feat(helmfile): Add template support for annotations

fix(helmfile): Splitting the directory ./helmfile/apps/services into -external and opendesk- services, please read migrations.md for more details
fix(helmfile): Streamline file extensions in /helmfile/environments/default to
2025-12-07 16:01:37 +01:00 · 2024-12-10 16:58:09 +00:00 · 2024-12-10 12:57:52 +01:00 · 2024-12-10 12:13:45 +01:00 · 2024-12-10 06:23:38 +00:00 · 2024-12-09 21:02:18 +01:00
126 changed files with 2562 additions and 822 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,7 +4,7 @@
 ---
 include:
  - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "v2.4.2"
+    ref: "v2.4.3"
    file:
      - "ci/common/automr.yml"
      - "ci/common/lint.yml"
@@ -36,17 +36,19 @@ stages:
  - "env-cleanup"
  - "env"
  - "pre-services-deploy"
-  - "migrations-pre"
-  - "basic-services-deploy"
-  - "component-deploy-stage-1"
-  - "component-deploy-stage-2"
-  - "migrations-post"
+  - "010-migrations-pre"
+  - "030-services"
+  - "050-components"
+  - "060-components"
+  - "090-migrations-post"
  - "lint"
-  - "tests"
+  - "post-prepare"
+  - "post-execute"
  - "env-stop"
  - ".post"

 variables:
+  RELEASE_BRANCH: "main"
  NAMESPACE:
    description: "The name of namespaces to deploy to."
    value: ""
@@ -145,6 +147,13 @@ variables:
    options:
      - "yes"
      - "no"
+  CREATE_DEFAULT_ACCOUNTS:
+    description: "Creates `default` and `default-admin` in the instance using the password defined as CI variable
+                 `DEFAULT_ACCOUNTS_PASSWORD`."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
  RUN_TESTS:
    description: "Triggers execution of E2E-tests."
    value: "no"
@@ -164,13 +173,14 @@ variables:
    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
    value: "gitlab.opencode.de/api/v4/projects/1506"
  TESTS_TESTSET:
-    description: "Selects testset for E2E-tests"
+    description: "Selects test set for E2E-tests"
    value: "Smoke"
    options:
      - "Regression"
      - "Smoke"
  TESTS_GRACE_PERIOD:
-    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail. GRACE_PERIOD is the period in seconds that should be waited before running the tests."
+    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail.
+                  GRACE_PERIOD is the period in seconds that should be waited before running the tests."
    value: "0"

 .deploy-common:
@@ -223,9 +233,6 @@ env-cleanup:
  stage: "env-cleanup"

 env-start:
-  environment:
-    name: "${NAMESPACE}"
-    on_stop: "env-stop"
  extends: ".deploy-common"
  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
  rules:
@@ -236,6 +243,34 @@ env-start:
  script:
    - "echo \"Deploying to Environment ${NAMESPACE} in ${CLUSTER} Cluster\""
    - "kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -"
+    - "export FILENAME_CERT_SECRET=cert_to_import.yaml"
+    # from self-signed-certificates.md:
+    # "Copy this cert's secret into the/each namespace you want to make use of the cert."
+    - |
+      kubectl get secret opendesk-root-cert-secret -n cert-manager -o yaml | \
+        grep -v \ uid\: | \
+        grep -v \ resourceVersion\: | \
+        grep -v \ creationTimestamp\: | \
+        sed --expression 's/namespace\:\ cert-manager/namespace: '"${NAMESPACE}"'/g' \
+        >${FILENAME_CERT_SECRET} || true
+    - |
+      if [ -s ${FILENAME_CERT_SECRET} ]; then
+        echo "Applying ${FILENAME_CERT_SECRET}"
+        kubectl apply -f ${FILENAME_CERT_SECRET}
+      fi
+    # from self-signed-certificates.md:
+    # "Create issuer in the/each namespace you want to make use of the cert."
+    - |
+      kubectl apply -f - <<EOF
+      apiVersion: cert-manager.io/v1
+      kind: Issuer
+      metadata:
+        name: "selfsigned-issuer"
+        namespace: ${NAMESPACE}
+      spec:
+        ca:
+          secretName: opendesk-root-cert-secret
+      EOF
  stage: "env"

 policies-deploy:
@@ -248,11 +283,11 @@ policies-deploy:
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
      when: "on_success"
  variables:
-    COMPONENT: "services"
+    COMPONENT: "opendesk-services"
    ADDITIONAL_ARGS: "-l name=opendesk-otterize"

 migrations-pre:
-  stage: "migrations-pre"
+  stage: "010-migrations-pre"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -261,10 +296,10 @@ migrations-pre:
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
      when: "on_success"
  variables:
-    COMPONENT: "migrations-pre"
+    COMPONENT: "opendesk-migrations-pre"

 migrations-post:
-  stage: "migrations-post"
+  stage: "090-migrations-post"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -273,10 +308,10 @@ migrations-post:
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
      when: "on_success"
  variables:
-    COMPONENT: "migrations-post"
+    COMPONENT: "opendesk-migrations-post"

-services-deploy:
-  stage: "basic-services-deploy"
+services-external-deploy:
+  stage: "030-services"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -285,10 +320,22 @@ services-deploy:
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
      when: "on_success"
  variables:
-    COMPONENT: "services"
+    COMPONENT: "services-external"
+
+opendesk-services-deploy:
+  stage: "030-services"
+  extends: ".deploy-common"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
+      when: "on_success"
+  variables:
+    COMPONENT: "opendesk-services"

 nubus-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -300,7 +347,7 @@ nubus-deploy:
    COMPONENT: "nubus"

 ox-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  timeout: "30m"
  rules:
@@ -313,7 +360,7 @@ ox-deploy:
    COMPONENT: "open-xchange"

 xwiki-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -325,7 +372,7 @@ xwiki-deploy:
    COMPONENT: "xwiki"

 collabora-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -337,7 +384,7 @@ collabora-deploy:
    COMPONENT: "collabora"

 cryptpad-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -349,7 +396,7 @@ cryptpad-deploy:
    COMPONENT: "cryptpad"

 nextcloud-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -361,7 +408,7 @@ nextcloud-deploy:
    COMPONENT: "nextcloud"

 openproject-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -373,7 +420,7 @@ openproject-deploy:
    COMPONENT: "openproject"

 openproject-bootstrap-deploy:
-  stage: "component-deploy-stage-2"
+  stage: "060-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -382,10 +429,10 @@ openproject-bootstrap-deploy:
          ($DEPLOY_ALL_COMPONENTS != "no" || ($DEPLOY_OPENPROJECT != "no" && $DEPLOY_NEXTCLOUD != "no"))
      when: "on_success"
  variables:
-    COMPONENT: "openproject-bootstrap"
+    COMPONENT: "opendesk-openproject-bootstrap"

 jitsi-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -397,7 +444,7 @@ jitsi-deploy:
    COMPONENT: "jitsi"

 element-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -408,39 +455,62 @@ element-deploy:
  variables:
    COMPONENT: "element"

-env-stop:
+fetch-administrator-credentials:
  extends: ".deploy-common"
  environment:
    name: "${NAMESPACE}"
-    action: "stop"
-  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
-  needs: []
+  stage: "post-prepare"
  rules:
    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/
-      when: "manual"
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api"
+          && $NAMESPACE =~ /.+/
+          && ($CREATE_DEFAULT_ACCOUNTS == "yes" || $RUN_TESTS == "yes")
+      when: "on_success"
  script:
-    - "echo 'We do not stop the env (delete the namespace) at the moment in this stage, as deleting a branches also
-      triggers this env-stop stage and we do not want this to happen.'"
-    # - kubectl delete namespace "${NAMESPACE}"
-  stage: "env-stop"
-  variables:
-    GIT_STRATEGY: "none"
-
-.ums-default-password: &ums-default-password
-  - |
-    DEFAULT_ADMINISTRATOR_PASSWORD=$(
+    - |
+      echo "DEFAULT_ADMINISTRATOR_PASSWORD=$(
       kubectl \
         -n ${NAMESPACE} \
         get secret ums-nubus-credentials \
         -o jsonpath='{.data.administrator_password}' | base64 -d \
-    )
+      )" >> .env
+  artifacts:
+    reports:
+      dotenv: ".env"

-run-tests:
-  extends: ".deploy-common"
+import-default-accounts:
+  stage: "post-execute"
+  extends: ".environments"
+  dependencies:
+    - "fetch-administrator-credentials"
+  environment:
+    name: "${NAMESPACE}"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $CREATE_DEFAULT_ACCOUNTS == "yes"
+      when: "on_success"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0"
+  script:
+    - "echo \"Starting default account import for ${DOMAIN}\""
+    - "cd /app"
+    - |
+      ./user_import_udm_rest_api.py \
+        --import_domain ${DOMAIN} \
+        --udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
+        --set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
+        --import_filename ./template.ods \
+        --admin_enable_fileshare True \
+        --admin_enable_knowledgemanagement True \
+        --admin_enable_projectmanagement True \
+        --create_admin_accounts True
+
+run-tests:
+  stage: "post-execute"
+  extends: ".deploy-common"
+  dependencies:
+    - "fetch-administrator-credentials"
  environment:
    name: "${NAMESPACE}"
-  stage: "tests"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
@@ -451,7 +521,6 @@ run-tests:
          - "de"
          - "en"
  script:
-    - *ums-default-password
    - |
      curl --request POST \
      --header "Content-Type: application/json" \
@@ -472,9 +541,6 @@ run-tests:
          \"screenshot_redirect_step\": \"yes\", \
          \"testset\": \"${TESTS_TESTSET}\", \
          \"testprofile\": \"Namespace\", \
-          \"gitlab_functional_yaml\": \"https://gitlab.opencode.de/api/v4/projects/1317/repository/files/helmfile%2Fenvironments%2Fdefault%2Ffunctional.yaml?ref=develop\", \
-          \"gitlab_env_namespace_template\": \"https://gitlab.opencode.de/api/v4/projects/1564/repository/files/environments%2F{operator}%2F{cluster}%2F{namespace}.yaml.gotmpl?ref=main\", \
-          \"gitlab_default_env_namespace\": \"values\", \
          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\" \
        } \
      }" \
@@ -486,7 +552,7 @@ avscan-prepare:
  rules:
    - if: >
          $JOB_AVSCAN_ENABLED != 'false' &&
-          $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+          $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
          $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "always"
    - when: "never"
@@ -514,7 +580,7 @@ avscan-prepare:
          CONTAINER_IMAGE: ""
          CONTAINER_REGISTRY: ""
          CONTAINER_TAG: ""
-          DATABASE_MIRROR: "https://registry.open-de.sk/repository/clamavdb.c3sl.ufpr.br"
+          DATABASE_MIRROR: "https://gitlab.opencode.de/bmi/opendesk/tooling/clamav-db-mirror/-/raw/main"
      EOF
    - >
      yq '.images
@@ -536,7 +602,7 @@ avscan-start:
  rules:
    - if: >
        $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "always"
    - when: "never"
@@ -546,8 +612,8 @@ avscan-start:
        job: "avscan-prepare"
    strategy: "depend"

-# Declare .environments which is in environments repository. In case it is not available
-# 'cache' is used because job must contain at least one key, so cache is just a dummy key.
+# Declare .environments which is in `opendesk-env` repository. In case it is not available
+# 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
 .environments:
  cache: {}

@@ -582,7 +648,7 @@ generate-release-version:
  rules:
    - if: >
        $JOB_RELEASE_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "on_success"

@@ -590,7 +656,7 @@ release:
  rules:
    - if: >
        $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "on_success"
  script:
@@ -606,7 +672,7 @@ release:
      fi
    - |
      echo -e "\n[INFO] Writing data to helm value file..."
-      cat <<EOF >helmfile/environments/default/global.generated.yaml
+      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
      # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
      # SPDX-License-Identifier: Apache-2.0
      ---
@@ -618,7 +684,7 @@ release:
    - |
      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
      {
-        "branches": ["main"],
+        "branches": ["${RELEASE_BRANCH}"],
        "plugins": [
          "@semantic-release/gitlab",
          "@semantic-release/release-notes-generator",
@@ -628,7 +694,7 @@ release:
              "charts/**/Chart.yaml",
              "CHANGELOG.md",
              "charts/**/README.md",
-              "helmfile/environments/default/global.generated.yaml",
+              "helmfile/environments/default/global.generated.yaml.gotmpl",
              ".kyverno/kyverno-test.yaml",
              "docs"
            ],
--- a/.gitlab/common/common.yml
+++ b/.gitlab/common/common.yml
@@ -2,10 +2,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.5.2\
-    @sha256:8445978facabf1526cdb4434e7da8b9c8b9b930337c247ea811b1a53765817e3"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.7\
-    @sha256:632ea46d4ff70d39a627404576ea3b14a1cf96d04ea0701cbea6b771765d1769"
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.5.3\
+    @sha256:1296e8590b59f02311881307bb14c58b72bafc92a58e7e7e7212508abf902b00"
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.8\
+    @sha256:59e714cad38e873cf8a9a132af76ad868b46a51ed12d0bd45477f328c0136991"

 .common:
  cache: {}
--- a/.gitlab/generate/generate-docs.yml
+++ b/.gitlab/generate/generate-docs.yml
@@ -13,7 +13,7 @@ generate-docs:
  extends: ".generate-common"
  image: "${OPENDESK_CI_CLI_IMAGE}"
  rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $RELEASE_BRANCH"
      when: "on_success"
  script:
    - "node /app/src/index.js generate-docs -d ${CI_PROJECT_DIR}"
--- a/.renovate/config.yaml
+++ b/.renovate/config.yaml
@@ -35,12 +35,12 @@ repositories:
    dependencyDashboard: true
    # Include package files only within these defined paths
    includePaths:
-      - "helmfile/environments/default/images.yaml"
-      - "helmfile/environments/default/charts.yaml"
+      - "helmfile/environments/default/images.yaml.gotmpl"
+      - "helmfile/environments/default/charts.yaml.gotmpl"
    customManagers:
      - customType: "regex"
        fileMatch:
-          - "helmfile/environments/default/images.yaml"
+          - "helmfile/environments/default/images.yaml.gotmpl"
        datasourceTemplate: "docker"
        matchStrings:
          # yamllint disable rule:line-length rule:quoted-strings
@@ -48,7 +48,7 @@ repositories:
          # yamllint enable rule:line-length rule:quoted-strings
      - customType: "regex"
        fileMatch:
-          - "helmfile/environments/default/charts.yaml"
+          - "helmfile/environments/default/charts.yaml.gotmpl"
        datasourceTemplate: "docker"
        matchStrings:
          # yamllint disable rule:line-length rule:quoted-strings
--- a/README.md
+++ b/README.md
@@ -8,16 +8,16 @@ SPDX-License-Identifier: Apache-2.0

 <!-- TOC -->
 * [Overview](#overview)
+* [Upgrades](#upgrades)
 * [Requirements](#requirements)
 * [Getting started](#getting-started)
 * [Advanced customization](#advanced-customization)
-* [Development](#development)
-* [Releases](#releases)
 * [Components](#components)
+* [Releases](#releases)
 * [Feedback](#feedback)
+* [Development](#development)
 * [License](#license)
 * [Copyright](#copyright)
-* [Footnotes](#footnotes)
 <!-- TOC -->

 # Overview
@@ -27,17 +27,17 @@ openDesk is a Kubernetes based, open-source and cloud-native digital workplace s

 openDesk currently features the following functional main components:

-| Function             | Functional Component        | Component<br/>Version                                                                 | Upstream Documentation                                                                                                               |
-| -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
-| Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                         |
-| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                         |
-| File management      | Nextcloud                   | [29.0.7](https://nextcloud.com/de/changelog/#29-0-7)                                  | [SNextcloud 29](https://docs.nextcloud.com/)                                                                                         |
-| Groupware            | OX App Suite                | [8.28](https://documentation.open-xchange.com/appsuite/releases/8.28/)                | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/ |
-| Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                    |
-| Portal & IAM         | Nubus                       | [1.0](https://www.univention.de/produkte/nubus/)                                      | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                            |
-| Project management   | OpenProject                 | [14.6.1](https://www.openproject.org/docs/release-notes/14-6-1/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                          |
-| Videoconferencing    | Jitsi                       | [2.0.9646](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9646) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                           |
-| Weboffice            | Collabora                   | [24.04.7.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)       |
+| Function             | Functional Component        | Component<br/>Version                                                                                | Upstream Documentation                                                                                                                |
+| -------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| Chat & collaboration | Element ft. Nordeck widgets | [1.11.87](https://github.com/element-hq/element-desktop/releases/tag/v1.11.87)                       | [For the most recent release](https://element.io/user-guide)                                                                          |
+| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                                     | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
+| File management      | Nextcloud                   | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8)                                                 | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                           |
+| Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)                       | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
+| Portal & IAM         | Nubus                       | [1.4.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
+| Project management   | OpenProject                 | [15.0.2](https://www.openproject.org/docs/release-notes/15-0-2/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
+| Weboffice            | Collabora                   | [24.04.9.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |

 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
@@ -46,13 +46,23 @@ This documentation aims to give you all that is needed to set up your own instan

 Basic knowledge of Kubernetes and DevOps processes is required though.

+# Upgrades
+
+You want to upgrade an existing openDesk installation?
+
+⟶ Visit our detailed documentation about [Updates & Upgrades](./docs/migrations.md).
+
 # Requirements

-⟶ Visit our detailed [Requirements](./docs/requirements.md) overview.
+You want to understand what is required to install openDesk yourself?
+
+⟶ Visit our [Requirements](./docs/requirements.md) overview.

 # Getting started

-⟶ Visit our detailed [Getting started](./docs/getting-started.md) guide.
+You would like to install openDesk in your own infrastructure?
+
+⟶ Visit our detailed [Getting started guide](./docs/getting-started.md).

 # Advanced customization

@@ -63,9 +73,9 @@ Basic knowledge of Kubernetes and DevOps processes is required though.
 - [Monitoring](./docs/monitoring.md)
 - [Theming](./docs/theming.md)

-# Development
+# Components

-⟶ To understand the repository contents from a developer perspective please read the [Development](./docs/development.md) guide.
+More information on openDesk's components and their integration can be found in our detailed [Component docs](./docs/components.md).

 # Releases

@@ -77,14 +87,10 @@ of this project.

 Please find a list of the artifacts related to the release either in the source code archive attached to the release or
 in the files from the release's git-tag:
- `./helmfile/environments/default/images.yaml`
- `./helmfile/environments/default/charts.yaml`
+- `./helmfile/environments/default/images.yaml.gotmpl`
+- `./helmfile/environments/default/charts.yaml.gotmpl`

-⟶ Visit our detailed [Workflow](./docs/workflow.md) docs.
-
-# Components
-
-⟶ Visit our detailed [Component](./docs/components.md) docs.
+Find more information in our [Workflow documentation](./docs/workflow.md).

 # Feedback

@@ -96,6 +102,10 @@ please use the [issues within this project](https://gitlab.opencode.de/bmi/opend
 If you want to address other topics, please check the section
 ["Rückmeldungen und Beteiligung" in the OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung) of the [openDesk Info Repository](https://gitlab.opencode.de/bmi/opendesk/info).

+# Development
+
+If you want to join or contribute to the development of openDesk please read the [Development guide](./docs/development.md).
+
 # License

 This project uses the following license: Apache-2.0
@@ -103,11 +113,3 @@ This project uses the following license: Apache-2.0
 # Copyright

 Copyright (C) 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-
-# Footnotes
-
-[^1]: Nubus is the Cloud Portal and IAM from Univention.
-It is currently integrated as a product preview within openDesk therefore, not all resources like documentation
-and structured release notes are available, while the
-[source code can already be found on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/component-code/crossfunctional/univention).
-Please find updates regarding the Nubus at https://nubus.io.
--- a/cspell.json
+++ b/cspell.json
@@ -74,7 +74,9 @@
        "filestore",
        "trashbin",
        "bootstrap",
-        "configurability"
+        "configurability",
+        "selfsigned",
+        "truststore"
    ],
    "ignoreWords": [],
    "import": []
--- a/dev/charts-local.py
+++ b/dev/charts-local.py
@@ -23,7 +23,7 @@ options = p.parse_args()
 script_path = os.path.dirname(os.path.realpath(__file__))
 # some static definitions
 log_path = script_path+'/../logs'
-charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml'
+charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml.gotmpl'
 base_repo_path = script_path+'/..'
 base_helmfile = base_repo_path+'/helmfile_generic.yaml.gotmpl'
 helmfile_backup_extension = '.bak'
@@ -43,8 +43,8 @@ consoleHandler.setFormatter(logFormatter)
 rootLogger.addHandler(consoleHandler)

 logging.debug(f"Working with relative paths from script location: {script_path}")
-logging.debug(f"Log directory: {log_path}")
-logging.debug(f"charts.yaml  : {charts_yaml}")
+logging.debug(f"Log directory:      {log_path}")
+logging.debug(f"charts.yaml.gotmpl: {charts_yaml}")


 def create_or_switch_branch_base_repo():
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -2,6 +2,7 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>CI/CD</h1>

 This page covers openDesk deployment automation via Gitlab CI.
--- a/docs/components.md
+++ b/docs/components.md
@@ -3,6 +3,7 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Components</h1>

 This section covers the internal system requirements and external service requirements for productive use.
@@ -26,28 +27,28 @@ openDesk consists of a variety of open-source projects. Here is a list with the
 Components of type `Eval` are used for development and evaluation purposes only,
 they need to be replaced in production deployments.

-| Component                   | Description                    | Type       |
-|-----------------------------|--------------------------------|------------|
-| Certificates                | TLS certificates               | Eval       |
-| ClamAV (Distributed)        | Antivirus engine               | Eval       |
-| ClamAV (Simple)             | Antivirus engine               | Eval       |
-| Collabora                   | Weboffice                      | Functional |
-| CryptPad                    | Weboffice                      | Functional |
-| dkimpy-milter               | DKIM milter for Postfix        | Eval       |
-| Element                     | Secure communications platform | Functional |
-| Jitsi                       | Videoconferencing              | Functional |
-| MariaDB                     | Database                       | Eval       |
-| Memcached                   | Cache Database                 | Eval       |
-| MinIO                       | Object Storage                 | Eval       |
-| Nextcloud                   | File share                     | Functional |
-| Nubus (UMS)                 | Identity Management & Portal   | Functional |
-| OpenProject                 | Project management             | Functional |
-| OX Appsuite                 | Groupware                      | Functional |
-| OX Dovecot                  | Mail backend (IMAP)            | Functional |
-| Postfix                     | MTA                            | Eval       |
-| PostgreSQL                  | Database                       | Eval       |
-| Redis                       | Cache Database                 | Eval       |
-| XWiki                       | Knowledge Management           | Functional |
+| Component            | Description                    | Type       |
+| -------------------- | ------------------------------ | ---------- |
+| Certificates         | TLS certificates               | Eval       |
+| ClamAV (Distributed) | Antivirus engine               | Eval       |
+| ClamAV (Simple)      | Antivirus engine               | Eval       |
+| Collabora            | Weboffice                      | Functional |
+| CryptPad             | Weboffice                      | Functional |
+| dkimpy-milter        | DKIM milter for Postfix        | Eval       |
+| Element              | Secure communications platform | Functional |
+| Jitsi                | Videoconferencing              | Functional |
+| MariaDB              | Database                       | Eval       |
+| Memcached            | Cache Database                 | Eval       |
+| MinIO                | Object Storage                 | Eval       |
+| Nextcloud            | File share                     | Functional |
+| Nubus (UMS)          | Identity Management & Portal   | Functional |
+| OpenProject          | Project management             | Functional |
+| OX App Suite         | Groupware                      | Functional |
+| OX Dovecot           | Mail backend (IMAP)            | Functional |
+| Postfix              | MTA                            | Eval       |
+| PostgreSQL           | Database                       | Eval       |
+| Redis                | Cache Database                 | Eval       |
+| XWiki                | Knowledge Management           | Functional |

 # Component integration

--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -2,8 +2,10 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Debugging</h1>

+<!-- TOC -->
 * [Disclaimer](#disclaimer)
 * [Enable debugging](#enable-debugging)
 * [Adding containers to a pod for debugging purposes](#adding-containers-to-a-pod-for-debugging-purposes)
@@ -14,6 +16,8 @@ SPDX-License-Identifier: Apache-2.0
  * [Nextcloud](#nextcloud)
  * [OpenProject](#openproject)
  * [PostgreSQL](#postgresql)
+  * [Keycloak](#keycloak)
+<!-- TOC -->

 # Disclaimer

@@ -31,11 +35,16 @@ environments, you should use them thoughtfully and carefully if needed.

 # Enable debugging

-Set `debug.enable` to `true` in [`debug.yaml`](../helmfile/environments/default/debug.yaml) to set the
-component's log level to debug, and it gets some features like:
- The `/admin` console is routed for Keycloak.
- An ingress for `http://minio-console.<your_domain>` is configured.
-and set the log level for components to "Debug".
+Check the openDesk [`debug.yaml.gotmpl`](../helmfile/environments/default/debug.yaml.gotmpl) and set for your deployment
+```
+debug:
+  enable: true
+```
+
+This will result in:
+- setting most component's log level to debug
+- making the Keycloak admin console available by default at `https://id.<your_domain>/admin/`
+- configured the ingress for `http://minio-console.<your_domain>`

 > **Note**<br>
 > When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.
@@ -176,3 +185,22 @@ While you will find all details in the [psql subsection](https://www.postgresql.
 - `\c <databasename>`: Connect to `<databasename>`
 - `\dt`: List (describe) tables within the currently connected database
 - `\q`: Quit the client
+
+## Keycloak
+
+Keycloak is the gateway to integrate other authentication management systems or applications. It can be desired to
+avoid enabling debug mode for the whole platform when you just need to look into Keycloak.
+
+That can easily be achieved in two steps:
+
+1. Updating the value for `KC_LOG_LEVEL` in the related configmap `ums-keycloak`.
+```shell
+export NAMESPACE=<your_namespace>
+export CONFIGMAP_NAME=ums-keycloak
+kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"data":{"KC_LOG_LEVEL":"DEBUG"}}'
+```
+
+2. Restart the Keycloak Pod(s).
+
+> **Note**<br>
+> As the `ums-keycloak-extensions-handler` is performing frequent (one per second) requests to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.
--- a/docs/development.md
+++ b/docs/development.md
@@ -7,17 +7,19 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Developing openDesk deployment automation</h1>

 Active development on the deployment is currently only available for project members.
-However, contributions will be possible using the CLA process.
+However, contributions are possible using the [CLA](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md?ref_type=heads) process.

+<!-- TOC -->
 * [Overview](#overview)
 * [Default branch, `develop` and other branches](#default-branch-develop-and-other-branches)
-* [External artifacts - `charts.yaml` and `images.yaml`](#external-artifacts---chartsyaml-and-imagesyaml)
+* [External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`](#external-artifacts---chartsyamlgotmpl-and-imagesyamlgotmpl)
  * [Linting](#linting)
    * [Disable linting selectively](#disable-linting-selectively)
  * [Renovate](#renovate)
  * [Mirroring](#mirroring)
    * [Get new artifacts mirrored](#get-new-artifacts-mirrored)
 * [Creating new charts/images](#creating-new-chartsimages)
+<!-- TOC -->

 # Overview

@@ -27,29 +29,29 @@ developing the openDesk platform.

 ```mermaid
 flowchart TD
- J[helmfile.yaml\nor a helmfile outside of this repository]-->A
+ J[helmfile.yaml.gotmpl\nor a helmfile outside of this repository]-->A
 J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor any an environment values file]
- A[./helmfile_generic.yaml]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml\nReferences the relevant app Helm\ncharts using details from 'charts.yaml']
- B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml`]
+ A[./helmfile_generic.yaml.gotmpl]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml.gotmpl\nReferences the relevant app Helm\ncharts using details from 'charts.yaml.gotmpl']
+ B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml.gotmpl`]
 A-->D[./helmfile/environments/default/*\nwith just some examples below]
- D-->F[charts.yaml]
- D-->G[images.yaml]
+ D-->F[charts.yaml.gotmpl]
+ D-->G[images.yaml.gotmpl]
 D-->H[global.*]
- D-->I[secrets.yaml\nreplicas.yaml\nresources.yaml\n...]
+ D-->I[secrets.yaml.gotmpl\nreplicas.yaml.gotmpl\nresources.yaml.gotmpl\n...]
 A-->|overwrite defaults with your\ndeployment/environment specific values|E[./helmfile/environments/default/values.yaml.gotmpl]
 ```

-The `helmfile.yaml` file in the root folder is the foundation
-for the entire deployment. It references the `helmfile_generic.yaml`
-file, which includes app-specific `helmfile.yaml` files and
+The `helmfile.yaml.gotmpl` file in the root folder is the foundation
+for the entire deployment. It references the `helmfile_generic.yaml.gotmpl`
+file, which includes app-specific `helmfile.yaml.gotmpl` files and
 global values files located in `./environments/default`.

-`helmfile.yaml` also refers to three predefined environments: `dev`,
+`helmfile.yaml.gotmpl` also refers to three predefined environments: `dev`,
 `test`, and `prod`.

-The `helmfile_generic.yaml` file is designed to be referenced from
+The `helmfile_generic.yaml.gotmpl` file is designed to be referenced from
 external repositories, where custom environments may be defined. An
-example is demonstrated in the `helmfile.yaml` file.
+example is demonstrated in the `helmfile.yaml.gotmpl` file.

 Before you investigate any app-specific configuration, it is recommended that you review the contents of `./helmfile/environments/default` to understand what configuration details are set there, as the app deployments reference them.

@@ -66,9 +68,9 @@ Of course, the merge request will target the `develop` branch, be in status `dra

 If you do not plan to merge from the branch you have pushed, please close the auto-created MR.

-# External artifacts - `charts.yaml` and `images.yaml`
+# External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`

-The `charts.yaml` and `images.yaml` files are the central place to reference external artifacts used for the deployment.
+The `charts.yaml.gotmpl` and `images.yaml.gotmpl` files are the central place to reference external artifacts used for the deployment.

 Besides the deployment automation itself, some tools work with the contents of the files:

@@ -140,7 +142,7 @@ The mirror script takes the information on what artifacts to mirror from the ann
 - `# upstreamRegistry` *required*: To identify the source registry
 - `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public, the access credentials have to be specified as ENV variables containing the value of this key in their name, so you want to specify that key all uppercase:
   - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
-  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORT`
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORD`
 - `# upstreamRepository` *required*: To identify the source repository
 - `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set, the mirror for the component will be activated. Only tags that match the given regular expression are being mirrored. **Note:** You must use single quotes for this attribute's value if you use backslash leading regex notation like `\d`.
 - `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing group
--- a/docs/enhanced-configuration.md
+++ b/docs/enhanced-configuration.md
@@ -13,3 +13,5 @@ The following enhanced configuration use cases are described in separate documen
 - [Federation with external identity provider](./enhanced-configuration/idp-federation.md)
 - [Matrix federation](./enhanced-configuration/matrix-federation.md)
 - [Groupware migration from M365 to openDesk](./enhanced-configuration/groupware-migration.md)
+- [Self-signed certificate and custom Certificate Authority (CA)](./enhanced-configuration/self-signed-certificates.md)
+- [GitOps deployments using Argo CD](./enhanced-configuration/gitops.md)
--- a/docs/enhanced-configuration/gitops.md
+++ b/docs/enhanced-configuration/gitops.md
@@ -0,0 +1,55 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>GitOps Deployment</h1>
+
+<!-- TOC -->
+* [Considerations](#considerations)
+* [ArgoCD](#argocd)
+  * [Option 1: Use YAML manifests](#option-1-use-yaml-manifests)
+  * [Option 2: Helmfile plugin](#option-2-helmfile-plugin)
+<!-- TOC -->
+
+The recommended deployment method for openDesk is via Helmfile. This can be done "by hand", via CI/CD (Gitlab) or using
+the [GitOps](https://about.gitlab.com/topics/gitops/) approach with tools like [Argo CD](https://argoproj.github.io/cd/).
+
+This documentation will use Argo CD to explain how to deploy openDesk GitOps-style.
+
+# Considerations
+
+- openDesk consists of multiple applications which have to be deployed in order.
+- During upgrades, migrations have to run before and after applications.
+
+# ArgoCD
+
+We are continuously improving our Argo CD support, please share you experience with Argo CD deployments e.g. by [creating
+at ticket](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues).
+
+There are two options to deploy openDesk via Argo CD described in the following sections.
+
+## Option 1: Use YAML manifests
+
+This option requires a preprocessing step before using Argo CD. This step requires you to compile the Helmfile based
+deployment into Kubernetes YAML manifest, to do so you need to execute the helmfile binary:
+
+```shell
+helmfile template > opendesk.yaml
+```
+
+References:
+- [Helmfile CLI documentation](https://helmfile.readthedocs.io/en/latest/#cli-reference)
+- [Generate K8s YAML Manifests for openDesk](https://gitlab.opencode.de/bmi/opendesk/deployment/options/generate-k8s-yaml-manifests)
+
+Afterwards, you can use the resulting manifests within an standard Argo CD workflow.
+
+## Option 2: Helmfile plugin
+
+It is possible to deploy openDesk via Argo CD with community developed
+[Helmfile plugin](https://github.com/travisghansen/argo-cd-helmfile).
+
+You can find an example for this approach in the
+[Argo CD Deployments](https://gitlab.opencode.de/bmi/opendesk/deployment/options/argocd-deploy) repository.
+It contains an example Helm chart (`opendesk-parent`) to create Argo CD Applications via a Helm chart (`opendesk`)
+according to `app of apps pattern` and is using sync waves to follow dependencies.
--- a/docs/enhanced-configuration/groupware-migration.md
+++ b/docs/enhanced-configuration/groupware-migration.md
@@ -1,11 +1,11 @@
-r<!--
+<!--
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->

 <h1>Migration from M365 with audriga migration service and master authentication</h1>

-* [Context](#context)
+<!-- TOC -->
 * [Prerequisites](#prerequisites)
  * [Prepare M365 tenant for access](#prepare-m365-tenant-for-access)
  * [Provisioning user accounts in openDesk](#provisioning-user-accounts-in-opendesk)
@@ -17,8 +17,7 @@ SPDX-License-Identifier: Apache-2.0
    * [Add multiple user accounts via CSV file](#add-multiple-user-accounts-via-csv-file)
  * [Start the migration](#start-the-migration)
  * [Monitor migration status](#monitor-migration-status)
-
-# Context
+<!-- TOC -->

 Most organizations already have email accounts on various platforms that need to be migrated to openDesk. This document describes the migration from M365 accounts to openDesk using the [audriga Migration Service](https://www.audriga.com) in combination with the master authentication option in openDesk. Other source platforms are also supported, and their migrations work in a similar manner.

@@ -75,18 +74,18 @@ With openDesk 1.0 Enterprise, you can set openDesk's email components (OX AppSui

 ```
 secrets:
-  oxAppsuite:
+  oxAppSuite:
    adminPassword: "your_temporary_master_password"
 functional:
  migration:
-    oxAppsuite:
+    oxAppSuite:
      enabled: true
 ```

 1. You must specify the master password referenced in the document's following sections.
 2. You need to enable the actual master authentication mode.

-Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppsuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppsuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
+Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppSuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppSuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.

 > **Note**<br>
 > For the changes to take effect, it is sufficient to deploy the `open-xchange` component.
--- a/docs/enhanced-configuration/idp-federation.md
+++ b/docs/enhanced-configuration/idp-federation.md
@@ -5,7 +5,9 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Federation with external identity provider (IdP)</h1>

+<!-- TOC -->
 * [Context](#context)
+* [References](#references)
 * [Prerequisites](#prerequisites)
  * [User accounts](#user-accounts)
  * [External IdP with OIDC](#external-idp-with-oidc)
@@ -17,13 +19,21 @@ SPDX-License-Identifier: Apache-2.0
    * [Separate realm](#separate-realm)
    * [OIDC Client](#oidc-client)
  * [openDesk IdP](#opendesk-idp)
-
-# Context
+<!-- TOC -->

 Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on to internal or external web applications.

 This document shows how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk single sign-on based on your organization's login.

+# References
+
+We would like to list successful IdP federation scenarios, so we are also happy about input from the community:
+
+| External IdP                                                        | last openDesk version tested |
+| ------------------------------------------------------------------- | ---------------------------- |
+| [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0                       |
+| [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                       |
+
 # Prerequisites

 ## User accounts
--- a/docs/enhanced-configuration/matrix-federation.md
+++ b/docs/enhanced-configuration/matrix-federation.md
@@ -12,8 +12,6 @@ SPDX-License-Identifier: Apache-2.0
  * [Separate Matrix domain](#separate-matrix-domain)
 <!-- TOC -->

-# Context
-
 The Element chat application and its server component Synapse are based on the Matrix protocol,
 that supports federation with other Matrix servers to communicate with the users with accounts on these servers.

--- a/docs/enhanced-configuration/self-signed-certificates.md
+++ b/docs/enhanced-configuration/self-signed-certificates.md
@@ -0,0 +1,107 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Self-signed certificate and custom Certificate Authority (CA)</h1>
+
+<!-- TOC -->
+* [Configuration](#configuration)
+  * [Option 1: Bring Your Own Certificate](#option-1-bring-your-own-certificate)
+  * [Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate](#option-2a-use-cert-managerio-with-auto-generated-namespace-based-root-certificate)
+  * [Option 2b: Use cert-manager.io with pre-defined/shared root-certificate](#option-2b-use-cert-managerio-with-pre-definedshared-root-certificate)
+<!-- TOC -->
+
+Deploying openDesk into an environment with custom public key infrastructure (PKI) that is usually not part of
+public certificate authority chains or deploying openDesk into a local cluster without ACME challenge.
+
+# Configuration
+
+There are two options to address the use case.
+
+## Option 1: Bring Your Own Certificate
+
+This option is useful, when you have your own PKI in your environment which is trusted by all clients that should
+access openDesk.
+
+1. Disable cert-manager.io certificate resource creation:
+
+    ```yaml
+    certificates:
+      enabled: false
+    ```
+
+1. Enable mount of self-signed certificates:
+
+    ```yaml
+    certificate:
+      selfSigned: true
+    ```
+
+1. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
+wildcard certificate or a certificate with [all required subdomains](../../helmfile/environments/default/global.yaml.gotmpl)
+set as SANs (Subject Alternative Name).
+
+1. Create a Kubernetes secret with name `opendesk-certificates-ca-tls` of type `kubernetes.io/tls` containing the custom
+CA certificate as X.509 encoded (`ca.crt`) and as jks trust store (`truststore.jks`).
+
+1. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
+trust store password.
+
+## Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate
+
+This option is useful, when you do not have a trusted certificate available and can't fetch a certificate from
+Let’s Encrypt. It will result in a cert-manager managed root certificate in the namespace you deploy openDesk into.
+
+1. Create self-signed cert-manager.io Cluster Issuer:
+    ```yaml
+    apiVersion: "cert-manager.io/v1"
+    kind: "ClusterIssuer"
+    metadata:
+      name: "selfsigned-issuer"
+    spec:
+      selfSigned: {}
+    ```
+
+1. Enable mount and creation of self-signed certificates:
+    ```yaml
+    certificate:
+      issuerRef:
+        name: "selfsigned-issuer"
+      selfSigned: true
+    ```
+
+## Option 2b: Use cert-manager.io with pre-defined/shared root-certificate
+
+Use this approach if you like to use a pre-created CA root certificate that can be "shared" (as copy) between
+multiple namespaces in a cluster.
+
+1. Create self-signed cert-manager.io Cluster Issuer root certificate the same was as in *Option 2a*.
+
+1. Create the root certificate for the previously created CA, in the example it is placed into the namespace `cert-manager`.
+    ```yaml
+    apiVersion: cert-manager.io/v1
+    kind: Certificate
+    metadata:
+      name: opendesk-root
+      namespace: cert-manager
+    spec:
+      isCA: true
+      commonName: opendesk.eu
+      secretName: opendesk-root-cert-secret
+      subject:
+        organizations: [ "openDesk cluster root certificate organization" ]
+      privateKey:
+        algorithm: ECDSA
+        size: 256
+      issuerRef:
+        name: selfsigned-issuer
+        kind: ClusterIssuer
+        group: cert-manager.io
+    ```
+
+1. Copy this cert's secret into the/each namespace you want to make use of the cert.
+
+1. Create issuer in the/each namespace you want to make use of the cert.
+
+The latter two steps are part of the `env-start:` section within [`.gitlab-ci.yml`](../../.gitlab-ci.yml).
--- a/docs/enhanced-configuration/separate-mail-matrix-domain.md
+++ b/docs/enhanced-configuration/separate-mail-matrix-domain.md
@@ -5,6 +5,7 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Separate domains for mail and or Matrix </h1>

+<!-- TOC -->
 * [Context](#context)
 * [Example configuration](#example-configuration)
  * [Mail domain](#mail-domain)
@@ -13,8 +14,7 @@ SPDX-License-Identifier: Apache-2.0
    * [Webserver](#webserver)
      * [Content Security Policy](#content-security-policy)
      * [.well-known](#well-known)
-
-# Context
+<!-- TOC -->

 As communication over mail and chat can go beyond the borders of your openDesk installation, you may want to use different domains for the mail and/or Matrix.

--- a/docs/external-services.md
+++ b/docs/external-services.md
@@ -18,59 +18,59 @@ This document will cover the additional configuration for external services like
 When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.

-| Component   | Name               | Type       | Parameter | Key                                      | Default                    |
-|-------------|--------------------|------------|-----------|------------------------------------------|----------------------------|
-| Element     | Synapse            | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.synapse.name` | `matrix` |
-|             |                    |            | Host      | `databases.synapse.host` | `postgresql` |
-|             |                    |            | Port      | `databases.synapse.port` | `5432` |
-|             |                    |            | Username  | `databases.synapse.username` | `matrix_user` |
-|             |                    |            | Password  | `databases.synapse.password` |                            |
-| Keycloak    | Keycloak           | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloak.name` | `keycloak` |
-|             |                    |            | Host      | `databases.keycloak.host` | `postgresql` |
-|             |                    |            | Port      | `databases.keycloak.port` | `5432` |
-|             |                    |            | Username  | `databases.keycloak.username` | `keycloak_user` |
-|             |                    |            | Password  | `databases.keycloak.password` |                            |
-|             | Keycloak Extension | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloakExtension.name` | `keycloak_extensions` |
-|             |                    |            | Host      | `databases.keycloakExtension.host` | `postgresql` |
-|             |                    |            | Port      | `databases.keycloakExtension.port` | `5432` |
-|             |                    |            | Username  | `databases.keycloakExtension.username` | `keycloak_extensions_user` |
-|             |                    |            | Password  | `databases.keycloakExtension.password` |                            |
-| UMS         | Notifications API  | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsNotificationsApi.name` | `notificationsapi` |
-|             |                    |            | Host      | `databases.umsNotificationsApi.host` | `postgresql` |
-|             |                    |            | Port      | `databases.umsNotificationsApi.port` | `5432` |
-|             |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user` |
-|             |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
-|             | Self Service       | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsSelfservice.name` | `selfservice` |
-|             |                    |            | Host      | `databases.umsSelfservice.host` | `postgresql` |
-|             |                    |            | Port      | `databases.umsSelfservice.port` | `5432` |
-|             |                    |            | Username  | `databases.umsSelfservice.username` | `selfservice_user` |
-|             |                    |            | Password  | `databases.umsSelfservice.password` |                            |
-| Nextcloud   | Nextcloud          | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.nextcloud.name` | `nextcloud` |
-|             |                    |            | Host      | `databases.nextcloud.host` | `mariadb` |
-|             |                    |            | Username  | `databases.nextcloud.username` | `nextcloud_user` |
-|             |                    |            | Password  | `databases.nextcloud.password` |                            |
-| OpenProject | OpenProject        | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.openproject.name` | `openproject` |
-|             |                    |            | Host      | `databases.openproject.host` | `postgresql` |
-|             |                    |            | Port      | `databases.openproject.port` | `5432` |
-|             |                    |            | Username  | `databases.openproject.username` | `openproject_user` |
-|             |                    |            | Password  | `databases.openproject.password` |                            |
-| OX Appsuite | OX Appsuite        | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.oxAppsuite.name` | `CONFIGDB` |
-|             |                    |            | Host      | `databases.oxAppsuite.host` | `mariadb` |
-|             |                    |            | Username  | `databases.oxAppsuite.username` | `root` |
-|             |                    |            | Password  | `databases.oxAppsuite.password` |                            |
-| XWiki       | XWiki              | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.xwiki.name` | `xwiki` |
-|             |                    |            | Host      | `databases.xwiki.host` | `mariadb` |
-|             |                    |            | Username  | `databases.xwiki.username` | `xwiki_user` |
-|             |                    |            | Password  | `databases.xwiki.password` |                            |
+| Component    | Name               | Type       | Parameter | Key                                      | Default                    |
+| ------------ | ------------------ | ---------- | --------- | ---------------------------------------- | -------------------------- |
+| Element      | Synapse            | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
+|              |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
+|              |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
+|              |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
+|              |                    |            | Password  | `databases.synapse.password`             |                            |
+| Keycloak     | Keycloak           | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
+|              |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
+|              |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
+|              |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
+|              |                    |            | Password  | `databases.keycloak.password`            |                            |
+|              | Keycloak Extension | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
+|              |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
+|              |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
+|              |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
+|              |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
+| UMS          | Notifications API  | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
+|              |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
+|              |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
+|              |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
+|              |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
+|              | Self Service       | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
+|              |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
+|              |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
+|              |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
+|              |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
+| Nextcloud    | Nextcloud          | MariaDB    |           |                                          |                            |
+|              |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
+|              |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
+|              |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
+|              |                    |            | Password  | `databases.nextcloud.password`           |                            |
+| OpenProject  | OpenProject        | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
+|              |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
+|              |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
+|              |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
+|              |                    |            | Password  | `databases.openproject.password`         |                            |
+| OX App Suite | OX App Suite       | MariaDB    |           |                                          |                            |
+|              |                    |            | Name      | `databases.oxAppSuite.name`              | `CONFIGDB`                 |
+|              |                    |            | Host      | `databases.oxAppSuite.host`              | `mariadb`                  |
+|              |                    |            | Username  | `databases.oxAppSuite.username`          | `root`                     |
+|              |                    |            | Password  | `databases.oxAppSuite.password`          |                            |
+| XWiki        | XWiki              | MariaDB    |           |                                          |                            |
+|              |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
+|              |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
+|              |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
+|              |                    |            | Password  | `databases.xwiki.password`               |                            |

 # Object storage

--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -59,34 +59,34 @@ For the following guide, we will use `dev` as environment where variables can be
 The deployment is designed to deploy each application/service under a dedicated subdomain.
 For your convenience, we recommend creating a `*.domain.tld` A-Record to your cluster ingress controller; otherwise, you must create an A-Record for each subdomain.

-| Record name                   | Type | Value                                              | Additional information                                           |
-|-------------------------------|------|----------------------------------------------------|------------------------------------------------------------------|
-| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                  |
-| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                  |
-| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
-| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
-| domain.tld                    | MX   | `10 mail.domain.tld` |                                                                  |
-| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all` | Optional, use proper MTA record if present                       |
-| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine` | Optional                                                         |
-| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...` | Optional DKIM settings                                           |
+| Record name                   | Type | Value                                              | Additional information                                           |
+| ----------------------------- | ---- | -------------------------------------------------- | ---------------------------------------------------------------- |
+| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                  |
+| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                  |
+| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                  |
+| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                       |
+| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                         |
+| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional DKIM settings                                           |

 ## Domain

-A list of all subdomains can be found in `helmfile/environments/default/global.yaml`.
+A list of all subdomains can be found in `helmfile/environments/default/global.gotmpl`.

 All subdomains can be customized. For example, _Nextcloud_ can be changed to `files.domain.tld` in `dev` environment:

 ```yaml
 global:
-  hosts:
-    nextcloud: "files"
+  hosts:
+    nextcloud: "files"
 ```

 The domain has to be set either via `dev` environment

 ```yaml
 global:
-  domain: "domain.tld"
+  domain: "domain.tld"
 ```

 or via environment variable
@@ -97,35 +97,37 @@ export DOMAIN=domain.tld

 ### Apps

-All available apps and their default value are in `helmfile/environments/default/workplace.yaml`.
+All available apps and their default value are in `helmfile/environments/default/opendesk_main.gotmpl`.

-| Component            | Name                        | Default | Description                    |
+| Component            | Name                        | Default | Description                    |
 | -------------------- | --------------------------- | ------- | ------------------------------ |
-| Certificates         | `certificates.enabled` | `true` | TLS certificates               |
-| ClamAV (Distributed) | `clamavDistributed.enabled` | `false` | Antivirus engine               |
-| ClamAV (Simple)      | `clamavSimple.enabled` | `true` | Antivirus engine               |
-| Collabora            | `collabora.enabled` | `true` | Weboffice                      |
-| CryptPad             | `cryptpad.enabled` | `true` | Weboffice                      |
-| Dovecot              | `dovecot.enabled` | `true` | Mail backend                   |
-| Element              | `element.enabled` | `true` | Secure communications platform |
-| Jitsi                | `jitsi.enabled` | `true` | Videoconferencing              |
-| MariaDB              | `mariadb.enabled` | `true` | Database                       |
-| Memcached            | `memcached.enabled` | `true` | Cache Database                 |
-| MinIO                | `minio.enabled` | `true` | Object Storage                 |
-| Nextcloud            | `nextcloud.enabled` | `true` | File share                     |
-| Nubus                | `nubus.enabled` | `true` | Identity Management & Portal   |
-| OpenProject          | `openproject.enabled` | `true` | Project management             |
-| OX Appsuite          | `oxAppsuite.enabled` | `true` | Groupware                      |
-| Postfix              | `postfix.enabled` | `true` | MTA                            |
-| PostgreSQL           | `postgresql.enabled` | `true` | Database                       |
-| Redis                | `redis.enabled` | `true` | Cache Database                 |
-| XWiki                | `xwiki.enabled` | `true` | Knowledge management           |
+| Certificates         | `certificates.enabled`      | `true`  | TLS certificates               |
+| ClamAV (Distributed) | `clamavDistributed.enabled` | `false` | Antivirus engine               |
+| ClamAV (Simple)      | `clamavSimple.enabled`      | `true`  | Antivirus engine               |
+| Collabora            | `collabora.enabled`         | `true`  | Weboffice                      |
+| CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
+| dkimpy               | `dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
+| Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
+| Element              | `element.enabled`           | `true`  | Secure communications platform |
+| Home                 | `home.enabled`              | `true`  | Base domain portal redirect    |
+| Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
+| MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
+| Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
+| MinIO                | `minio.enabled`             | `true`  | Object Storage                 |
+| Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
+| Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
+| OpenProject          | `openproject.enabled`       | `true`  | Project management             |
+| OX App Suite         | `oxAppSuite.enabled`        | `true`  | Groupware                      |
+| Postfix              | `postfix.enabled`           | `true`  | MTA                            |
+| PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
+| Redis                | `redis.enabled`             | `true`  | Cache Database                 |
+| XWiki                | `xwiki.enabled`             | `true`  | Knowledge management           |

 Exemplary, Jitsi can be disabled like:

 ```yaml
 jitsi:
-  enabled: false
+  enabled: false
 ```

 ## Private registries
@@ -145,7 +147,7 @@ prefer the use of a private image registry, you can configure such for

 ```yaml
 global:
-  imageRegistry: "my_private_registry.domain.tld"
+  imageRegistry: "my_private_registry.domain.tld"
 ```

 alternatively, you can use an environment variable:
@@ -158,16 +160,16 @@ or control repository override fine-granular per registry:

 ```yaml
 repositories:
-  image:
-    dockerHub: "my_private_registry.domain.tld/docker.io/"
-    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
+  image:
+    dockerHub: "my_private_registry.domain.tld/docker.io/"
+    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
 ```

 If authentication is required, you can reference `imagePullSecrets` as follows:

 ```yaml
 global:
-  imagePullSecrets:
+  imagePullSecrets:
    - "external-registry"
 ```

@@ -182,8 +184,8 @@ used:

 ```yaml
 cluster:
-  service:
-    type: "NodePort"
+  service:
+    type: "NodePort"
 ```

 ### Networking
@@ -192,16 +194,16 @@ If your cluster has not the default `cluster.local` domain configured, you need

 ```yaml
 cluster:
-  networking:
-    domain: "acme.internal"
+  networking:
+    domain: "acme.internal"
 ```

 If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via the following:

 ```yaml
 cluster:
-  networking:
-    cidr:
+  networking:
+    cidr:
      - "127.0.0.0/8"
 ```

@@ -210,8 +212,8 @@ explicitly configure the related IPs or IP ranges:

 ```yaml
 cluster:
-  networking:
-    incomingCIDR:
+  networking:
+    incomingCIDR:
      - "172.16.0.0/12"
 ```

@@ -223,7 +225,7 @@ setting the following attribute to the name of the currently only supported ingr

 ```yaml
 ingress:
-  ingressClassName: "name-of-my-nginx-ingress"
+  ingressClassName: "name-of-my-nginx-ingress"
 ```

 ### Container runtime
@@ -233,30 +235,32 @@ Some apps require specific configurations for the container runtime. You can set

 ```yaml
 cluster:
-  container:
-    engine: "containerd"
+  container:
+    engine: "containerd"
 ```

 ### Volumes
-
-When your cluster has a `ReadWriteMany` volume provisioner, you can benefit from the distribution or scaling of apps. By
-default, only `ReadWriteOnce` is enabled. To enable `ReadWriteMany` you can set:
-
-```yaml
-cluster:
-  persistence:
-    readWriteMany: true
-```
-
-The **StorageClass** can be set by:
+The **StorageClass** must be set by:

 ```yaml
 persistence:
-  storageClassNames:
-    RWX: "my-read-write-many-class"
-    RWO: "my-read-write-once-class"
+  storageClassNames:
+    RWX: "my-read-write-many-class"
+    RWO: "my-read-write-once-class"
 ```

+`RWX` is optional and requires that your cluster has a `ReadWriteMany` volume provisioner. If you can make use
+of it it benefits the distribution or scaling of apps. By default, only `ReadWriteOnce` is enabled.
+To enable `ReadWriteMany` you have to set:
+
+```yaml
+cluster:
+  persistence:
+    readWriteMany: true
+```
+
+
+
 ## Connectivity

 ### Ports
@@ -267,22 +271,22 @@ persistence:

 To use the openDesk functionality with its web-based user interface, you need to expose the following ports publicly:

-| Component          | Description             |  Port | Type |
+| Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
-| openDesk           | Kubernetes Ingress      |    80 |  TCP |
-| openDesk           | Kubernetes Ingress      |   443 |  TCP |
-| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
+| openDesk           | Kubernetes Ingress      |    80 |  TCP |
+| openDesk           | Kubernetes Ingress      |   443 |  TCP |
+| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |

 #### Mail clients

 To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need public exposure:

-| Component          | Description             |  Port | Type |
+| Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
-| Dovecot            | IMAPS                   |   993 |  TCP |
-|                    | POP3S                   |   995 |  TCP |
-| Postfix            | SMTP                    |    25 |  TCP |
-|                    | SMTPS                   |   587 |  TCP |
+| Dovecot            | IMAPS                   |   993 |  TCP |
+|                    | POP3S                   |   995 |  TCP |
+| Postfix            | SMTP                    |    25 |  TCP |
+|                    | SMTPS                   |   587 |  TCP |

 ### Mail/SMTP configuration

@@ -291,9 +295,9 @@ the whole subdomain.

 ```yaml
 smtp:
-  host: "mail.open.desk"
-  username: "openDesk"
-  password: "secret"
+  host: "mail.open.desk"
+  username: "openDesk"
+  password: "secret"
 ```

 Enabling DKIM signing of emails helps to reduce spam and increases trust.
@@ -301,12 +305,12 @@ openDesk ships dkimpy-milter as Postfix milter for signing emails.

 ```yaml
 dkimpy:
-  enable: true
-  dkim:
-    key:
-      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
-    selector: "default"
-    useED25519: true # when false, RSA is used
+  enable: true
+  dkim:
+    key:
+      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
+    selector: "default"
+    useED25519: true # when false, RSA is used
 ```

 ### TURN configuration
@@ -316,14 +320,14 @@ these options:

 ```yaml
 turn:
-  transport: "udp" # or tcp
-  credentials: "secret"
-  server:
-    host: "turn.open.desk"
-    port: "3478"
-  tls:
-    host: "turns.open.desk"
-    port: "5349"
+  transport: "udp" # or tcp
+  credentials: "secret"
+  server:
+    host: "turn.open.desk"
+    port: "3478"
+  tls:
+    host: "turns.open.desk"
+    port: "5349"
 ```

 ### Certificate issuer
@@ -334,7 +338,7 @@ turn off `Certificate` resource creation by:

 ```yaml
 certificates:
-  enabled: false
+  enabled: false
 ```

 If you want to leverage the `cert-manager.io` to handle certificates, like `Let's encrypt`, you need to provide the
@@ -342,15 +346,15 @@ configured cluster issuer:

 ```yaml
 certificate:
-  issuerRef:
-    name: "letsencrypt-prod"
+  issuerRef:
+    name: "letsencrypt-prod"
 ```

 Additionally, it is possible to request wildcard certificates by:

 ```yaml
 certificate:
-  wildcard: true
+  wildcard: true
 ```

 ## Password seed
@@ -415,22 +419,38 @@ If you change the subdomain of `nubus`, you must replace `portal` with the speci
 openDesk deploys with the standard user account `Administrator`, which password you get retrieved as follows:

 ```shell
-# Replace with your namespace
-NAMESPACE=your-namespace
+# Set your namespace
+NAMESPACE=<your_namespace>

 # Get password for IAM "Administrator" account
-kubectl -n ${NAMESPACE} secret ums-nubus-credentials -o jsonpath='{.data.administrator_password}' | base64 -d
+kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.administrator_password}' | base64 -d
 ```

-In openDesk Community Edition, you get two more default accounts:
- `default.admin`: `kubectl -n ${NAMESPACE} secret ums-nubus-credentials -o jsonpath='{.data.admin_password}' | base64 -d`
- `default.user`: `kubectl -n ${NAMESPACE} secret ums-nubus-credentials -o jsonpath='{.data.user_password}' | base64 -d`
+Using the aforementioned account, you can either create new accounts manually or make use of the
+[openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import/)
+script or container.
+
+For example you get a `default` and `default-admin` account by running the following snippet, after settings the
+appropriate values in the first three lines.
+
+```shell
+ADMINISTRATOR_PASSWORD=<your_administrator_password_see_above>
+DOMAIN=<your_domain>
+DEFAULT_USERS_PASSWORD=<password_for_the_created_default_accounts>
+docker run --rm registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0 \
+  ./user_import_udm_rest_api.py \
+    --import_domain ${DOMAIN} \
+    --udm_api_password ${ADMINISTRATOR_PASSWORD} \
+    --set_default_password ${DEFAULT_USERS_PASSWORD} \
+    --import_filename template.ods \
+    --create_admin_accounts True
+```

 ## Using from external repository

-Referring to `./helmfile_generic.yaml` from an external
-directory or repository is possible. The `helmfile.yaml` that refers to
-`./helmfile_generic.yaml` may define custom environments. These custom
+Referring to `./helmfile_generic.yaml.gotmpl` from an external
+directory or repository is possible. The `helmfile.yaml.gotmpl` that refers to
+`./helmfile_generic.yaml.gotmpl` may define custom environments. These custom
 environments may overwrite specific configuration values. These
 configuration values are:

@@ -456,7 +476,7 @@ NAMESPACE=your-namespace

 # Uninstall all Helm charts
 for OPENDESK_RELEASE in $(helm ls -n ${NAMESPACE} -aq); do
-  helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
+  helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
 done

 # Delete leftover resources
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -3,43 +3,236 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 -->

-<h1>Upgrade migrations</h1>
+<h1>Updates & Upgrades</h1>

+<!-- TOC -->
 * [Disclaimer](#disclaimer)
-* [Releases upgrades](#releases-upgrades)
+* [openDesk supported upgrade path](#opendesk-supported-upgrade-path)
+* [Releases upgrade details](#releases-upgrade-details)
+  * [From v1.0.0](#from-v100)
+    * [Pre-upgrade: Manual checks/steps](#pre-upgrade-manual-checkssteps)
+      * [Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
+      * [Helmfile Cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
+      * [Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
+      * [Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names](#helmfile-cleanup-streamlining-openxchange-and-oxappsuite-attribute-names)
+      * [Helmfile feature update: Dicts to define `customization.release`](#helmfile-feature-update-dicts-to-define-customizationrelease)
+      * [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
+      * [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
+      * [External requirements: Redis 7.4](#external-requirements-redis-74)
  * [From v0.9.0](#from-v090)
-    * [Changed openDesk defaults](#changed-opendesk-defaults)
-      * [Removal of unnecessary OX-Profiles in Nubus](#removal-of-unnecessary-ox-profiles-in-nubus)
-      * [Matrix ID localpart update](#matrix-id-localpart-update)
-      * [File-share configurability](#file-share-configurability)
-      * [Updated default subdomains in `global.hosts`](#updated-default-subdomains-in-globalhosts)
-      * [Updated `global.imagePullSecrets`](#updated-globalimagepullsecrets)
-      * [Dedicated group for access to the UDM REST API](#dedicated-group-for-access-to-the-udm-rest-api)
+    * [Pre-upgrade: Manual steps](#pre-upgrade-manual-steps)
+      * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
+      * [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
+      * [Changed openDesk defaults: Matrix ID](#changed-opendesk-defaults-matrix-id)
+      * [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
+      * [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
+      * [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
    * [Automated migrations](#automated-migrations)
-      * [Manual cleanup](#manual-cleanup)
+    * [Post-upgrade: Manual steps](#post-upgrade-manual-steps)
+      * [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
+      * [Optional Cleanup](#optional-cleanup)
  * [From v0.8.1](#from-v081)
    * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
    * [Updated customizable template attributes](#updated-customizable-template-attributes)
    * [`migrations` S3 bucket](#migrations-s3-bucket)
 * [Related components and artifacts](#related-components-and-artifacts)
  * [Development](#development)
+<!-- TOC -->

 # Disclaimer

-With openDesk 1.0, we aim to offer hassle-free updates. Though some situations may require manual interaction, these are described in this document.
+With openDesk 1.0, we aim to offer hassle-free updates/upgrades.
+
+But openDesk requires a defined upgrade path that is described in the section [openDesk supported upgrade path](#opendesk-supported-upgrade-path).
+
+Some upgrades even require manual interaction, which are referenced in the aforementioned section and described further down this document.

 > **Known limitations:**<br>
 > We assume that the PV reclaim policy is set to `delete`, resulting in PVs getting deleted as soon as the related PVC was deleted; we will not address explicit deletion for PVs.

-# Releases upgrades
+# openDesk supported upgrade path
+
+When updating your openDesk installation you have to install the releases listed below in the sequential order from
+the lowest version number you are already on to the more current version you are looking to install.
+
+Explanation of the table's columns:
+- *Coming from*: Check the column for the release you are currently on.
+- *Mandatory release*: Defines which release(s) support the upgrade from your currently installed version.
+- *Automatic migration*: Summary of, or link to openDesk's automatic migration details.
+- *Manual activities*: Reference to required manual steps to upgrade your openDesk installation to the *Mandatory release*.
+
+| Coming from   | Mandatory (minimum) release | Automatic migration                                                                                                                                           | Manual activities             |
+| ------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
+| v0.9.0        | v1.x.x                      | [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_2.py) | See [From v0.9.0](#from-v090) |
+| v0.8.1        | v0.9.0                      | Initializes migration system                                                                                                                                  | See [From v0.8.1](#from-v081) |
+| not supported | v0.8.1                      | First release that supporting updates                                                                                                                         |                               |
+
+# Releases upgrade details
+
+## From v1.0.0
+
+### Pre-upgrade: Manual checks/steps
+
+#### Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`
+
+In v1.0.0 the files in [`/helmfile/environments/default`](../helmfile/environments/default/) had mixed extensions,
+we have streamlined them to consistently use `*.yaml.gotmpl`.
+
+This change requires manual action likely in two situations:
+
+1. You are referencing our upstream files from the aforementioned directory, e.g. in your Argo CD deployment. Please update your references to use the filenames with the new extension.
+2. You have custom files containing configuration information that are named just `*.yaml`: Please rename them to `*.yaml.gotmpl`.
+
+#### Helmfile Cleanup: Prefixing certain app directories with `opendesk-`
+
+To make it more obvious that some elements from below the [`apps`](../helmfile/apps/) directory are completely
+provided by openDesk, we have prefixed these app directories with `opendesk-`.
+
+Affected are the following directories, here listed directly with the new prefix:
+
+- [`./helmfile/apps/opendesk-migrations-pre`](../helmfile/apps/opendesk-migrations-pre)
+- [`./helmfile/apps/opendesk-migrations-post`](../helmfile/apps/opendesk-migrations-post)
+- [`./helmfile/apps/opendesk-openproject-bootstrap`](../helmfile/apps/opendesk-openproject-bootstrap)
+
+The described changes most likely require manual action in the following situation:
+
+- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+
+#### Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services
+
+In v1.0.0 there was a directory `/helmfile/apps/services` that was intended to contain all the services an operator had to provide externally for production deployments.
+
+As some services that are actually part of openDesk snuck in there, so we had to split the directory into two separate ones:
+
+- [`./helmfile/apps/opendesk-services`](../helmfile/apps/opendesk-services)
+- [`./helmfile/apps/services-external`](../helmfile/apps/services-external)
+
+The described changes most likely require manual action in the following situation:
+
+- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+
+#### Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names
+
+We have updated some attribute names around Open-Xchange / OX App Suite to be consistent within our Helmfile
+deployment and to aligning with the actual brand names as well as with our rule of thumb for brand based
+attribute names[^1].
+
+In case you are using any of the customizations below (`WAS`), please update as shown (`NOW`):
+
+```
+WAS: oxAppsuite: ...
+NOW: oxAppSuite: ...
+```
+
+```
+WAS: cache.oxAppsuite: ...
+NOW: cache.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuite: ...
+NOW: charts.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuiteBootstrap: ...
+NOW: charts.oxAppSuiteBootstrap: ...
+```
+
+```
+WAS: customization.release.openXchange: ...
+NOW: customization.release.openxchange: ...
+```
+
+```
+WAS: customization.release.opendeskOpenXchangeBootstrap: ...
+NOW: customization.release.opendeskOpenxchangeBootstrap: ...
+```
+
+```
+WAS: databases.oxAppsuite: ...
+NOW: databases.oxAppSuite: ...
+```
+
+```
+WAS: ingress.parameters.openXchangeAppSuite: ...
+NOW: ingress.parameters.oxAppSuite: ...
+```
+
+```
+WAS: ingress.bodyTimeout.openXchangeAppSuite: ...
+NOW: ingress.bodyTimeout.oxAppSuite: ...
+```
+
+```
+WAS: migration.oxAppsuite: ...
+NOW: migration.oxAppSuite: ...
+```
+
+```
+WAS: secrets.oxAppsuite: ...
+NOW: secrets.oxAppSuite: ...
+```
+
+#### Helmfile feature update: Dicts to define `customization.release`
+
+If you make use of the `customization.release` option, you have to switch to a dictionary based definition of customization files e.g. from
+
+```yaml
+customization:
+  release:
+    collaboraOnline: "./my_custom_templating.yaml.gotmpl"
+```
+
+to
+
+```yaml
+customization:
+  release:
+    collaboraOnline:
+      file1: "./my_custom_templating.yaml.gotmpl"
+```
+
+You can freely choose the `file1` dictionary key used in the example above, but it should start with a letter.
+
+#### openDesk defaults (new): Enforce login
+
+Users accessing the openDesk portal are now automatically redirected to the login screen as a default.
+
+In case you want to keep the previous behavior you need to set the following `functional` flag:
+
+```yaml
+functional:
+  portal:
+    enforceLogin: false
+```
+
+#### openDesk defaults (changed): Jitsi room history enabled
+
+The default to store the Jitsi room history in the local storage of a user's browser has changed.
+
+It is now enabled and therefore stored by default.
+
+To preserve the 1.0.0 behavior of not storing the room history you have to explicitly configure it:
+
+```yaml
+functional:
+  dataProtection:
+    jitsiRoomHistory:
+      enabled: false
+```
+
+#### External requirements: Redis 7.4
+
+The update from openDesk 1.0.0 contains Redis 7.4.1, like the other openDesk bundled services the bundled Redis is as well not meant to be used in production.
+
+Please ensure for the Redis you are using that it is updated to at least 7.4 to support the requirement of OX App Suite.

 ## From v0.9.0

-Before openDesk 1.0, we faced significant changes in some components and the overall platform configuration. Therefore, please review the
+### Pre-upgrade: Manual steps

-### Changed openDesk defaults
-
-#### Removal of unnecessary OX-Profiles in Nubus
+#### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus

 > **Warning**<br>
 > The upgrade will fail if you do not address this section for your current deployment.
@@ -66,7 +259,20 @@ You can review and update other accounts as follows:
    - "Login disabled" if the user should not use the Groupware module.
  - Update the user account with the green "SAVE" button at the top of the page.

-#### Matrix ID localpart update
+#### Configuration Cleanup: Updated `global.imagePullSecrets`
+
+Without using a custom registry, you can pull all the openDesk images without authentication.
+Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them.
+
+You can keep the current settings by setting the `external-registry` in your custom environment values:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "external-registry"
+```
+
+#### Changed openDesk defaults: Matrix ID

 Until 0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's Matrix ID. Due to restrictions on the
 Matrix protocol, an update of a Matrix ID is not possible; therefore, it was technically convenient to use the UUID
@@ -99,7 +305,7 @@ functional:
       useImmutableIdentifierForLocalpart: true
 ```

-#### File-share configurability
+#### Changed openDesk defaults: File-share configurability

 Now, we provide some configurability regarding the sharing capabilities of the Nextcloud component.

@@ -118,7 +324,7 @@ functional:
         activeByDefault: false
 ```

-#### Updated default subdomains in `global.hosts`
+#### Changed openDesk defaults: Updated default subdomains in `global.hosts`

 We have streamlined the subdomain names in openDesk to be more user-friendly and to avoid the use of specific
 product names.
@@ -174,20 +380,7 @@ In case you would like to update an existing deployment to the new hostnames, pl
  - In Nextcloud: *Administration* > *OpenProject* > *OpenProject server*
    - Update the *OpenProject host* to `projects.<your_domain>`

-#### Updated `global.imagePullSecrets`
-
-Without using a custom registry, you can pull all the openDesk images without authentication.
-Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them.
-
-You can keep the current settings by setting the `external-registry` in your custom environment values:
-
-```yaml
-global:
-  imagePullSecrets:
-    - "external-registry"
-```
-
-#### Dedicated group for access to the UDM REST API
+#### Changed openDesk defaults: Dedicated group for access to the UDM REST API

 Prerequisite: You allow the use of the [IAM's API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html)
 with the following settings:
@@ -216,7 +409,26 @@ The permissions required to execute the migrations can be found in the migration

 The actual actions are described as code comments in the related run module [`run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_2.py).

-#### Manual cleanup
+### Post-upgrade: Manual steps
+
+#### Configuration Improvement: Separate user permission for using Video Conference component
+
+With openDesk 1.0 the user permission for authenticated access to the Chat and Video Conference components was split into two separate permissions.
+
+Therefore the newly added *Video Conference* permission has to be added to users that should have continued access to the component.
+
+This can be done as IAM admin:
+- Open the *user* module.
+- Select all users that should get the permission for *Video Conference* using the select box left from the users entry.
+- In top bar of the user table click on *Edit*.
+- Select the *openDesk* section the the left-hand menu.
+- Check the check box for *Video Conference* and the directly below check box for *Overwrite*.
+- Click on the green *Save* button on top of the screen to apply the change.
+
+> **Hint**<br>
+> If you have a lot of users andd want to update (almost) all them, you can select all users by clicking the check box in the user's table header and then de-selecting the users you do not want to update.
+
+#### Optional Cleanup

 We do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the no longer used PVCs after a successful upgrade:

@@ -263,8 +475,11 @@ The status of the upgrade migrations is tracked in the ConfigMap `migrations-sta

 When a new upgrade migration is required, ensure to address the following list:

- Update the generated release version file [`global.generated.yaml`](../helmfile/environments/default/global.generated.yaml) at least on the patch level to test the upgrade in your feature branch and trigger it in the `develop` branch after the feature branch was merged. During the release process, the value is overwritten by the release's version number.
+- Update the generated release version file [`global.generated.yaml.gotmpl`](../helmfile/environments/default/global.generated.yaml.gotmpl) at least on the patch level to test the upgrade in your feature branch and trigger it in the `develop` branch after the feature branch was merged. During the release process, the value is overwritten by the release's version number.
 - You have to implement the migration logic as a runner script in the [`opendesk-migrations`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations) image. Please find more instructions in the linked repository.
 - You most likely have to update the [`opendesk-migrations` Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations) within the `rules` section of the [`role.yaml`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/templates/role.yaml) to provide the permissions required for the execution of your migration's logic.
 - You must set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
- Update the [`charts.yaml`](../helmfile/environments/default/charts.yaml) and [`images.yaml`](../helmfile/environments/default/images.yaml) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
+- Update the [`charts.yaml.gotmpl`](../helmfile/environments/default/charts.yaml.gotmpl) and [`images.yaml.gotmpl`](../helmfile/environments/default/images.yaml.gotmpl) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
+
+[^1]: We do not follow a brand name's specific spelling when it comes to upper and lower case and only use new word
+uppercase when names consist of multiple, space divided words.
--- a/docs/monitoring.md
+++ b/docs/monitoring.md
@@ -30,7 +30,7 @@ repository or Prometheus operator.
 # Defaults

 All configurable options and their defaults can be found in
-[`monitoring.yaml`](../helmfile/environments/default/monitoring.yaml).
+[`monitoring.yaml.gotmpl`](../helmfile/environments/default/monitoring.yaml.gotmpl).

 # Metrics

@@ -46,7 +46,10 @@ prometheus:

 # Alerts

-Some Helm charts provide a default set of prometheusRules for alerting; enable it by:
+openDesk ships with a set of Prometheus alerting rules that are specific to the operation of openDesk.
+Some of these are created by our partners while others are defined in [opendesk-alerts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts).
+
+All alert rules are deployed as [PrometheusRule](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PrometheusRule) and can be enabled like this:

 ```yaml
 prometheus:
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -2,6 +2,7 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Requirements</h1>

 This section covers the internal system requirements and external service requirements for productive use.
--- a/docs/scaling.md
+++ b/docs/scaling.md
@@ -5,18 +5,18 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Scaling</h1>

-This document should cover the ability to scale apps.
+This document covers the ability to scale applications.

 # Horizontal scalability

 We are working on generating this document automatically based on the file
-[`replicas.yaml`](../helmfile/environments/default/replicas.yaml) that contains necessary annotations.
+[`replicas.yaml.gotmpl`](../helmfile/environments/default/replicas.yaml.gotmpl) that contains necessary annotations.
 In the meantime, this file can be used to check the components scaling support/capabilities.

 # Upstream information

 While scaling services horizontally is the ideal solution, information about vertical scaling is helpful
-when defining the application's resources, see [`resources.yaml`](../helmfile/environments/default/resources.yaml) for references.
+when defining the application's resources, see [`resources.yaml.gotmpl`](../helmfile/environments/default/resources.yaml.gotmpl) for references.

 Please find below links to the application's upstream resources about scaling:

--- a/docs/security-context.md
+++ b/docs/security-context.md
@@ -2,8 +2,10 @@
 SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Kubernetes Security Context</h1>

+<!-- TOC -->
 * [Container Security Context](#container-security-context)
  * [allowPrivilegeEscalation](#allowprivilegeescalation)
  * [capabilities](#capabilities)
@@ -14,6 +16,7 @@ SPDX-License-Identifier: Apache-2.0
  * [readOnlyRootFilesystem](#readonlyrootfilesystem)
  * [runAsNonRoot](#runasnonroot)
 * [Status quo](#status-quo)
+<!-- TOC -->

 # Container Security Context

--- a/docs/theming.md
+++ b/docs/theming.md
@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Theming</h1>

-This document will cover the theming options for an openDesk deployment.
+This document covers the theming options for an openDesk deployment.

 <!-- TOC -->
 * [Settings](#settings)
--- a/docs/workflow.md
+++ b/docs/workflow.md
@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Technical development and release workflow</h1>

+<!-- TOC -->
 * [Scope](#scope)
 * [Roles and responsibilities](#roles-and-responsibilities)
 * [Deployment automation](#deployment-automation)
@@ -29,6 +30,7 @@ SPDX-License-Identifier: Apache-2.0
      * [Commit messages / Conventional Commits](#commit-messages--conventional-commits)
      * [Verified commits](#verified-commits)
 * [Footnotes](#footnotes)
+<!-- TOC -->

 # Scope

@@ -233,7 +235,7 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
 1. Linting
   - Blocking
     - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
-     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in [development.md](./development.md).
+     - openDesk specific: Especially `images.yaml.gotmpl` and `charts.yaml.gotmpl`, find more details in [development.md](./development.md).
   - Non-Blocking
     - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
     - Formal: Yaml
--- a/helmfile.yaml.gotmpl
+++ b/helmfile.yaml.gotmpl
@@ -22,7 +22,7 @@ helmfiles:
 #
 #   Use this format from a remote repository
 #
-#   - path: "git::https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git@helmfile_generic.yaml?ref=v0.7.1"
+#   - path: "git::https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git@helmfile_generic.yaml.gotmpl?ref=v0.7.1"
 #     values:
 #       - {{ toYaml .Values | nindent 8 }}
 # */}}
--- a/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
@@ -18,10 +18,12 @@ releases:
    version: "{{ .Values.charts.collabora.version }}"
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.collaboraOnline | default "additionalValues: false" }}
+      {{ range .Values.customization.release.collaboraOnline }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.collabora.enabled }}

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "collabora"
 ...
--- a/helmfile/apps/collabora/values.yaml.gotmpl
+++ b/helmfile/apps/collabora/values.yaml.gotmpl
@@ -22,14 +22,6 @@ collabora:

 fullnameOverride: "collabora"

-grafana:
-  dashboards:
-    enabled: {{ .Values.monitoring.grafana.dashboards.enabled }}
-    labels:
-      {{ .Values.monitoring.grafana.dashboards.labels | toYaml | nindent 6 }}
-    annotations:
-      {{ .Values.monitoring.grafana.dashboards.annotations | toYaml | nindent 6 }}
-
 image:
  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
  tag: {{ .Values.images.collabora.tag | quote }}
@@ -78,6 +70,9 @@ ingress:
      acl admin_url path_beg /cool/adminws/
      acl admin_url path_beg /browser/dist/admin/admin.html
      http-request deny if admin_url
+   {{- with .Values.annotations.collabora.ingress }}
+   {{ . | toYaml | nindent 4 }}
+   {{- end }}
  enabled: {{ .Values.ingress.enabled }}
  className: {{ .Values.ingress.ingressClassName | quote }}
  hosts:
@@ -90,7 +85,8 @@ ingress:
      hosts:
        - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"

-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.collabora.pod | toYaml | nindent 2 }}

 podSecurityContext:
  fsGroup: 100
--- a/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
@@ -18,10 +18,12 @@ releases:
    version: "{{ .Values.charts.cryptpad.version }}"
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.cryptpad | default "additionalValues: false" }}
+      {{ range .Values.customization.release.cryptpad }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.cryptpad.enabled }}

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "cryptpad"
 ...
--- a/helmfile/apps/cryptpad/values.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/values.yaml.gotmpl
@@ -39,6 +39,9 @@ ingress:
  enabled: {{ .Values.ingress.enabled }}
  annotations:
    nginx.org/websocket-services: "cryptpad"
+   {{- with .Values.annotations.cryptpad.ingress }}
+   {{ . | toYaml | nindent 4 }}
+   {{- end }}
  className: {{ .Values.ingress.ingressClassName | quote }}
  hosts:
    - host: "{{ .Values.global.hosts.cryptpad }}.{{ .Values.global.domain }}"
@@ -53,7 +56,8 @@ ingress:
 persistence:
  enabled: false

-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.jitsiKeycloakAdapter.pod | toYaml | nindent 2 }}

 podSecurityContext:
  fsGroup: 4001
--- a/helmfile/apps/element/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/element/helmfile-child.yaml.gotmpl
@@ -32,7 +32,6 @@ repositories:
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
-
  - name: "synapse-create-account-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseCreateAccount.verify }}
@@ -79,13 +78,54 @@ repositories:
    oci: true
    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"

+  # openDesk Enterprise Repositories
+
+  # openDesk Element
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
+  - name: "synapse-admin-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseAdmin.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
+  - name: "synapse-adminbot-web-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseAdminbotWeb.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
+  - name: "synapse-groupsync-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseGroupsync.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
+  - name: "synapse-pipe-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapsePipe.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
+
 releases:
+  # During upgrade 1.0.0 -> 1.1.0 the chart 'opendesk-element' has been moved to 'opendesk-element-web'
  - name: "opendesk-element"
    chart: "element-repo/{{ .Values.charts.element.name }}"
    version: "{{ .Values.charts.element.version }}"
+    installed: false
+
+  - name: "opendesk-element-web"
+    chart: "element-repo/{{ .Values.charts.elementWeb.name }}"
+    version: "{{ .Values.charts.elementWeb.version }}"
    values:
      - "values-element.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskElement | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskElement }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -94,7 +134,9 @@ releases:
    version: "{{ .Values.charts.elementWellKnown.version }}"
    values:
      - "values-well-known.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskWellKnown | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskWellKnown }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -103,7 +145,9 @@ releases:
    version: "{{ .Values.charts.synapseWeb.version }}"
    values:
      - "values-synapse-web.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskSynapseWeb | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskSynapseWeb }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -112,7 +156,9 @@ releases:
    version: "{{ .Values.charts.synapse.version }}"
    values:
      - "values-synapse.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskSynapse | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskSynapse }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -172,7 +218,78 @@ releases:
    installed: {{ .Values.element.enabled }}
    timeout: 900

+  # openDesk Enterprise Releases
+  - name: "opendesk-synapse-admin"
+    chart: "synapse-admin-repo/{{ .Values.charts.synapseAdmin.name }}"
+    version: "{{ .Values.charts.synapseAdmin.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdmin }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-pipe"
+    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
+    version: "{{ .Values.charts.synapsePipe.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdminbotPipe }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-web"
+    chart: "synapse-adminbot-web-repo/{{ .Values.charts.synapseAdminbotWeb.name }}"
+    version: "{{ .Values.charts.synapseAdminbotWeb.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdminbotWeb }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-auditbot-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-auditbot-pipe"
+    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
+    version: "{{ .Values.charts.synapsePipe.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAuditbotPipe }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-groupsync"
+    chart: "synapse-groupsync-repo/{{ .Values.charts.synapseGroupsync.name }}"
+    version: "{{ .Values.charts.synapseGroupsync.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseGroupsync }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementGroupsync.enabled }}
+    timeout: 900
+
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "element"
 ...
--- a/helmfile/apps/element/values-element.yaml.gotmpl
+++ b/helmfile/apps/element/values-element.yaml.gotmpl
@@ -136,8 +136,11 @@ ingress:
  tls:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.element.ingress | toYaml | nindent 4 }}

-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.element.pod | toYaml | nindent 2 }}

 podSecurityContext:
  enabled: true
@@ -148,6 +151,14 @@ replicaCount: {{ .Values.replicas.element }}
 resources:
  {{ .Values.resources.element | toYaml | nindent 2 }}

+service:
+  annotations:
+    {{ .Values.annotations.element.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.element.serviceAccount | toYaml | nindent 4 }}
+
 theme:
  {{ .Values.theme | toYaml | nindent 2 }}

--- a/helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl
@@ -54,4 +54,7 @@ resources:
 theme:
  {{ .Values.theme | toYaml | nindent 2 }}

+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...
--- a/helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl
@@ -54,4 +54,7 @@ theme:
 resources:
  {{ .Values.resources.matrixNeoChoiceWidget | toYaml | nindent 2 }}

+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...
--- a/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
@@ -47,6 +47,22 @@ extraEnvVars:
      secretKeyRef:
        name: "matrix-neodatefix-bot-account"
        key: "access_token"
+{{- if .Values.certificate.selfSigned }}
+  - name: "NODE_EXTRA_CA_CERTS"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}

 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
--- a/helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl
@@ -59,4 +59,7 @@ resources:
 theme:
  {{ .Values.theme | toYaml | nindent 2 }}

+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...
--- a/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
@@ -42,7 +42,8 @@ image:
  repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
  tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}

-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.matrixUserVerificationService.pod | toYaml | nindent 2 }}

 podSecurityContext:
  enabled: true
@@ -53,4 +54,12 @@ replicaCount: {{ .Values.replicas.matrixUserVerificationService }}
 resources:
  {{ .Values.resources.matrixUserVerificationService | toYaml | nindent 2 }}

+service:
+  annotations:
+    {{ .Values.annotations.matrixUserVerificationService.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.matrixUserVerificationService.serviceAccount | toYaml | nindent 4 }}
+
 ...
--- a/helmfile/apps/element/values-synapse-web.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-web.yaml.gotmpl
@@ -44,6 +44,9 @@ ingress:
    nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.element }}"
    nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}s"
    nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}s"
+    {{- with .Values.annotations.synapseWeb.ingress }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  host: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
  enabled: {{ .Values.ingress.enabled }}
  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -51,7 +54,8 @@ ingress:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}

-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.synapseWeb.pod | toYaml | nindent 2 }}

 podSecurityContext:
  enabled: true
@@ -62,4 +66,12 @@ replicaCount: {{ .Values.replicas.synapseWeb }}
 resources:
  {{ .Values.resources.synapseWeb | toYaml | nindent 2 }}

+service:
+  annotations:
+    {{ .Values.annotations.synapseWeb.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.synapseWeb.serviceAccount | toYaml | nindent 4 }}
+
 ...
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -27,9 +27,26 @@ configuration:

  database:
    host: {{ .Values.databases.synapse.host | quote }}
+    port: {{ .Values.databases.synapse.port }}
    name: {{ .Values.databases.synapse.name | quote }}
    user: {{ .Values.databases.synapse.username | quote }}
-    password: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    password:
+      value: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    requireAuth: {{ .Values.databases.synapse.requireAuth }}
+    channelBinding: {{ .Values.databases.synapse.channelBinding | quote }}
+    connectTimeout: {{ .Values.databases.synapse.connectTimeout }}
+    clientEncoding: {{ .Values.databases.synapse.clientEncoding | quote }}
+    keepalives: {{ .Values.databases.synapse.keepalives }}
+    keepalivesIdle: {{ .Values.databases.synapse.keepalivesIdle }}
+    keepalivesInterval: {{ .Values.databases.synapse.keepalivesInterval }}
+    keepalivesCount: {{ .Values.databases.synapse.keepalivesCount }}
+    replication: {{ .Values.databases.synapse.replication }}
+    gssencmode: {{ .Values.databases.synapse.gssencmode | quote }}
+    sslmode: {{ .Values.databases.synapse.sslmode | quote }}
+    sslcompression: {{ .Values.databases.synapse.sslcompression }}
+    sslMinProtocolVersion: {{ .Values.databases.synapse.sslMinProtocolVersion | quote }}
+    connectionPoolMin: {{ .Values.databases.synapse.connectionPoolMin }}
+    connectionPoolMax: {{ .Values.databases.synapse.connectionPoolMax }}

  homeserver:
    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
@@ -43,8 +60,8 @@ configuration:
              regex: "@.*"
        url: null
        sender_localpart: intercom-service
-      - as_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
-        hs_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+      - as_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
        id: ox-appsuite
        namespaces:
          users:
@@ -114,6 +131,27 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.synapse | toYaml | nindent 4 }}

+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "REQUESTS_CA_BUNDLE"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  - name: "SSL_CERT_FILE"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  - name: "SSL_CERT_DIR"
+    value: "/etc/ssl/certs"
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 federation:
  enabled: {{ .Values.functional.externalServices.matrix.federation.enabled }}
  ingress:
@@ -123,6 +161,8 @@ federation:
    tls:
      enabled: {{ .Values.ingress.tls.enabled }}
      secretName: {{ .Values.ingress.tls.secretName | quote }}
+    annotations:
+      {{ .Values.annotations.synapse.ingress | toYaml | nindent 6 }}

 global:
  domain: {{ .Values.global.domain | quote }}
@@ -141,7 +181,8 @@ persistence:
  size: {{ .Values.persistence.size.synapse | quote }}
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.synapse.pod | toYaml | nindent 2 }}

 podSecurityContext:
  enabled: true
@@ -156,6 +197,14 @@ replicaCount: {{ .Values.replicas.synapse }}
 resources:
  {{ .Values.resources.synapse | toYaml | nindent 2 }}

+service:
+  annotations:
+    {{ .Values.annotations.synapse.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.synapse.serviceAccount | toYaml | nindent 4 }}
+
 tls:
  secretName: {{ if .Values.global.matrixDomain }}"opendesk-certificates-synapse-tls"{{ else }}"opendesk-certificates-tls"{{ end }}
 ...
--- a/helmfile/apps/element/values-well-known.yaml.gotmpl
+++ b/helmfile/apps/element/values-well-known.yaml.gotmpl
@@ -44,8 +44,11 @@ ingress:
  tls:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.elementWellKnown.ingress | toYaml | nindent 4 }}

-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementWellKnown.pod | toYaml | nindent 2 }}

 podSecurityContext:
  enabled: true
@@ -56,4 +59,11 @@ replicaCount: {{ .Values.replicas.wellKnown }}
 resources:
  {{ .Values.resources.wellKnown | toYaml | nindent 2 }}

+service:
+  annotations:
+    {{ .Values.annotations.elementWellKnown.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementWellKnown.serviceAccount | toYaml | nindent 4 }}
 ...
--- a/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
@@ -18,11 +18,13 @@ releases:
    version: "{{ .Values.charts.jitsi.version }}"
    values:
      - "values-jitsi.yaml.gotmpl"
-      - {{ .Values.customization.release.jitsi | default "additionalValues: false" }}
+      {{ range .Values.customization.release.jitsi }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.jitsi.enabled }}
    timeout: 900

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "jitsi"
 ...
--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -28,6 +28,25 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.jitsiKeycloakAdapter | toYaml | nindent 4 }}

+
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "DENO_CERT"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}

@@ -38,7 +57,8 @@ image:
  tag: {{ .Values.images.jitsiKeycloakAdapter.tag | quote }}

 settings:
-  jwtAppSecret: {{ .Values.secrets.jitsi.jwtAppSecret | quote }}
+  jwtAppSecret:
+    value: {{ .Values.secrets.jitsi.jwtAppSecret | quote }}
  keycloakRealm: {{ .Values.platform.realm | quote }}
  keycloakClientId: "opendesk-jitsi"

@@ -55,6 +75,10 @@ jitsi:
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    ingress:
      enabled: {{ .Values.ingress.enabled }}
+      annotations:
+        {{- with .Values.annotations.jitsi.ingress }}
+        {{ . | toYaml | nindent 8 }}
+        {{- end }}
      ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
      hosts:
        - host: "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
@@ -82,6 +106,8 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.jitsi.pod | toYaml | nindent 6 }}
  prosody:
    image:
      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
@@ -131,6 +157,8 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.prosody | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.prosody.pod | toYaml | nindent 6 }}
  jicofo:
    replicaCount: {{ .Values.replicas.jicofo }}
    image:
@@ -154,8 +182,14 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.jicofo.pod | toYaml | nindent 6 }}
  jvb:
    replicaCount: {{ .Values.replicas.jvb }}
+    # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
+    # upstream charts v1.4.0 a value for `publicIPs` is required. We set a dummy value as we anyway update it
+    # later with the `patchJVB` job.
+    publicIPs: [ 0.0.0.0 ]
    image:
      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
      tag: {{ .Values.images.jvb.tag | quote }}
@@ -178,6 +212,8 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jvb | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.jvb.pod | toYaml | nindent 6 }}
  jibri:
    replicaCount: {{ .Values.replicas.jibri }}
    image:
@@ -194,10 +230,16 @@ jitsi:
      # Chart does not allow to template more
      capabilities:
        add: ["SYS_ADMIN"]
+    podAnnotations:
+      {{ .Values.annotations.jibri.pod | toYaml | nindent 6 }}
  imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
    - name: {{ . | quote }}
  {{- end }}
+  serviceAccount:
+    annotations:
+      {{ .Values.annotations.jitsi.serviceAccount | toYaml | nindent 6 }}
+

 patchJVB:
  configuration:
@@ -224,10 +266,15 @@ patchJVB:
    repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
    tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}

-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.cryptpad.pod | toYaml | nindent 2 }}

 replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}

 resources:
  {{ .Values.resources.jitsiKeycloakAdapter | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.jitsiPatchJVB.serviceAccount | toYaml | nindent 4 }}
 ...
--- a/helmfile/apps/migrations-post/values.yaml.gotmpl
+++ b/helmfile/apps/migrations-post/values.yaml.gotmpl
@@ -1,10 +0,0 @@
-{{/*
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-SPDX-License-Identifier: Apache-2.0
-*/}}
---
-podAnnotations: {}
-
-migrations:
-  stage: "POST"
-...
--- a/helmfile/apps/migrations-pre/values.yaml.gotmpl
+++ b/helmfile/apps/migrations-pre/values.yaml.gotmpl
@@ -1,10 +0,0 @@
-{{/*
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-SPDX-License-Identifier: Apache-2.0
-*/}}
---
-podAnnotations: {}
-
-migrations:
-  stage: "PRE"
-...
--- a/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
@@ -25,7 +25,9 @@ releases:
    version: "{{ .Values.charts.nextcloudManagement.version }}"
    values:
      - "values-nextcloud-mgmt.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskNextcloudManagement | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskNextcloudManagement }}
+      - {{ . }}
+      {{ end }}
    waitForJobs: true
    wait: true
    installed: {{ .Values.nextcloud.enabled }}
@@ -35,12 +37,14 @@ releases:
    version: "{{ .Values.charts.nextcloud.version }}"
    values:
      - "values-nextcloud.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskNextcloud | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskNextcloud }}
+      - {{ . }}
+      {{ end }}
    needs:
      - "opendesk-nextcloud-management"
    installed: {{ .Values.nextcloud.enabled }}

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "nextcloud"
 ...
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -12,40 +13,57 @@ global:

 additionalAnnotations:
  intents.otterize.com/service-name: "opendesk-nextcloud-php"
+  {{- with .Values.annotations.nextcloudManagement.all }}
+  {{ . | toYaml | nindent 2}}
+  {{- end }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.nextcloudManagement.serviceAccount | toYaml | nindent 4 }}

 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}

 configuration:
  administrator:
+    # The admin user is (currently) required to bootstrap the OpenProject <> Nextcloud integration.
+    enabled: true
    username:
      value: "nextcloud"
    password:
      value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
  antivirus:
+    {{- if .Values.antivirus.icap.host }}
+    host: {{ .Values.antivirus.icap.host | quote }}
+    port: {{ .Values.antivirus.icap.port | quote }}
+    {{- else }}
    {{- if .Values.clamavDistributed.enabled }}
    host: "clamav-icap"
    {{- else if .Values.clamavSimple.enabled }}
    host: "clamav-simple"
    {{- end }}
+    port: 1344
+    {{- end }}
  cache:
    auth:
      enabled: true
      username:
-        value: "default"
+        value: {{ .Values.cache.nextcloud.username }}
      password:
        value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
    host: {{ .Values.cache.nextcloud.host | quote }}
    port: {{ .Values.cache.nextcloud.port | quote }}
+    tls: {{ .Values.cache.nextcloud.tls }}
  collabora:
    # internalWopiUrl: ""
    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
  database:
    host: {{ .Values.databases.nextcloud.host | quote }}
    port: {{ .Values.databases.nextcloud.port | quote }}
+    name: {{ .Values.databases.nextcloud.name | quote }}
    auth:
      username:
-        value: "nextcloud_user"
+        value: {{ .Values.databases.nextcloud.username | quote }}
      password:
        value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
  ldap:
@@ -88,6 +106,7 @@ configuration:
    defaultExternalExpireEnabled: {{ .Values.functional.filestore.sharing.external.expiry.activeByDefault }}
    defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
    defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
+    sendPasswordMail: {{ .Values.functional.filestore.sharing.external.sendPasswordMail | quote }}
  smtp:
    auth:
      enabled: false
@@ -130,6 +149,24 @@ podSecurityContext:

 debug:
  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
+  bootstrap: {{ .Values.debug.enabled }}
+
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "FS_IMPORT_CA_CERTIFICATES"
+    value: "true"
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}

 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -10,6 +11,7 @@ global:
 exporter:
  enabled: true
  configuration:
+    server: "http://opendesk-nextcloud-aio"
    token:
      value: {{ .Values.secrets.nextcloud.metricsToken | quote }}
  containerSecurityContext:
@@ -49,25 +51,35 @@ exporter:
 aio:
  additionalAnnotations:
    intents.otterize.com/service-name: "opendesk-nextcloud"
+    {{- with .Values.annotations.nextcloud.all }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
+
+  serviceAccount:
+    annotations:
+      {{ .Values.annotations.nextcloud.serviceAccount | toYaml | nindent 6 }}
+
  configuration:
    cache:
      auth:
        enabled: true
        username:
-          value: "default"
+          value: {{ .Values.cache.nextcloud.username }}
        password:
          value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
      host: {{ .Values.cache.nextcloud.host | quote }}
      port: {{ .Values.cache.nextcloud.port | quote }}
+      tls: {{ .Values.cache.nextcloud.tls }}
    database:
      host: {{ .Values.databases.nextcloud.host | quote }}
      port: {{ .Values.databases.nextcloud.port | quote }}
+      name: {{ .Values.databases.nextcloud.name | quote }}
      auth:
        username:
-          value: "nextcloud_user"
+          value: {{ .Values.databases.nextcloud.username | quote }}
        password:
          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
-    trustedProxies: {{ join " " .Values.cluster.networking.cidr | quote }}
+    trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
@@ -87,6 +99,24 @@ aio:
    successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
  debug:
    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
+  {{- if .Values.certificate.selfSigned }}
+  extraEnvVars:
+    - name: "FS_IMPORT_CA_CERTIFICATES"
+      value: "true"
+  {{- end }}
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+  extraVolumeMounts:
+    - name: "trusted-cert-secret-volume"
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+  {{- end }}
  image:
    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
    repository: {{ .Values.images.nextcloud.repository | quote }}
@@ -101,11 +131,15 @@ aio:
      nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.nextcloud }}"
      nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}s"
      nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}s"
+      {{- with .Values.annotations.nextcloud.ingress }}
+        {{ . | toYaml | nindent 8 }}
+      {{- end }}
    ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
    host: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
    tls:
      secretName: {{ .Values.ingress.tls.secretName | quote }}
-  podAnnotations: {}
+  podAnnotations:
+    {{ .Values.annotations.nextcloud.podAnnotations | toYaml | nindent 6 }}
  podSecurityContext:
    fsGroup: 101
  prometheus:
--- a/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
@@ -28,6 +28,14 @@ repositories:
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+  # NGINX S3 Gateway Chart
+  - name: "nginx-s3-gateway-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.nginxS3Gateway.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"

 releases:
  # Univention Management Stack Umbrella Chart
@@ -38,7 +46,9 @@ releases:
      - "values-nubus.yaml.gotmpl"
      - "values-opendesk-customization.yaml.gotmpl"
      - "values-opendesk-images.yaml.gotmpl"
-      - {{ .Values.customization.release.ums | default "additionalValues: false" }}
+      {{ range .Values.customization.release.ums }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.nubus.enabled }}
    timeout: 900
  # Intercom-Service
@@ -47,7 +57,9 @@ releases:
    version: "{{ .Values.charts.intercomService.version }}"
    values:
      - "values-intercom-service.yaml.gotmpl"
-      - {{ .Values.customization.release.intercomService | default "additionalValues: false" }}
+      {{ range .Values.customization.release.intercomService }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.nubus.enabled }}

  # openDesk Keycloak Bootstrap Chart
@@ -56,13 +68,27 @@ releases:
    version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
    values:
      - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskKeycloakBootstrap | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskKeycloakBootstrap }}
+      - {{ . }}
+      {{ end }}
    needs:
      - "ums"
    installed: {{ .Values.nubus.enabled }}
    timeout: 900

+  # NGINX S3 Gateway (when cluster minio is not used)
+  - name: "nubus"
+    chart: "nginx-s3-gateway-repo/{{ .Values.charts.nginxS3Gateway.name }}"
+    version: "{{ .Values.charts.nginxS3Gateway.version }}"
+    values:
+      - "values-nginx-s3-gateway.yaml.gotmpl"
+      {{ range .Values.customization.release.nginxS3Gateway }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ not .Values.minio.enabled }}
+    timeout: 900
+
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "nubus"
 ...
--- a/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
@@ -20,6 +20,28 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.intercom | toYaml | nindent 4 }}

+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
+extraEnvVars:
+  - name: "REDIS_USER"
+    value: {{ .Values.cache.intercomService.username }}
+  {{- if .Values.certificate.selfSigned }}
+  - name: "NODE_EXTRA_CA_CERTS"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  {{- end }}
+
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
--- a/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
@@ -0,0 +1,39 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nginxS3Gateway.registry | quote }}
+  repository: {{ .Values.images.nginxS3Gateway.repository | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  tag: {{ .Values.images.nginxS3Gateway.tag | quote }}
+
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+  host: "{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: "/portal-assets/icons/$2/$3"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+  path: "/univention/(portal|selfservice)/icons/(logos|entries)/(.*)$"
+  tls:
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+configuration:
+  bucket: {{ .Values.objectstores.nubus.bucket | quote }}
+  endpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+  port: 443
+  region: {{ .Values.objectstores.nubus.region | quote }}
+  style: "path"
+  credentials:
+    accessKey:
+      value: {{ .Values.objectstores.nubus.username | quote }}
+    secretKey:
+      value: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+
+resources:
+  {{ .Values.resources.nginxS3Gateway | toYaml | nindent 2 }}
+
+replicaCount: {{ .Values.replicas.nginxS3Gateway }}
+...
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -8,6 +8,9 @@ global:
  ldap:
    baseDn: {{ .Values.ldap.baseDn | quote }}
    domainName: {{ .Values.global.domain | quote }}
+    auth:
+      cnAdmin:
+        password: {{ .Values.secrets.nubus.ldapSecret | quote }}
  domain: {{ .Values.global.domain | quote }}
  subDomains:
    portal: {{ .Values.global.hosts.nubus | quote }}
@@ -23,36 +26,6 @@ global:
      host: "minio"
      port: "9000"
      protocol: "http"
-  credentialOverride:
-    ldapServer:
-      adminPassword: {{ .Values.secrets.nubus.ldapSecret | quote}}
-    defaultUsers:
-      defaultAdminPassword: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote}}
-      defaultUserPassword: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote}}
-      defaultAdministratorPassword: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote}}
-    portalConsumer:
-      minio:
-        accessKey: {{ .Values.objectstores.nubus.username | quote }}
-        secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
-      provisioningApi:
-        password: {{ .Values.secrets.nubus.portalConsumer.provisioningApiPassword | quote}}
-    provisioning:
-      api:
-        adminPassword: {{ .Values.secrets.nubus.provisioning.api.adminPassword | quote}}
-        natsPassword: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
-        prefillPassword: {{ .Values.secrets.nubus.provisioning.api.prefillPassword | quote}}
-        udmTransformerPassword: {{ .Values.secrets.nubus.provisioning.api.udmTransformerPassword | quote}}
-      dispatcher:
-        natsPassword: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
-      nats:
-        adminPassword: {{ .Values.secrets.nats.natsAdminPassword | quote}}
-      prefill:
-        natsPassword: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
-      udmTransformer:
-        natsPassword: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
-    selfserviceConsumer:
-      provisioningApi:
-        password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}

  # -- Extensions to load. Add entries to load additional extensions into Nubus.
  extensions:
@@ -144,6 +117,10 @@ global:
            groups: __DELETE_KEY__

 ingress:
+  # temporary fix
+  {{- if not .Values.minio.enabled }}
+  enabled: false
+  {{- end }}
  certManager:
    enabled: false
  tls:
@@ -161,12 +138,42 @@ minio:

 # Nubus services which use customer supplied services
 keycloak:
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-crt-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+    - name: "trusted-cert-jks-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "truststore.jks"
+            path: "truststore.jks"
+  extraVolumeMounts:
+    - name: "trusted-cert-crt-secret-volume"
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+    - name: "trusted-cert-jks-secret-volume"
+      mountPath: "/etc/ssl/certs/truststore.jks"
+      subPath: "truststore.jks"
+  extraEnvVars:
+    - name: "KC_HTTPS_TRUST_STORE_FILE"
+      value: "/etc/ssl/certs/truststore.jks"
+    - name: "KC_HTTPS_TRUST_STORE_PASSWORD"
+      value: {{ .Values.secrets.certificates.password | quote }}
+    - name: "KC_HTTPS_TRUST_STORE_TYPE"
+      value: "jks"
+  {{- end }}
  keycloak:
    auth:
      username: "kcadmin"
-      credentialSecret:
+      existingSecret:
        name: "ums-opendesk-keycloak-credentials"
-        key: "admin_password"
+        keyMapping:
+          adminPassword: "admin_password"
  postgresql:
    connection:
      host: {{ .Values.databases.keycloak.host | quote }}
@@ -174,11 +181,13 @@ keycloak:
    auth:
      username: {{ .Values.databases.keycloak.username | quote }}
      database: {{ .Values.databases.keycloak.name | quote }}
-      credentialSecret:
+      existingSecret:
        name: "ums-keycloak-postgresql-opendesk-credentials"
-        key: "keycloakDatabasePassword"
+        keyMapping:
+          password: keycloakDatabasePassword
  config:
    exposeAdminConsole: {{ .Values.debug.enabled }}
+    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}

 nubusGuardian:
  provisioning:
@@ -223,7 +232,8 @@ nubusNotificationsApi:
    auth:
      username: {{ .Values.databases.umsNotificationsApi.username | quote }}
      database: {{ .Values.databases.umsNotificationsApi.name | quote }}
-      existingSecret: "ums-notifications-api-postgresql-opendesk-credentials"
+      existingSecret:
+        name: "ums-notifications-api-postgresql-opendesk-credentials"
  ingress:
    certManager:
      enabled: false
@@ -243,9 +253,10 @@ nubusKeycloakExtensions:
  keycloak:
    auth:
      username: "kcadmin"
-      credentialSecret:
+      existingSecret:
        name: "ums-opendesk-keycloak-credentials"
-        key: "admin_password"
+        keyMapping:
+          adminPassword: "admin_password"
  proxy:
    ingress:
      paths:
@@ -267,7 +278,6 @@ nubusKeycloakExtensions:
        enabled: {{ .Values.ingress.tls.enabled }}
        secretName: {{ .Values.ingress.tls.secretName | quote }}

-
  postgresql:
    connection:
      host: {{ .Values.databases.keycloakExtension.host | quote }}
@@ -275,9 +285,10 @@ nubusKeycloakExtensions:
    auth:
      database: {{ .Values.databases.keycloakExtension.name | quote }}
      username: {{ .Values.databases.keycloakExtension.username | quote }}
-      credentialSecret:
+      existingSecret:
        name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
-        key: "umcKeycloakExtensionsDatabasePassword"
+        keyMapping:
+          password: "umcKeycloakExtensionsDatabasePassword"
  smtp:
    connection:
      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
@@ -287,9 +298,10 @@ nubusKeycloakExtensions:
    auth:
      enabled: false
      username: ""
-      credentialSecret:
+      existingSecret:
        name: "ums-keycloak-extensions-smtp-opendesk-credentials"
-        key: "umcKeycloakExtensionsSmtpPassword"
+        keyMapping:
+          password: "umcKeycloakExtensionsSmtpPassword"
  handler:
    appConfig:
      logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
@@ -303,15 +315,28 @@ nubusPortalConsumer:
  enabled: true
  portalConsumer:
    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
-    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
  provisioningApi:
    auth:
      username: "portal-consumer"
+      password: {{ .Values.secrets.nubus.portalConsumer.provisioningApiPassword | quote }}
+      # TODO: Workaround for a small bug introduced during the secrets refactoring.
+      # The fix will be part of a future Nubus release and the two lines can then be deleted.
+      existingSecret:
+        name: "ums-portal-consumer-credentials"
+  objectStorage:
+    auth:
+      accessKey: {{ .Values.objectstores.nubus.username | quote }}
+      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}

 nubusPortalServer:
+  objectStorage:
+    auth:
+      accessKey: {{ .Values.objectstores.nubus.username | quote }}
+      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
  portalServer:
-    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
    objectStorageCredentialSecret:
      name: "ums-portal-server-minio-opendesk-credentials"
@@ -337,6 +362,43 @@ nubusUdmRestApi:

 nubusProvisioning:
  enabled: true
+  ldap:
+    auth:
+      password: {{ .Values.secrets.nubus.ldapSecret | quote }}
+  nats:
+    auth:
+      adminPassword: {{ .Values.secrets.nats.natsAdminPassword | quote }}
+  api:
+    auth:
+      adminPassword: {{ .Values.secrets.nubus.provisioning.api.adminPassword | quote }}
+      prefillPassword: {{ .Values.secrets.nubus.provisioning.api.prefillPassword | quote}}
+      udmTransformerPassword: {{ .Values.secrets.nubus.provisioning.api.udmTransformerPassword | quote}}
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
+
+  dispatcher:
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
+
+  prefill:
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
+
+  udmTransformer:
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
+
+  registerConsumers:
+    createUsers:
+      oxConsumer:
+        existingSecret:
+          name: ums-provisioning-ox-credentials
+          keyMapping:
+            password: "ox-connector.json"

 nubusUdmListener:
  enabled: true
@@ -346,6 +408,9 @@ nubusSelfServiceListener:

 nubusSelfServiceConsumer:
  enabled: true
+  provisioningApi:
+    auth:
+      password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}

 # Nubus services
 nubusStackDataUms:
@@ -365,8 +430,10 @@ nubusStackDataUms:
    smtpStartTls: false
    ldapBase: {{ .Values.ldap.baseDn }}
  templateContext:
-    # creates the default.user and default.admin
-    loadDevData: true
+    initialPasswordDefaultAdmin: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote }}
+    initialPasswordDefaultUser: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote }}
+    initialPasswordAdministrator: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote }}
+    portalEnforceLogin: {{ .Values.functional.portal.enforceLogin }}
    portalHeaderLogo: {{ toYaml .Values.theme.imagery.logoHeaderSvgB64 | quote }}
    portalTiles: {{ toYaml .Values.theme.imagery.portalTiles | nindent 6 }}
    portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }}
@@ -431,18 +498,20 @@ nubusUmcServer:
    auth:
      username: {{ .Values.databases.umsSelfservice.username | quote }}
      database: {{ .Values.databases.umsSelfservice.name | quote }}
-      credentialSecret:
+      existingSecret:
        name: "ums-umc-server-postgresql-opendesk-credentials"
-        key: "umcServerDatabasePassword"
+        keyMapping:
+          password: "umcServerDatabasePassword"
  memcached:
    bundled: false
    server: {{ .Values.cache.umsSelfservice.host | quote }}
    auth:
-      credentialSecret:
+      existingSecret:
        name: "ums-umc-server-memcached-opendesk-credentials"
-        key: "umcServerMemcachedPassword"
+        keyMapping:
+          memcached-password: "umcServerMemcachedPassword"
  smtp:
-    credentialSecret:
+    existingSecret:
      name: "ums-umc-server-smtp-credentials-custom"
  ingress:
    certManager:
@@ -467,9 +536,8 @@ nubusKeycloakBootstrap:
  keycloak:
    auth:
      username: "kcadmin"
-      credentialSecret:
+      existingSecret:
        name: "ums-opendesk-keycloak-credentials"
-        key: "admin_password"
  bootstrap:
    ldapMappers:
      - ldapAndUserModelAttributeName: "opendeskProjectmanagementAdmin"
@@ -480,7 +548,7 @@ nubusKeycloakBootstrap:
  ldap:
    auth:
      bindDn: {{ printf "uid=ldapsearch_keycloak,cn=users,%s" .Values.ldap.baseDn }}
-      credentialSecret:
+      existingSecret:
        name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"

 # Credential secrets for accessing customer supplied services
@@ -525,3 +593,6 @@ extraSecrets:
  - name: "ums-umc-server-smtp-credentials-custom"
    stringData:
      password: ""
+  - name: "ums-provisioning-ox-credentials"
+    stringData:
+      ox-connector.json: "{ \"name\": \"ox-connector\", \"realms_topics\": [{\"realm\": \"udm\", \"topic\": \"oxmail/oxcontext\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/accessprofile\"}, {\"realm\": \"udm\", \"topic\": \"users/user\"}, {\"realm\": \"udm\", \"topic\": \"oxresources/oxresources\"}, {\"realm\": \"udm\", \"topic\": \"groups/group\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/functional_account\"}], \"request_prefill\": true, \"password\": \"{{ .Values.secrets.oxConnector.provisioningApiPassword }}\" }"
--- a/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
@@ -5,6 +5,8 @@ SPDX-License-Identifier: Apache-2.0
 ---
 keycloak:
  enabled: true
+  ingress:
+    enabled: false
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
@@ -238,6 +240,7 @@ nubusUmcServer:
        Ihr {domainname} Passwort-Service

 nubusKeycloakExtensions:
+  enabled: true
  handler:
    imagePullSecrets:
      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
@@ -287,6 +290,38 @@ nubusPortalConsumer:
      type: "RuntimeDefault"
    seLinuxOptions:
      {{ .Values.seLinuxOptions.umsPortalConsumer | toYaml | nindent 6 }}
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+          - key: "ca.crt"
+            path: "cacert.pem"
+  extraVolumeMounts:
+    - name: "trusted-cert-secret-volume"
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+  waitForDependency:
+    extraVolumeMounts:
+      - name: "trusted-cert-secret-volume"
+        readOnly: true
+        mountPath: "/etc/ssl/certs/ca-certificates.crt"
+        subPath: "ca-certificates.crt"
+      - name: "trusted-cert-secret-volume"
+        readOnly: true
+        mountPath: "/usr/local/lib/python3.7/dist-packages/certifi/cacert.pem"
+        subPath: "cacert.pem"
+    extraEnvVars:
+      - name: "REQUESTS_CA_BUNDLE"
+        value: "/etc/ssl/certs/ca-certificates.crt"
+      - name: "DEFAULT_CA_BUNDLE_PATH"
+        value: "/etc/ssl/certs/ca-certificates.crt"
+      - name: "SSL_CERT_FILE"
+        value: "/etc/ssl/certs/ca-certificates.crt"
+  {{- end }}

 nubusUdmListener:
  containerSecurityContext:
@@ -333,6 +368,34 @@ nubusPortalServer:
  replicaCount: {{ .Values.replicas.umsPortalServer }}
  resources:
    {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-crt-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+          - key: "ca.crt"
+            path: "cacert.pem"
+  extraVolumeMounts:
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/usr/local/lib/python3.7/dist-packages/certifi/cacert.pem"
+      subPath: "cacert.pem"
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/usr/lib/python3/dist-packages/botocore/cacert.pem"
+      subPath: "cacert.pem"
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/usr/lib/python3/dist-packages/certifi/cacert.pem"
+      subPath: "cacert.pem"
+  {{- end }}

 nubusLdapNotifier:
  containerSecurityContext:
--- a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -532,4 +532,18 @@ podSecurityContext:
 resources:
  {{ .Values.resources.opendeskKeycloakBootstrap | toYaml | nindent 2 }}

+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 ...
--- a/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
@@ -15,22 +15,22 @@ repositories:
  # Open-Xchange
  - name: "open-xchange-repo"
    keyring: "../../files/gpg-pubkeys/open-xchange-com.gpg"
-    verify: {{ .Values.charts.openXchangeAppSuite.verify }}
+    verify: {{ .Values.charts.oxAppSuite.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"

  # openDesk Open-Xchange Bootstrap
  # Source:
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap
  - name: "open-xchange-bootstrap-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.openXchangeAppSuiteBootstrap.verify }}
+    verify: {{ .Values.charts.oxAppSuiteBootstrap.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/{{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"

  # OX Connector
  - name: "ox-connector-repo"
@@ -45,27 +45,33 @@ releases:
    version: "{{ .Values.charts.dovecot.version }}"
    values:
      - "values-dovecot.yaml.gotmpl"
-      - {{ .Values.customization.release.dovecot | default "additionalValues: false" }}
+      {{ range .Values.customization.release.dovecot }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.dovecot.enabled }}
    timeout: 900

  - name: "open-xchange"
-    chart: "open-xchange-repo/{{ .Values.charts.openXchangeAppSuite.name }}"
-    version: "{{ .Values.charts.openXchangeAppSuite.version }}"
+    chart: "open-xchange-repo/{{ .Values.charts.oxAppSuite.name }}"
+    version: "{{ .Values.charts.oxAppSuite.version }}"
    values:
      - "values-openxchange.yaml.gotmpl"
      - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
-      - {{ .Values.customization.release.openXchange | default "additionalValues: false" }}
-    installed: {{ .Values.oxAppsuite.enabled }}
+      {{ range .Values.customization.release.openxchange }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
    timeout: 900

  - name: "opendesk-open-xchange-bootstrap"
-    chart: "open-xchange-bootstrap-repo/{{ .Values.charts.openXchangeAppSuiteBootstrap.name }}"
-    version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
+    chart: "open-xchange-bootstrap-repo/{{ .Values.charts.oxAppSuiteBootstrap.name }}"
+    version: "{{ .Values.charts.oxAppSuiteBootstrap.version }}"
    values:
      - "values-openxchange-bootstrap.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskOpenXchangeBootstrap | default "additionalValues: false" }}
-    installed: {{ .Values.oxAppsuite.enabled }}
+      {{ range .Values.customization.release.opendeskOpenxchangeBootstrap }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
    timeout: 900

  - name: "ox-connector"
@@ -73,12 +79,14 @@ releases:
    version: "{{ .Values.charts.oxConnector.version }}"
    values:
      - "values-oxconnector.yaml.gotmpl"
-      - {{ .Values.customization.release.oxConnector | default "additionalValues: false" }}
-    installed: {{ .Values.oxAppsuite.enabled }}
+      {{ range .Values.customization.release.oxConnector }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
    needs:
      - "open-xchange"

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "open-xchange"
 ...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -17,8 +17,8 @@ dovecot:
  mailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  password: {{ .Values.secrets.dovecot.doveadm | quote }}
  migration:
-    enabled: {{ .Values.functional.migration.oxAppsuite.enabled }}
-    masterPassword: {{ .Values.secrets.oxAppsuite.migrationsMasterPassword | quote }}
+    enabled: {{ .Values.functional.migration.oxAppSuite.enabled }}
+    masterPassword: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
  ldap:
    enabled: true
    host: {{ .Values.ldap.host | quote }}
@@ -72,6 +72,20 @@ containerSecurityContext:

 podAnnotations: {}

+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 podSecurityContext:
  enabled: true
  fsGroup: 1000
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -7,16 +7,16 @@ SPDX-License-Identifier: Apache-2.0
 global:
  hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
  appsuite:
-    cookieHashSalt: {{ .Values.secrets.oxAppsuite.cookieHashSalt }}
-    shareCryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey }}
-    sessiondEncryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey }}
+    cookieHashSalt: {{ .Values.secrets.oxAppSuite.cookieHashSalt }}
+    shareCryptKey: {{ .Values.secrets.oxAppSuite.shareCryptKey }}
+    sessiondEncryptionKey: {{ .Values.secrets.oxAppSuite.sessiondEncryptionKey }}
  mysql:
-    host: {{ .Values.databases.oxAppsuite.host | quote }}
-    database: {{ .Values.databases.oxAppsuite.name | quote }}
+    host: {{ .Values.databases.oxAppSuite.host | quote }}
+    database: {{ .Values.databases.oxAppSuite.name | quote }}
    auth:
-      user: {{ .Values.databases.oxAppsuite.username | quote }}
-      password: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
-      rootPassword: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
+      user: {{ .Values.databases.oxAppSuite.username | quote }}
+      password: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
+      rootPassword: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}

 nextcloud-integration-ui:
  image:
@@ -105,9 +105,9 @@ appsuite:
    routes:
      http-api-routes-appsuite-api:
        annotations:
-          nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.openXchangeAppSuite }}"
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openXchangeAppSuite }}"
-          nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openXchangeAppSuite }}"
+          nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.oxAppSuite }}"
+          nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.oxAppSuite }}"
+          nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.oxAppSuite }}"
      trailslash:
        enabled: false
  core-mw:
@@ -119,13 +119,13 @@ appsuite:
        oidcLogin: true
        oidcPath: "/oidc"
    masterAdmin: "admin"
-    masterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+    masterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
    hzGroupName: "hzgroup"
-    hzGroupPassword: {{ .Values.secrets.oxAppsuite.hzGroupPassword | quote }}
+    hzGroupPassword: {{ .Values.secrets.oxAppSuite.hzGroupPassword | quote }}
    basicAuthLogin: "oxlogin"
-    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
+    basicAuthPassword: {{ .Values.secrets.oxAppSuite.basicAuthPassword | quote }}
    jolokiaLogin: "jolokia"
-    jolokiaPassword: {{ .Values.secrets.oxAppsuite.jolokiaPassword | quote }}
+    jolokiaPassword: {{ .Values.secrets.oxAppSuite.jolokiaPassword | quote }}
    hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
    podAnnotations: {}
    serviceAccount:
@@ -174,7 +174,7 @@ appsuite:
          chown open-xchange:open-xchange /opt/open-xchange/guard-files
    packages:
      status:
-        {{- if .Values.functional.migration.oxAppsuite.enabled }}
+        {{- if .Values.functional.migration.oxAppSuite.enabled }}
        open-xchange-authentication-masterpassword: "enabled"
        open-xchange-authentication-ldap: "disabled"
        open-xchange-authentication-oauth: "disabled"
@@ -185,6 +185,10 @@ appsuite:
        open-xchange-authentication-oauth: "enabled"
        open-xchange-authentication-ldap: "disabled"
        {{- end }}
+        # OX Documents (office-web) is not used in openDesk
+        open-xchange-documents-backend: "disabled"
+        open-xchange-documents-monitoring: "disabled"
+        open-xchange-documents-templates: "disabled"
    properties:
      com.openexchange.UIWebPath: "/appsuite/"
      com.openexchange.showAdmin: "false"
@@ -287,14 +291,38 @@ appsuite:
      com.openexchange.smime.test: "true"
      # Other
      com.openexchange.secret.secretSource: "\"<user-id> + '@' + <context-id> + '/' + <random>\""
+      {{- if .Values.certificate.selfSigned }}
+      # Selfsigned
+      com.openexchange.net.ssl.default.truststore.enabled: "false"
+      com.openexchange.net.ssl.custom.truststore.enabled: "true"
+      com.openexchange.net.ssl.custom.truststore.path: "/etc/ssl/certs/truststore.jks"
+      com.openexchange.net.ssl.custom.truststore.password: {{ .Values.secrets.certificates.password | quote }}
+      {{- end }}
+    {{- if .Values.certificate.selfSigned }}
+    extraEnv:
+    - name: "JAVA_OPTS_APPEND"
+      value: {{ printf "%s %s=%s" "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks -Djavax.net.ssl.trustStoreType=jks" "-Djavax.net.ssl.trustStorePassword" .Values.secrets.certificates.password | quote }}
+    extraVolumes:
+      - name: "trusted-cert-secret-volume"
+        secret:
+          secretName: "opendesk-certificates-ca-tls"
+          items:
+            - key: "truststore.jks"
+              path: "truststore.jks"
+            - key: "ca.crt"
+              path: "ca-certificates.crt"
+    extraMounts:
+      - name: "trusted-cert-secret-volume"
+        mountPath: "/etc/ssl/certs/"
+    {{- end }}
    secretProperties:
-      com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
-      com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
-      com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
-      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+      com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppSuite.cookieHashSalt | quote }}
+      com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppSuite.sessiondEncryptionKey | quote }}
+      com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppSuite.shareCryptKey | quote }}
+      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
    propertiesFiles:
      /opt/open-xchange/etc/masterpassword-authentication.properties:
-        com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppsuite.migrationsMasterPassword | quote }}
+        com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
      /opt/open-xchange/etc/AdminDaemon.properties:
        MASTER_ACCOUNT_OVERRIDE: "true"
      /opt/open-xchange/etc/AdminUser.properties:
@@ -308,12 +336,17 @@ appsuite:
        bindOnly: "false"
      /opt/open-xchange/etc/antivirus.properties:
        com.openexchange.antivirus.enabled: "true"
+        {{- if .Values.antivirus.icap.host }}
+        com.openexchange.antivirus.server: {{ .Values.antivirus.icap.host | quote }}
+        com.openexchange.antivirus.port: {{ .Values.antivirus.icap.port | quote }}
+        {{- else }}
        {{- if .Values.clamavDistributed.enabled }}
        com.openexchange.antivirus.server: "clamav-icap"
        {{- else if .Values.clamavSimple.enabled }}
        com.openexchange.antivirus.server: "clamav-simple"
        {{- end }}
        com.openexchange.antivirus.port: "1344"
+        {{- end }}
        com.openexchange.antivirus.maxFileSize: "1024"
    uiSettings:
      io.ox.nextcloud//server: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/fs/"
@@ -359,16 +392,17 @@ appsuite:
      # MC+base64(20 random bytes)
      # RC+base64(20 random bytes)
      oxguardpass: |
-        {{ .Values.secrets.oxAppsuite.oxguardMC }}
-        {{ .Values.secrets.oxAppsuite.oxguardRC }}
+        {{ .Values.secrets.oxAppSuite.oxguardMC }}
+        {{ .Values.secrets.oxAppSuite.oxguardRC }}
    redis: &redisConfiguration
      enabled: true
      mode: "standalone"
      hosts:
-        - "redis-master:6379"
+        - {{ printf "%s:%v" .Values.cache.oxAppSuite.host .Values.cache.oxAppSuite.port | quote }}
      auth:
        enabled: true
-        password: {{ .Values.secrets.redis.password | quote }}
+        username: {{ .Values.cache.oxAppSuite.username | quote }}
+        password: {{ .Values.cache.oxAppSuite.password | default .Values.secrets.redis.password | quote }}
    image:
      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
@@ -467,9 +501,9 @@ appsuite:

  core-documentconverter:
    adminUser: "admin"
-    adminPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+    adminPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
    basicAuthLogin: "oxlogin"
-    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
+    basicAuthPassword: {{ .Values.secrets.oxAppSuite.basicAuthPassword | quote }}
    enabled: true
    documentConverter:
      cache:
@@ -554,9 +588,9 @@ appsuite:
  core-imageconverter:
    enabled: true
    adminUser: "admin"
-    adminPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+    adminPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
    basicAuthLogin: "oxlogin"
-    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
+    basicAuthPassword: {{ .Values.secrets.oxAppSuite.basicAuthPassword | quote }}
    image:
      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeImageConverter.registry | quote }}
      repository: {{ .Values.images.openxchangeImageConverter.repository | quote }}
--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -4,6 +4,20 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.oxConnector.registry | quote }}
  repository: {{ .Values.images.oxConnector.repository | quote }}
@@ -36,7 +50,7 @@ oxConnector:
  oxLocalTimezone: "Europe/Berlin"
  oxLanguage: "de_DE"
  oxMasterAdmin: "admin"
-  oxMasterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+  oxMasterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
  oxSmtpServer: "smtp://127.0.0.1:587"
  oxSoapServer: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"

--- a/helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl
@@ -21,11 +21,13 @@ releases:
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
-      - {{ .Values.customization.release.migrationsPost | default "additionalValues: false" }}
+      {{ range .Values.customization.release.migrationsPost }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.migrations.enabled }}
    timeout: 900

 commonLabels:
-  deploy-stage: "component-0"
-  component: "opendesk-migrations"
+  deployStage: "090-migrations-post"
+  component: "migrations-post"
 ...
--- a/helmfile/apps/opendesk-migrations-post/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-post/helmfile.yaml.gotmpl
--- a/helmfile/apps/opendesk-migrations-post/values.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-post/values.yaml.gotmpl
@@ -0,0 +1,15 @@
+{{/*
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+podAnnotations:
+  {{ .Values.annotations.migrationsPost.pod | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.migrationsPost.serviceAccount | toYaml | nindent 4 }}
+
+migrations:
+  stage: "POST"
+...
--- a/helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl
@@ -21,11 +21,13 @@ releases:
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
-      - {{ .Values.customization.release.migrationsPre | default "additionalValues: false" }}
+      {{ range .Values.customization.release.migrationsPre }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.migrations.enabled }}
    timeout: 900

 commonLabels:
-  deploy-stage: "component-0"
-  component: "opendesk-migrations"
+  deployStage: "010-migrations-pre"
+  component: "migrations-pre"
 ...
--- a/helmfile/apps/opendesk-migrations-pre/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-pre/helmfile.yaml.gotmpl
--- a/helmfile/apps/opendesk-migrations-pre/values.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-pre/values.yaml.gotmpl
@@ -0,0 +1,15 @@
+{{/*
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+podAnnotations:
+  {{ .Values.annotations.migrationsPre.pod | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.migrationsPre.serviceAccount | toYaml | nindent 4 }}
+
+migrations:
+  stage: "PRE"
+...
--- a/helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl
@@ -20,11 +20,13 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskOpenprojectBootstrap | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskOpenprojectBootstrap }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.openproject.enabled }}
    timeout: 900

 commonLabels:
-  deploy-stage: "component-2"
+  deployStage: "060-components"
  component: "opendesk-openproject-bootstrap"
 ...
--- a/helmfile/apps/opendesk-openproject-bootstrap/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/helmfile.yaml.gotmpl
--- a/helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl
@@ -44,6 +44,20 @@ containerSecurityContext:
  seLinuxOptions:
    {{ .Values.seLinuxOptions.openprojectBootstrap | toYaml | nindent 4 }}

+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openprojectBootstrap.registry | quote }}
  repository: {{ .Values.images.openprojectBootstrap.repository | quote }}
@@ -58,4 +72,10 @@ podSecurityContext:
  fsGroup: 1000
  fsGroupChangePolicy: "OnRootMismatch"

+additionalAnnotations:
+  {{ .Values.annotations.openprojectBootstrap.all | toYaml | nindent 2 }}
+
+podAnnotations:
+  {{ .Values.annotations.openprojectBootstrap.pod | toYaml | nindent 2 }}
+
 ...
--- a/helmfile/apps/opendesk-services/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/helmfile-child.yaml.gotmpl
@@ -0,0 +1,111 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # openDesk Otterize
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-otterize
+  - name: "otterize-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.otterize.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
+
+  # openDesk Home
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
+  - name: "home-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.home.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
+
+  # openDesk Certificates
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
+  - name: "certificates-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.certificates.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
+
+    # openDesk Alerts
+  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts
+  - name: "opendesk-alerts-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.opendeskAlerts.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"
+
+    # openDesk Grafana Dashboards
+    # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards
+  - name: "dashboards-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.opendeskDashboards.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"
+
+releases:
+  - name: "opendesk-otterize"
+    chart: "otterize-repo/{{ .Values.charts.otterize.name }}"
+    version: "{{ .Values.charts.otterize.version }}"
+    values:
+      - "values-otterize.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskOtterize }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.security.otterizeIntents.enabled }}
+    timeout: 900
+
+  - name: "opendesk-home"
+    chart: "home-repo/{{ .Values.charts.home.name }}"
+    version: "{{ .Values.charts.home.version }}"
+    values:
+      - "values-home.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskHome }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.home.enabled }}
+
+  - name: "opendesk-certificates"
+    chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
+    version: "{{ .Values.charts.certificates.version }}"
+    values:
+      - "values-certificates.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskCertificates }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.certificates.enabled }}
+    timeout: 900
+
+  - name: "opendesk-alerts"
+    chart: "opendesk-alerts-repo/{{ .Values.charts.opendeskAlerts.name }}"
+    version: "{{ .Values.charts.opendeskAlerts.version }}"
+    values:
+      - "values-opendesk-alerts.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskAlerts}}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
+    timeout: 900
+
+  - name: "opendesk-dashboards"
+    chart: "dashboards-repo/{{ .Values.charts.opendeskDashboards.name }}"
+    version: "{{ .Values.charts.opendeskDashboards.version }}"
+    values:
+      - "values-dashboards.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskDashboards | default "additionalValues: false" }}
+    installed: {{ .Values.monitoring.grafana.dashboards.enabled }}
+    timeout: 900
+
+commonLabels:
+  deployStage: "030-opendesk-services"
+  component: "opendesk-services"
+...
--- a/helmfile/apps/opendesk-services/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/helmfile.yaml.gotmpl
--- a/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
@@ -39,7 +39,7 @@ global:
    {{- if .Values.openproject.enabled }}
    openproject: {{ .Values.global.hosts.openproject }}
    {{- end }}
-    {{- if .Values.oxAppsuite.enabled }}
+    {{- if .Values.oxAppSuite.enabled }}
    openxchange: {{ .Values.global.hosts.openxchange }}
    {{- end }}
    {{- if .Values.nubus.enabled }}
@@ -52,9 +52,18 @@ global:

 issuerRef:
  name: {{ .Values.certificate.issuerRef.name | quote }}
+  kind: {{ .Values.certificate.issuerRef.kind | quote }}

 cleanup:
  keepRessourceOnDelete: {{ .Values.debug.cleanup.keepRessourceOnDelete }}

+selfSigned:
+  enabled: {{ .Values.certificate.selfSigned }}
+  keystores:
+    jks:
+      enabled: true
+      password:
+        value: {{ .Values.secrets.certificates.password | quote }}
+
 wildcard: {{ .Values.certificate.wildcard }}
 ...
--- a/helmfile/apps/opendesk-services/values-dashboards.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-dashboards.yaml.gotmpl
@@ -0,0 +1,54 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+additionalAnnotations:
+  {{ .Values.monitoring.grafana.dashboards.annotations | toYaml | nindent 2 }}
+additionalLabels:
+  {{ .Values.monitoring.grafana.dashboards.labels | toYaml | nindent 2 }}
+
+config:
+  apps:
+    collabora:
+      enable: {{ .Values.collabora.enabled }}
+      selectors:
+        namespace: {{ .Values.collabora.namespace | quote }}
+    matrixElement:
+      enable: {{ .Values.element.enabled }}
+      selectors:
+        namespace: {{ .Values.element.namespace | quote }}
+    diagrams:
+      enable: {{ .Values.cryptpad.enabled }}
+      selectors:
+        namespace: {{ .Values.cryptpad.namespace | quote }}
+    nextcloud:
+      enable: {{ .Values.nextcloud.enabled }}
+      selectors:
+        namespace: {{ .Values.nextcloud.namespace | quote }}
+    openxchange:
+      enable: {{ .Values.oxAppSuite.enabled }}
+      selectors:
+        namespace: {{ .Values.oxAppSuite.namespace | quote }}
+    xwiki:
+      enable: {{ .Values.xwiki.enabled }}
+      selectors:
+        namespace: {{ .Values.xwiki.namespace | quote }}
+    nubus:
+      enable: {{ .Values.nubus.enabled }}
+      selectors:
+        namespace: {{ .Values.nubus.namespace | quote }}
+    openproject:
+      enable: {{ .Values.openproject.enabled }}
+      selectors:
+        namespace: {{ .Values.openproject.namespace | quote }}
+    jitsi:
+      enable: {{ .Values.jitsi.enabled }}
+      selectors:
+        namespace: {{ .Values.jitsi.namespace | quote }}
+    collabora:
+      enable: {{ .Values.collabora.enabled }}
+      selectors:
+        namespace: {{ .Values.collabora.namespace | quote }}
+...
--- a/helmfile/apps/opendesk-services/values-home.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-home.yaml.gotmpl
--- a/helmfile/apps/opendesk-services/values-opendesk-alerts.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-opendesk-alerts.yaml.gotmpl
@@ -0,0 +1,52 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+additionalAnnotations:
+  {{ .Values.monitoring.prometheus.prometheusRules.annotations | toYaml | nindent 2 }}
+additionalLabels:
+  {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 2 }}
+
+config:
+  collabora:
+    enable: {{ .Values.collabora.enabled }}
+    selectors:
+      namespace: {{ .Values.collabora.namespace | quote }}
+  matrix:
+    enable: {{ .Values.element.enabled }}
+    selectors:
+      namespace: {{ .Values.element.namespace | quote }}
+  diagrams:
+    enable: {{ .Values.cryptpad.enabled }}
+    selectors:
+      namespace: {{ .Values.cryptpad.namespace | quote }}
+  nextcloud:
+    enable: {{ .Values.nextcloud.enabled }}
+    selectors:
+      namespace: {{ .Values.nextcloud.namespace | quote }}
+  openXChange:
+    enable: {{ .Values.oxAppSuite.enabled }}
+    selectors:
+      namespace: {{ .Values.oxAppSuite.namespace | quote }}
+  xwiki:
+    enable: {{ .Values.xwiki.enabled }}
+    selectors:
+      namespace: {{ .Values.xwiki.namespace | quote }}
+  nubus:
+    enable: {{ .Values.nubus.enabled }}
+    selectors:
+      namespace: {{ .Values.nubus.namespace | quote }}
+  openProject:
+    enable: {{ .Values.openproject.enabled }}
+    selectors:
+      namespace: {{ .Values.openproject.namespace | quote }}
+  jitsi:
+    enable: {{ .Values.jitsi.enabled }}
+    selectors:
+      namespace: {{ .Values.jitsi.namespace | quote }}
+  collabora:
+    enable: {{ .Values.collabora.enabled }}
+    selectors:
+      namespace: {{ .Values.collabora.namespace | quote }}
+
--- a/helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl
@@ -29,7 +29,7 @@ apps:
  openproject:
    enabled: {{ .Values.openproject.enabled }}
  oxAppsuite:
-    enabled: {{ .Values.oxAppsuite.enabled }}
+    enabled: {{ .Values.oxAppSuite.enabled }}
  postfix:
    enabled: {{ .Values.postfix.enabled }}
  postgresql:
--- a/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
@@ -20,11 +20,13 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.openproject | default "additionalValues: false" }}
+      {{ range .Values.customization.release.openproject }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.openproject.enabled }}
    timeout: 1800

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "openproject"
 ...
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -40,7 +40,8 @@ dbInit:
 environment:
 # For more details and more options see
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
-  OPENPROJECT_LOG__LEVEL: {{ if .Values.debug.enabled }}"debug"{{ else }}"warn"{{ end }}
+  OPENPROJECT_APP__TITLE: "Projects | {{ .Values.theme.texts.productName }}"
+  OPENPROJECT_LOG__LEVEL: {{ if .Values.debug.enabled }}"debug"{{ else }}"info"{{ end }}
  OPENPROJECT_LOGIN__REQUIRED: "true"
  OPENPROJECT_USER__DEFAULT__TIMEZONE: "Europe/Berlin"
  OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
@@ -84,10 +85,24 @@ environment:
  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.nubus .Values.global.domain | quote }}
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
-  {{- if .Values.enterprise.openproject.token }}
-  OPENPROJECT_ENTERPRISE__TOKEN: {{ .Values.enterprise.openproject.token | quote }}
+  {{- if .Values.certificate.selfSigned }}
+  SSL_CERT_FILE: "/etc/ssl/certs/ca-certificates.crt"
  {{- end }}

+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openproject.registry | quote }}
  repository: {{ .Values.images.openproject.repository | quote }}
@@ -103,7 +118,8 @@ memcached:
 persistence:
  enabled: false

-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.openproject.pod | toYaml | nindent 2 }}

 postgresql:
  bundled: false
@@ -149,6 +165,10 @@ openproject:
      admin: "openproject_admin"
  useTmpVolumes: true

+serviceAccount:
+  annotations:
+    {{ .Values.annotations.openproject.serviceAccount | toYaml | nindent 4 }}
+
 ingress:
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.openproject }}"
@@ -157,6 +177,9 @@ ingress:
    nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.openproject }}"
    nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openproject }}s"
    nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openproject }}s"
+    {{- with .Values.annotations.openproject.ingress }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
  host: "{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
  enabled: {{ .Values.ingress.enabled }}
  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -175,8 +198,8 @@ s3:
  enabled: true
  directUploads: {{ .Values.objectstores.openproject.directUploads }}
  enableSignatureV4Streaming: {{ .Values.objectstores.openproject.enableSignatureV4Streaming }}
-  endpoint: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
-  host: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+  endpoint: {{ printf "https://%s" (.Values.objectstores.openproject.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
+  host: {{ printf "https://%s" (.Values.objectstores.openproject.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
  pathStyle: {{ .Values.objectstores.openproject.pathStyle }}
  region: {{ .Values.objectstores.openproject.region | quote }}
  bucketName: {{ .Values.objectstores.openproject.bucket | quote }}
--- a/helmfile/apps/services-external/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/services-external/helmfile-child.yaml.gotmpl
@@ -2,36 +2,6 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
-  # openDesk Otterize
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-otterize
-  - name: "otterize-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.otterize.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
-
-  # openDesk Home
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
-  - name: "home-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.home.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
-
-  # openDesk Certificates
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
-  - name: "certificates-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.certificates.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
-
  # openDesk PostgreSQL
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postgresql
  - name: "postgresql-repo"
@@ -113,39 +83,27 @@ repositories:
    oci: true
    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"

+  # openDesk Enterprise Repositories
+
+  # Cassandra
+  # Source: https://github.com/bitnami/charts/
+  - name: "cassandra-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.cassandra.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"
+
 releases:
-  - name: "opendesk-otterize"
-    chart: "otterize-repo/{{ .Values.charts.otterize.name }}"
-    version: "{{ .Values.charts.otterize.version }}"
-    values:
-      - "values-otterize.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskOtterize | default "additionalValues: false" }}
-    installed: {{ .Values.security.otterizeIntents.enabled }}
-    timeout: 900
-
-  - name: "opendesk-home"
-    chart: "home-repo/{{ .Values.charts.home.name }}"
-    version: "{{ .Values.charts.home.version }}"
-    values:
-      - "values-home.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskHome | default "additionalValues: false" }}
-    installed: {{ .Values.home.enabled }}
-
-  - name: "opendesk-certificates"
-    chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
-    version: "{{ .Values.charts.certificates.version }}"
-    values:
-      - "values-certificates.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskCertificates | default "additionalValues: false" }}
-    installed: {{ .Values.certificates.enabled }}
-    timeout: 900
-
  - name: "redis"
    chart: "redis-repo/{{ .Values.charts.redis.name }}"
    version: "{{ .Values.charts.redis.version }}"
    values:
      - "values-redis.yaml.gotmpl"
-      - {{ .Values.customization.release.redis | default "additionalValues: false" }}
+      {{ range .Values.customization.release.redis }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.redis.enabled }}
    timeout: 900

@@ -154,7 +112,9 @@ releases:
    version: "{{ .Values.charts.memcached.version }}"
    values:
      - "values-memcached.yaml.gotmpl"
-      - {{ .Values.customization.release.memcached | default "additionalValues: false" }}
+      {{ range .Values.customization.release.memcached }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.memcached.enabled }}
    timeout: 900

@@ -163,7 +123,9 @@ releases:
    version: "{{ .Values.charts.postgresql.version }}"
    values:
      - "values-postgresql.yaml.gotmpl"
-      - {{ .Values.customization.release.postgresql | default "additionalValues: false" }}
+      {{ range .Values.customization.release.postgresql }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.postgresql.enabled }}
    timeout: 900

@@ -172,7 +134,9 @@ releases:
    version: "{{ .Values.charts.mariadb.version }}"
    values:
      - "values-mariadb.yaml.gotmpl"
-      - {{ .Values.customization.release.mariadb | default "additionalValues: false" }}
+      {{ range .Values.customization.release.mariadb }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.mariadb.enabled }}
    timeout: 900

@@ -181,7 +145,9 @@ releases:
    version: "{{ .Values.charts.postfix.version }}"
    values:
      - "values-postfix.yaml.gotmpl"
-      - {{ .Values.customization.release.postfix | default "additionalValues: false" }}
+      {{ range .Values.customization.release.postfix }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.postfix.enabled }}
    timeout: 900

@@ -190,7 +156,9 @@ releases:
    version: "{{ .Values.charts.dkimpy.version }}"
    values:
      - "values-dkimpy.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskDkimpyMilter | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskDkimpyMilter }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.dkimpy.enabled }}
    timeout: 900

@@ -199,7 +167,9 @@ releases:
    version: "{{ .Values.charts.clamav.version }}"
    values:
      - "values-clamav-distributed.yaml.gotmpl"
-      - {{ .Values.customization.release.clamav | default "additionalValues: false" }}
+      {{ range .Values.customization.release.clamav }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.clamavDistributed.enabled }}
    timeout: 900

@@ -208,7 +178,9 @@ releases:
    version: "{{ .Values.charts.clamavSimple.version }}"
    values:
      - "values-clamav-simple.yaml.gotmpl"
-      - {{ .Values.customization.release.clamavSimple | default "additionalValues: false" }}
+      {{ range .Values.customization.release.clamavSimple }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.clamavSimple.enabled }}
    timeout: 900

@@ -217,11 +189,24 @@ releases:
    version: "{{ .Values.charts.minio.version }}"
    values:
      - "values-minio.yaml.gotmpl"
-      - {{ .Values.customization.release.minio | default "additionalValues: false" }}
+      {{ range .Values.customization.release.minio }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.minio.enabled }}
    timeout: 900

+  # openDesk Enterprise Releases
+  - name: "cassandra"
+    chart: "cassandra-repo/{{ .Values.charts.cassandra.name }}"
+    version: "{{ .Values.charts.cassandra.version }}"
+    values:
+      {{ range .Values.customization.release.cassandra }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.cassandra.enabled }}
+    timeout: 900
+
 commonLabels:
-  deploy-stage: "services"
-  component: "services"
+  deployStage: "030-services-external"
+  component: "services-external"
 ...
--- a/helmfile/apps/services-external/helmfile.yaml.gotmpl
+++ b/helmfile/apps/services-external/helmfile.yaml.gotmpl
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...
--- a/helmfile/apps/services-external/values-clamav-distributed.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-clamav-distributed.yaml.gotmpl
--- a/helmfile/apps/services-external/values-clamav-simple.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-clamav-simple.yaml.gotmpl
--- a/helmfile/apps/services-external/values-dkimpy.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-dkimpy.yaml.gotmpl
--- a/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
@@ -42,32 +42,33 @@ job:
    - username: {{ .Values.databases.nextcloud.username | quote }}
      password: {{ .Values.secrets.mariadb.nextcloudUser | quote}}
      connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
+    # OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
    # users for the moment.
    - username: "openxchange_user"
    # - username: {{ .Values.databases.xwiki.username | quote }}
      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
-      connectionLimit: {{ .Values.databases.oxAppsuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+      connectionLimit: {{ .Values.databases.oxAppSuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
    - username: "xwiki_user"
-    # - username: {{ .Values.databases.oxAppsuite.username | quote }}
+    # - username: {{ .Values.databases.oxAppSuite.username | quote }}
      password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
  databases:
    - name: {{ .Values.databases.nextcloud.name | quote }}
      user: {{ .Values.databases.nextcloud.username | quote }}
-    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
+    # OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
    # users for the moment.
    - name: "openxchange"
      user: "openxchange_user"
-    # - name: {{ .Values.databases.oxAppsuite.name | quote }}
-    #   user: {{ .Values.databases.oxAppsuite.username | quote }}
+    # - name: {{ .Values.databases.oxAppSuite.name | quote }}
+    #   user: {{ .Values.databases.oxAppSuite.username | quote }}
    - name: "xwiki"
      user: "xwiki_user"
    # - name: {{ .Values.databases.xwiki.name | quote }}
    #   user: {{ .Values.databases.xwiki.username | quote }}

 mariadb:
-  rootPassword: {{ .Values.secrets.mariadb.rootPassword | quote }}
+  rootPassword:
+    value: {{ .Values.secrets.mariadb.rootPassword | quote }}

 persistence:
  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
--- a/helmfile/apps/services-external/values-memcached.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-memcached.yaml.gotmpl
--- a/helmfile/apps/services-external/values-minio.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-minio.yaml.gotmpl
@@ -201,4 +201,16 @@ startupProbe:
 statefulset:
  replicaCount: {{ .Values.replicas.minio }}

+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "public.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/certs/CAs"
+{{- end }}
 ...
--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -68,11 +68,15 @@ postfix:
  smtpdTLSCertFile: "/etc/tls/tls.crt"
  smtpdKeyFile: "/etc/tls/tls.key"
  smtpdSASLPath: "inet:dovecot:3659"
+  {{- if .Values.antivirus.milter.host }}
+  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
+  {{- else }}
  {{- if .Values.clamavDistributed.enabled }}
  smtpdMilters: "inet:clamav-milter:7357"
  {{- else if .Values.clamavSimple.enabled }}
  smtpdMilters: "inet:clamav-simple:7357"
  {{- end }}
+  {{- end }}
  virtualMailboxDomains: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  virtualTransport: "lmtps:dovecot:24"

--- a/helmfile/apps/services-external/values-postgresql.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postgresql.yaml.gotmpl
--- a/helmfile/apps/services-external/values-redis.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-redis.yaml.gotmpl
--- a/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
@@ -19,11 +19,13 @@ releases:
    wait: true
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.xwiki | default "additionalValues: false" }}
+      {{ range .Values.customization.release.xwiki }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.xwiki.enabled }}
    timeout: 1800

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "xwiki"
 ...
--- a/helmfile/apps/xwiki/values.yaml.gotmpl
+++ b/helmfile/apps/xwiki/values.yaml.gotmpl
@@ -11,11 +11,19 @@ image:

 imagePullSecrets: {{ .Values.global.imagePullSecrets }}

+
+{{- if .Values.certificate.selfSigned }}
+javaOpts:
+  - "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks"
+  - "-Djavax.net.ssl.trustStoreType=jks"
+  - {{ printf "%s=%s" "-Djavax.net.ssl.trustStorePassword" .Values.secrets.certificates.password | quote }}
+{{- end }}
+
 externalDB:
  password: {{ .Values.databases.xwiki.password | default .Values.secrets.mariadb.rootPassword | quote }}
  database: {{ .Values.databases.xwiki.name | quote }}
  user: {{ .Values.databases.xwiki.username | quote }}
-  host: {{ .Values.databases.xwiki.host | quote }}
+  host: {{ printf "%s:%d" .Values.databases.xwiki.host .Values.databases.xwiki.port | quote }}
  customKeyRef:
    enabled: false

@@ -49,8 +57,10 @@ customConfigs:
    xwiki.authentication.ldap.photo_attribute: "jpegPhoto"
    ## Enable the synchronization of the LDAP profile picture
    xwiki.authentication.ldap.update_photo: 1
-    ## Password of default user
+    {{ if .Values.debug.enabled }}
+    ## Password of "superadmin" user, disables account if not password is set
    xwiki.superadminpassword: {{ .Values.secrets.xwiki.superadminpassword | quote }}
+    {{ end }}
    ## LDAP Server configuration
    xwiki.authentication.ldap.server: {{ .Values.ldap.host | quote }}
    xwiki.authentication.ldap.port: 389
@@ -199,4 +209,19 @@ service:
 volumePermissions:
  enabled: true

+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "truststore.jks"
+          path: "truststore.jks"
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs"
+{{- end }}
+
 ...
--- a/helmfile/bases/environments.yaml
+++ b/helmfile/bases/environments.yaml
@@ -4,21 +4,17 @@
 environments:
  default:
    values:
-      - "../../environments/default/*.gotmpl"
-      - "../../environments/default/*.yaml"
+      - "../../environments/default/*.yaml.gotmpl"
  dev:
    values:
-      - "../../environments/default/*.gotmpl"
-      - "../../environments/default/*.yaml"
+      - "../../environments/default/*.yaml.gotmpl"
      - "../../environments/dev/*.yaml.gotmpl"
  test:
    values:
-      - "../../environments/default/*.gotmpl"
-      - "../../environments/default/*.yaml"
+      - "../../environments/default/*.yaml.gotmpl"
      - "../../environments/test/*.yaml.gotmpl"
  prod:
    values:
-      - "../../environments/default/*.gotmpl"
-      - "../../environments/default/*.yaml"
+      - "../../environments/default/*.yaml.gotmpl"
      - "../../environments/prod/*.yaml.gotmpl"
 ...
--- a/helmfile/environments/default/_helper.yaml.gotmpl
+++ b/helmfile/environments/default/_helper.yaml.gotmpl
--- a/helmfile/environments/default/annotations.yaml
+++ b/helmfile/environments/default/annotations.yaml
@@ -0,0 +1,73 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+annotations:
+  collabora:
+    ingress: ~
+    pod: ~
+  cryptpad:
+    ingress: ~
+    pod: ~
+  element:
+    ingress: ~
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  elementWellKnown:
+    ingress: ~
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  jicofo:
+    pod: ~
+  jitsi:
+    ingress: ~
+    pod: ~
+    serviceAccount: ~
+  jitsiKeycloakAdapter:
+    pod: ~
+  jitsiPatchJVB:
+    serviceAccount: ~
+  jvb:
+    pod: ~
+  prosody:
+    pod: ~
+  matrixUserVerificationService:
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  migrationsPre:
+    pod: ~
+    serviceAccount: ~
+  migrationsPost:
+    pod: ~
+    serviceAccount: ~
+  nextcloudManagement:
+    all: ~
+    serviceAccount: ~
+  nextcloud:
+    all: ~
+    ingress: ~
+    serviceAccount: ~
+  openproject:
+    ingress: ~
+    pod: ~
+    serviceAccount: ~
+  openprojectBootstrap:
+    all: ~
+    pod: ~
+  synapse:
+    ingress: ~
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  synapseWeb:
+    ingress: ~
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  # XWiki has no annotation support.
+  # xwiki:
+  #   pod: ~
+
+...
--- a/helmfile/environments/default/antivirus.yaml.gotmpl
+++ b/helmfile/environments/default/antivirus.yaml.gotmpl
@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+antivirus:
+  icap:
+    host: ~
+    port: 1344
+  milter:
+    host: ~
+    port: 7357
+...
--- a/helmfile/environments/default/cache.yaml.gotmpl
+++ b/helmfile/environments/default/cache.yaml.gotmpl
@@ -5,14 +5,22 @@ cache:
  intercomService:
    host: "redis-headless"
    port: 6379
+    username: "default"
    password: ""
  nextcloud:
    host: "redis-headless"
    port: 6379
+    username: "default"
    password: ""
+    tls: false
  openproject:
    host: "memcached"
    port: 11211
+  oxAppSuite:
+    host: "redis-headless"
+    port: 6379
+    username: "default"
+    password: ""
  umsSelfservice:
    host: "memcached"
    port: 11211
--- a/helmfile/environments/default/certificate.yaml.gotmpl
+++ b/helmfile/environments/default/certificate.yaml.gotmpl
@@ -1,8 +1,11 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 certificate:
  issuerRef:
    name: "letsencrypt-prod"
+    kind: "ClusterIssuer"
  wildcard: false
+  selfSigned: false
 ...
--- a/helmfile/environments/default/charts.yaml.gotmpl
+++ b/helmfile/environments/default/charts.yaml.gotmpl
@@ -6,6 +6,13 @@
 # yamllint disable rule:line-length
 ---
 charts:
+  cassandra:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
+    verify: true
  certificates:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -14,7 +21,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-certificates"
    name: "opendesk-certificates"
-    version: "2.1.3"
+    version: "3.1.0"
    verify: true
  clamav:
    # providerCategory: "Platform"
@@ -46,7 +53,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/collabora/charts-mirror"
    name: "collabora-online"
-    version: "1.1.21"
+    version: "1.1.26"
    verify: true
  cryptpad:
    # providerCategory: "Supplier"
@@ -80,7 +87,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-dovecot"
    name: "dovecot"
-    version: "1.4.0"
+    version: "1.4.1"
    verify: true
  element:
    # providerCategory: "Platform"
@@ -90,7 +97,17 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-element"
-    version: "3.4.1"
+    version: "5.0.1"
+    verify: true
+  elementWeb:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
+    name: "opendesk-element-web"
+    version: "5.0.1"
    verify: true
  elementWellKnown:
    # providerCategory: "Platform"
@@ -100,7 +117,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-well-known"
-    version: "3.4.1"
+    version: "5.0.1"
    verify: true
  home:
    # providerCategory: "Platform"
@@ -132,7 +149,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
    name: "opendesk-jitsi"
-    version: "1.12.5"
+    version: "2.1.1"
    verify: true
  mariadb:
    # providerCategory: "Platform"
@@ -142,7 +159,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-mariadb"
    name: "mariadb"
-    version: "2.3.1"
+    version: "3.0.3"
    verify: true
  matrixNeoboardWidget:
    # providerCategory: "Platform"
@@ -152,7 +169,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
    name: "matrix-neoboard-widget"
-    version: "3.5.0"
+    version: "3.5.1"
    verify: true
  matrixNeochoiseWidget:
    # providerCategory: "Platform"
@@ -162,7 +179,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
    name: "matrix-neochoice-widget"
-    version: "3.5.0"
+    version: "3.5.1"
    verify: true
  matrixNeodatefixBot:
    # providerCategory: "Platform"
@@ -172,7 +189,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
    name: "matrix-neodatefix-bot"
-    version: "3.5.0"
+    version: "3.5.1"
    verify: true
  matrixNeodatefixWidget:
    # providerCategory: "Platform"
@@ -182,7 +199,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
    name: "matrix-neodatefix-widget"
-    version: "3.5.0"
+    version: "3.5.1"
    verify: true
  matrixUserVerificationService:
    # providerCategory: "Platform"
@@ -192,7 +209,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-matrix-user-verification-service"
-    version: "3.4.0"
+    version: "5.0.1"
    verify: true
  memcached:
    # providerCategory: "Community"
@@ -232,7 +249,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud"
-    version: "3.4.1"
+    version: "3.6.2"
    verify: true
  nextcloudManagement:
    # providerCategory: "Platform"
@@ -242,7 +259,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud-management"
-    version: "3.4.1"
+    version: "3.6.2"
    verify: true
  nginx:
    # providerCategory: "Community"
@@ -254,6 +271,16 @@ charts:
    name: "nginx"
    version: "15.9.3"
    verify: true
+  nginxS3Gateway:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # packageName=bmi/opendesk/components/platform-development/charts/nginx-s3-gateway/nginx-s3-gateway
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/nginx-s3-gateway"
+    name: "nginx-s3-gateway"
+    version: "1.0.1"
+    verify: true
  nubus:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -264,7 +291,27 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
    name: "nubus"
-    version: "0.64.2"
+    version: "1.4.0"
+    verify: true
+  opendeskAlerts:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-alerts"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-alerts"
+    name: "opendesk-alerts"
+    version: "1.1.0"
+    verify: true
+  opendeskDashboards:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegiostry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-dashboards"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-dashboards"
+    name: "opendesk-dashboards"
+    version: "1.1.0"
    verify: true
  opendeskKeycloakBootstrap:
    # providerCategory: "Platform"
@@ -286,7 +333,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
    name: "openproject"
-    version: "8.0.0"
+    version: "9.0.1"
    verify: true
  openprojectBootstrap:
    # providerCategory: "Platform"
@@ -298,28 +345,6 @@ charts:
    name: "opendesk-openproject-bootstrap"
    version: "2.1.1"
    verify: true
-  openXchangeAppSuite:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Open-Xchange"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["2", "2", "37"]
-    # upstreamRegistry: "https://registry.open-xchange.com"
-    # upstreamRepository: "appsuite-public-sector/charts/appsuite-public-sector"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
-    name: "appsuite-public-sector"
-    version: "2.10.9"
-    verify: false
-  openXchangeAppSuiteBootstrap:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap/opendesk-open-xchange-bootstrap"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap"
-    name: "opendesk-open-xchange-bootstrap"
-    version: "2.1.2"
-    verify: true
  otterize:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -330,6 +355,28 @@ charts:
    name: "opendesk-otterize"
    version: "2.1.0"
    verify: true
+  oxAppSuite:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["2", "2", "37"]
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/charts/appsuite-public-sector"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
+    name: "appsuite-public-sector"
+    version: "2.12.85"
+    verify: false
+  oxAppSuiteBootstrap:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap/opendesk-open-xchange-bootstrap"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap"
+    name: "opendesk-open-xchange-bootstrap"
+    version: "2.1.2"
+    verify: true
  oxConnector:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -380,7 +427,21 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse"
-    version: "3.4.1"
+    version: "5.0.1"
+    verify: true
+  synapseAdmin:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
+    verify: true
+  synapseAdminbotWeb:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
    verify: true
  synapseCreateAccount:
    # providerCategory: "Platform"
@@ -390,7 +451,21 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-create-account"
-    version: "3.4.1"
+    version: "5.0.1"
+    verify: true
+  synapseGroupsync:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
+    verify: true
+  synapsePipe:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
    verify: true
  synapseWeb:
    # providerCategory: "Platform"
@@ -400,7 +475,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-web"
-    version: "3.4.1"
+    version: "5.0.1"
    verify: true
  xwiki:
    # providerCategory: "Supplier"
--- a/helmfile/environments/default/cluster.yaml.gotmpl
+++ b/helmfile/environments/default/cluster.yaml.gotmpl
--- a/helmfile/environments/default/customization.yaml
+++ b/helmfile/environments/default/customization.yaml
@@ -1,57 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
---
-# This variable allows customization of helmfile releases by loading custom values file.
-# Example:
-# customization:
-#   release:
-#     collaboraOnline: /path/to/additional/file.yaml
-customization:
-  release:
-    # collabora
-    collaboraOnline: ~
-    # cryptpad
-    cryptpad: ~
-    # element
-    opendeskElement: ~
-    opendeskWellKnown: ~
-    opendeskSynapseWeb: ~
-    opendeskSynapse: ~
-    # jitsi
-    jitsi: ~
-    # migrations-post
-    migrationsPost: ~
-    # migrations-pre
-    migrationsPre: ~
-    # nextcloud
-    opendeskNextcloudManagement: ~
-    opendeskNextcloud: ~
-    # nubus
-    ums: ~
-    intercomService: ~
-    opendeskKeycloakBootstrap: ~
-    # open-xchange
-    dovecot: ~
-    openXchange: ~
-    opendeskOpenXchangeBootstrap: ~
-    oxConnector: ~
-    # openproject
-    openproject: ~
-    # openproject-bootstrap
-    opendeskOpenprojectBootstrap: ~
-    # services
-    opendeskOtterize: ~
-    opendeskHome: ~
-    opendeskCertificates: ~
-    redis: ~
-    memcached: ~
-    postgresql: ~
-    mariadb: ~
-    postfix: ~
-    opendeskDkimpyMilter: ~
-    clamav: ~
-    clamavSimple: ~
-    minio: ~
-    # xwiki
-    xwiki: ~
-...
--- a/helmfile/environments/default/customization.yaml.gotmpl
+++ b/helmfile/environments/default/customization.yaml.gotmpl
@@ -0,0 +1,78 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# This variable allows customization of helmfile releases by loading custom values file.
+#
+# **Warning**: Customizations are a very powerful tool to apply individual changes to your
+# openDesk installation. As there are no limits set for what you use it, openDesk cannot
+# support the configurations you are about to create using the customization-option. If you
+# have the demand for a specific configuration, try to get it into the openDesk standard
+# by creating a ticket at https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues
+#
+# Example:
+# customization:
+#   release:
+#     collaboraOnline:
+#       myCustomConfig: "/path/to/additional/file.yaml.gotmpl"
+customization:
+  release:
+    # collabora
+    collaboraOnline: {}
+    # cryptpad
+    cryptpad: {}
+    # element
+    opendeskElement: {}
+    opendeskWellKnown: {}
+    opendeskSynapseWeb: {}
+    opendeskSynapse: {}
+    # jitsi
+    jitsi: {}
+    # migrations-post
+    migrationsPost: {}
+    # migrations-pre
+    migrationsPre: {}
+    # nextcloud
+    opendeskNextcloudManagement: {}
+    opendeskNextcloud: {}
+    # nubus
+    ums: {}
+    intercomService: {}
+    opendeskKeycloakBootstrap: {}
+    nginxS3Gateway: {}
+    # open-xchange
+    dovecot: {}
+    openxchange: {}
+    opendeskOpenxchangeBootstrap: {}
+    oxConnector: {}
+    # openproject
+    openproject: {}
+    # openproject-bootstrap
+    opendeskOpenprojectBootstrap: {}
+    # services
+    opendeskOtterize: {}
+    opendeskHome: {}
+    opendeskCertificates: {}
+    opendeskAlerts: {}
+    opendeskDashboards: {}
+    redis: {}
+    memcached: {}
+    postgresql: {}
+    mariadb: {}
+    postfix: {}
+    opendeskDkimpyMilter: {}
+    clamav: {}
+    clamavSimple: {}
+    minio: {}
+    # xwiki
+    xwiki: {}
+
+    # openDesk Enterprise Components
+    cassandra: {}
+    opendeskSynapseAdmin: {}
+    opendeskSynapseAdminbotBootstrap: {}
+    opendeskSynapseAdminbotPipe: {}
+    opendeskSynapseAdminbotWeb: {}
+    opendeskSynapseAuditbotBootstrap: {}
+    opendeskSynapseAuditbotPipe: {}
+    opendeskSynapseGroupsync: {}
+...
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Dominik Kaminski	9e123ef681	feat(helmfile): Add template support for annotations	2024-12-10 16:58:09 +00:00
Thorsten Roßner	277a1f5a65	fix(helmfile): Splitting the directory `./helmfile/apps/services` into `-external` and `opendesk-` services, please read migrations.md for more details	2024-12-10 12:57:52 +01:00
Thorsten Roßner	0e3b661565	fix(helmfile): Streamline file extensions in `/helmfile/environments/default` to `*.yaml.gotmpl`., please read migrations.md for more details	2024-12-10 12:13:45 +01:00
MTRNord	627b9c1e84	fix(element): Toggle IPv4-only mode depending on cluster.networking.ipFamilies	2024-12-10 06:23:38 +00:00
Thomas Kaltenbrunner	00a1a9394e	fix(element): Prepare element for openDesk Enterprise.	2024-12-09 21:02:18 +01:00
Simon Herman	1441c5734f	feat(helmfile): Add grafana dashboards	2024-12-09 15:29:51 +00:00
Thorsten Roßner	9d7644dc04	fix(element): Update Synapse to 1.120.2 and Element to 1.11.87 update also related containers	2024-12-06 14:17:32 +01:00
Thorsten Roßner	54f9e4c3f8	fix(helmfile): Remove `default.user` and `default.admin` for new deployments.	2024-12-06 12:11:50 +00:00
Norbert Tretkowski	2a94f2dd4b	fix(nubus): Update to 1.4.0	2024-12-06 12:11:50 +00:00
Thomas Kaltenbrunner	c0cbb76921	fix(cassandra): Remove values in charts.yaml for enterprise components.	2024-12-04 18:42:54 +01:00
René Fischer	45add7981c	feat(jitsi): Enable Jitsi room history by default.	2024-12-04 16:11:49 +00:00
Oliver Günther	d3b191644b	fix(openproject): Update branding and Helm chart to 9.0.1	2024-12-04 14:16:25 +01:00
Thorsten Roßner	bbe7550c46	fix(docs): Add GitOps / Argo CD documentation	2024-12-04 05:51:08 +00:00
Thorsten Roßner	a9c8dfeab1	fix(helmfile): Auto-redirect user to login dialogue, please read migrations.md for more details	2024-12-04 05:50:27 +00:00
Lilly Sell	f630a369da	feat(helmfile): Add openDesk specific alerts	2024-12-03 11:15:49 +00:00
Thomas Kaltenbrunner	508e286232	fix(cassandra): Prepare cassandra for openDesk Enterprise.	2024-12-02 17:27:10 +01:00
Thorsten Roßner	407f2be2ad	fix(collabora): Update to 24.04.9.2.	2024-12-02 16:31:10 +01:00
Thorsten Roßner	18fcaa0331	fix(nextcloud): Update Chart to 3.6.1 and Image to 2.3.3 (including rollback to 29.0.8). Introducing setting for `functional.filestore.sharing.external.sendPasswordMail`	2024-12-02 12:07:05 +01:00
Thorsten Roßner	f96942536f	fix(helmfile): Streamline `commonLabels.deployStage`.	2024-11-29 12:20:15 +01:00
Thorsten Roßner	56ce3355fc	fix(jitsi): Update to 2.0.9823 and chart to 2.1.1	2024-11-29 06:24:38 +01:00
Thorsten Roßner	6ff1fcd438	fix(helmfile): Unify templating name for Open-Xchange to `openxchange` and for OX App Suite to `oxAppSuite`.	2024-11-28 15:07:25 +01:00
Dominik Kaminski	8611d95e5a	fix(open-xchange): Fix truststore decrypt error on self-signed deployments	2024-11-27 13:12:44 +01:00
Thorsten Roßner	86ef0be542	fix(helmfile): Use dictionaries for defining `customization.yaml`, please read migrations.md for more details	2024-11-26 17:02:48 +01:00
Dominik Kaminski	df144fe3d3	fix(services): Add template for certificate issuerRef.kind	2024-11-26 13:41:59 +01:00
Dominik Kaminski	83da87e962	feat(helmfile): Add template support for antivirus icap/milter	2024-11-26 08:59:57 +00:00
Thorsten Roßner	e2b3bd543f	fix(xwiki): Set superadmin password account only when debug is enabled	2024-11-26 07:03:30 +00:00
Thorsten Roßner	e5ad0bb2e0	fix(ci): Explicitly set RELEASE_BRANCH (to `main`) for scan and release steps	2024-11-25 16:23:17 +01:00
Dominik Kaminski	1213ecc425	fix(element): Rename release opendesk-element to opendesk-element-web	2024-11-25 16:14:46 +01:00
Dominik Kaminski	5e0b2e26fc	fix(services): Update Redis to 7.4.1 as required by OX Appsuite, please read migrations.md for more details	2024-11-25 16:14:04 +01:00
Dominik Kaminski	1402593556	fix(nextcloud): Add Redis TLS option	2024-11-23 06:50:12 +00:00
Dominik Kaminski	564fb2d7c7	fix(helmfile): Add Redis username and tls option	2024-11-23 06:50:12 +00:00
Dominik Kaminski	9e102e2d1b	fix(element): Add extensive database options	2024-11-23 06:50:12 +00:00
Dominik Kaminski	b3b6ab5a61	fix(nubus): Add nginx s3 proxy when minio disabled	2024-11-23 06:50:12 +00:00
Dominik Kaminski	7f1f6cdcd4	fix(nextcloud): Fix templating for nextcloud database name	2024-11-23 06:50:12 +00:00
Dominik Kaminski	de15071ae9	fix(xwiki): Fix templating for xwiki database port	2024-11-23 06:50:12 +00:00
Dominik Kaminski	c8c12a278e	fix(nextcloud): Fix templating for nextcloud database user	2024-11-23 06:50:12 +00:00
Luis Lürenbaum	71ff9141cb	chore(ci): Cleanup variables for e2e-test trigger	2024-11-22 11:55:49 +01:00
Thorsten Roßner	43f427e06a	fix(helmfile): Streamline `requests.cpu` in `resources.yaml`	2024-11-22 08:10:35 +01:00
Thorsten Roßner	31ea6e0e08	fix(open-xchange): Extend Dovecot LDAP filter to also match OX-Resources	2024-11-22 07:35:30 +01:00
Thorsten Roßner	1b13c3ea65	fix(nubus): Use favicon with transparent background for portal	2024-11-22 07:33:14 +01:00
Thorsten Roßner	0738fa080d	fix(helmfile): Allow usage of pre-defined CA certificates.	2024-11-20 16:01:45 +00:00
Oliver Günther	c06e0bb8d4	fix(openproject): Bump version to 15.0.2	2024-11-20 14:53:32 +01:00
Thorsten Roßner	c63cca72a3	fix(nextcloud): Update to 29.0.9 incl. latest apps.	2024-11-19 16:48:43 +01:00
Thorsten Roßner	9dbb2b755c	fix(jitsi): Update to switch the colors of `Hang up` and `End meeting for all` buttons.	2024-11-18 08:20:39 +01:00
openDesk Bot	08feab1cfc	fix(services): Update MariaDB chart to v3.0.3 in preparation for the use of external secrets.	2024-11-15 06:34:25 +00:00
Viktor Pracht	0c88699917	fix(open-xchange): Update AppSuite to 8.30, update Helm chart to 2.12.85	2024-11-14 16:55:19 +01:00
openDesk Bot	58fc76db5b	docs: Fix erroneous kubectl commands for fetching of secrets	2024-11-13 11:54:41 +00:00
Thorsten Roßner	5c691e4508	fix(jitsi): Update Jitsi Helm chart and images.	2024-11-13 12:23:19 +01:00
Thorsten Roßner	b6725dddc1	fix(helmfile): Remove `theme` subtree from the migration's `.Values` secret to avoid a bloated secret hitting limits in certain clusters setups and GitOps tools.	2024-11-06 16:33:49 +01:00
Oliver Günther	4c82adf668	fix(openproject): Update to 14.6.3 incl. latest Helm chart (8.3.2).	2024-11-05 07:46:27 +00:00
openDesk Bot	f1202f5fa5	chore(docs): Streamline for integration into docs.opendesk.eu	2024-11-05 08:44:03 +01:00
Dominik Kaminski	c71faf5e80	feat(helmfile): Allow custom/self-signed ca-certificates	2024-10-28 08:58:05 +01:00
Dominik Kaminski	b25ada1f60	fix(nextcloud): Support IPv4 only clusters	2024-10-26 08:02:49 +00:00
Thorsten Roßner	3b3679bab1	fix(nubus): Enable Keycloak debug mode logging; add Keycloak specific section to debugging.md	2024-10-15 16:21:55 +00:00
Thorsten Roßner	a86c0afdbb	fix(docs): Update and streamline README.md and migrations.md.	2024-10-15 16:21:55 +00:00
Thorsten Roßner	bc0ca8b4c1	fix(nextcloud): Trusted Proxy setting.	2024-10-15 16:21:17 +00:00
Thorsten Roßner	901b1f529e	fix(nubus): Update external portal links and login screen background.	2024-10-15 16:30:13 +02:00