESPACE} delete secret ums-provisioning-ox-credentials-test
+```
+
+#### Helmfile new default: PostgreSQL for XWiki and Nextcloud
+
+**Target group:** All upgrade installations that do not already use the previous optional PostgreSQL database backend for Nextcloud and XWiki.
+
+openDesk now uses PostgreSQL as default database backend for Nextcloud and XWiki.
+
+When upgrading existing instances you likely want to keep the current database backend (MariaDB).
+
+**Use case A:** You use your own external database services, if not see "Use case B" further down.
+
+You just have to add the new `type` attribute and set it to `mariadb`:
+
+```yaml
+databases:
+  nextcloud:
+    type: "mariadb"
+  xwiki:
+    type: "mariadb"
+```
+
+**Use case B:** You use the openDesk supplied database services.
+
+Ensure you set the following attributes before upgrading, this includes the aforementioned `type` attribute.
+
+```yaml
+databases:
+  nextcloud:
+    type: "mariadb"
+    host: "mariadb"
+    port: 3306
+  xwiki:
+    type: "mariadb"
+    host: "mariadb"
+    port: 3306
+    username: "root"
+```
+
+In case you are planning to migrate an existing instance from MariaDB to PostgreSQL please check the upstream documentation for details:
+
+- Nextcloud database migration: https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
+- XWiki:
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
+
 ## From v1.1.1
 
 ### Pre-upgrade from v1.1.1
@@ -604,6 +666,20 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
 
 # Automated migrations - Details
 
+## From v1.1.2 (automated)
+
+> **Note**<br>
+> Details can be found in [run_4.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_4.py).
+
+### migrations-pre
+
+- Delete PVC `group-membership-cache-ums-portal-consumer-0`: With the upgrade the Nubus Portal Consumer no longer requires to be executed with root privileges. The PVC contains files that require root permission to access them, therefore the PVC gets deleted (and re-created) during the upgrade.
+- Delete StatefulSet `ums-portal-consumer`: A bug was fixed in the templating of the Portal Consumer's PVC causing the values in `persistence.storages.nubusPortalConsumer.*` to be ignored. As these values are immutable, we had to delete the whole StatefulSet.
+
+### migrations-post
+
+- Restarting Deployment `ums-provisioning-udm-transformer` and StatefulSet `ums-provisioning-udm-listener` as well as deleting the Nubus Provisioning consumer `durable_name:incoming` on stream `stream:incoming`: Due to a bug in Nubus 1.7.0 the `incoming` stream was blocked after the upgrade, the aforementioned measures unblock the stream.
+
 ## From v1.0.0 (automated)
 
 With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.

docs/monitoring.md

@@ -67,7 +67,9 @@ grafana:
     enabled: true
 ```
 
-# Components
+Please find the details in the [related Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards).
+
+# Component overview
 
 | Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
 |:----------|-----------------------------------|-------------------------|---------------------|

docs/requirements.md

@@ -25,8 +25,8 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
 
 - K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
-- Ingress controller (Ingress NGINX) == [4.11.x/1.11.x](https://github.com/kubernetes/ingress-nginx/releases) - tested with 1.11.1 up to 1.11.4
-  - **Note**: We are working on support for more recent versions, as issues have been reported with 1.12.x.
+- Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases) - tested with 1.11.1 up to 1.11.5
+  - **Important Note**: We are working on support for more recent versions, but please ensure to use at least 1.11.5 due to ["security issues"](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) in earlier versions.
 - [Helm](https://helm.sh/) >= v3.9.0
 - [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc8**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0

docs/security-context.md

@@ -155,7 +155,7 @@ This list gives you an overview of templated security settings and if they compl
 | **element**/matrix-neodatefix-bot-bootstrap | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/matrix-neodatefix-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-element | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
-| **element**/opendesk-matrix-user-verification-service | :x: | no | no | no | no | 0 | 0 | yes | yes |
+| **element**/opendesk-matrix-user-verification-service | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **element**/opendesk-matrix-user-verification-service-bootstrap | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-synapse | :white_check_mark: | no | no | yes | yes | 10991 | 10991 | yes | yes |
 | **element**/opendesk-synapse-web | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
@@ -210,6 +210,7 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/nextcloud-integration-ui | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/opendesk-open-xchange-bootstrap | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/postfix-ox | :x: | yes | yes | yes | no | 0 | 0 | yes | no |
 | **opendesk-migrations-post**/opendesk-migrations-post | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **opendesk-migrations-pre**/opendesk-migrations-pre | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **opendesk-openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
@@ -226,7 +227,7 @@ This list gives you an overview of templated security settings and if they compl
 | **services-external**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services-external**/minio | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services-external**/opendesk-dkimpy-milter | :x: | yes | no | yes | yes | 1000 | 1000 | yes | no |
-| **services-external**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
+| **services-external**/postfix | :x: | yes | yes | yes | no | 0 | 0 | yes | no |
 | **services-external**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services-external**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |

helmfile/apps/collabora/values.yaml.gotmpl

@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -27,6 +27,9 @@ collabora:
     {{- else }}
     --o:logging.anonymize.anonymize_user_data=true
     {{- end }}
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    --o:user_interface.use_integration_theme=false
+    {{- end }}
     {{- if .Values.apps.collaboraController.enabled }}
     --o:indirection_endpoint.url=https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/routeToken
     --o:monitors.monitor[0]=wss://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/ws

helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl

@@ -123,7 +123,7 @@ configuration:
       value: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
 
   opendeskIntegration:
-    centralnavigation:
+    centralNavigation:
       username:
         value: "opendesk_username"
       password:

helmfile/apps/notes/values.yaml.gotmpl

@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  repository: {{ printf "%s/%s" (coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.notesBackend.registry) (.Values.images.notesBackend.repository) | quote }}
+  repository: {{ printf "%s/%s" (coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.notesBackend.registry) (.Values.images.notesBackend.repository) | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.notesBackend.tag }}
   credentials:
@@ -48,7 +48,7 @@ ingressMedia:
   host: "{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}"
   annotations:
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/auth-url: "https://{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}/api/v1.0/documents/retrieve-auth/"
+    nginx.ingress.kubernetes.io/auth-url: "https://{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}/api/v1.0/documents/media-auth/"
     nginx.ingress.kubernetes.io/upstream-vhost: {{ .Values.objectstores.notes.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
     nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
     nginx.ingress.kubernetes.io/use-regex: "true"
@@ -143,6 +143,10 @@ djangoSuperUserPass: {{ .Values.secrets.notes.superuser }}
 djangoSecretKey: {{ .Values.secrets.notes.djangoSecretKey }}
 
 backend:
+  image:
+    repository: {{ printf "%s/%s" (coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.notesBackend.registry) (.Values.images.notesBackend.repository) | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    tag: {{ .Values.images.notesBackend.tag }}
   replicas: {{ .Values.replicas.notesBackend }}
   envVars:
     DB_HOST: {{ .Values.databases.notes.host | quote }}
@@ -160,11 +164,16 @@ backend:
     AWS_S3_SECRET_ACCESS_KEY: {{ .Values.objectstores.notes.secretKey | default .Values.secrets.minio.notesUser | quote }}
     AWS_STORAGE_BUCKET_NAME: {{ .Values.objectstores.notes.bucket }}
     DJANGO_CSRF_TRUSTED_ORIGINS: {{ printf "https://%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
+    DJANGO_SITE_DOMAIN: {{ printf "%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
+    DJANGO_SITE_NAME: {{ printf "%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
     DJANGO_CONFIGURATION: Production
     DJANGO_ALLOWED_HOSTS: "*"
     DJANGO_SECRET_KEY: {{ .Values.secrets.notes.djangoSecretKey }}
     DJANGO_SETTINGS_MODULE: impress.settings
     DJANGO_SUPERUSER_PASSWORD: {{ .Values.secrets.notes.superuser }}
+    DJANGO_EMAIL_BRAND_NAME: "openDesk"
+    DJANGO_EMAIL_LOGO_IMG: {{ printf "https://%s.%s/univention/portal/icons/entries/swp.notes.svg" .Values.global.hosts.nubus .Values.global.domain | quote }}
+    DJANGO_EMAIL_FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
     DJANGO_EMAIL_HOST: "postfix"
     DJANGO_EMAIL_PORT: 25
     DJANGO_EMAIL_USE_SSL: False
@@ -181,7 +190,8 @@ backend:
     OIDC_RP_SIGN_ALGO: RS256
     OIDC_RP_SCOPES: "openid opendesk-notes-scope"
     USER_OIDC_FIELD_TO_SHORTNAME: "given_name"
-    USER_OIDC_FIELDS_TO_FULLNAME: "given_name family_name"
+    USER_OIDC_FIELDS_TO_FULLNAME: "given_name,family_name"
+    USER_OIDC_ESSENTIAL_CLAIMS: "email"
     OIDC_REDIRECT_ALLOWED_HOSTS: {{ printf "https://%s.%s/*" .Values.global.hosts.notes .Values.global.domain | quote }}
     OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{}"
     OIDC_RENEW_ID_TOKEN: "False"
@@ -202,8 +212,7 @@ backend:
       - "/bin/sh"
       - "-c"
       - |
-        python manage.py migrate --no-input &&
-        python manage.py create_demo --force
+        python manage.py migrate --no-input
     restartPolicy: Never
 
   createsuperuser:

helmfile/apps/nubus/helmfile-child.yaml.gotmpl

@@ -74,7 +74,7 @@ releases:
     installed: {{ .Values.apps.nubus.enabled }}
     timeout: 900
 
-  # NGINX S3 Gateway (when cluster minio is not used)
+  # NGINX S3 Gateway
   - name: "nubus"
     chart: "nginx-s3-gateway-repo/{{ .Values.charts.nginxS3Gateway.name }}"
     version: "{{ .Values.charts.nginxS3Gateway.version }}"
@@ -83,7 +83,7 @@ releases:
       {{- range .Values.customization.release.nginxS3Gateway }}
       - {{ . }}
       {{- end }}
-    installed: {{ not .Values.apps.minio.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}
     timeout: 900
 
 commonLabels:

helmfile/apps/nubus/values-intercom-service.yaml.gotmpl

@@ -53,6 +53,7 @@ ics:
   secret: {{ .Values.secrets.intercom.secret | quote }}
   issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
   originRegex: "{{ .Values.global.domain }}"
+  enableSessionCookie: true
   userUniqueMapper: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
   usernameClaim: "opendesk_username"
   keycloak:

helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl

@@ -3,6 +3,10 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+global:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
 image:
   registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nginxS3Gateway.registry | quote }}
   repository: {{ .Values.images.nginxS3Gateway.repository | quote }}

helmfile/apps/nubus/values-nubus.yaml.gotmpl

@@ -17,13 +17,8 @@ global:
       cnAdmin:
         password: {{ .Values.secrets.nubus.ldapSecret | quote }}
   nubusDeployment: true
-  nubusMasterPassword: {{ .Values.secrets.nubus.masterpassword | quote }}
-  objectStorage:
-    bucket: {{ .Values.objectstores.nubus.bucket | quote }}
-    connection:
-      host: "minio"
-      port: "9000"
-      protocol: "http"
+  secrets:
+    masterPassword: {{ .Values.secrets.nubus.masterpassword | quote }}
   subDomains:
     portal: {{ .Values.global.hosts.nubus | quote }}
     keycloak: {{ .Values.global.hosts.keycloak | quote }}
@@ -133,6 +128,8 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  minio:
+    enabled: false
 
 # Nubus bundled services
 postgresql:
@@ -583,16 +580,18 @@ nubusPortalConsumer:
         {{- range .Values.global.imagePullSecrets }}
         - name: {{ . | quote }}
         {{- end }}
+    assetsBaseUrl: {{ printf "https://%s.%s/univention/portal" .Values.global.hosts.nubus .Values.global.domain | quote }}
     logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
-    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
-    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
   objectStorage:
     auth:
       accessKey: {{ .Values.objectstores.nubus.username | quote }}
       secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+    bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
+    endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
   persistence:
-    size: {{ .Values.persistence.storages.nubusPortalConsumer.size | quote }}
-    storageClass: {{ coalesce .Values.persistence.storages.nubusPortalConsumer.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+    groupMembershipCache:
+      size: {{ .Values.persistence.storages.nubusPortalConsumer.size | quote }}
+      storageClass: {{ coalesce .Values.persistence.storages.nubusPortalConsumer.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
   podAnnotations:
     intents.otterize.com/service-name: "ums-portal-consumer"
   provisioningApi:
@@ -615,6 +614,12 @@ nubusPortalConsumer:
       repository: {{ .Values.images.nubusWaitForDependency.repository }}
       tag: {{ .Values.images.nubusWaitForDependency.tag }}
       imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    extraEnvVars:
+      - name: AWS_DEFAULT_REGION
+        value: {{ .Values.objectstores.nubus.region | quote }}
+  extraEnvVars:
+    - name: AWS_DEFAULT_REGION
+      value: {{ .Values.objectstores.nubus.region | quote }}
   {{- if .Values.certificate.selfSigned }}
   extraVolumes:
     - name: "trusted-cert-secret-volume"
@@ -646,9 +651,14 @@ nubusPortalConsumer:
         value: "/etc/ssl/certs/ca-certificates.crt"
       - name: "SSL_CERT_FILE"
         value: "/etc/ssl/certs/ca-certificates.crt"
+      - name: AWS_DEFAULT_REGION
+        value: {{ .Values.objectstores.nubus.region | quote }}
   {{- end }}
 
 nubusPortalServer:
+  extraEnvVars:
+    - name: AWS_DEFAULT_REGION
+      value: {{ .Values.objectstores.nubus.region | quote }}
   additionalAnnotations:
     intents.otterize.com/service-name: "ums-portal-server"
   containerSecurityContext:
@@ -682,22 +692,27 @@ nubusPortalServer:
     auth:
       accessKey: {{ .Values.objectstores.nubus.username | quote }}
       secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
-  portalServer:
-    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
-    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
+    bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
+    endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
     objectStorageCredentialSecret:
       name: "ums-portal-server-minio-opendesk-credentials"
       accessKeyKey: "access-key-id"
       secretKeyKey: "secret-key-id"
+  portalServer:
     centralNavigation:
       enabled: true
       authenticatorSecretName: "ums-opendesk-portal-server-central-navigation"
+    featureToggles:
+      notifications_api: false
   replicaCount: {{ .Values.replicas.umsPortalServer }}
   resources:
     {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
   serviceAccount:
     create: true
   {{- if .Values.certificate.selfSigned }}
+  extraEnvVars:
+    - name: AWS_DEFAULT_REGION
+      value: {{ .Values.objectstores.nubus.region | quote }}
   extraVolumes:
     - name: "trusted-cert-crt-secret-volume"
       secret:
@@ -827,6 +842,7 @@ nubusLdapServer:
   replicaCountPrimary: {{ .Values.replicas.umsLdapServerPrimary }}
   replicaCountSecondary: {{ .Values.replicas.umsLdapServerSecondary }}
   replicaCountProxy: {{ .Values.replicas.umsLdapServerProxy }}
+  resources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
   resourcesPrimary: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
   resourcesSecondary: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
   serviceAccount:
@@ -840,6 +856,9 @@ nubusLdapServer:
 
 nubusProvisioning:
   enabled: true
+  extraEnvVars:
+    - name: AWS_DEFAULT_REGION
+      value: {{ .Values.objectstores.nubus.region | quote }}
   api:
     additionalAnnotations:
       intents.otterize.com/service-name: "ums-provisioning-api"
@@ -972,12 +991,14 @@ nubusProvisioning:
   registerConsumers:
     additionalAnnotations:
       intents.otterize.com/service-name: "ums-provisioning-register-consumers"
+    {{- if .Values.apps.oxAppSuite.enabled }}
     createUsers:
       oxConsumer:
         existingSecret:
           name: ums-provisioning-ox-credentials
           keyMapping:
             password: "ox-connector.json"
+    {{- end }}
     image:
       registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
       repository: {{ .Values.images.nubusWaitForDependency.repository }}
@@ -1017,6 +1038,9 @@ nubusUdmListener:
   replicaCount: {{ .Values.replicas.umsUdmListener }}
   resources:
     {{ .Values.resources.umsUdmListener | toYaml | nindent 4 }}
+  nats:
+    auth:
+      password: {{ .Values.secrets.nubus.provisioning.udmListenerNatsPassword | quote}}
 
 nubusSelfServiceListener:
   enabled: false
@@ -1055,6 +1079,8 @@ nubusSelfServiceConsumer:
       password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}
   resources:
     {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
+  resourcesWaitForDependency:
+    {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
   replicaCount: {{ .Values.replicas.umsSelfserviceConsumer }}
   waitForDependency:
     image:
@@ -1088,6 +1114,14 @@ nubusStackDataUms:
     repository: {{ .Values.images.nubusDataLoader.repository }}
     tag: {{ .Values.images.nubusDataLoader.tag }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  nubusPortalConsumer:
+    objectStorage:
+      bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
+      endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
+  nubusPortalServer:
+    objectStorage:
+      bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
+      endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
   initResources:
     {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}
   # In openDesk the external memcache does not expect a username to be set. Overwriting
@@ -1096,6 +1130,13 @@ nubusStackDataUms:
     memcached:
       auth:
         username: ""
+      connection:
+        host: {{ .Values.cache.umsSelfservice.host | quote }}
+    postgresql:
+      auth:
+        username: {{ .Values.databases.umsSelfservice.username | quote }}
+      connection:
+        host: {{ .Values.databases.umsSelfservice.host | quote }}
   pullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   resources:
@@ -1383,6 +1424,12 @@ nubusKeycloakBootstrap:
     intents.otterize.com/service-name: "ums-keycloak-bootstrap"
   resources:
     {{ .Values.resources.umsKeycloakBootstrap | toYaml | nindent 4 }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 # Credential secrets for accessing customer supplied services
 extraSecrets:

helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl

@@ -90,8 +90,10 @@ config:
                '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}',
                '${client_security-admin-console}' ]
   keycloak:
-    adminUser: "kcadmin"
-    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
+    admin:
+      values:
+        username: "kcadmin"
+        password: {{ .Values.secrets.keycloak.adminPassword | quote }}
     realm: {{ .Values.platform.realm | quote }}
     intraCluster:
       enabled: true

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -119,7 +119,7 @@ appsuite:
     asConfig:
       default:
         host: "all"
-        pageHeaderPrefix: "as8.souvap App Suite"
+        productName: {{ .Values.theme.texts.productName | quote }}
         oidcLogin: true
         oidcPath: "/oidc"
     masterAdmin: "admin"

helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl

@@ -22,12 +22,16 @@ config:
   openproject:
     fileshareName: "Nextcloud at {{ .Values.global.domain }}"
     admin:
-      username: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
-      password: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
+      username: 
+        value: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
+      password:
+        value: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
   nextcloud:
     admin:
-      username: "nextcloud"
-      password: {{ .Values.secrets.nextcloud.adminPassword | quote }}
+      username:
+        value: "nextcloud"
+      password:
+        value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false

helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl

@@ -49,6 +49,10 @@ global:
     {{- if .Values.apps.xwiki.enabled }}
     xwiki: {{ .Values.global.hosts.xwiki }}
     {{- end }}
+    {{- if .Values.apps.notes.enabled }}
+    notes: {{ .Values.global.hosts.notes }}
+    {{- end }}
+
 
 issuerRef:
   name: {{ .Values.certificate.issuerRef.name | quote }}

helmfile/apps/services-external/values-postfix.yaml.gotmpl

@@ -83,8 +83,11 @@ postfix:
   smtpdMilters: "inet:clamav-simple:7357"
   {{- end }}
   {{- end }}
+  # Only deliver mail to Dovecot, if it is available
+  {{- if .Values.apps.oxAppSuite.enabled }}
   virtualMailboxDomains: {{ if .Values.global.additionalMailDomains }}{{ printf "%s,%s" (.Values.global.mailDomain | default .Values.global.domain) .Values.global.additionalMailDomains }}{{ else }}{{ .Values.global.mailDomain | default .Values.global.domain | quote }}{{ end }}
   virtualTransport: "lmtps:dovecot:24"
+  {{- end }}
 
 podAnnotations: {}
 

helmfile/apps/xwiki/values.yaml.gotmpl

@@ -190,8 +190,7 @@ properties:
   "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.navbar-default-bg": {{ .Values.theme.colors.white | quote }}
   "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.navbar-default-link-hover-bg": {{ .Values.theme.colors.secondaryGreyLight | quote }}
   # yamllint disable-line rule:line-length
-  "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.lessCode": "li#tmWorkplaceServices { padding-left: 16px; padding-top: 5px; } .navbar-right { padding-top: 8px; } .navbar { border-bottom: 1px solid #ddd !important; height: 64px;} div#companylogo { width: 90px; height: auto; padding-top: 7px; padding-left: 9px; }"
-
+  "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.lessCode": "li#tmWorkplaceServices { padding-left: 16px; padding-top: 5px; } .navbar-right { padding-top: 8px; } .navbar { border-bottom: 1px solid #ddd !important; height: 64px; } div#companylogo { width: 90px; padding-top: 7px; padding-left: 9px; margin-top: auto; margin-bottom: auto; } div#companylogo a { display: contents; }"
   "property:xwiki:XWiki.AuthService.Configuration^XWiki.AuthService.ConfigurationClass.authService": "keycloak-bridge-auth"
   ## Fields to search in when importing users from the administration UI (not completely in scope for now)
   "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.ldapUserAttributes":

helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl

@@ -6,12 +6,12 @@ charts:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/product-development/charts/opendesk-dovecot-pro"
     name: "dovecot"
-    version: "1.0.0"
+    version: "1.0.3-r1"
     verify: true
   oxAppSuite:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/charts-mirror"
     name: "appsuite-public-sector-pro-chart"
-    version: "1.10.114"
+    version: "1.15.236"
     verify: false
 ...

helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl

@@ -13,9 +13,9 @@ images:
   nextcloud:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/nextcloud/images/opendesk-nextcloud"
-    tag: "1.1.5@sha256:825998ebf99ae3f9f80ba42fe8f652e9213a5f086d8c4dd96c7d66f88b8572c4"
+    tag: "1.1.9@sha256:ad28c9dd8cdb4bdd325fe132215d0cf094392c3ddd1f114707b09bb7d1c61a9e"
   openxchangeCoreMW:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/core-mw"
-    tag: "8.30.63@sha256:181fcb31f500f88573e6b735587b52df906199337fa62aeee1e64aacdc64f548"
+    tag: "8.35.85@sha256:54d01a16ea29a3ae8f1857e5bdf6d2e34046b8a3fa3d6179bb3ad3d047e1318f"
 ...

helmfile/environments/default/certificate.yaml.gotmpl

@@ -6,6 +6,8 @@ certificate:
   issuerRef:
     name: "letsencrypt-prod"
     kind: "ClusterIssuer"
+  # When using `wildcard: true` please ensure you configure the cert-manager accordingly, e.g. using DNS
+  # validation (`DNS-01`) in case of letsencrypt.
   wildcard: false
   selfSigned: false
 ...

helmfile/environments/default/charts.yaml.gotmpl

@@ -99,7 +99,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-dovecot"
     name: "dovecot"
-    version: "1.4.1"
+    version: "1.4.2"
     verify: true
   element:
     # providerCategory: "Platform"
@@ -109,7 +109,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-element"
-    version: "6.1.0"
+    version: "6.1.2"
     verify: true
   elementWellKnown:
     # providerCategory: "Platform"
@@ -119,7 +119,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-well-known"
-    version: "6.1.0"
+    version: "6.1.2"
     verify: true
   home:
     # providerCategory: "Platform"
@@ -141,7 +141,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "intercom-service"
-    version: "2.10.3"
+    version: "2.12.0"
     verify: true
   jitsi:
     # providerCategory: "Platform"
@@ -211,7 +211,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-matrix-user-verification-service"
-    version: "6.1.0"
+    version: "6.1.2"
     verify: true
   memcached:
     # providerCategory: "Community"
@@ -231,7 +231,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
     name: "opendesk-migrations"
-    version: "1.4.0"
+    version: "1.6.0"
     verify: true
   minio:
     # providerCategory: "Community"
@@ -251,7 +251,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud"
-    version: "4.0.0"
+    version: "4.0.3"
     verify: true
   nextcloudManagement:
     # providerCategory: "Platform"
@@ -261,7 +261,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud-management"
-    version: "4.0.0"
+    version: "4.0.3"
     verify: true
   nginx:
     # providerCategory: "Community"
@@ -300,10 +300,10 @@ charts:
     # upstreamRepository: "nubus/charts/nubus"
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
     # upstreamMirrorStartFrom: ["0", "19", "3"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/charts"
     name: "nubus"
-    version: "1.5.1"
+    version: "1.7.1-pre-yschmidt-0572-test"
     verify: true
   opendeskAlerts:
     # providerCategory: "Platform"
@@ -333,7 +333,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
     name: "opendesk-keycloak-bootstrap"
-    version: "2.3.0"
+    version: "2.4.0"
     verify: true
   opendeskStaticFiles:
     # providerCategory: "Platform"
@@ -355,7 +355,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
     name: "openproject"
-    version: "9.7.1"
+    version: "9.8.1"
     verify: true
   openprojectBootstrap:
     # providerCategory: "Platform"
@@ -365,7 +365,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-openproject-bootstrap"
     name: "opendesk-openproject-bootstrap"
-    version: "2.1.1"
+    version: "2.2.0"
     verify: true
   otterize:
     # providerCategory: "Platform"
@@ -387,7 +387,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
     name: "appsuite-public-sector"
-    version: "2.15.50"
+    version: "2.17.164"
     verify: false
   oxAppSuiteBootstrap:
     # providerCategory: "Platform"
@@ -419,7 +419,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix"
     name: "postfix"
-    version: "2.3.2"
+    version: "2.3.3"
     verify: true
   postgresql:
     # providerCategory: "Platform"
@@ -449,7 +449,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse"
-    version: "6.1.0"
+    version: "6.1.2"
     verify: true
   synapseAdmin:
     # Enterprise Component
@@ -477,7 +477,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse-create-account"
-    version: "6.1.0"
+    version: "6.1.2"
     verify: true
   synapseGroupsync:
     # Enterprise Component
@@ -505,7 +505,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse-web"
-    version: "6.1.0"
+    version: "6.1.2"
     verify: true
   xwiki:
     # providerCategory: "Supplier"
@@ -517,6 +517,6 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
     name: "xwiki"
-    version: "1.4.1"
+    version: "1.4.3"
     verify: false
 ...

helmfile/environments/default/database.yaml.gotmpl

@@ -40,11 +40,10 @@ databases:
     password: ""
     connectionLimit: ~
   nextcloud:
-    # Nextcloud itself also supports `postgresql` or `oci`
-    type: "mariadb"
+    type: "postgresql"
     name: "nextcloud"
-    host: "mariadb"
-    port: 3306
+    host: "postgresql"
+    port: 5432
     username: "nextcloud_user"
     password: ""
     connectionLimit: ~
@@ -125,12 +124,11 @@ databases:
     password: ""
     connectionLimit: 10
   xwiki:
-    # XWiki itself also supports `postgresql`
-    type: "mariadb"
+    type: "postgresql"
     name: "xwiki"
-    host: "mariadb"
-    port: 3306
-    username: "root"
+    host: "postgresql"
+    port: 5432
+    username: "xwiki_user"
     password: ""
     connectionLimit: ~
 ...

helmfile/environments/default/global.generated.yaml.gotmpl

@@ -3,5 +3,5 @@
 ---
 global:
   systemInformation:
-    releaseVersion: "v1.1.2"
+    releaseVersion: "v1.2.0"
 ...

helmfile/environments/default/images.yaml.gotmpl

@@ -79,12 +79,13 @@ images:
     tag: "2.3.21@sha256:c76965a84d1ca527f523404eb027119f6736b199c094e4671037cb345ecad3dc"
   element:
     # providerCategory: "Supplier"
-    # providerResponsible: "Nordeck"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/supplier/nordeck/images/opendesk-element-web"
+    # providerResponsible: "Element"
+    # upstreamRegistry: "https://ghcr.io"
+    # upstreamRepository: "element-hq/element-web-modules/opendesk-plugin"
+    # upstreamMirrorTagFilterRegEx: '^latest-\d+$'
     registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/nordeck/images/opendesk-element-web"
-    tag: "1.11.7@sha256:c5881cea86a721252e724000e4ed870cae66f9b3eabc45074e1f43b1818423bc"
+    repository: "bmi/opendesk/components/supplier/element/images-mirror/opendesk-plugin"
+    tag: "latest-250304@sha256:b997a9245c5a85ddb9935e6a9f8f8da60fed58aad17df8f1e1e2fabafdbf0dd1"
   elementAdminBot:
     # Enterprise Component
     # providerCategory: "Supplier"
@@ -152,7 +153,7 @@ images:
     # upstreamMirrorStartFrom: ["2", "1", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/intercom-service"
-    tag: "2.10.3@sha256:7b767f7a3f0e6c43e0f287374fd7fc758ec73e9fdb760a88150a64b2a33d1b66"
+    tag: "2.12.0@sha256:380476d849fb353dc167ba52a6b0f6235b3fa7561c082e65c37e2242cedb0df1"
   jibri:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -202,7 +203,7 @@ images:
     # upstreamMirrorStartFrom: ["2023", "12", "14"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jitsi-keycloak-adapter"
-    tag: "v20250117@sha256:254025cb03a05a1eba5971a1f07f13a4148c4ac8538a7e7c79fbd4b86e2f2cd5"
+    tag: "v20250314@sha256:2e24db127ab266b90b8fd371ce547e7f9619b6be3fefed30906867b1ce368697"
   jitsiPatchJVB:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -238,7 +239,7 @@ images:
     # upstreamMirrorStartFrom: ["1", "4", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-neoboard-widget"
-    tag: "2.0.0@sha256:dea11481404c2368d0089543d977fb26af51753073e9e5cb73e389bde82c4004"
+    tag: "2.1.0@sha256:3a386d5a7d1b0582372909e8f3714fc82304fbfb0c078807476d867f726d30f5"
   matrixNeoChoiceWidget:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -248,7 +249,7 @@ images:
     # upstreamMirrorStartFrom: ["1", "4", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-poll-widget"
-    tag: "1.5.0@sha256:29f332c5b79774201cc4fe2724e13017b6f4acc492211bc1cbfd6b4aa78b05fd"
+    tag: "1.5.1@sha256:00d28898e2b08d00dc7f4ed986d496779b95f0b87347b6059b76d291eb44a7eb"
   matrixNeoDateFixBot:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -294,7 +295,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
-    tag: "1.4.1@sha256:c831f3bb27da483cbf46239d8f96df9597f710fbe3804f198ee1d89b1be71936"
+    tag: "1.6.0@sha256:67ac4872f879b3ef3e27924754b3f89c6bdb158c22bd91c6c7c484aa2fed91ce"
   milter:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -318,7 +319,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.4.8@sha256:4ff33258b7d13a04a7ba1121c4e1ff23dd91f5b7cd54ba548f4cb2061dcb2a8d"
+    tag: "2.4.11@sha256:2fe6e311735c706016fe7b39c8f60a6cf0f0e735761dbc60fb4cd2eedbe135c4"
   nextcloudExporter:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -340,9 +341,9 @@ images:
     # providerResponsible: "DINUM"
     # upstreamRegistry: "https://registry-1.docker.io"
     # upstreamRepository: "lasuite/impress-backend"
-    registry: "registry-1.docker.io"
-    repository: "lasuite/impress-backend"
-    tag: "v1.10.0-docs-production@sha256:62f31bf18335fec031f9ea3af828b84a8bb811793b63bc1c484e4ce14d437198"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/opendesk-notes"
+    tag: "1.7.0-docs-v2.4.0-backend@sha256:837e09dfcb4014de97b5254956dda899e586170276d1d0b0f94cca0685f3d2ef"
   notesFrontend:
     # providerCategory: "Supplier"
     # providerResponsible: "DINUM"
@@ -350,7 +351,7 @@ images:
     # upstreamRepository: "lasuite/impress-frontend"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-notes"
-    tag: "1.5.1@sha256:dad7dd60a5eb39b71b4911558cf7eac9ed6dc050593a046f5da0eaa75c65d344"
+    tag: "1.7.0-docs-v2.4.0-frontend@sha256:98fb87ad877eb5658c6bef1c09adf4e03f816dce61867bc099838aca15890887"
   notesYProvider:
     # providerCategory: "Supplier"
     # providerResponsible: "DINUM"
@@ -358,7 +359,7 @@ images:
     # upstreamRepository: "lasuite/impress-y-provider"
     registry: "registry-1.docker.io"
     repository: "lasuite/impress-y-provider"
-    tag: "v1.10.0-docs-production@sha256:9fcdb1fe7b20f0026b94765d64d83a2fe76cbe6e59c43d098fa21a7ea0c74803"
+    tag: "v2.4.0@sha256:329d47f5cda80941a7f0812969c3194ba68da3e7e1ef38e3d08c266fc97555c1"
   nubusDataLoader:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -368,7 +369,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "41", "5"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/data-loader"
-    tag: "0.80.2@sha256:04b4b928e5e957f6544b6e0af32c75340cfacf182a78e03bc1a65bdf9f8d9e5d"
+    tag: "0.87.0@sha256:b45af938d7b0c3138054a859985e60c76c8a79caeb1dc31a6cd4189035bb07b7"
   nubusGuardianAuthorizationApi:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -412,13 +413,13 @@ images:
   nubusKeycloak:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
-    # upstreamRegistry: "https://docker.software-univention.de"
-    # upstreamRepository: "keycloak-keycloak"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/keycloak"
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+).+$'
     # upstreamMirrorStartFrom: ["22", "0", "3"]
     registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-keycloak"
-    tag: "25.0.1-ucs1@sha256:61cb3e703672f6d8806af41bec8056ca84e295bbeb546fdb5349322d1174a43d"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak"
+    tag: "25.0.6-ucs5@sha256:8e9df64f9b6c5ce6e5f0ae732f0aadc928e13e7166236bd16bf647b92dad22bb"
   nubusKeycloakBootstrap:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -458,7 +459,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "8", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-notifier"
-    tag: "0.29.1@sha256:c06923e8d9190a83d94b2f3e429d8ae812f09fbb9f89b5689d3e221ccbbcd1ab"
+    tag: "0.33.0@sha256:1aed364bff3a5ce8fe6c19e6c8914a3243f7a0684c3ea9330fc61bcb6cbe4cac"
   nubusLdapServer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -468,7 +469,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "8", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server"
-    tag: "0.29.1@sha256:0d3f136572849311490d2b616fa948bb6c97a6df9517fcc3770264ed8ee5c8e6"
+    tag: "0.33.0@sha256:9354c79788ac48820ac781463e50f6ee315bf352b4ae384c3355124347953aa8"
   nubusLdapServerDhInitContainer:
     # providerCategory: 'Community'
     # providerResponsible: 'Univention'
@@ -476,7 +477,7 @@ images:
     # upstreamRepository: 'natsio/nats-box'
     registry: "registry-1.docker.io"
     repository: "natsio/nats-box"
-    tag: "0.14.2@sha256:c9b8ebaabb2ca4c227feb4f6b856dc72d4775ac3d71f80d2c65aa82303079011"
+    tag: "0.16.0-nonroot@sha256:f486ca86dfc9b72a2310ea720994a94ce55e447ad01daccd2fb33d61f322dc51"
   nubusLdapServerLeaderElector:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -486,7 +487,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "29", "1"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server-elector"
-    tag: "0.31.1@sha256:70d23a5055acb2bcaaa629e78b2168355efebab20047a40a8f410b1ce0f624e2"
+    tag: "0.33.0@sha256:c1304a156094b276199fb263baf93e3704ceece478d7f663061b1b1f05f5931c"
   nubusNats:
     # providerCategory: 'Community'
     # providerResponsible: 'Univention'
@@ -494,7 +495,7 @@ images:
     # upstreamRepository: 'library/nats'
     registry: "registry-1.docker.io"
     repository: "library/nats"
-    tag: "2.10.10@sha256:fa26beda8a3187ccefa47afcfe9ea6d0e2f40a57c8f64d70bd63c792d7973938"
+    tag: "2.10.26@sha256:736d575e60135ce1d50fc206675d48d0e57dcaa0704f696f0cb4b5f6dadd49d7"
   nubusNatsBox:
     # providerCategory: 'Community'
     # providerResponsible: 'Univention'
@@ -502,7 +503,7 @@ images:
     # upstreamRepository: 'natsio/nats-box'
     registry: "registry-1.docker.io"
     repository: "natsio/nats-box"
-    tag: "0.14.2@sha256:c9b8ebaabb2ca4c227feb4f6b856dc72d4775ac3d71f80d2c65aa82303079011"
+    tag: "0.16.0-nonroot@sha256:f486ca86dfc9b72a2310ea720994a94ce55e447ad01daccd2fb33d61f322dc51"
   nubusNatsReloader:
     # providerCategory: 'Community'
     # providerResponsible: 'Univention'
@@ -510,7 +511,7 @@ images:
     # upstreamRepository: 'natsio/nats-server-config-reloader'
     registry: "registry-1.docker.io"
     repository: "natsio/nats-server-config-reloader"
-    tag: "0.14.1@sha256:77dd4c60001ffbf442c6b25592e73b4fca06ea9406c677607192788d80453783"
+    tag: "0.17.1@sha256:f364bb8330d3430666ca09f17c6a43bfaefde32f0f3e79d4a41c588c29936e99"
   nubusNotificationsApi:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -520,7 +521,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "9", "4"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/notifications-api"
-    tag: "0.48.3@sha256:7d4e8e0a6fb6be2b3f1e5f0db49375d7a0a5820fc7517b685b2109dac00ea823"
+    tag: "0.55.0@sha256:845d027becc48892314ed9bed4f2c78feaa63d632fcded2fe1cdc6458b1ba831"
   nubusOpendeskExtension:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -528,7 +529,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-    tag: "1.12.5@sha256:58cd2e545b65d354cc242cd97b06ce41733e9c6701c132c108bac245c493f7f0"
+    tag: "1.12.8@sha256:9c5e06ed459c0b5f35e511c476b982b86466760bd3fe1617aa908fdcf9e389df"
   nubusOpendeskExtensionA2gMapper:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -564,9 +565,9 @@ images:
     # upstreamRepository: "nubus/images/portal-consumer"
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
     # upstreamMirrorStartFrom: ["0", "27", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-consumer"
-    tag: "0.48.3@sha256:329ad2fbfdba2fb3cb0b170158f9fdff8786c0f1e24537d16a197432e0d0f2d0"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/images/portal-consumer"
+    tag: "0.60.0@sha256:f1c27d091a8a0e88709cd8ea03a1ce2d7399ff95dc87f058a44b65817a9c231e"
   nubusPortalExtension:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -574,17 +575,17 @@ images:
     # upstreamRepository: "nubus/images/portal-extension"
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
     # upstreamMirrorStartFrom: ["0", "28", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-extension"
-    tag: "0.44.3@sha256:734efc0adda680526dde09387db964612f9e0ab020382580984488cc993c68f0"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/images/portal-extension"
+    tag: "0.60.0@sha256:bfa6266e8c2ccffc2a37e52dadd2f5ca6e37341c92be8e849696604001a0f2d2"
   nubusPortalFrontend:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
     # upstreamRegistry: "https://artifacts.software-univention.de"
     # upstreamRepository: "nubus/images/portal-frontend"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus-portal-update"
-    tag: "1.10.14@sha256:fbdec057958fd7e728431cf96896b8453c2f5b390ce3d2f169a7766f49926b1b"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/images/portal-frontend"
+    tag: "0.60.0@sha256:f7f2c0defc77183b14ed7f0367c3e5ca1d0c25fd89554875f61bd3b43316c7bf"
   nubusPortalServer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -592,9 +593,9 @@ images:
     # upstreamRepository: "nubus/images/portal-server"
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
     # upstreamMirrorStartFrom: ["0", "9", "4"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-server"
-    tag: "0.48.3@sha256:331a3f247d3c3d496ee1be78d71b6c737666f2fbf0bced1985e2edb295729e59"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/images/portal-server"
+    tag: "0.60.0@sha256:1deee2efefcd985d9d46fe4556f599d210f346dc570ddd3902e4d23cc8f12dcd"
   nubusProvisioningDispatcher:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -604,7 +605,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-dispatcher"
-    tag: "0.48.1@sha256:0fac927b2690d6b704e4918102adcbd971effd2cf4af2fb7b86aba5902788a8e"
+    tag: "0.49.1@sha256:3ebc70a95749504f771e257187854d6bd3623fe9b0f8085aa4116e5290db9beb"
   nubusProvisioningEventsAndConsumerApi:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -614,7 +615,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-events-and-consumer-api"
-    tag: "0.48.1@sha256:042633fbf98f9600fa79103476871f4754aab5633b0d04ad4aae780e80f685f4"
+    tag: "0.49.1@sha256:8ad56dc861fa4880c100ba9efffe75398e8b077e4eeb673dadac34cfe44aa1ba"
   nubusProvisioningPrefill:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -624,7 +625,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-prefill"
-    tag: "0.48.1@sha256:6019d3ab31a69c46c12addb7b7ede30e9b25d236169f3bb4bde678d576f207d3"
+    tag: "0.49.1@sha256:3b3eac87ca6dd140236e8a36cd5b42efceb33013beb836f1caeff85ff700a570"
   nubusProvisioningUdmListener:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -634,7 +635,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-listener"
-    tag: "0.48.1@sha256:39aeb312e0148400b54184dbbe4595cd75e8dc62c0abfaaf56efc863f2486810"
+    tag: "0.49.1@sha256:4534ec7c0ee1af3a1eabd4a39cc28c5ddc225e0c3a6bea31a0d6cdf6dcb11147"
   nubusProvisioningUdmTransformer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -644,7 +645,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-transformer"
-    tag: "0.48.1@sha256:414a329af821e50b20c0443bc6364f91f4f6a8cc879cc881757a715f273c5a99"
+    tag: "0.49.1@sha256:43f4636ed88333005570c97c51cf46deba499a25ffd65e993b37cf1418dfc483"
   nubusSelfServiceConsumer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -654,7 +655,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "3", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-invitation"
-    tag: "0.12.3@sha256:8c20895767bb1972a3abb066ba8adc4034ce718b199fbe205a9ae67d5544a888"
+    tag: "0.14.0@sha256:999c50058a02f6006a8d1732b651a5c738c5ee91fc453dc8ae3fcdbb9d4192c0"
   nubusUdmRestApi:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -664,7 +665,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "9", "3"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/udm-rest-api"
-    tag: "0.26.1@sha256:7b5e2fd05ebdd388a9f4af7fb254f95fe120ea6e038e0436070e581b2c0b4abd"
+    tag: "0.29.0@sha256:2b061d1cf244aeadcb790a08cac94804a32abe73dd442382355a6657b05c0ff2"
   nubusUmcGateway:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -674,7 +675,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "7", "3"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-gateway"
-    tag: "0.35.5@sha256:f9a13261821de731f3c3a665aa128b16d7e48e6f3d79a9d4038f9667069542c8"
+    tag: "0.37.0@sha256:3ac0e34e9b1c353ab7778bae548804e3dcc236dd454c3f500de9795eb7dda947"
   nubusUmcServer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -684,7 +685,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "7", "3"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-server"
-    tag: "0.35.5@sha256:f81ce86b16f03d8c840c2f5f6d6814b8119caf2a08f0f01b0a5dab5a528d228a"
+    tag: "0.37.0@sha256:ef06422cab2ab2bc4f84a13dfd7bfb7e862a3504f83fc6957fcbdfaa433d0468"
   nubusUmcServerProxy:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -702,7 +703,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "9", "4"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/wait-for-dependency"
-    tag: "0.26.0@sha256:a31fde86bf21c597a31356fe492ab7e7a03a89282ca215eb7100763d6eb96b6b"
+    tag: "0.28.0@sha256:816ad27b76046be360398274ba3c1f1bcec8f58c2ea5a200b2fb675aab1a5ab8"
   opendeskKeycloakBootstrap:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -710,7 +711,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
-    tag: "1.2.1@sha256:f5ce0be27580c6347c5e700c4fa271a811d45d8a0e4b40ffe8a4d0e3d47e670f"
+    tag: "1.3.0@sha256:f0c18be261666b7dbb1794f61aaac2321608d396060b007d18b429d0e4d703a7"
   opendeskStaticFiles:
     # providerCategory: "Community"
     # providerResponsible: "Element"
@@ -728,7 +729,7 @@ images:
     # upstreamMirrorStartFrom: ["13", "1", "1"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "15.3.1@sha256:4d9738ad49c2756ccdb1b589a27d4963cc8cdcdc9d5394efe14f705825bac5af"
+    tag: "15.4.1@sha256:4614f6c27f114d4dcaed28449e287784f8b8834e1982535eb89ea00d5fad2230"
   openprojectBootstrap:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -762,7 +763,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "6", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-guidedtours"
-    tag: "8.6.9@sha256:c6ce1047292937af2f153ffa5f88d54955c90b52ed7b17a80efd112030dd2aa9"
+    tag: "8.6.14@sha256:c00546144667d2d5036fa37b2e6185f1abb53c13e9eee7b0c78ec64ac8e5250a"
   openxchangeCoreMW:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -772,7 +773,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "51"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/middleware-public-sector"
-    tag: "8.33.56@sha256:4b3064fbcd068562a66cea1ff38c859aecc48038650efbf786d4122601ced674"
+    tag: "8.35.83@sha256:5c4180c1ba255193059241921e6fe0a34555592aa29104a145a0e1beb91157d2"
   openxchangeCoreUI:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -782,7 +783,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "1"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui"
-    tag: "8.33.2@sha256:8c98cc1f91a366a6c4f1464fb7efcef148fc614c117c34a9d5da45ee40c04bae"
+    tag: "8.35.2@sha256:658563b6ec4d3d5f2e06f2987cd8e730d91b8d0c65b0206495007d347f98965f"
   openxchangeCoreUIMiddleware:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -802,7 +803,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "799279"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-user-guide"
-    tag: "8.33.1228926@sha256:0b6356afdce7021b78ff49020cf4defcc671c0146547043e1313fc1136a2f576"
+    tag: "8.35.1292950@sha256:a6937222e3b07b42c7dc6a066aae0cd05b3b899325a4e4aee50ee91355c9b3b5"
   openxchangeDocumentConverter:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -812,7 +813,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "50"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/documentconverter"
-    tag: "8.33.49@sha256:0bbb37e36aeaad00e7c6f78d4a25621be9fdd854dc39ba9dfa0ea923c088978c"
+    tag: "8.35.1671@sha256:0a7b9d7af9cd22562196b854ad11ca3fd477ddcc70f2ccd113e87ab3b7aad26c"
   openxchangeGotenberg:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -822,7 +823,7 @@ images:
     # upstreamMirrorStartFrom: ["7", "9", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/gotenberg"
-    tag: "8.12.0@sha256:2b36e1ea5db6d3d475348c0ed8df5edf09ab92781a9cfbb9ce7c96971cfcc5a8"
+    tag: "8.15.3@sha256:0864c9cd905264f714f0c306d5b38eec8599b908c9096e0283b5db3ff6706172"
   openxchangeGuardUI:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -842,7 +843,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "50"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/imageconverter"
-    tag: "8.33.53@sha256:454c53e2b7f5fab14bf29495854ffe2c10f44c4d4a611e237232eeeb3903feb8"
+    tag: "8.35.77@sha256:fb67cbaf0771ea6c18b5a1b94aaec9bf72b930227613e70535d382be58940372"
   openxchangeNextcloudIntegrationUI:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -852,7 +853,7 @@ images:
     # upstreamMirrorStartFrom: ["1", "2", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/nextcloud-integration-ui"
-    tag: "1.3.2@sha256:d9129b87a184cc0020a40f2720e3190c64b30ed983dc68e4b3fe52cc8a7ee1a4"
+    tag: "1.4.0@sha256:4be267ab2dc8dbef6b8382e2de6b28f3851a7af7f68702f360d457898cb9011e"
   openxchangePublicSectorUI:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -862,7 +863,7 @@ images:
     # upstreamMirrorStartFrom: ["2", "2", "1"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/public-sector-ui"
-    tag: "2.3.1@sha256:8bd35ef700eb48b8f40a71d02aea179cf2eae95a1be3b3b5f1cacb3698bc488a"
+    tag: "2.4.0@sha256:6513e948028ed98aca633d9943ef3be5fed890e4757eee6b527b7215206d2bd6"
   oxConnector:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -872,7 +873,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "4", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/ox-connector-standalone"
-    tag: "0.14.5@sha256:0b7816e3c8eca1949d3adc8c19d64394a862cbe478a3c51c6d18e546f02aea3d"
+    tag: "0.14.7@sha256:04e7d25ef5450ab7dd61c64c4923017c00157a01de548b6cd9f90b650762e1b0"
   postfix:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -927,14 +928,14 @@ images:
     tag: "1.32.0@sha256:6d49f7f37ae5f4c07bfe46edb44e3d3b6896974d1b87da76d8aa8d6e23b4d619"
   synapseGuestModule:
     # providerCategory: "Supplier"
-    # providerResponsible: "Nordeck"
+    # providerResponsible: "Element"
     # upstreamRegistry: "https://ghcr.io"
-    # upstreamRepository: "nordeck/synapse-guest-module"
+    # upstreamRepository: "element-hq/synapse-guest-module"
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
     # upstreamMirrorStartFrom: ["1", "0", "0"]
     registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/synapse-guest-module"
-    tag: "2.0.0@sha256:0fb4ee93cf6fc58f3f3b2f7f8c95d5e6d259b9a5dc354bde516e441187819283"
+    repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse-guest-module"
+    tag: "1.0.1@sha256:a8c02b2eb4dfea9632b32d00415af8d5276870fa150fac392914f67053c161ea"
   synapseWeb:
     # providerCategory: "Community"
     # providerResponsible: "Element"
@@ -960,7 +961,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "12"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/xwiki"
-    tag: "0.23-mariadb-jetty-alpine@sha256:d358212cc5c3addc4be02cfd0f2b08aa8b88399ac5848e152111f231356558da"
+    tag: "0.25-mariadb-jetty-alpine@sha256:7175ef5e454b4eb0f6fd6a92a9503d8a680db3ca97b25c3a4eedac9c9bfbcdaf"
   xwikiPostgres:
     # providerCategory: "Supplier"
     # providerResponsible: "XWiki"
@@ -970,5 +971,5 @@ images:
     # upstreamMirrorStartFrom: ["0", "23"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/xwiki"
-    tag: "0.23-postgres-jetty-alpine@sha256:01f7d6fd8397a7903c23452cded4866220d733554066b6f5746eecde183fe15a"
+    tag: "0.25-postgres-jetty-alpine@sha256:1bfc57a65f8bc6b059d550791699b5afa33b91db8d4c75ca8f6f3d2299f7c335"
 ...

helmfile/environments/default/secrets.yaml.gotmpl

@@ -54,6 +54,7 @@ secrets:
         udmTransformerPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "udmproducer" "events_api" | sha1sum | quote }}
       dispatcherNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "dispatcher" "nats" | sha1sum | quote }}
       prefillNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "prefill" "nats" | sha1sum | quote }}
+      udmListenerNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "udmListener" "nats" | sha1sum | quote }}
       udmTransformerNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "udmTransformer" "nats" | sha1sum | quote }}
     guardian:
       udmPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "cn=admin" "udm" | sha1sum | quote }}

helmfile/shared/migrations.yaml.gotmpl

@@ -19,7 +19,7 @@ cleanup:
   deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 
 migrations:
-  runId: 3
+  runId: 4
   namespace: {{ .Values.apps.migrations.namespace | default .Release.Namespace | quote }}
   loglevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
   failOnUnexpectedState: true