feat(helmfile): Add template support for external secrets for mariadb

Signed-off-by: Axel Lender <lender@b1-systems.de>
fix(postfix): Require TLSv1.3
2025-12-06 15:31:38 +01:00 · 2025-05-23 10:30:53 +02:00 · 2025-05-22 10:15:24 +02:00 · 2025-05-20 08:38:04 +02:00
6 changed files with 26 additions and 2 deletions
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ openDesk currently features the following functional main components:
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89)                                                | [For the most recent release](https://element.io/user-guide)                                                                          |
 | Collaborative notes  | Notes (aka Docs)            | [2.4.0](https://github.com/suitenumerique/docs/releases/tag/v2.4.0)                                                           | Online documentation/welcome document available in installed application                                                              |
 | Diagram editor       | CryptPad ft. diagrams.net   | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                                                        | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | [30.0.6](https://nextcloud.com/de/changelog/#30-0-6)                                                                          | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
+| File management      | Nextcloud                   | [30.0.10](https://nextcloud.com/de/changelog/#30-0-10)                                                                          | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
 | Groupware            | OX App Suite                | [8.37](https://documentation.open-xchange.com/appsuite/releases/8.37/)                                                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
 | Knowledge management | XWiki                       | [16.10.5](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.5/)                                              | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
 | Portal & IAM         | Nubus                       | [1.9.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html#version-1-9-1-2025-05-07) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
--- a/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
@@ -55,6 +55,10 @@ postfix:
  {{- if .Values.apps.dkimpy.enabled }}
  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
  {{- end }}
+
+  minTLSVersion: "TLSv1.3"
+  smtpdTLSMandatoryCiphers: "high"
+
  rspamdHost: ""
  relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
  allowRelayNets: false
--- a/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
@@ -72,6 +72,9 @@ job:
 mariadb:
  rootPassword:
    value: {{ .Values.secrets.mariadb.rootPassword | quote }}
+    existingSecret:
+      name: {{ .Values.external_secrets.mariadb.rootPassword.name | quote }}
+      key: {{ .Values.external_secrets.mariadb.rootPassword.key | quote }}

 persistence:
  size: {{ .Values.persistence.storages.mariadb.size | quote }}
--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -65,8 +65,14 @@ postfix:
  {{- end }}
  rspamdHost: ""
  relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
+
+  # Warning: This setting allows unauthenticated mail relay from relayNets!
  relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
  allowRelayNets: true
+
+  minTLSVersion: "TLSv1.3"
+  smtpdTLSMandatoryCiphers: "high"
+
  smtpSASLAuthEnable: "yes"
  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
  smtpTLSSecurityLevel: "encrypt"
--- a/helmfile/environments/default/external_secrets.yaml.gotmpl
+++ b/helmfile/environments/default/external_secrets.yaml.gotmpl
@@ -0,0 +1,11 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+external_secrets:
+  mariadb:
+    rootPassword:
+      name: ~
+      key: ~
+...
--- a/helmfile/environments/default/images.yaml.gotmpl
+++ b/helmfile/environments/default/images.yaml.gotmpl
@@ -320,7 +320,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.5.0@sha256:9457bc2116620e52dcd1f5f12f042090aa4cca2a3e4d5f64b7c84c232ca6bb63"
+    tag: "2.6.0@sha256:47b9d01b70f72a717ce89a80bf36a2c01653c6a7335dd3287f7cab1555aa8864"
  nextcloudExporter:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
Author	SHA1	Message	Date
Axel Lender	2e1c3213b0	feat(helmfile): Add template support for external secrets for mariadb Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-05-23 10:30:53 +02:00
Thomas Kaltenbrunner	cb9f24bf05	fix(postfix): Require TLSv1.3	2025-05-22 10:15:24 +02:00
Tilman Lüttje	c3a6452b9e	feat(nextcloud): Update to patch level 30.0.10	2025-05-20 08:38:04 +02:00