fix(notes): Fix repeated redirects on expired session; Remove fetching of external assets

fix(open-xchange): Don't enable sasl auth when no relay host is set
fix(notes): Fix python path for self signed certs
2025-12-06 07:21:36 +01:00 · 2025-10-16 09:33:13 +00:00 · 2025-10-08 13:37:44 +00:00 · 2025-10-03 23:03:08 +02:00 · 2025-10-01 11:27:48 +02:00 · 2025-10-01 11:12:43 +02:00
15 changed files with 117 additions and 22 deletions
--- a/.gitlab/issue_templates/Default.md
+++ b/.gitlab/issue_templates/Default.md
@@ -0,0 +1,59 @@
+## 🐛 Issue Report Template
+
+Thank you for reporting an issue!
+Please provide the details below to help us investigate and resolve it efficiently.
+If you have a feature request, please select the "Feature Request" template.
+
+### 📦 Deployment Details
+- **Release version deployed**:
+  _(e.g. v1.4.2, commit hash, or branch name)_
+
+- **Deployment type**:
+  - [ ] Fresh installation
+  - [ ] Upgrade (from version: ___ )
+
+### ☸️ Kubernetes Environment
+- **Kubernetes distribution** (select one):
+  - [ ] Rancher RKE / RKE2
+  - [ ] OpenShift
+  - [ ] k3s
+  - [ ] kind / minikube
+  - [ ] Other: ___________
+
+- **Kubernetes version**:
+  _(e.g. v1.27.3)_
+
+### 🌐 Ingress & Certificates
+- **Ingress controller in use**:
+  - [ ] Ingress NGINX Controller version: ___
+  - [ ] Other: Currently only Ingress NGINX is supported
+
+- **Certificate status**:
+  - [ ] Let’s Encrypt
+  - [ ] Other publicly verifiable certificate (issuer: ___ )
+  - [ ] Self-signed certificate (see [`self-signed-certificated.md`](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/enhanced-configuration/self-signed-certificates.md))
+    - [ ] Option 1
+    - [ ] Option 2a
+    - [ ] Option 2b
+
+### 🔧 Tooling Versions
+- **Helm version (`helm version`)**: ___________
+- **Helmfile version (`helmfile --version`)**: ___________
+
+### 🔍 Problem Description
+- **Expected behavior**:
+
+- **Observed behavior / error message**:
+
+- **Steps to reproduce**:
+  1.
+  2.
+  3.
+
+### 📄 Additional context
+
+- Relevant logs (please redact sensitive info):
+- Screenshots (if applicable):
+- Other notes that might help:
+
+## 🙌 Thank you for contributing to the project!
--- a/.gitlab/issue_templates/Feature_Request.md
+++ b/.gitlab/issue_templates/Feature_Request.md
@@ -0,0 +1,37 @@
+## 💡 Feature Request Template
+
+Thank you for suggesting an improvement!
+To help us understand and evaluate your idea, please provide the details below.
+
+### 📝 Summary
+
+- **Short description of the feature**:
+  _(One or two sentences that capture the core idea)_
+
+### 🎯 Use Case / Motivation
+
+- **Who would benefit from this feature?**
+  - [ ] Operators / Administrators
+  - [ ] Developers
+  - [ ] End users
+  - [ ] Other: ___________
+
+- **Why is this feature needed?**
+  _(Describe the problem, pain point, or gap this would address)_
+
+### 🔧 Proposed Solution
+
+- **How should it work?**
+  _(Describe the desired functionality. If relevant, provide examples, CLI flags, configuration snippets, or workflows.)_
+
+### 📊 Alternatives Considered
+
+- **Other approaches you’ve tried or thought of**:
+  _(What’s possible now, and why is it not sufficient?)_
+
+### 📄 Additional Context
+
+- Links to related issues, merge requests, or external references:
+- Screenshots, diagrams, or mockups (if available):
+
+## 🙌 Thank you for helping improve the project!
--- a/README.md
+++ b/README.md
@@ -43,7 +43,7 @@ openDesk currently features the following functional main components:
 | Portal & IAM         | Nubus                       | AGPL-3.0-or-later                                                                      | [1.14.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/1.14.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
 | Project management   | OpenProject                 | GPL-3.0-only                                                                           | [16.4.1](https://www.openproject.org/docs/release-notes/16-4-1/)                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
 | Videoconferencing    | Jitsi                       | Apache-2.0                                                                             | [2.0.10431](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_10431)       | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
-| Weboffice            | Collabora                   | MPL-2.0                                                                                | [25.04.4](https://www.collaboraoffice.com/code-25-04-release-notes/)                          | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
+| Weboffice            | Collabora                   | MPL-2.0                                                                                | [25.04.5](https://www.collaboraoffice.com/code-25-04-release-notes/)                          | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |

 While not all components are perfectly designed for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -37,3 +37,8 @@ SPDX-License-Identifier = "CC-BY-SA-4.0"
 path = ".gitlab/merge_request_templates/*.md"
 SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
 SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = ".gitlab/issue_templates/*.md"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -168,7 +168,7 @@ While you will find all the details for the CLI tool in the [MariaDB documentati

 ## Nextcloud

-`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
+`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/stable/admin_manual/occ_command.html).

 You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`

--- a/docs/developer/development.md
+++ b/docs/developer/development.md
@@ -108,9 +108,9 @@ If you follow the "push early, push often" paradigm to save your work to the cen
 existing documentation, you can avoid the CI and its linting being executed, as it might not offer additional value.

 GitLab offers two options to skip the CI on a commit/push:
- Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
+1. Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
 **Note:** The string has to be removed before merging your feature branch into `develop`.
- Use the related git push option `git push -o ci.skip` ([details](https://docs.gitlab.com/ee/user/project/push_options.html#push-options-for-gitlab-cicd)).
+2. Use the related git push option `git push -o ci.skip` ([details](https://docs.gitlab.com/topics/git/commit/#push-options)).

 ## Renovate

--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -139,6 +139,6 @@ Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare

 [^1]: Due to a [Helm bug](https://github.com/helm/helm/issues/30890) Helm 3.18.0 is not supported.

-[^2]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail.
+[^2]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail. E.g. the `local-path-provisioner` does not have sticky bit support.

 [^3]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
--- a/helmfile/apps/notes/values.yaml.gotmpl
+++ b/helmfile/apps/notes/values.yaml.gotmpl
@@ -149,7 +149,7 @@ backend:
      subPath: "theme.json"
    {{- if .Values.certificate.selfSigned }}
    - name: "trusted-cert-secret-volume"
-      mountPath: "/usr/local/lib/python3.12/site-packages/certifi/cacert.pem"
+      mountPath: "/usr/local/lib/python3.13/site-packages/certifi/cacert.pem"
      subPath: "ca-certificates.crt"
    {{- end }}

--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -256,10 +256,6 @@ appsuite:
              open-xchange-authentication-masterpassword: "enabled"
          properties:
            com.openexchange.calendar.allowOrganizerPartStatChanges: "true"
-            # Mailfilter
-            com.openexchange.mail.filter.passwordSource: global
-            com.openexchange.mail.filter.masterPassword:  {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
-            com.openexchange.mail.filter.preferredSaslMech: ""
          propertiesFiles:
            /opt/open-xchange/etc/masterpassword-authentication.properties:
              com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -49,11 +49,11 @@ oxConnector:
  oxMasterAdmin: "admin"
  oxMasterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
  oxSmtpServer: "smtp://127.0.0.1:587"
-  oxSoapServer: "http://open-xchange-core-mw-admin"
+  oxSoapServer: {{ printf "http://%s.%s.svc.%s" "open-xchange-core-mw-admin" (.Values.apps.oxAppSuite.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}

 provisioningApi:
  connection:
-    baseUrl: "http://ums-provisioning-api"
+    baseUrl: {{ printf "http://%s.%s.svc.%s" "ums-provisioning-api" (.Values.apps.nubus.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
  auth:
    username: "ox-connector"
    password: {{ .Values.secrets.oxConnector.provisioningApiPassword | quote }}
--- a/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
@@ -63,10 +63,9 @@ postfix:
        value: {{ .Values.smtp.username }}
      password:
        value: {{ .Values.smtp.password }}
+  smtpSASLAuthEnable: "yes"
  {{- end }}
  allowRelayNets: false
-  smtpSASLAuthEnable: "yes"
-  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
  smtpTLSSecurityLevel: "encrypt"
  smtpdSASLAuthEnable: "yes"
  smtpdSASLSecurityOptions: "noanonymous"
--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -68,14 +68,13 @@ postfix:
        value: {{ .Values.smtp.username }}
      password:
        value: {{ .Values.smtp.password }}
+  smtpSASLAuthEnable: "yes"
  {{- end }}
  # Warning: This setting allows unauthenticated mail relay from relayNets!
  allowRelayNets: true
  relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
  minTLSVersion: "TLSv1.2"
  smtpdTLSMandatoryCiphers: "medium"
-  smtpSASLAuthEnable: "yes"
-  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
  smtpTLSSecurityLevel: "encrypt"
  smtpdSASLAuthEnable: "yes"
  smtpdSASLSecurityOptions: "noanonymous"
--- a/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
@@ -5,7 +5,7 @@ images:
  collabora:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "25.04.4.3.1@sha256:b0b5fa9b061df1e8473dff9bb2cf295ab41bd7b35a78b785de518883b07e97c2"
+    tag: "25.04.5.3.1@sha256:d22407cd3bd83dd832f986a697d81c1a4642f55129c76a5a20e637274ce7bf62"
  dovecot:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/dovecot-pro"
--- a/helmfile/environments/default/charts.yaml.gotmpl
+++ b/helmfile/environments/default/charts.yaml.gotmpl
@@ -437,7 +437,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix"
    name: "postfix"
-    version: "5.0.0"
+    version: "5.0.1"
    verify: true
  postgresql:
    # providerCategory: "Platform"
--- a/helmfile/environments/default/images.yaml.gotmpl
+++ b/helmfile/environments/default/images.yaml.gotmpl
@@ -50,7 +50,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "25.04.4.3.1@sha256:2ba934fb0dc18965bfaf19151017205b0a85af8b069bc34c994a8eae0b4bee34"
+    tag: "25.04.5.3.1@sha256:0e1ccf43308121c657936510de27244057c3826777a491495a0f7e55a196bc59"
  collaboraController:
    # Enterprise Component
    # providerCategory: "Supplier"
@@ -354,7 +354,7 @@ images:
    # upstreamRepository: "lasuite/impress-backend"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-notes"
-    tag: "1.11.0-docs-v3.4.0-backend@sha256:a07acb86ee260fd9242c4173a01c67c36552d149a2af91220348bdb588c19bf5"
+    tag: "1.12.1-docs-v3.4.0-backend@sha256:9d611d924056bd945499ef038ee7ac4c7a1196adfe0fc464d600d163dc42291a"
  notesFrontend:
    # providerCategory: "Supplier"
    # providerResponsible: "DINUM"
@@ -362,7 +362,7 @@ images:
    # upstreamRepository: "lasuite/impress-frontend"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-notes"
-    tag: "1.11.0-docs-v3.4.0-frontend@sha256:e7316700442455419ebb2e37fe2ae246bb90a7d09ad30477df608b5eb6089095"
+    tag: "1.12.1-docs-v3.4.0-frontend@sha256:51cb96a97dd5668366d9f664977cbb869e4a59499bf30bc1766528dd41843ac7"
  notesYProvider:
    # providerCategory: "Supplier"
    # providerResponsible: "DINUM"
@@ -370,7 +370,7 @@ images:
    # upstreamRepository: "lasuite/impress-y-provider"
    registry: "registry-1.docker.io"
    repository: "lasuite/impress-y-provider"
-    tag: "v3.2.1@sha256:9dd7068336c02fe71806bc3576e7dc8636d7ccb139667c6303f0753e18d3ab7e"
+    tag: "v3.4.0@sha256:fce38ca22cdc80c06803ded6f7147b6d1df22dd21f58ef834adef1d3aa83d667"
  nubusBlocklistCleanup:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
Author	SHA1	Message	Date
rweber	c1012f4e65	fix(notes): Fix repeated redirects on expired session; Remove fetching of external assets	2025-10-16 09:33:13 +00:00
Thomas Kaltenbrunner	ff3b221870	fix(open-xchange): Don't enable sasl auth when no relay host is set	2025-10-08 13:37:44 +00:00
Thomas Kaltenbrunner	c4279d11bb	fix(notes): Fix python path for self signed certs	2025-10-03 23:03:08 +02:00
Thorsten Roßner	98283aeef7	docs(requirements.md): Explicitly state that `local-path-provisioner` does not support sticky bit	2025-10-01 11:27:48 +02:00
Thorsten Roßner	26da7e3667	fix(gitlab): Add issue templates	2025-10-01 11:12:43 +02:00
Thorsten Roßner	8593d5f2bd	fix(ox-connector): Use FQDN for internal service URLs	2025-10-01 08:53:30 +02:00
Thorsten Roßner	4fd991b110	docs(misc): [bmi/opendesk/documentation/handbooks#1] Fixes broken external links	2025-09-30 09:30:24 +02:00
Thorsten Roßner	e0128e6ccf	fix(collabora): Update from 25.04.4.3.1 to 25.04.5.3.1	2025-09-26 09:46:08 +02:00