feat(postgresql): Add template support for existing secrets

Signed-off-by: Axel Lender <lender@b1-systems.de>
feat(mariadb): Add template support for existing secrets
2025-12-06 15:31:38 +01:00 · 2025-12-03 21:26:07 +01:00 · 2025-12-03 21:18:21 +01:00 · 2025-11-27 14:03:07 +01:00 · 2025-11-13 11:15:16 +01:00 · 2025-11-13 11:15:16 +01:00
65 changed files with 2070 additions and 491 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -762,7 +762,7 @@ import-default-accounts:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $CREATE_DEFAULT_ACCOUNTS == "yes"
      when: "on_success"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.3.2"
  script:
    - "echo \"Starting default account import for ${DOMAIN}\""
    - "cd /app"
--- a/.gitlab/issue_templates/Default.md
+++ b/.gitlab/issue_templates/Default.md
@@ -0,0 +1,59 @@
+## 🐛 Issue Report Template
+
+Thank you for reporting an issue!
+Please provide the details below to help us investigate and resolve it efficiently.
+If you have a feature request, please select the "Feature Request" template.
+
+### 📦 Deployment Details
+- **Release version deployed**:
+  _(e.g. v1.4.2, commit hash, or branch name)_
+
+- **Deployment type**:
+  - [ ] Fresh installation
+  - [ ] Upgrade (from version: ___ )
+
+### ☸️ Kubernetes Environment
+- **Kubernetes distribution** (select one):
+  - [ ] Rancher RKE / RKE2
+  - [ ] OpenShift
+  - [ ] k3s
+  - [ ] kind / minikube
+  - [ ] Other: ___________
+
+- **Kubernetes version**:
+  _(e.g. v1.27.3)_
+
+### 🌐 Ingress & Certificates
+- **Ingress controller in use**:
+  - [ ] Ingress NGINX Controller version: ___
+  - [ ] Other: Currently only Ingress NGINX is supported
+
+- **Certificate status**:
+  - [ ] Let’s Encrypt
+  - [ ] Other publicly verifiable certificate (issuer: ___ )
+  - [ ] Self-signed certificate (see [`self-signed-certificated.md`](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/enhanced-configuration/self-signed-certificates.md))
+    - [ ] Option 1
+    - [ ] Option 2a
+    - [ ] Option 2b
+
+### 🔧 Tooling Versions
+- **Helm version (`helm version`)**: ___________
+- **Helmfile version (`helmfile --version`)**: ___________
+
+### 🔍 Problem Description
+- **Expected behavior**:
+
+- **Observed behavior / error message**:
+
+- **Steps to reproduce**:
+  1.
+  2.
+  3.
+
+### 📄 Additional context
+
+- Relevant logs (please redact sensitive info):
+- Screenshots (if applicable):
+- Other notes that might help:
+
+## 🙌 Thank you for contributing to the project!
--- a/.gitlab/issue_templates/Feature_Request.md
+++ b/.gitlab/issue_templates/Feature_Request.md
@@ -0,0 +1,37 @@
+## 💡 Feature Request Template
+
+Thank you for suggesting an improvement!
+To help us understand and evaluate your idea, please provide the details below.
+
+### 📝 Summary
+
+- **Short description of the feature**:
+  _(One or two sentences that capture the core idea)_
+
+### 🎯 Use Case / Motivation
+
+- **Who would benefit from this feature?**
+  - [ ] Operators / Administrators
+  - [ ] Developers
+  - [ ] End users
+  - [ ] Other: ___________
+
+- **Why is this feature needed?**
+  _(Describe the problem, pain point, or gap this would address)_
+
+### 🔧 Proposed Solution
+
+- **How should it work?**
+  _(Describe the desired functionality. If relevant, provide examples, CLI flags, configuration snippets, or workflows.)_
+
+### 📊 Alternatives Considered
+
+- **Other approaches you’ve tried or thought of**:
+  _(What’s possible now, and why is it not sufficient?)_
+
+### 📄 Additional Context
+
+- Links to related issues, merge requests, or external references:
+- Screenshots, diagrams, or mockups (if available):
+
+## 🙌 Thank you for helping improve the project!
--- a/.gitlab/merge_request_templates/Bugfix.md
+++ b/.gitlab/merge_request_templates/Bugfix.md
@@ -42,7 +42,6 @@ Set labels:
 ```
 /label ~"MR-Type::Bugfix"
 /label ~"PO::👀"
-/label ~"Tech Lead::👀"
 /label ~"QA::👀"
 /label ~"Testautomation::👀"
 ```
--- a/.gitlab/merge_request_templates/Feature.md
+++ b/.gitlab/merge_request_templates/Feature.md
@@ -29,7 +29,6 @@ Set labels:
 ```
 /label ~"MR-Type::Feature"
 /label ~"PO::👀"
-/label ~"Tech Lead::👀"
 /label ~"QA::👀"
 /label ~"Testautomation::👀"
 ```
--- a/.gitlab/merge_request_templates/Other.md
+++ b/.gitlab/merge_request_templates/Other.md
@@ -23,7 +23,6 @@ Set labels:
 ```
 /label ~"MR-Type::Other"
 /label ~"PO::👀"
-/label ~"Tech Lead::👀"
 /label ~"QA::👀"
 /label ~"Testautomation::👀"
 ```
--- a/.gitlab/merge_request_templates/Update.md
+++ b/.gitlab/merge_request_templates/Update.md
@@ -10,7 +10,7 @@

 ## 🔄 Requirements for migrations

- [ ] Minimum version of the application required in existing depoyments to update/upgrade:
+- [ ] Minimum version of the application required in existing deployments to update/upgrade:
 - [ ] Describe manual steps required to update existing deployments. This especially applies if the upgrade includes any breaking changes:
 - [ ] Any other considerations in context of the update:

@@ -23,7 +23,6 @@ Set labels:
 ```
 /label ~"MR-Type::AppUpdate"
 /label ~"PO::👀"
-/label ~"Tech Lead::👀"
 /label ~"QA::👀"
 /label ~"Testautomation::👀"
 ```
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,46 @@
+# [1.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.7.1...v1.8.0) (2025-09-25)
+
+
+### Bug Fixes
+
+* **clamav:** [bmi/opendesk/deployment/opendesk[#234](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/234)] Update Helm chart to support conditional proxy credentials ([dee7525](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dee75256492577c7b2ab6bafd741e06f98acfccd))
+* **element:** Let Synapse create room `v12` by default; review `migrations.md` for details ([af9d4cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/af9d4cda6cf641e65fe49054e1397159272f3bd1))
+* **helmfile:** Add more detailed descriptions on `functional.authentication.realmSettings` and provide two `accessCodeLifespan*` options ([0314a70](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0314a7076ae7d377d86c3ff3acda691966a36635))
+* **helmfile:** Do not set portal "Support" link by default ([776fe92](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/776fe92ae18963b11503d4d7e20bbf298902ad9b))
+* **intercom-service:** Update from v2.19.0 to v2.19.5 ([3305dfa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3305dfa5fb4a22bd5354dec1f65eb0e95eed678d))
+* **jitsi:** [bmi/opendesk/deployment/opendesk[#228](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/228)] Turn off Gravatar option, by default this still keeps the input field in the Jitsi UI, but does not longer issue requests to gravatar.com; check `migrations.md` in case the option should be enabled ([083fa98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/083fa9842d6bd9c27eabac28f49668e5bee02a42))
+* **nextcloud:** App "Spreed" and core app "Comments" not enabled by default; review `migrations.md` for potential upgrade steps ([31d35b2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31d35b25c6cf0e4a18cf6f33b01a6dd0fd10545e))
+* **nextcloud:** Update from 31.0.6 to 31.0.7 including the latest app versions ([f848b9a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f848b9a0f4d6f65babb983b6527bfc63776b455a))
+* **open-xchange:** Add client onboarding for mail ([d8fc3e0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d8fc3e04f584da23bfd0590676f26cbac65bf4cf))
+* **open-xchange:** Set guest mode to inherit theming and set theme for notification mail button ([f2ce251](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f2ce25193a78eee3f103aabb368bf8457900fa1c))
+* **open-xchange:** Switch off Element integration when `apps.element.enabled: [secure]` ([7a2dbc5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7a2dbc5f8cca5981ffc171f2be1b72c40877ac2c))
+* **open-xchange:** Update Dovecot charts with improved auth cache defaults ([836d8a4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/836d8a494dcd2e8ab8ea95684742cd143cac6074))
+* **opendesk-certificates:** [bmi/opendesk/deployment/opendesk[#236](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/236)] Update Helm chart to add `commonName` to certificate ([2e708a7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2e708a75b6abdb987925333714c99d1e09bbc5a2))
+* **openproject:** [bmi/opendesk/deployment/opendesk[#228](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/228)] Turn off Gravatar option by default; check `migrations.md` in case the option should be enabled ([628e914](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/628e91435c37a615a421a48c2a9a0639840d9a78))
+* **ox-connector:** Update from v0.27.7 to v0.27.9 ([ba77f2b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ba77f2b11c0eb649891a5375258e6649686333fb))
+* **postfix:** Relax TLS settings to `TLSv1.2`/`medium` for broader SMTP relay compatibility ([31cbd9a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31cbd9af1a9afb177b70bccd329829f75bceab03))
+* **xwiki:** Update image to set new default for user self-registration; review migrations.md for required actions on existing deployments ([c75abaf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c75abaf1e660fe8daeeb09ee3d41e14ea67e9a25))
+
+
+### Features
+
+* **collabora:** Support for macro execution controlled by `functional.weboffice.macros.enabled` (default: `[secure]`) ([38f2bdd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/38f2bdd2b98e4248972363db73c03373db71f433))
+* **cryptpad:** Update from 2024.6.1 to 2025.6.0 ([23dfe0a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/23dfe0aaa6012f5695fc026d06920bd4b0a63f66))
+* **element:** Update Element-Web from 1.11.89 or 1.12.0 and Synapse from 1.129.0 to 1.137.0 ([f895bcc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f895bcc2b8a7d4010b19c7ffb6712c4813231f9d))
+* **element:** Update NeoBoard widget to v2.3.1, NeoChoice widget to v1.6.0, NeoDateFix widget to v1.7.2 and NeoDateFix bot to 2.8.5 ([b377a5e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b377a5e0e25e317c64c2d30b44370beb211e23fd))
+* **jitsi:** Upgrade from stable-9955 to stable-10431 ([e138610](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e138610d2941f6c3a93eef3764f252bd4eab9987))
+* **nextcloud:** Expose `forbiddenChars` in `functional.yaml.gotmpl`; review `migrations.md` for required upgrade steps ([5a2c1fc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5a2c1fcf98d3773deef8292773962d5f70832a0f))
+* **notes:** Update from 3.2.1 to 3.4.0 ([c636650](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c63665040cf3c985dc9878992785a893d261c420))
+* **nubus:** Update from 1.12.0 to 1.13.1 ([35424b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/35424b88d652a1e8a4c37fee4355636badba22b6))
+* **nubus:** Update from v1.13.1 to v1.14.0 using OIDC instead of SAML for portal SSO; review `migrations.md` for required upgrade steps ([d3b1f57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d3b1f575cc2deab70ca262ab301c6b67f9c1b393))
+* **open-xchange:** Add options to `functional.groupware`; review `migrations.md` for details on new defaults/required upgrade steps ([8a7cc3b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8a7cc3b8c7199f8c15f01e1b2d55d630431ddf9c))
+* **open-xchange:** Enable mail categories ([4da1c5d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4da1c5d9e3b1f66419a5e19ba683cff5681315bd))
+* **open-xchange:** Update from 8.39 to 8.40 ([c70a0bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c70a0bdc4c1564032982a2967788e0b78db74c00))
+* **open-xchange:** Update from 8.40 to 8.41 ([c50b817](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c50b81779539186f3885d6bdb64d348fbe7bda67))
+* **openproject:** Update OpenProject from 16.2.1 to 16.3.2 ([f77f329](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f77f3291caf778274c23f89bde3661e586447f5a))
+* **openproject:** Update OpenProject from 16.3.2 to 16.4.1 ([f5483d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f5483d1a3b4cb8fddff38bb9fc29439cd6c4fc40))
+* **xwiki:** Update from 16.10.5 to 17.4.4 and configure openDesk's Collabora for `.odt`, `.rtf` and `.docx` export of wiki pages ([813e92c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/813e92c1b05f806bff8022d71d8cd25f475b0b8f))
+
 ## [1.7.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.7.0...v1.7.1) (2025-08-26)


--- a/README.md
+++ b/README.md
@@ -32,18 +32,18 @@ For production use, the [openDesk Enterprise Edition](./README-EE.md) is recomme

 openDesk currently features the following functional main components:

-| Function             | Functional component        | License                                                                                | Component<br/>version                                                                                                   | Upstream documentation                                                                                                                |
-|----------------------|-----------------------------|----------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
-| Chat & collaboration | Element ft. Nordeck widgets | AGPL-3.0-or-later (Element Web), AGPL-3.0-only (Synapse), Apache-2.0 (Nordeck widgets) | [1.11.89](https://github.com/element-hq/element-web/releases/tag/v1.11.89)                                              | [For the most recent release](https://element.io/user-guide)                                                                          |
-| Collaborative notes  | Notes (aka Docs)            | MIT                                                                                    | [3.2.1](https://github.com/suitenumerique/docs/releases/tag/v3.2.1)                                                     | Online documentation/welcome document available in installed application                                                              |
-| Diagram editor       | CryptPad ft. diagrams.net   | AGPL-3.0-only                                                                          | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                                                  | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | AGPL-3.0-or-later                                                                      | [31.0.7](https://nextcloud.com/de/changelog/#31-0-7)                                                                    | [Nextcloud 31](https://docs.nextcloud.com/)                                                                                           |
-| Groupware            | OX App Suite                | GPL-2.0-only (backend), AGPL-3.0-or-later (frontend)                                   | [8.40](https://documentation.open-xchange.com/appsuite/releases/8.40/)                                                  | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
-| Knowledge management | XWiki                       | LGPL-2.1-or-later                                                                      | [17.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.4.4/)                                          | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
-| Portal & IAM         | Nubus                       | AGPL-3.0-or-later                                                                      | [1.13.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/1.13.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | GPL-3.0-only                                                                           | [16.3.2](https://www.openproject.org/docs/release-notes/16-3-2/)                                                        | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
-| Videoconferencing    | Jitsi                       | Apache-2.0                                                                             | [2.0.9955](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9955)                                   | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
-| Weboffice            | Collabora                   | MPL-2.0                                                                                | [25.04.4](https://www.collaboraoffice.com/code-25-04-release-notes/)                                                    | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
+| Function             | Functional component        | License                                                                                | Component<br/>version                                                                         | Upstream documentation                                                                                                                |
+|----------------------|-----------------------------|----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
+| Chat & collaboration | Element ft. Nordeck widgets | AGPL-3.0-or-later (Element Web), AGPL-3.0-only (Synapse), Apache-2.0 (Nordeck widgets) | [1.12.0](https://github.com/element-hq/element-web/releases/tag/v1.12.0)                      | [For the most recent release](https://element.io/user-guide)                                                                          |
+| Collaborative notes  | Notes (aka Docs)            | MIT                                                                                    | [3.4.0](https://github.com/suitenumerique/docs/releases/tag/v3.4.0)                           | Online documentation/welcome document available in installed application                                                              |
+| Diagram editor       | CryptPad ft. diagrams.net   | AGPL-3.0-only                                                                          | [2025.6.0](https://github.com/cryptpad/cryptpad/releases/tag/2025.6.0)                        | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
+| File management      | Nextcloud                   | AGPL-3.0-or-later                                                                      | [31.0.7](https://nextcloud.com/de/changelog/#31-0-7)                                          | [Nextcloud 31](https://docs.nextcloud.com/)                                                                                           |
+| Groupware            | OX App Suite                | GPL-2.0-only (backend), AGPL-3.0-or-later (frontend)                                   | [8.41](https://documentation.open-xchange.com/appsuite/releases/8.41/)                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Knowledge management | XWiki                       | LGPL-2.1-or-later                                                                      | [17.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.4.4/)                | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
+| Portal & IAM         | Nubus                       | AGPL-3.0-or-later                                                                      | [1.14.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/1.14.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
+| Project management   | OpenProject                 | GPL-3.0-only                                                                           | [16.4.1](https://www.openproject.org/docs/release-notes/16-4-1/)                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Videoconferencing    | Jitsi                       | Apache-2.0                                                                             | [2.0.10431](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_10431)       | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
+| Weboffice            | Collabora                   | MPL-2.0                                                                                | [25.04.5](https://www.collaboraoffice.com/code-25-04-release-notes/)                          | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |

 While not all components are perfectly designed for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -37,3 +37,8 @@ SPDX-License-Identifier = "CC-BY-SA-4.0"
 path = ".gitlab/merge_request_templates/*.md"
 SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
 SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = ".gitlab/issue_templates/*.md"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
--- a/docs/data-storage.md
+++ b/docs/data-storage.md
@@ -71,7 +71,7 @@ XWiki,PersistentVolume,1
 | **ClamAV**           | PVC          | No       | ClamAV Database                                                                   | `clamav-database-clamav-simple-0`              | `/var/lib/clamav`                                                                                         |
 | **Dovecot**          | PVC          | Yes      | openDesk CE only: User mail directories                                           | `dovecot`                                      | `/srv/mail`                                                                                               |
 |                      | S3           | Yes      | openDesk EE only: User mail                                                       | `dovecot`                                      | `dovecot`                                                                                                 |
-|                      | Cassandra    | Yes      | openDesk EE only: Metadata and ACLs                                               | `dovecot_dictmap`, `dovecot_acl`               |
+|                      | Cassandra    | Yes      | openDesk EE only: Metadata and ACLs                                               | `dovecot_dictmap`, `dovecot_acl`               |                                                                                                           |
 | **Element/Synapse**  | PostgreSQL   | Yes      | Application's main database                                                       | `matrix`                                       |                                                                                                           |
 |                      | PVC          | Yes      | Attachments                                                                       | `media-opendesk-synapse-0`                     | `/media`                                                                                                  |
 |                      |              | Yes      | Sync and state data                                                               | `matrix-neodatefix-bot`                        | `/app/storage`                                                                                            |
@@ -83,6 +83,7 @@ XWiki,PersistentVolume,1
 | **Nubus**            | PostgreSQL   | Yes      | Main database for Nubus' IdP Keycloak                                             | `keycloak`                                     |                                                                                                           |
 |                      |              | Yes      | Login actions and device-fingerprints                                             | `keycloak_extensions`                          |                                                                                                           |
 |                      |              | Optional | Store of the temporary password reset token                                       | `selfservice`                                  |                                                                                                           |
+|                      |              | Optional | OIDC session storage                                                              | `umsAuthSession`                               |                                                                                                           |
 |                      |              | No       | Notification features are not used in openDesk 1.1                                | `notificationsapi`                             |                                                                                                           |
 |                      |              | No       | Guardian features are currently not used in openDesk 1.1                          | `guardianmanagementapi`                        |                                                                                                           |
 |                      | S3           | No       | Static files for Portal                                                           | `ums`                                          |                                                                                                           |
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -168,7 +168,7 @@ While you will find all the details for the CLI tool in the [MariaDB documentati

 ## Nextcloud

-`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
+`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/stable/admin_manual/occ_command.html).

 You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`

@@ -218,6 +218,9 @@ kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"dat
 > **Note**<br>
 > Because the `ums-keycloak-extensions-handler` is sending frequent requests (one per second) to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.

+> **Note**<br>
+> While you can set the standard log levels like `INFO`, `DEBUG`, `TRACE` etc. you can also set class specific logs by comma separating the details in the `KC_LOG_LEVEL` environment variable like e.g. `INFO,org.keycloak.protocol.oidc.endpoints:TRACE`. The example sets the overall loglevel to `INFO` but provides trace logs for `org.keycloak.protocol.oidc.endpoints`.
+
 ### Accessing the Keycloak admin console

 Deployments set to `debug.enable: true` expose the Keycloak admin console at `http://id.<your_opendesk_domain>/admin/`. This can also be achieved by updating the Ingress `ums-keycloak-extensions-proxy` with an additional path that allows access to `/admin/`.
--- a/docs/developer/development.md
+++ b/docs/developer/development.md
@@ -108,9 +108,9 @@ If you follow the "push early, push often" paradigm to save your work to the cen
 existing documentation, you can avoid the CI and its linting being executed, as it might not offer additional value.

 GitLab offers two options to skip the CI on a commit/push:
- Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
+1. Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
 **Note:** The string has to be removed before merging your feature branch into `develop`.
- Use the related git push option `git push -o ci.skip` ([details](https://docs.gitlab.com/ee/user/project/push_options.html#push-options-for-gitlab-cicd)).
+2. Use the related git push option `git push -o ci.skip` ([details](https://docs.gitlab.com/topics/git/commit/#push-options)).

 ## Renovate

--- a/docs/enhanced-configuration/self-signed-certificates.md
+++ b/docs/enhanced-configuration/self-signed-certificates.md
@@ -38,6 +38,8 @@ access openDesk.
    ```yaml
    certificate:
      selfSigned: true
+      caCertificate:
+        create: false
    ```

 3. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
@@ -50,6 +52,10 @@ CA certificate as X.509 encoded (`ca.crt`) and as jks trust store (`truststore.j
 5. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
 trust store password.

+> **Note**<br>
+> XWiki does not support the use of an existing secret to access the keystore. Therefore you have to set the password
+> from step 5 also as `secrets.certificates.password`.
+
 ## Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate

 This option is useful when you do not have a trusted certificate available and can't fetch a certificate from
--- a/docs/existing-secrets.md
+++ b/docs/existing-secrets.md
@@ -0,0 +1,360 @@
+<!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Existing Secrets</h1>
+
+This document covers how to utilise existing secrets and special requirements. The examples documented here are mostly showing the format with the openDesk default values.
+
+<!-- TOC -->
+* [General](#general)
+* [Components](#components)
+  * [Cassandra](#cassandra)
+  * [Keycloak](#keycloak)
+  * [MariaDB](#mariadb)
+  * [MinIO](#minio)
+  * [Notes](#notes)
+  * [OpenProject](#openproject)
+  * [PostgreSQL](#postgresql)
+  * [XWiki](#xwiki)
+<!-- TOC -->
+
+# General
+
+⚠ ATTENTION: This feature is still in early development. For now you can't simply replace plain secrets with existing secrets because some secrets are used several components where some maybe don't support existing secrets by now.
+
+For most components when set the existing secret will supersede e.g. a password in a `values.yaml` file.
+
+The file [`existing_secrets.yaml`](/helmfile/environments/default/existing_secrets.yaml.gotmpl) lists all possible references to existing secrets that are currently implemented in openDesk.
+
+# Components
+
+This section covers information and special requirements to existing secrets that some Helm Charts expect.
+
+## Cassandra
+
+Cassandra is pre-populated with information regarding Dovecot with a `cql` script. The openDesk default `initDB` setting is configured as follows:
+
+```yaml
+  initUserData.cql: >
+    CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
+    CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.username | quote }};
+    ALTER ROLE {{ .Values.databases.dovecotDictmap.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotDictmapUser "''" | squote }} AND LOGIN = true;
+    GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotDictmap.name | quote }} TO {{ .Values.databases.dovecotDictmap.username | quote }};
+    CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotACL.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
+    CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotACL.username | quote }};
+    ALTER ROLE {{ .Values.databases.dovecotACL.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotACLUser "''" | squote }} AND LOGIN = true;
+    GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotACL.name | quote }} TO {{ .Values.databases.dovecotACL.username | quote }};
+```
+
+This has to be adapted into a secret that also holds a `cql` script and is named in `initDBSecret`.
+
+## Keycloak
+
+Several existing secrets utilised by the Keycloak bootstrap chart are expected in a special format and/or key.
+
+### Admin credentials
+
+```yaml
+stringData:
+  admin.yaml: |
+    username: "kcadmin"
+    password: "{{ .Values.secrets.keycloak.adminPassword }}"
+```
+
+### ox-connector
+
+The secret `openxchangeConnector.provisioningApiPassword` has to provide a JSON file. The value `.Values.secrets.oxConnector.provisioningApiPassword` is taken from the default openDesk install without existing secrets and has to be replaced by some secret value. The following format is expected:
+
+```yaml
+    stringData:
+      ox-connector.json: "{ \"name\": \"ox-connector\", \"realms_topics\": [{\"realm\": \"udm\", \"topic\": \"oxmail/oxcontext\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/accessprofile\"}, {\"realm\": \"udm\", \"topic\": \"users/user\"}, {\"realm\": \"udm\", \"topic\": \"oxresources/oxresources\"}, {\"realm\": \"udm\", \"topic\": \"groups/group\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/functional_account\"}], \"request_prefill\": true, \"password\": \"{{ .Values.secrets.oxConnector.provisioningApiPassword }}\" }"
+```
+
+### LDAP Search
+
+The secret `nubus.ldapSearch.keycloak` has the requirement to use `password` as key.
+
+### SSOFederation and Clients
+
+Values taken from those existing secrets will supersede secret values that are already present for the `client`/`IdP` in the configuration or add them accordingly. Further the secrets for the have to provide a `yaml` file in a special format. Both formats rely on the same key as used in the configuration respectively. The expected format for each configuration can be seen in the table below:
+
+|Section                                              |Format       |
+|-----------------------------------------------------|-------------|
+|`functional.authentication.clients`                  |1.           |
+|`functional.authentication.ssoFederation.idpDict`    |2.           |
+|`keycloak.clients`                                   |1.           |
+
+1. Expected format for the `clients` secrets:
+ 
+    ```yaml
+    opendesk-intercom:
+      clientId: "opendesk-intercom"
+      secret: "{{ .Values.secrets.keycloak.clientSecret.intercom }}"
+    opendesk-notes:
+      clientId: "opendesk-notes"
+      secret: "{{ .Values.secrets.keycloak.clientSecret.notes }}"
+    opendesk-dovecot:
+      clientId: "opendesk-dovecot"
+      secret: "{{ .Values.secrets.keycloak.clientSecret.dovecot }}"
+    opendesk-oxappsuite:
+      clientId: "opendesk-oxappsuite"
+      secret: "{{ .Values.secrets.keycloak.clientSecret.as8oidc }}"
+    opendesk-matrix:
+      clientId: "opendesk-matrix"
+      secret: "{{ .Values.secrets.keycloak.clientSecret.matrix }}"
+    opendesk-nextcloud:
+      clientId: "opendesk-nextcloud"
+      secret: "{{ .Values.secrets.keycloak.clientSecret.ncoidc }}"
+    opendesk-openproject:
+      clientId: "opendesk-openproject"
+      secret: "{{ .Values.secrets.keycloak.clientSecret.openproject }}"
+    opendesk-xwiki:
+      clientId: "opendesk-xwiki"
+      secret: "{{ .Values.secrets.keycloak.clientSecret.xwiki }}"
+    ```
+
+2. Expected format for the `ssoFederation` secret:
+
+    ```yaml
+    yourIdpDictEntry:
+      clientId: "yourSecretValueHere"
+      clientSecret: "yourSecretValueHere"
+    ```
+## MariaDB
+
+When initialising databases, users and credentials the Chart expects `.sql` files inside the secret to mount and feed them to the database client.
+
+The expected format for the databases is as follows:
+
+```yaml
+stringData:
+  init-db-open-xchange.sql: |
+    CREATE DATABASE IF NOT EXISTS openxchange_dummy;
+    GRANT ALL PRIVILEGES ON openxchange_dummy.* TO "openxchange_user"@"%";
+    FLUSH PRIVILEGES;
+  init-db-nextcloud.sql: |
+    CREATE DATABASE IF NOT EXISTS nextcloud;
+    GRANT ALL PRIVILEGES ON nextcloud.* TO "nextcloud_user"@"%";
+    FLUSH PRIVILEGES;
+  init-db-xwiki.sql: |
+    CREATE DATABASE IF NOT EXISTS xwiki;
+    GRANT ALL PRIVILEGES ON xwiki.* TO "xwiki_user"@"%";
+    FLUSH PRIVILEGES;
+```
+
+For the user and credentials the following format is expected:
+
+```yaml
+stringData:
+  init-user-open-xchange.sql: |
+    CREATE USER IF NOT EXISTS "openxchange_user"@"%" IDENTIFIED BY {{ .Values.secrets.mariadb.openxchangeUser | quote }};
+    ALTER USER "openxchange_user"@"%" WITH MAX_USER_CONNECTIONS 100;
+    ALTER USER "openxchange_user"@"%" IDENTIFIED BY {{ .Values.secrets.mariadb.openxchangeUser | quote }};
+  init-user-nextcloud.sql: |
+    CREATE USER IF NOT EXISTS "nextcloud_user"@"%" IDENTIFIED BY {{ .Values.secrets.mariadb.nextcloudUser | quote }};
+    ALTER USER "nextcloud_user"@"%" WITH MAX_USER_CONNECTIONS 100;
+    ALTER USER "nextcloud_user"@"%" IDENTIFIED BY {{ .Values.secrets.mariadb.nextcloudUser | quote }};
+  init-user-xwiki.sql: |
+    CREATE USER IF NOT EXISTS "xwiki_user"@"%" IDENTIFIED BY {{ .Values.secrets.mariadb.xwikiUser | quote }};
+    ALTER USER "xwiki_user"@"%" WITH MAX_USER_CONNECTIONS 100;
+    ALTER USER "xwiki_user"@"%" IDENTIFIED BY {{ .Values.secrets.mariadb.xwikiUser | quote }};
+```
+
+
+## MinIO
+
+Like described in the [upstream `values.yaml`](https://github.com/bitnami/charts/blob/main/bitnami/minio/values.yaml#L1595) credentials and information about a user in existing secrets listed in `usersExistingSecrets` have to be formatted as follows:
+
+```yaml
+stringData:
+  username1: |
+    username=test-username
+    password=test-password
+    disabled=false
+    policies=readwrite,consoleAdmin,diagnostics
+    setPolicies=false
+```
+
+Further we need the credentials introduced at MinIO in various other components that didn't implement the special format from MinIO. Hence we have to create key-value-pairs of the passwords for them.
+
+## Notes
+
+There are some values that consist of more than just one secret part.
+
+```yaml
+backend:
+  configuration:
+    django:
+      superuserEmail:
+        value: {{ printf "default.admin@%s" .Values.global.domain | quote }}
+    redisUrl:
+      value: "redis://default:{{ .Values.cache.notes.password | default .Values.secrets.redis.password }}@{{ .Values.cache.notes.host }}:{{ .Values.cache.notes.port }}/7"
+```
+
+## OpenProject
+
+Here we need a custom secret to inject confidential data into environment variables as expected by OpenProject.
+
+```yaml
+stringData:
+  OPENPROJECT_SEED__ENTERPRISE__TOKEN: {{ .Values.enterpriseKeys.openproject.token | quote }}
+  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.nubus.ldapSearch.openproject | quote }}
+  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_USER: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
+  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
+  OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  OPENPROJECT_SMTP__PASSWORD: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+```
+
+## PostgreSQL
+
+In order to initialise PostgreSQL with databases, users and credentials existing secrets are expected to contain `.sql` files.
+
+The expected format for the databases is as follows:
+
+```yaml
+stringData:
+  init-db-keycloak.sql: |
+    SELECT 'CREATE DATABASE keycloak' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'keycloak')\gexec
+    ALTER DATABASE keycloak OWNER TO keycloak_user;
+    GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak_user;
+  init-db-keycloakExtension.sql: |
+    SELECT 'CREATE DATABASE keycloak_extensions' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'keycloak_extensions')\gexec
+    ALTER DATABASE keycloak_extensions OWNER TO keycloak_extensions_user;
+    GRANT ALL PRIVILEGES ON DATABASE keycloak_extensions TO keycloak_extensions_user;
+  init-db-notes.sql.sql: |
+    SELECT 'CREATE DATABASE notes' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'notes')\gexec
+    ALTER DATABASE notes OWNER TO notes_user;
+    GRANT ALL PRIVILEGES ON DATABASE notes TO notes_user;
+  init-db-openproject.sql: |
+    SELECT 'CREATE DATABASE openproject' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'openproject')\gexec
+    ALTER DATABASE openproject OWNER TO openproject_user;
+    GRANT ALL PRIVILEGES ON DATABASE openproject TO openproject_user;
+  init-db-synapse.sql: |
+    SELECT 'CREATE DATABASE matrix ENCODING ''UTF8'' LC_COLLATE=''C'' LC_CTYPE=''C'' template=template0' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'matrix')\gexec
+    ALTER DATABASE matrix OWNER TO matrix_user;
+    GRANT ALL PRIVILEGES ON DATABASE matrix TO matrix_user;
+  init-db-umsGuardianManagementApi.sql: |
+    SELECT 'CREATE DATABASE guardianmanagementapi' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'guardianmanagementapi')\gexec
+    ALTER DATABASE guardianmanagementapi OWNER TO guardianmanagementapi_user;
+    GRANT ALL PRIVILEGES ON DATABASE guardianmanagementapi TO guardianmanagementapi_user;
+  init-db-umsNotificationsApi.sql: |
+    SELECT 'CREATE DATABASE notificationsapi' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'notificationsapi')\gexec
+    ALTER DATABASE notificationsapi OWNER TO notificationsapi_user;
+    GRANT ALL PRIVILEGES ON DATABASE notificationsapi TO notificationsapi_user;
+  init-db-umsSelfservice.sql: |
+    SELECT 'CREATE DATABASE selfservice' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'selfservice')\gexec
+    ALTER DATABASE selfservice OWNER TO selfservice_user;
+    GRANT ALL PRIVILEGES ON DATABASE selfservice TO selfservice_user;
+  init-db-nextcloud.sql: |
+    SELECT 'CREATE DATABASE nextcloud' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'nextcloud')\gexec
+    ALTER DATABASE nextcloud OWNER TO nextcloud_user;
+    GRANT ALL PRIVILEGES ON DATABASE nextcloud TO nextcloud_user;
+  init-db-xwiki.sql: |
+    SELECT 'CREATE DATABASE xwiki ENCODING ''UNICODE'' template=template0' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'xwiki')\gexec
+    ALTER DATABASE xwiki OWNER TO xwiki_user;
+    GRANT ALL PRIVILEGES ON DATABASE xwiki TO xwiki_user;
+```
+
+For the user and credentials the following format is expected:
+
+```yaml
+stringData:
+  init-user-keycloak.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'keycloak_user') THEN
+      ALTER ROLE "keycloak_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.keycloakUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "keycloak_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.keycloakUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+  init-user-notes.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'notes_user') THEN
+      ALTER ROLE "notes_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.notesUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "notes_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.notesUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+  init-user-openproject.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'openproject_user') THEN
+      ALTER ROLE "openproject_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.openprojectUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "openproject_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.openprojectUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+  init-user-keycloakExtension.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'keycloak_extensions_user') THEN
+      ALTER ROLE "keycloak_extensions_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.keycloakExtensionUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "keycloak_extensions_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.keycloakExtensionUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+  init-user-synapse.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'matrix_user') THEN
+      ALTER ROLE "matrix_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.matrixUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "matrix_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.matrixUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+  init-user-umsNotificationsApi.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'notificationsapi_user') THEN
+      ALTER ROLE "notificationsapi_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.umsNotificationsApiUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "notificationsapi_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.umsNotificationsApiUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+  init-user-umsGuardianManagementApi.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'guardianmanagementapi_user') THEN
+      ALTER ROLE "guardianmanagementapi_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.umsGuardianManagementApiUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "guardianmanagementapi_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.umsGuardianManagementApiUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+  init-user-umsSelfservice.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'selfservice_user') THEN
+      ALTER ROLE "selfservice_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.umsSelfserviceUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "selfservice_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.umsSelfserviceUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+  init-user-nextcloud.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'nextcloud_user') THEN
+      ALTER ROLE "nextcloud_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.nextcloudUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "nextcloud_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.nextcloudUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+  init-user-xwiki.sql: |
+    DO $$BEGIN
+    IF EXISTS (SELECT FROM pg_user WHERE usename = 'xwiki_user') THEN
+      ALTER ROLE "xwiki_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.xwikiUser | squote }} CONNECTION LIMIT 100;
+    ELSE
+      CREATE ROLE "xwiki_user" WITH LOGIN ENCRYPTED PASSWORD {{ .Values.secrets.postgresql.xwikiUser | squote }} CONNECTION LIMIT 100;
+    END IF;
+    END$$
+```
+
+## XWiki
+
+Properties listed in the file of the existing secret will overwrite plain values.
+
+Licenses can also be given via properties and require the format `licenses=<EnterpriseLicense>,<Applicationslicense>`.
+
+Like described in the [upstream `values.yaml`](https://github.com/xwiki-contrib/xwiki-helm/blob/master/charts/xwiki/values.yaml#L435) credentials and information about a user in existing secrets listed in `propertiesSecret` have to be formatted as follows:
+
+```yaml
+stringData:
+  propertiesFile: |
+    propertie1=propertie1Value
+    propertie2=propertie2Value
+    propertie3=propertie3Value
+```
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -305,18 +305,8 @@ To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), t

 ### Mail/SMTP configuration

-To use the full potential of the openDesk, you need to set up an SMTP relay that allows sending emails from
-the whole subdomain. The following attribute can be set:
-
-```yaml
-smtp:
-  host: "mail.open.desk"
-  username: "openDesk"
-  password: "secret"
-```
-
-Enabling DKIM signing of emails helps to reduce spam and increases trust.
-openDesk ships dkimpy-milter as Postfix milter for signing emails. The following attributes can be set:
+Enabling DKIM signing for outgoing emails helps reduce the risk of messages being marked as spam and improves recipient trust.
+openDesk includes `dkimpy-milter` as a Postfix milter for signing emails. You can configure the following attributes:

 ```yaml
 apps:
@@ -330,6 +320,17 @@ smtp:
    useED25519: true # when false, RSA is used
 ```

+A common scenario for outgoing mail is to send it through a smarthost or mail relay, which often handles DKIM signing as well.
+
+If you prefer to use a smarthost, you can configure it as follows:
+
+```yaml
+smtp:
+  host: "smarthost.domain.tld"
+  username: "smarthost-auth-username"
+  password: "secret"
+```
+
 ### TURN configuration

 Some components (Jitsi, Element) use a TURN server for direct communication. You can configure your own TURN server with
@@ -340,10 +341,10 @@ turn:
  transport: "udp" # or tcp
  credentials: "secret"
  server:
-    host: "turn.open.desk"
+    host: "turn.domain.tld"
    port: "3478"
  tls:
-    host: "turns.open.desk"
+    host: "turns.domain.tld"
    port: "5349"
 ```

--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -10,9 +10,20 @@ SPDX-License-Identifier: Apache-2.0
 * [Deprecation warnings](#deprecation-warnings)
 * [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
 * [Manual checks/actions](#manual-checksactions)
+  * [external secrets](#external-secrets)
+  * [v1.7.1+](#v171)
+    * [Pre-upgrade to v1.7.1+](#pre-upgrade-to-v171)
+      * [New application default: Default group for two-factor authentication is now "2FA Users"](#new-application-default-default-group-for-two-factor-authentication-is-now-2fa-users)
+      * [New database and secrets: Portal now uses OIDC](#new-database-and-secrets-portal-now-uses-oidc)
+      * [New application default: XWiki blocks self-registration of user accounts](#new-application-default-xwiki-blocks-self-registration-of-user-accounts)
+      * [New application default: Synapse rooms `v12`](#new-application-default-synapse-rooms-v12)
+      * [New Helmfile default: Restricting characters for directory and filenames in fileshare module](#new-helmfile-default-restricting-characters-for-directory-and-filenames-in-fileshare-module)
+      * [Helmfile new default: New groupware settings changing current behaviour](#helmfile-new-default-new-groupware-settings-changing-current-behaviour)
+      * [New application default: Nextcloud apps "Spreed" and "Comments" no longer enabled by default](#new-application-default-nextcloud-apps-spreed-and-comments-no-longer-enabled-by-default)
+      * [New application default: Gravatar is switched off for Jitsi and OpenProject](#new-application-default-gravatar-is-switched-off-for-jitsi-and-openproject)
  * [v1.7.0+](#v170)
    * [Pre-upgrade to v1.7.0+](#pre-upgrade-to-v170)
-    * [Helmfile fix: Ensure enterprise overrides apply when deploying from project root](#helmfile-fix-ensure-enterprise-overrides-apply-when-deploying-from-project-root)
+      * [Helmfile fix: Ensure enterprise overrides apply when deploying from project root](#helmfile-fix-ensure-enterprise-overrides-apply-when-deploying-from-project-root)
      * [Replace Helm chart: New Notes Helm chart with support for self-signed deployments](#replace-helm-chart-new-notes-helm-chart-with-support-for-self-signed-deployments)
    * [Post-upgrade to v1.7.0+](#post-upgrade-to-v170)
      * [Upstream fix: Provisioning of functional mailboxes](#upstream-fix-provisioning-of-functional-mailboxes)
@@ -127,11 +138,184 @@ If you would like more details about the automated migrations, please read secti

 # Manual checks/actions

+## external secrets
+
+### pre upgrade
+
+#### Changed structure in `functional.ssoFederation`
+
+**Target group:** All upgrade deployments with configured ssoFederation.
+
+The structure of the configuration for the usage of ssoFederation has changed, please see [`functional.yaml.gotmpl`](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/helmfile/environments/default/functional.yaml.gotmpl) for further details of the new structure of the ssoFederation configuration.
+
+#### Changed structure in `config.opendesk.clients` and `config.custom.clients`
+
+**Target group:** All upgrade deployments
+
+The configuration underneath the named sections has changed from a list to a dictionary. An example can be seen in [`values-opendesk-keycloak-bootstrap.yaml.gotmpl`](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl?ref_type=heads) for the `opendesk.clients`.
+
+## v1.7.1+
+
+### Pre-upgrade to v1.7.1+
+
+#### New application default: Default group for two-factor authentication is now "2FA Users"
+
+**Target group:** All upgrade deployments.
+
+In previous openDesk versions, the default group for enforcing two-factor authentication (2FA) was `2fa-users`. Accounts in this group were required to set up and use time-based one-time passwords (TOTP) for 2FA during login.
+
+With the release v1.8.0 of openDesk, the openDesk IAM Nubus introduces a new default group named `2FA Users` serving the same purpose. Existing deployments will retain the old group, which will continue to enforce 2FA as before.
+
+However, for consistency and easier maintenance, we recommend migrating users from the old group to the new one and removing the old group afterward.
+
+#### New database and secrets: Portal now uses OIDC
+
+**Target group:** All upgrade deployments.
+
+The portal has been migrated to use OIDC for single sign-on by default. This introduces the following requirements for existing deployments:
+
+- New database: Deployments using external databases must provide a new PostgreSQL database. See `databases.umsAuthSession` in `databases.yaml.gotmpl` for configuration details.
+- New secrets: Deployments managing secrets manually must add:
+  - `secrets.keycloak.clientSecret.portal`: The OIDC client secret for the portal.
+  - `secrets.postgresql.umsAuthSessionUser`: For internal databases, set the secret for the database user here. If you are using an external database, you already provide these credentials in the New database step above.
+
+> **Note**<br>
+> The SAML Client for the Nubus portal is still preserved in Keycloak and will be removed in one of the next openDesk releases.
+
+#### New application default: XWiki blocks self-registration of user accounts
+
+**Target group:** All openDesk deployments using XWiki.
+
+The upgrade itself requires no manual intervention. However, the previous default (self-registration enabled) may be unexpected in many deployments.
+
+XWiki supports self-registration for creating local, application-specific accounts. Before this upgrade, the feature was enabled by default. It can not be disabled at the deployment level due to limitations in the XWiki package.
+
+With the new default, self-registration is switched off for new deployments. Existing deployments must apply the change manually:
+
+1. Log in with an XWiki admin account.
+2. Open the URL below (replace `<YOURDOMAIN>` with your domain), or navigate manually:
+   - URL: `https://wiki.<YOURDOMAIN>/bin/admin/XWiki/XWikiPreferences?editor=globaladmin&section=Rights#|t=usersandgroupstable&p=1&l=10&uorg=users&wiki=local&clsname=XWiki.XWikiGlobalRights`
+   - Manual navigation: Burger menu → *Administer Wiki* (repeat for each subwiki, if applicable) → *Users & Groups* → *Rights* → *Users* (table header)
+3. In the first row labeled "Unregistered Users", ensure the box in the "Register" column shows a ❌ (disabled) by clicking it if necessary.
+
+#### New application default: Synapse rooms `v12`
+
+**Target group:** All deployments using Element/Synapse with unrestricted federation and public, federation-enabled rooms.
+
+Following the [security bulletin from matrix.org](https://matrix.org/blog/2025/08/security-release/), openDesk now sets the default room version for new Matrix rooms to v12.
+
+This change does not affect existing rooms. There is no immediate action required. However, if your setup allows unrestricted Matrix federation and you operate public, federation-enabled rooms, you should consider upgrading those rooms to v12 for improved security and compatibility.
+
+For instructions on upgrading rooms, refer to the [official upstream documentation](https://docs.element.io/latest/element-server-suite-pro/administration/upgrading-local-rooms/).
+
+OpenDesk includes several bundled widgets. When upgrading a room, a new room is created to replace the old one — widget data will not be automatically transferred to the new room.
+
+To preserve as much data as possible, dedicated upgrade guidelines for each of these widgets are available:
+
+- Matrix NeoBoard widget: https://github.com/nordeck/matrix-neoboard?tab=readme-ov-file#matrix-room-upgrades
+- Matrix Meetings widget: https://github.com/nordeck/matrix-meetings?tab=readme-ov-file#matrix-room-upgrades
+- Matrix Poll widget: https://github.com/nordeck/matrix-poll?tab=readme-ov-file#matrix-room-upgrades
+
+> **Note**<br>
+> These instructions apply to any room upgrades, not just upgrade to `v12`.
+
+#### New Helmfile default: Restricting characters for directory and filenames in fileshare module
+
+**Target group:** All openDesk deployments using the fileshare module, as they may already contain files or directories with characters that are now restricted.
+
+openDesk now enforces restrictions on the characters allowed in directory and filenames by explicitly disallowing the following set: `* " | ? ; : \ / ~ < >`
+
+The reason is that desktop clients can not handle all characters due to restrictions in the underlying operating system and therefor syncing these directories and/or files will fail.
+
+This change was introduced because desktop clients cannot reliably handle certain characters due to operating system limitations, causing file synchronization to fail when these characters are present.
+
+For existing deployments, any files or directories containing restricted characters must be renamed before updates within the file or (sub)directory can succeed.
+
+Nextcloud provides tooling for renaming affected files using an [`occ command`](https://docs.nextcloud.com/server/latest/admin_manual/occ_command.html#sanitize-filenames) that can be executed by the operator, the command also supports a dry-run mode.
+
+You can customize the default restriction settings in `functional.yaml.gotmpl`:
+
+```yaml
+functional:
+  filestore:
+    naming:
+      forbiddenChars:
+        - '*'
+        - '"'
+        - '|'
+        - '?'
+        - ';'
+        - ':'
+        - '\'
+        - '/'
+        - '~'
+        - '<'
+        - '>'
+```
+
+#### Helmfile new default: New groupware settings changing current behaviour
+
+**Target group:** All openDesk deployments using OX App Suite
+
+The following options, newly introduced in `functional.yaml.gotmpl`, modify the previous default behavior of openDesk. Please review whether the new defaults are appropriate for your deployment:
+
+* `functional.groupware.mail.inbound.forward.enabled: false`
+  This setting prevents users from forwarding all incoming emails to external accounts.
+  Instead, the new option `functional.groupware.mail.inbound.notify.enabled: true` enables notifications to user-defined email addresses when new messages arrive.
+  To keep the previous behavior, set `forward` to `true` and `notify` to `false`.
+
+* `functional.groupware.userProfile.editRealName: false`
+  This setting prevents users from editing their display name in OX App Suite (e.g. the name shown when sending emails, in addition to the sender address).
+  The display name is centrally managed by the openDesk IAM.
+  To allow users to change it within OX App Suite, set this option to `true`.
+
+> **Note**<br>
+> openDesk v1.8.0 adds even more options under `functional.groupware.*` while retaining the current default behaviour.
+
+#### New application default: Nextcloud apps "Spreed" and "Comments" no longer enabled by default
+
+**Target group:** All openDesk deployments using the fileshare module.
+
+The following Nextcloud apps/functions are no longer enabled by default. Please check if they are required in your deployment, i.e. are used by the user:
+
+* [Spreed](https://apps.nextcloud.com/apps/spreed): Used in openDesk to provide a chat tab to the file/directory details pane in the fileshare application.
+* Comments: Core app that lets users leave comments in the activity tab of the file/directory details pane.
+
+If required the apps can be enabled using the openDesk customization options for `opendeskNextcloudManagement`, see `customizations.yaml.gotmpl` for details, with the following settings:
+```yaml
+configuration:
+  feature:
+    comments:
+      enabled: true
+    apps:
+      spreed:
+        enabled: true
+```
+
+#### New application default: Gravatar is switched off for Jitsi and OpenProject
+
+**Target group:** All openDesk deployments using the video conference and project module that explicitly want Gravatar support.
+
+Gravatar support is no longer enabled by default in Jitsi and OpenProject. In case it is required openDesk's customization options can be used to enabled it, see `customizations.yaml.gotmpl` for details.
+
+- Jitsi: `customization.release.jitsi` with
+  ```yaml
+  jitsi:
+    web:
+      extraConfig:
+        disableThirdPartyRequests: false
+  ```
+- Open Project: `customization.release.openproject` with
+  ```yaml
+  environment:
+    OPENPROJECT_PLUGIN__OPENPROJECT__AVATARS: '{enable_gravatars: true, enable_local_avatars: true}'
+  ```
+
 ## v1.7.0+

 ### Pre-upgrade to v1.7.0+

-### Helmfile fix: Ensure enterprise overrides apply when deploying from project root
+#### Helmfile fix: Ensure enterprise overrides apply when deploying from project root

 **Target group:** All openDesk Enterprise deployments initiated from the project root using `helmfile_generic.yaml.gotmpl`

--- a/docs/permissions.md
+++ b/docs/permissions.md
@@ -84,7 +84,7 @@ openDesk includes predefined groups. Please see below.

 - **Domain Users**: Members of this group are *openDesk Users*.
 - **Domain Admins**: Members of this group are *openDesk IAM Administrators*. By default, this group has two-factor authentication (2FA) enabled.
- **2fa-users**: Members of this group that are forced to use two-factor authentication (2FA).
+- **2FA Users**: Members of this group that are forced to use two-factor authentication (2FA).
 - **IAM API - Full Access**: Members of this group have full (read and write) access to the IAM's REST API.

 ### Application groups
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -139,6 +139,6 @@ Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare

 [^1]: Due to a [Helm bug](https://github.com/helm/helm/issues/30890) Helm 3.18.0 is not supported.

-[^2]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail.
+[^2]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail. E.g. the `local-path-provisioner` does not have sticky bit support.

 [^3]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
--- a/docs/security.md
+++ b/docs/security.md
@@ -1,4 +1,5 @@
 <!--
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
@@ -8,9 +9,10 @@ SPDX-License-Identifier: Apache-2.0
 This document covers the current status of security measures.

 <!-- TOC -->
-* [Helm chart trust chain](#helm-chart-trust-chain)
-* [Kubernetes security enforcements](#kubernetes-security-enforcements)
-* [Network policies](#network-policies)
+* [Helm Chart Trust Chain](#helm-chart-trust-chain)
+* [Kubernetes Security Enforcements](#kubernetes-security-enforcements)
+* [NetworkPolicies](#networkpolicies)
+* [Existing Secrets](#existing-secrets)
 <!-- TOC -->

 # Helm chart trust chain
@@ -49,3 +51,9 @@ security:
  otterizeIntents:
    enabled: true
 ```
+
+# Existing Secrets
+
+We urge you to use existing secrets for your confidential credentials.
+
+For further explanation and documentation please visit [Existing Secrets](./docs/existing-secrets.md).
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -86,7 +86,7 @@ The following naming scheme is applied for the deployment matrix:
  - *Secrets*: Master password based secrets based on `secrets.yaml.gotmpl`
  - *Certificates*: Letsencrypt-prod certificates are used.
  - *Deployment*: GitLab CI based deployment.
- `funct1`: Different configuration of `functional.yaml`, self-signed-certs [and when available external secrets].
+- `funct1`: Different configuration of `functional.yaml`, self-signed-certs [and when available existing secrets].
 - `extsrv`: External services (where possible).
 - `gitops`: Argo CD based deployment.

--- a/helmfile/apps/collabora/values.yaml.gotmpl
+++ b/helmfile/apps/collabora/values.yaml.gotmpl
@@ -40,6 +40,13 @@ collabora:
    {{- end }}
  username: "collabora-internal-admin"
  password: {{ .Values.secrets.collabora.adminPassword | quote }}
+  {{- if .Values.existingSecrets.collabora.existingSecret.name }}
+  existingSecret:
+    enabled: true
+    secretName: {{ .Values.existingSecrets.collabora.existingSecret.name | quote }}
+    usernameKey: {{ .Values.existingSecrets.collabora.existingSecret.usernameKey | quote }}
+    passwordKey: {{ .Values.existingSecrets.collabora.existingSecret.passwordKey | quote }}
+  {{- end }}

 fullnameOverride: "collabora"

@@ -143,6 +150,22 @@ securityContext:
    drop:
      - "ALL"
    add:
+      # For secuity reasons, esp. when macros are enabled, Collabora isolates all documents workspaces
+      # from each other. This isolation can work in three different ways. Collabora will automatically
+      # select the best option.
+      # - Using linux user namespaces is the most efficient one. You can test if user namespaces are
+      #   available by running `unshare -Ur bash` in the Collabora Pod. If it returns
+      #   `unshare: unshare failed: Operation not permitted`
+      #   user namespaces are not available.
+      #   Capabilities required: none
+      #   Note: A container runtime still could gate syscalls like `unshare` with `CAP_SYSADMIN`. You could
+      #         try using a custom seccompProfile in that case.
+      #         Ref.: https://github.com/CollaboraOnline/online/blob/master/docker/cool-seccomp-profile.json
+      # - Linking the documents and runtime environment into their own context.
+      #   Capabilities required: `CAP_SYSADMIN`, `CAP_SYSCHROOT`, `CHOWN`, `FOWNER`
+      # - Copying the documents and runtime environment into their own context,
+      #   having impact on the performance.
+      #   Capabilities required: `CAP_SYSCHROOT`, `CHOWN`, `FOWNER`
      - "CHOWN"
      - "FOWNER"
      - "SYS_CHROOT"
--- a/helmfile/apps/element/values-element.yaml.gotmpl
+++ b/helmfile/apps/element/values-element.yaml.gotmpl
@@ -34,6 +34,7 @@ configuration:
            - org.matrix.msc2762.receive.event:net.nordeck.whiteboard.document.chunk
            - org.matrix.msc2762.send.event:net.nordeck.whiteboard.document.snapshot
            - org.matrix.msc2762.receive.event:net.nordeck.whiteboard.document.snapshot
+            - org.matrix.msc2762.receive.state_event:m.room.create
            - org.matrix.msc2762.send.state_event:m.room.power_levels#
            - org.matrix.msc2762.receive.state_event:m.room.power_levels#
            - org.matrix.msc2762.receive.state_event:m.room.member
@@ -56,6 +57,7 @@ configuration:
            - org.matrix.msc2762.receive.state_event:net.nordeck.poll
            - org.matrix.msc2762.send.state_event:net.nordeck.poll.settings
            - org.matrix.msc2762.receive.state_event:net.nordeck.poll.settings
+            - org.matrix.msc2762.receive.state_event:m.room.create
            - org.matrix.msc2762.receive.state_event:m.room.power_levels
            - org.matrix.msc2762.receive.state_event:m.room.name
            - org.matrix.msc2762.receive.state_event:m.room.member
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -51,6 +51,7 @@ configuration:

  homeserver:
    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
+    defaultRoomVersion: 12
    appServiceConfigs:
      - as_token: {{ .Values.secrets.intercom.synapseAsToken | quote }}
        hs_token: {{ .Values.secrets.intercom.synapseAsToken | quote }}
--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -94,6 +94,7 @@ jitsi:
            - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
    extraConfig:
      doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
+      disableThirdPartyRequests: true
    extraEnvs:
      TURN_ENABLE: "1"
    resources:
--- a/helmfile/apps/nextcloud/values-nextcloud-management.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-management.yaml.gotmpl
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
@@ -26,8 +26,14 @@ configuration:
    enabled: true
    username:
      value: "nextcloud"
+      secret:
+        name: {{ .Values.existingSecrets.nextcloud.admin.username.name | quote }}
+        key: {{ .Values.existingSecrets.nextcloud.admin.username.key | quote }}
    password:
      value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.nextcloud.admin.password.name | quote }}
+        key: {{ .Values.existingSecrets.nextcloud.admin.password.key | quote }}

  antivirus:
    {{- if .Values.antivirus.icap.host }}
@@ -47,8 +53,14 @@ configuration:
      enabled: true
      username:
        value: {{ .Values.cache.nextcloud.username }}
+        secret:
+          name: {{ .Values.existingSecrets.cache.nextcloud.username.name | quote }}
+          key: {{ .Values.existingSecrets.cache.nextcloud.username.key | quote }}
      password:
        value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.cache.nextcloud.password.name | quote }}
+          key: {{ .Values.existingSecrets.cache.nextcloud.password.key | quote }}
    host: {{ .Values.cache.nextcloud.host | quote }}
    port: {{ .Values.cache.nextcloud.port | quote }}
    tls: {{ .Values.cache.nextcloud.tls }}
@@ -68,7 +80,9 @@ configuration:
      notifyPush:
        enabled: {{ gt .Values.replicas.nextcloudNotifyPush 0 }}
      spreed:
-        enabled: true
+        enabled: false
+    comments:
+      enabled: false
    circles:
      enabled: false

@@ -91,6 +105,9 @@ configuration:
    auth:
      username:
        value: {{ .Values.databases.nextcloud.username | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.databases.nextcloud.username.name | quote }}
+          key: {{ .Values.existingSecrets.databases.nextcloud.username.key | quote }}
      password:
        {{- if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
        value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
@@ -99,6 +116,9 @@ configuration:
        {{- else }}
        value: {{ .Values.databases.nextcloud.password | quote }}
        {{- end }}
+        secret:
+          name: {{ .Values.existingSecrets.databases.nextcloud.password.name | quote }}
+          key: {{ .Values.existingSecrets.databases.nextcloud.password.key | quote }}

  ldap:
    base: {{ .Values.ldap.baseDn | quote }}
@@ -106,14 +126,23 @@ configuration:
    dn: "uid=ldapsearch_nextcloud,cn=users,{{ .Values.ldap.baseDn }}"
    password:
      value: {{ .Values.secrets.nubus.ldapSearch.nextcloud | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.nubus.ldapSearch.nextcloud.name | quote }}
+        key: {{ .Values.existingSecrets.nubus.ldapSearch.nextcloud.key | quote }}
    adminGroupName: "managed-by-attribute-FileshareAdmin"

  objectstore:
    auth:
      accessKey:
        value: {{ .Values.objectstores.nextcloud.username | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.objectstores.nextcloud.accessKey.name | quote }}
+          key: {{ .Values.existingSecrets.objectstores.nextcloud.accessKey.key | quote }}
      secretKey:
        value: {{ .Values.objectstores.nextcloud.secretKey | default .Values.secrets.minio.nextcloudUser | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.objectstores.nextcloud.secretKey.name | quote }}
+          key: {{ .Values.existingSecrets.objectstores.nextcloud.secretKey.key | quote }}
    bucket: {{ .Values.objectstores.nextcloud.bucket | quote }}
    host: {{ .Values.objectstores.nextcloud.endpoint | quote }}
    region: {{ .Values.objectstores.nextcloud.region | quote }}
@@ -127,6 +156,9 @@ configuration:
      value: "opendesk-nextcloud"
    password:
      value: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.keycloak.clientSecret.nextcloudOidc.name | quote }}
+        key: {{ .Values.existingSecrets.keycloak.clientSecret.nextcloudOidc.key | quote }}

  opendeskIntegration:
    centralNavigation:
@@ -135,6 +167,9 @@ configuration:
        value: "opendesk_username"
      password:
        value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.centralnavigation.apiKey.name | quote }}
+          key: {{ .Values.existingSecrets.centralnavigation.apiKey.key | quote }}
    oxAppSuite:
      enabled: {{ .Values.apps.oxAppSuite.enabled }}

@@ -159,6 +194,9 @@ configuration:
        value: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
      password:
        value: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.postfix.opendeskSystem.password.name | quote }}
+          key: {{ .Values.existingSecrets.postfix.opendeskSystem.password.key | quote }}
    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
    port: 587
    fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
@@ -175,9 +213,11 @@ configuration:
  serverinfo:
    token:
      value: {{ .Values.secrets.nextcloud.metricsToken | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.nextcloud.metricsToken.name | quote }}
+        key: {{ .Values.existingSecrets.nextcloud.metricsToken.key | quote }}

-  # A sane default for windows clients would be: `* " | & ? , ; : \ / ~ < >`
-  forbiddenChars: "* \" | & ? , ; : \\ / ~ < >"
+  forbiddenChars: {{ join " " .Values.functional.filestore.naming.forbiddenChars | quote }}

 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
@@ -7,7 +7,6 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 exporter:
-
  additionalAnnotations:
    intents.otterize.com/service-name: "opendesk-nextcloud-exporter"
    {{- with .Values.annotations.nextcloudExporter.additional }}
@@ -19,6 +18,9 @@ exporter:
    server: "http://opendesk-nextcloud-aio"
    token:
      value: {{ .Values.secrets.nextcloud.metricsToken | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.nextcloud.metricsToken.name | quote }}
+        key: {{ .Values.existingSecrets.nextcloud.metricsToken.key | quote }}
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
@@ -59,6 +61,23 @@ exporter:
      {{ .Values.annotations.nextcloudExporter.serviceAccount | toYaml | nindent 6 }}

 aio:
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - weight: 1
+          podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+                - key: "app.kubernetes.io/name"
+                  operator: "In"
+                  values:
+                    - "aio"
+                - key: "app.kubernetes.io/instance"
+                  operator: "In"
+                  values:
+                    - "opendesk-nextcloud"
+            topologyKey: "kubernetes.io/hostname"
+
  additionalAnnotations:
    intents.otterize.com/service-name: "opendesk-nextcloud-aio"
    {{- with .Values.annotations.nextcloudAio.additional }}
@@ -71,8 +90,14 @@ aio:
        enabled: true
        username:
          value: {{ .Values.cache.nextcloud.username }}
+          secret:
+            name: {{ .Values.existingSecrets.cache.nextcloud.username.name | quote }}
+            key: {{ .Values.existingSecrets.cache.nextcloud.username.key | quote }}
        password:
          value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
+          secret:
+            name: {{ .Values.existingSecrets.cache.nextcloud.password.name | quote }}
+            key: {{ .Values.existingSecrets.cache.nextcloud.password.key | quote }}
      host: {{ .Values.cache.nextcloud.host | quote }}
      port: {{ .Values.cache.nextcloud.port | quote }}
      tls: {{ .Values.cache.nextcloud.tls }}
@@ -90,6 +115,9 @@ aio:
      auth:
        username:
          value: {{ .Values.databases.nextcloud.username | quote }}
+          secret:
+            name: {{ .Values.existingSecrets.databases.nextcloud.username.name | quote }}
+            key: {{ .Values.existingSecrets.databases.nextcloud.username.key | quote }}
        password:
          {{- if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
@@ -98,6 +126,9 @@ aio:
          {{- else }}
          value: {{ .Values.databases.nextcloud.password | quote }}
          {{- end }}
+          secret:
+            name: {{ .Values.existingSecrets.databases.nextcloud.password.name | quote }}
+            key: {{ .Values.existingSecrets.databases.nextcloud.password.key | quote }}
    trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
  containerSecurityContext:
    allowPrivilegeEscalation: false
--- a/helmfile/apps/notes/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/notes/helmfile-child.yaml.gotmpl
@@ -11,6 +11,13 @@ repositories:
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
+  - name: "notes-customization-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.notesCustomization.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.notesCustomization.registry }}/{{ .Values.charts.notesCustomization.repository }}"

 releases:
  - name: "impress"
@@ -24,6 +31,17 @@ releases:
      {{- end }}
    installed: {{ .Values.apps.notes.enabled }}
    timeout: 1800
+  - name: "impress-customization"
+    chart: "notes-customization-repo/{{ .Values.charts.notesCustomization.name }}"
+    version: "{{ .Values.charts.notesCustomization.version }}"
+    wait: true
+    values:
+      - "values-customization.yaml.gotmpl"
+      {{- range .Values.customization.release.notesCustomization }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.notes.enabled }}
+    timeout: 1800

 commonLabels:
  deploy-stage: "component-1"
--- a/helmfile/apps/notes/values-customization.yaml.gotmpl
+++ b/helmfile/apps/notes/values-customization.yaml.gotmpl
@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+frontend:
+  runtimeEnvs:
+    ICS_BASE_URL: {{ printf "https://%s.%s" .Values.global.hosts.intercomService .Values.global.domain | quote }}
+    PORTAL_BASE_URL: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain | quote }}
+...
--- a/helmfile/apps/notes/values.yaml.gotmpl
+++ b/helmfile/apps/notes/values.yaml.gotmpl
@@ -4,12 +4,22 @@
 global:
  collaborationServerSecret:
    value: {{ .Values.secrets.notes.collaborationSecret | quote }}
+    existingSecret:
+      name: {{ .Values.existingSecrets.notes.collaborationSecret.name | quote }}
+      key: {{ .Values.existingSecrets.notes.collaborationSecret.key | quote }}
  fqdn: "{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}"
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
  tlsSecretName: {{ .Values.ingress.tls.secretName | quote }}
  yProviderApiKey:
    value: {{ .Values.secrets.notes.collaborationSecret | quote }}
+    existingSecret:
+      name: {{ .Values.existingSecrets.notes.collaborationSecret.name | quote }}
+      key: {{ .Values.existingSecrets.notes.collaborationSecret.key | quote }}
+  fqdn: "{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}"
+  tlsSecretName: {{ .Values.ingress.tls.secretName | quote }}
+  fqdn: "{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}"
+  tlsSecretName: {{ .Values.ingress.tls.secretName | quote }}

 backend:
  image:
@@ -27,7 +37,7 @@ backend:
      {{- end }}
    ingressClassName: {{ .Values.ingress.ingressClassName }}
  ingressAdmin:
-    enabled: true
+    enabled: false
    annotations:
      {{ .Values.annotations.notesBackend.ingressAdmin | toYaml | nindent 6 }}
    ingressClassName: {{ .Values.ingress.ingressClassName }}
@@ -36,14 +46,23 @@ backend:
    ai:
      apiKey:
        value: {{ .Values.ai.apiKey }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.ai.apiKey.name | quote }}
+          key: {{ .Values.existingSecrets.ai.apiKey.key | quote }}
      baseUrl: {{ .Values.ai.endpoint }}
      model: {{ .Values.ai.model | quote }}
    aws:
      endpointUrl: {{ printf "https://%s" (.Values.objectstores.notes.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
      s3AccessKeyId:
        value: {{ .Values.objectstores.notes.username }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.objectstores.notes.s3AccessKeyId.name | quote }}
+          key: {{ .Values.existingSecrets.objectstores.notes.s3AccessKeyId.key | quote }}
      s3SecretAccessKey:
        value: {{ .Values.objectstores.notes.secretKey | default .Values.secrets.minio.notesUser | quote }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.objectstores.notes.s3SecretAccessKey.name | quote }}
+          key: {{ .Values.existingSecrets.objectstores.notes.s3SecretAccessKey.key | quote }}
      storageBucketName: {{ .Values.objectstores.notes.bucket }}
    collaboration:
      apiUrl: {{ printf "https://%s.%s/collaboration/api/" .Values.global.hosts.notes .Values.global.domain | quote }}
@@ -53,9 +72,15 @@ backend:
      name: {{ .Values.databases.notes.name | quote }}
      password:
        value: {{ .Values.databases.notes.password | default .Values.secrets.postgresql.notesUser | quote }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.databases.notes.password.name | quote  }}
+          key: {{ .Values.existingSecrets.databases.notes.password.key | quote }}
      port: {{ .Values.databases.notes.port | quote }}
      user:
        value: {{ .Values.databases.notes.username | quote }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.databases.notes.user.name | quote }}
+          key: {{ .Values.existingSecrets.databases.notes.user.key | quote }}
    email:
      brandName: "openDesk"
      from: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.mailDomain | default .Values.global.domain }}"
@@ -64,14 +89,23 @@ backend:
      logoImage: {{ printf "https://%s.%s/univention/portal/icons/entries/swp.notes.svg" .Values.global.hosts.nubus .Values.global.domain | quote }}
      user:
        value: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.postfix.opendeskSystem.username.name | quote }}
+          key: {{ .Values.existingSecrets.postfix.opendeskSystem.username.key | quote }}
      password:
        value: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.postfix.opendeskSystem.password.name | quote }}
+          key: {{ .Values.existingSecrets.postfix.opendeskSystem.password.key | quote }}
    oidc:
      enabled: true
      rpClientId:
        value: "opendesk-notes"
      rpClientSecret:
        value: {{ .Values.secrets.keycloak.clientSecret.notes | quote }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.keycloak.clientSecret.notes.name | quote }}
+          key: {{ .Values.existingSecrets.keycloak.clientSecret.notes.key | quote }}
      opJWKSEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
      opAuthorizationEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/auth"
      opTokenEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
@@ -88,14 +122,26 @@ backend:
    django:
      secretKey:
        value: {{ .Values.secrets.notes.djangoSecretKey }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.notes.django.secretKey.name | quote }}
+          key: {{ .Values.existingSecrets.notes.django.secretKey.key | quote }}
      createSuperuser: true
      superuserEmail:
        value: {{ printf "default.admin@%s" .Values.global.domain | quote }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.notes.django.superuserEmail.name | quote }}
+          key: {{ .Values.existingSecrets.notes.django.superuserEmail.key | quote }}
      superuserPassword:
        value: {{ .Values.secrets.notes.superuser }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.notes.django.superuserPassword.name | quote }}
+          key: {{ .Values.existingSecrets.notes.django.superuserPassword.key | quote }}
    frontendTheme: "openDesk"
    redisUrl:
      value: "redis://default:{{ .Values.cache.notes.password | default .Values.secrets.redis.password }}@{{ .Values.cache.notes.host }}:{{ .Values.cache.notes.port }}/7"
+      existingSecret:
+        name: {{ .Values.existingSecrets.notes.redisUrl.name | quote }}
+        key: {{ .Values.existingSecrets.notes.redisUrl.key | quote }}
  extraEnvVars:
    - name: "FRONTEND_HOMEPAGE_FEATURE_ENABLED"
      value: "False"
@@ -131,19 +177,27 @@ backend:
  service:
    annotations:
      {{ .Values.annotations.notesBackend.service | toYaml | nindent 6 }}
-  {{- if .Values.certificate.selfSigned }}
  extraVolumes:
+    - name: "customization-volume"
+      configMap:
+        name: "impress-customization"
+    {{- if .Values.certificate.selfSigned }}
    - name: "trusted-cert-secret-volume"
      secret:
        secretName: "opendesk-certificates-ca-tls"
        items:
          - key: "ca.crt"
            path: "ca-certificates.crt"
+    {{- end }}
  extraVolumeMounts:
+    - name: "customization-volume"
+      mountPath: "/app/impress/configuration/theme/default.json"
+      subPath: "theme.json"
+    {{- if .Values.certificate.selfSigned }}
    - name: "trusted-cert-secret-volume"
-      mountPath: "/usr/local/lib/python3.12/site-packages/certifi/cacert.pem"
+      mountPath: "/usr/local/lib/python3.13/site-packages/certifi/cacert.pem"
      subPath: "ca-certificates.crt"
-  {{- end }}
+    {{- end }}

 frontend:
  image:
@@ -161,11 +215,6 @@ frontend:
    annotations:
      {{ .Values.annotations.notesFrontend.ingressMedia | toYaml | nindent 6 }}
    ingressClassName: {{ .Values.ingress.ingressClassName }}
-  extraEnvVars:
-    - name: "ICS_BASE_URL"
-      value: {{ printf "https://%s.%s" .Values.global.hosts.intercomService .Values.global.domain | quote }}
-    - name: "PORTAL_BASE_URL"
-      value: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain | quote }}
  configuration:
    objectStoreHost: {{ printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain | quote }}
  resources:
@@ -197,6 +246,14 @@ frontend:
  serviceMedia:
    annotations:
      {{ .Values.annotations.notesFrontend.service | toYaml | nindent 6 }}
+  extraVolumes:
+    - name: "customization-volume"
+      configMap:
+        name: "impress-customization"
+  extraVolumeMounts:
+    - name: "customization-volume"
+      mountPath: "/usr/share/nginx/html/runtime-env.js"
+      subPath: "runtime-env.js"

 y-provider:
  image:
--- a/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
@@ -53,6 +53,10 @@ global:
 ics:
  session:
    secret: {{ .Values.secrets.intercom.secret | quote }}
+    existingSecret:
+      name: {{ .Values.existingSecrets.nubus.ics.session.name | quote }}
+      keyMapping:
+        secret: {{ .Values.existingSecrets.nubus.ics.session.key | quote }}
  issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
  originRegex: "{{ .Values.global.domain }}"
  enableSessionCookie: true
@@ -66,21 +70,37 @@ ics:
  oidc:
    id: "opendesk-intercom"
    clientSecret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
+    existingSecret:
+      name: {{ .Values.existingSecrets.keycloak.clientSecret.intercom.name | quote}}
+      keyMapping:
+        clientSecret: {{ .Values.existingSecrets.keycloak.clientSecret.intercom.key | quote }}
  matrix:
    subdomain: {{ .Values.global.hosts.synapse | quote }}
    serverName: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
    auth:
      applicationServiceSecret: {{ .Values.secrets.intercom.synapseAsToken | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.nubus.ics.synapseAsToken.name | quote }}
+        keyMapping:
+          password: {{ .Values.existingSecrets.nubus.ics.synapseAsToken.key | quote }}
  nordeck:
    subdomain: {{ .Values.global.hosts.matrixNeoDateFixBot | quote }}
  portal:
    auth:
      sharedSecret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.centralnavigation.apiKey.name | quote }}
+        keyMapping:
+          sharedSecret: {{ .Values.existingSecrets.centralnavigation.apiKey.key | quote }}
  redis:
    host: {{ .Values.cache.intercomService.host | quote }}
    port: {{ .Values.cache.intercomService.port }}
    auth:
      password: {{ .Values.cache.intercomService.password | default .Values.secrets.redis.password | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.redis.existingSecret | quote }}
+        keyMapping:
+          password: {{ .Values.existingSecrets.redis.existingSecretPasswordKey | quote }}
  openxchange:
    oci: true
    url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
@@ -131,10 +151,9 @@ provisioning:
      auth:
        username: "kcadmin"
        existingSecret:
-          name: "ums-opendesk-keycloak-credentials"
+          name: {{ .Values.existingSecrets.keycloak.adminPassword.name | default "ums-opendesk-keycloak-credentials" | quote }}
          keyMapping:
-            password: "admin_password"
-        key: "admin_password"
+            passowrd: {{ .Values.existingSecrets.keycloak.adminPassword.key | default "admin_password" | quote }}
  image:
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
--- a/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
@@ -38,8 +38,14 @@ configuration:
  credentials:
    accessKey:
      value: {{ .Values.objectstores.nubus.username | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.objectstores.nubus.accessKey.name | quote }}
+        key: {{ .Values.existingSecrets.objectstores.nubus.accessKey.key | quote }}
    secretKey:
      value: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.objectstores.nubus.secretKey.name | quote }}
+        key: {{ .Values.existingSecrets.objectstores.nubus.secretKey.key | quote }}

 podAnnotations:
  {{ .Values.annotations.nubusNginxS3Gateway.pod | toYaml | nindent 2 }}
--- a/helmfile/apps/nubus/values-nubus-guardian.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus-guardian.yaml.gotmpl
@@ -200,25 +200,25 @@ nubusGuardian:
      username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
      database: {{ .Values.databases.umsGuardianManagementApi.name | quote }}
      existingSecret:
-        name: "ums-guardian-postgresql-opendesk-credentials"
+        name: {{ .Values.existingSecrets.databases.umsGuardianManagementApi.password.name | default "ums-guardian-postgresql-opendesk-credentials" | quote }}
        keyMapping:
-          password: "guardianDatabasePassword"
+          password: {{ .Values.existingSecrets.databases.umsGuardianManagementApi.password.key | default "guardianDatabasePassword" | quote }}
  provisioning:
    enabled: false
    config:
      nubusBaseUrl: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain }}
      keycloak:
        credentialSecret:
-          name: "ums-opendesk-keycloak-credentials"
-          key: "admin_password"
+          name: {{ .Values.existingSecrets.keycloak.adminPassword.name | default "ums-opendesk-keycloak-credentials" | quote }}
+          key: {{ .Values.existingSecrets.keycloak.adminPassword.key | default "admin_password" | quote }}
      realm: {{ .Values.platform.realm | quote }}
      username: "kcadmin"
    keycloak:
      auth:
        existingSecret:
-          name: "ums-opendesk-guardian-client-secret"
-          keyMapping:
-            password: "managementApiClientSecret"
+        name: {{ .Values.existingSecrets.keycloak.clientSecret.guardian.name | default "ums-opendesk-guardian-client-secret" | quote }}
+        keyMapping:
+          password: {{ .Values.existingSecrets.keycloak.clientSecret.guardian.key | default "managementApiClientSecret" | quote }}
      connection:
        host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
        baseUrl: "http://ums-keycloak:8080"
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -86,12 +86,16 @@ global:
                      visible: "False"
            wizard:
              disabled: "No"
-
    ucs:
      web:
        theme: "light"

    umc:
+      # Configures that login redirects point to OIDC and not SAML. Does not disable the saml endpoint.
+      web:
+        sso:
+          enabled: false
+
      cookie-banner:
        show: "false"
      login:
@@ -188,11 +192,10 @@ keycloak:
  keycloak:
    auth:
      username: "kcadmin"
-      # TODO: Pending secrets refactoring to be able to provide the value directly
      existingSecret:
-        name: "ums-opendesk-keycloak-credentials"
+        name: {{ .Values.existingSecrets.keycloak.adminPassword.name | default "ums-opendesk-keycloak-credentials" | quote }}
        keyMapping:
-          adminPassword: "admin_password"
+          adminPassword: {{ .Values.existingSecrets.keycloak.adminPassword.key | default "admin_password" | quote }}
    login:
      messages:
        de:
@@ -215,11 +218,10 @@ keycloak:
    auth:
      username: {{ .Values.databases.keycloak.username | quote }}
      database: {{ .Values.databases.keycloak.name | quote }}
-      # TODO: Pending secrets refactoring to be able to provide the value directly
      existingSecret:
-        name: "ums-keycloak-postgresql-opendesk-credentials"
+        name: {{ .Values.existingSecrets.databases.keycloak.password.name | default "ums-keycloak-postgresql-opendesk-credentials" | quote }}
        keyMapping:
-          password: keycloakDatabasePassword
+          password: {{ .Values.existingSecrets.databases.keycloak.password.key | default "keycloakDatabasePassword" | quote }}
  replicaCount: {{ .Values.replicas.keycloak }}
  resources:
    {{ .Values.resources.umsKeycloak | toYaml | nindent 4 }}
@@ -443,9 +445,9 @@ nubusKeycloakExtensions:
      # TODO: Pending secrets refactoring in component chart. This will refer to
      # the secret generated by the keycloak subchart.
      existingSecret:
-        name: "ums-opendesk-keycloak-credentials"
+        name: {{ .Values.existingSecrets.keycloak.adminPassword.name | default "ums-opendesk-keycloak-credentials" | quote }}
        keyMapping:
-          adminPassword: "admin_password"
+          adminPassword: {{ .Values.existingSecrets.keycloak.adminPassword.key | default "admin_password" | quote }}
  proxy:
    additionalAnnotations:
      {{ .Values.annotations.nubusKeycloakExtensions.proxyAdditional | toYaml | nindent 6 }}
@@ -523,11 +525,10 @@ nubusKeycloakExtensions:
    auth:
      database: {{ .Values.databases.keycloakExtension.name | quote }}
      username: {{ .Values.databases.keycloakExtension.username | quote }}
-      # TODO: Pending secrets refactoring for this component chart
      existingSecret:
-        name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
+        name: {{ .Values.existingSecrets.databases.keycloakExtension.password.name | default "ums-keycloak-extensions-postgresql-opendesk-credentials" | quote }}
        keyMapping:
-          password: "umcKeycloakExtensionsDatabasePassword"
+          password: {{ .Values.existingSecrets.databases.keycloakExtension.password.key | default "umcKeycloakExtensionsDatabasePassword" | quote }}
  smtp:
    connection:
      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
@@ -540,9 +541,9 @@ nubusKeycloakExtensions:
      # TODO: Pending secrets refactoring in the component chart
      password: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
      existingSecret:
-        name: "ums-keycloak-extensions-smtp-opendesk-credentials"
+        name: {{ .Values.existingSecrets.postfix.opendeskSystem.password.name | default "ums-keycloak-extensions-smtp-opendesk-credentials" | quote }}
        keyMapping:
-          password: "umcKeycloakExtensionsSmtpPassword"
+          password: {{ .Values.existingSecrets.postfix.opendeskSystem.password.key | default "umcKeycloakExtensionsSmtpPassword" | quote }}
  handler:
    additionalAnnotations:
      {{ .Values.annotations.nubusKeycloakExtensions.handlerAdditional | toYaml | nindent 6 }}
@@ -1106,9 +1107,9 @@ nubusProvisioning:
    createUsers:
      oxConsumer:
        existingSecret:
-          name: ums-provisioning-ox-credentials
+          name: {{ .Values.existingSecrets.openxchangeConnector.provisioningApiPassword.name | default "ums-provisioning-ox-credentials" | quote }}
          keyMapping:
-            registration: "ox-connector.json"
+            registration: {{ .Values.existingSecrets.openxchangeConnector.provisioningApiPassword.key | default "ox-connector.json" | quote }}
    {{- end }}
    image:
      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
@@ -1458,19 +1459,32 @@ nubusUmcServer:
  # Ref.: https://docs.software-univention.de/nubus-kubernetes-operation/1.x/en/reference.html#envvar-nubusUmcServer.podManagementPolicy
  podManagementPolicy: "{{ if gt .Values.replicas.umsUmcServer 4 }}Parallel{{ else }}OrderedReady{{ end }}"
  postgresql:
-    bundled: false
-    connection:
-      host: {{ .Values.databases.umsSelfservice.host | quote }}
-      port: {{ .Values.databases.umsSelfservice.port | quote }}
-    auth:
-      username: {{ .Values.databases.umsSelfservice.username | quote }}
-      database: {{ .Values.databases.umsSelfservice.name | quote }}
-      password: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
-      # NOTE: Nubus has still an existing secret configured for legacy reasons.
-      # This disables the existing secret and ensures that the value from above
-      # is used.
-      existingSecret:
-        name: null
+    selfservice:
+      connection:
+        host: {{ .Values.databases.umsSelfservice.host | quote }}
+        port: {{ .Values.databases.umsSelfservice.port | quote }}
+      auth:
+        username: {{ .Values.databases.umsSelfservice.username | quote }}
+        database: {{ .Values.databases.umsSelfservice.name | quote }}
+        password: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
+        # NOTE: Nubus has still an existing secret configured for legacy reasons.
+        # This disables the existing secret and ensures that the value from above
+        # is used.
+        existingSecret:
+          name: null
+    authSession:
+      connection:
+        host: {{ .Values.databases.umsAuthSession.host | quote }}
+        port: {{ .Values.databases.umsAuthSession.port | quote }}
+      auth:
+        username: {{ .Values.databases.umsAuthSession.username | quote }}
+        database: {{ .Values.databases.umsAuthSession.name | quote }}
+        password: {{ .Values.databases.umsAuthSession.password | default .Values.secrets.postgresql.umsAuthSessionUser | quote }}
+        # NOTE: Nubus has still an existing secret configured for legacy reasons.
+        # This disables the existing secret and ensures that the value from above
+        # is used.
+        existingSecret:
+          name: null
  proxy:
    image:
      registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusUmcServerProxy.registry | quote }}
@@ -1558,7 +1572,6 @@ nubusKeycloakBootstrap:
      - ldapAndUserModelAttributeName: "oxContextIDNum"
    twoFactorAuthentication:
      enabled: true
-      group: "2fa-users"
  config:
    debug:
      enabled: {{ .Values.debug.enabled }}
@@ -1588,12 +1601,14 @@ nubusKeycloakBootstrap:
    auth:
      username: "kcadmin"
      existingSecret:
-        name: "ums-opendesk-keycloak-credentials"
+        name: {{ .Values.existingSecrets.keycloak.adminPassword.name | default "ums-opendesk-keycloak-credentials" | quote }}
+        keyMapping:
+          adminPassword: {{ .Values.existingSecrets.keycloak.adminPassword.key | default "admin_password" | quote }}
  ldap:
    auth:
      bindDn: {{ printf "uid=ldapsearch_keycloak,cn=users,%s" .Values.ldap.baseDn }}
      existingSecret:
-        name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
+        name: {{ .Values.existingSecrets.nubus.ldapSearch.keycloak.name | default "ums-keycloak-bootstrap-ldap-opendesk-credentials" | quote }}
  podAnnotations:
    intents.otterize.com/service-name: "ums-keycloak-bootstrap"
    {{- with .Values.annotations.nubusKeycloakBootstrapNubus.pod }}
@@ -1616,27 +1631,50 @@ nubusKeycloakBootstrap:

 # Credential secrets for accessing customer supplied services
 extraSecrets:
+  {{- if and (not .Values.existingSecrets.keycloak.clientSecret.guardian.name)
+             (not .Values.existingSecrets.keycloak.clientSecret.guardian.key) }}
  - name: "ums-opendesk-guardian-client-secret"
    stringData:
      managementApiClientSecret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
+  {{- end }}
+  {{- if and (not .Values.existingSecrets.keycloak.adminPassword.name)
+             (not .Values.existingSecrets.keycloak.adminPassword.key) }}
  - name: "ums-opendesk-keycloak-credentials"
    stringData:
      admin_password: {{ .Values.secrets.keycloak.adminPassword | quote }}
+  {{- end }}
+  {{- if and (not .Values.existingSecrets.databases.keycloak.password.name)
+             (not .Values.existingSecrets.databases.keycloak.password.key) }}
  - name: "ums-keycloak-postgresql-opendesk-credentials"
    stringData:
      keycloakDatabasePassword: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
+  {{- end }}
+  {{- if and (not .Values.existingSecrets.databases.umsGuardianManagementApi.password.name)
+             (not .Values.existingSecrets.databases.umsGuardianManagementApi.password.key) }}
  - name: "ums-guardian-postgresql-opendesk-credentials"
    stringData:
      guardianDatabasePassword: {{ .Values.databases.umsGuardianManagementApi.password | default .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
+  {{- end }}
+  {{- if and (not .Values.existingSecrets.databases.keycloakExtension.password.name)
+             (not .Values.existingSecrets.databases.keycloakExtension.password.key) }}
  - name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
    stringData:
      umcKeycloakExtensionsDatabasePassword: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
+  {{- end }}
+  {{- if and (not .Values.existingSecrets.postfix.opendeskSystem.password.name)
+             (not .Values.existingSecrets.postfix.opendeskSystem.password.key) }}
  - name: "ums-keycloak-extensions-smtp-opendesk-credentials"
    stringData:
      umcKeycloakExtensionsSmtpPassword: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+  {{- end }}
+  {{- if and (not .Values.existingSecrets.nubus.ldapSearch.keycloak.name) }}
  - name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
    stringData:
      password: {{ .Values.secrets.nubus.ldapSearch.keycloak | quote }}
+  {{- end }}
+  {{- if and (not .Values.existingSecrets.openxchangeConnector.provisioningApiPassword.name)
+             (not .Values.existingSecrets.openxchangeConnector.provisioningApiPassword.key) }}
  - name: "ums-provisioning-ox-credentials"
    stringData:
      ox-connector.json: "{ \"name\": \"ox-connector\", \"realms_topics\": [{\"realm\": \"udm\", \"topic\": \"oxmail/oxcontext\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/accessprofile\"}, {\"realm\": \"udm\", \"topic\": \"users/user\"}, {\"realm\": \"udm\", \"topic\": \"oxresources/oxresources\"}, {\"realm\": \"udm\", \"topic\": \"groups/group\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/functional_account\"}], \"request_prefill\": true, \"password\": \"{{ .Values.secrets.oxConnector.provisioningApiPassword }}\" }"
+  {{- end }}
--- a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -80,11 +80,15 @@ config:
    clientScopes:
      {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
    clients:
-      {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
+      value:
+        {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 8 }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.functional.authentication.clients.name | quote }}
+        key: {{ .Values.existingSecrets.functional.authentication.clients.key | quote }}
  managed:
    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list',
                    'offline_access', 'roles', 'address', 'phone' ]
-    clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}',
+    clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', 'UMC OIDC', '${client_account}',
               '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}',
               '${client_security-admin-console}' ]
  keycloak:
@@ -92,6 +96,8 @@ config:
      values:
        username: "kcadmin"
        password: {{ .Values.secrets.keycloak.adminPassword | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.keycloak.adminSecret.name | quote }}
    realm: {{ .Values.platform.realm | quote }}
    intraCluster:
      enabled: true
@@ -113,11 +119,13 @@ config:
  ssoFederation:
    enabled: {{ .Values.functional.authentication.ssoFederation.enabled }}
    enforceFederatedLogin: {{ .Values.functional.authentication.ssoFederation.enforceFederatedLogin }}
-    name: {{ .Values.functional.authentication.ssoFederation.name | quote }}
-    idpDetails: {{ .Values.functional.authentication.ssoFederation.idpDetails | toYaml | nindent 6 }}
+    value: {{ .Values.functional.authentication.ssoFederation.idpDict | toYaml | nindent 8 }}
+    existingSecret:
+      name : {{ .Values.existingSecrets.functional.authentication.ssoFederation.name | quote }}
+      key : {{ .Values.existingSecrets.functional.authentication.ssoFederation.key | quote }}
  twoFactorSettings:
    additionalGroups: {{ .Values.functional.authentication.twoFactor.groups | toYaml | nindent 6 }}
-  precreateGroups: [ 'Domain Admins', 'Domain Users', '2fa-users', 'IAM API - Full Access',
+  precreateGroups: [ 'Domain Admins', 'Domain Users', 'IAM API - Full Access',
                     {{ if .Values.apps.nextcloud.enabled }}'managed-by-attribute-Fileshare', 'managed-by-attribute-FileshareAdmin',{{ end }}
                     {{ if .Values.apps.xwiki.enabled }}'managed-by-attribute-Knowledgemanagement', 'managed-by-attribute-KnowledgemanagementAdmin',{{ end }}
                     {{ if .Values.apps.element.enabled }}'managed-by-attribute-Livecollaboration', 'managed-by-attribute-LivecollaborationAdmin',{{ end }}
@@ -517,233 +525,246 @@ config:
              jsonType.label: "String"
      {{ end }}
    clients:
-      - name: "opendesk-intercom"
-        clientId: "opendesk-intercom"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/callback"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          use.refresh.tokens: true
-          backchannel.logout.session.required: true
-          standard.token.exchange.enabled: true
-          standard.token.exchange.enableRefreshRequestedTokenType: "SAME_SESSION"
-          backchannel.logout.revoke.offline.tokens: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
-        protocolMappers:
-          - name: "intercom-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "opendesk-intercom"
-              id.token.claim: false
-              access.token.claim: true
-          - name: "opendesk_username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "opendesk_username"
-              jsonType.label: "String"
-          - name: "opendesk_useruuid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "entryUUID"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "opendesk_useruuid"
-              jsonType.label: "String"
-        defaultClientScopes:
-          - "offline_access"
-      {{ if .Values.apps.notes.enabled }}
-      - name: "opendesk-notes"
-        clientId: "opendesk-notes"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.notes | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}/api/v1.0/callback/"
-        standardFlowEnabled: true
-        implicitFlowEnabled: false
-        alwaysDisplayInConsole: false
-        bearerOnly: false
-        directAccessGrantsEnabled: true
-        serviceAccountsEnabled: false
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        surrogateAuthRequired: false
-        attributes:
-          backchannel.logout.revoke.offline.tokens: false
-          backchannel.logout.session.required: false
-          client.introspection.response.allow.jwt.claim.enabled: false
-          client.use.lightweight.access.token.enabled: false
-          client_credentials.use_refresh_token: false
-          display.on.consent.screen: false
-          oauth2.device.authorization.grant.enabled: false
-          oidc.ciba.grant.enabled: false
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}/*"
-          require.pushed.authorization.requests: false
-          tls.client.certificate.bound.access.tokens: false
-          token.response.type.bearer.lower-case: false
-          use.jwks.url: false
-          use.refresh.tokens: false
-          # it is probably not even required to set this value explicitly.
-          user.info.response.signature.alg: "RS256"
-        defaultClientScopes:
-          - "opendesk-notes-scope"
-      {{ end }}
-      {{ if .Values.apps.oxAppSuite.enabled }}
-      - name: "opendesk-dovecot"
-        clientId: "opendesk-dovecot"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: false
-        defaultClientScopes:
-          - "opendesk-dovecot-scope"
-      - name: "opendesk-oxappsuite"
-        clientId: "opendesk-oxappsuite"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        defaultClientScopes:
-          - "opendesk-oxappsuite-scope"
-          - "read_contacts"
-          - "write_contacts"
-      {{ end }}
-      {{ if .Values.apps.jitsi.enabled }}
-      - name: "opendesk-jitsi"
-        clientId: "opendesk-jitsi"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        redirectUris:
-          - "https://{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}/*"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: true
-        fullScopeAllowed: true
-        authorizationServicesEnabled: false
-        defaultClientScopes:
-          - "opendesk-jitsi-scope"
-      {{ end }}
-      {{ if .Values.apps.element.enabled }}
-      - name: "opendesk-matrix"
-        clientId: "opendesk-matrix"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        standardFlowEnabled: true
-        directAccessGrantsEnabled: true
-        serviceAccountsEnabled: true
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        defaultClientScopes:
-          - "opendesk-matrix-scope"
-      {{ end }}
-      {{ if .Values.apps.nextcloud.enabled }}
-      - name: "opendesk-nextcloud"
-        clientId: "opendesk-nextcloud"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/user_oidc/backchannel-logout/opendesk"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        defaultClientScopes:
-          - "opendesk-nextcloud-scope"
-          - "read_contacts"
-          - "write_contacts"
-      {{ end }}
-      {{ if .Values.apps.openproject.enabled }}
-      - name: "opendesk-openproject"
-        clientId: "opendesk-openproject"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        serviceAccountsEnabled: true
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        defaultClientScopes:
-          - "opendesk-openproject-scope"
-      {{ end }}
-      {{ if .Values.apps.xwiki.enabled }}
-      - name: "opendesk-xwiki"
-        clientId: "opendesk-xwiki"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: false
-          backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/oidc/authenticator/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        defaultClientScopes:
-          - "opendesk-xwiki-scope"
-      {{ end }}
+      value:
+        opendesk-intercom:
+          name: "opendesk-intercom"
+          clientId: "opendesk-intercom"
+          protocol: "openid-connect"
+          clientAuthenticatorType: "client-secret"
+          secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
+          redirectUris:
+            - "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/callback"
+          consentRequired: false
+          frontchannelLogout: false
+          publicClient: false
+          authorizationServicesEnabled: false
+          attributes:
+            use.refresh.tokens: true
+            backchannel.logout.session.required: true
+            standard.token.exchange.enabled: true
+            standard.token.exchange.enableRefreshRequestedTokenType: "SAME_SESSION"
+            backchannel.logout.revoke.offline.tokens: true
+            backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
+          protocolMappers:
+            - name: "intercom-audience"
+              protocol: "openid-connect"
+              protocolMapper: "oidc-audience-mapper"
+              consentRequired: false
+              config:
+                included.client.audience: "opendesk-intercom"
+                id.token.claim: false
+                access.token.claim: true
+            - name: "opendesk_username"
+              protocol: "openid-connect"
+              protocolMapper: "oidc-usermodel-attribute-mapper"
+              consentRequired: false
+              config:
+                userinfo.token.claim: true
+                user.attribute: "uid"
+                id.token.claim: true
+                access.token.claim: true
+                claim.name: "opendesk_username"
+                jsonType.label: "String"
+            - name: "opendesk_useruuid"
+              protocol: "openid-connect"
+              protocolMapper: "oidc-usermodel-attribute-mapper"
+              consentRequired: false
+              config:
+                userinfo.token.claim: true
+                user.attribute: "entryUUID"
+                id.token.claim: true
+                access.token.claim: true
+                claim.name: "opendesk_useruuid"
+                jsonType.label: "String"
+          defaultClientScopes:
+            - "offline_access"
+        {{ if .Values.apps.notes.enabled }}
+        opendesk-notes:
+          name: "opendesk-notes"
+          clientId: "opendesk-notes"
+          protocol: "openid-connect"
+          clientAuthenticatorType: "client-secret"
+          secret: {{ .Values.secrets.keycloak.clientSecret.notes | quote }}
+          redirectUris:
+            - "https://{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}/api/v1.0/callback/"
+          standardFlowEnabled: true
+          implicitFlowEnabled: false
+          alwaysDisplayInConsole: false
+          bearerOnly: false
+          directAccessGrantsEnabled: true
+          serviceAccountsEnabled: false
+          consentRequired: false
+          frontchannelLogout: false
+          publicClient: false
+          authorizationServicesEnabled: false
+          surrogateAuthRequired: false
+          attributes:
+            backchannel.logout.revoke.offline.tokens: false
+            backchannel.logout.session.required: false
+            client.introspection.response.allow.jwt.claim.enabled: false
+            client.use.lightweight.access.token.enabled: false
+            client_credentials.use_refresh_token: false
+            display.on.consent.screen: false
+            oauth2.device.authorization.grant.enabled: false
+            oidc.ciba.grant.enabled: false
+            post.logout.redirect.uris: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}/*"
+            require.pushed.authorization.requests: false
+            tls.client.certificate.bound.access.tokens: false
+            token.response.type.bearer.lower-case: false
+            use.jwks.url: false
+            use.refresh.tokens: false
+            # it is probably not even required to set this value explicitly.
+            user.info.response.signature.alg: "RS256"
+          defaultClientScopes:
+            - "opendesk-notes-scope"
+        {{ end }}
+        {{ if .Values.apps.oxAppSuite.enabled }}
+        opendesk-dovecot:
+          name: "opendesk-dovecot"
+          clientId: "opendesk-dovecot"
+          protocol: "openid-connect"
+          clientAuthenticatorType: "client-secret"
+          secret: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
+          consentRequired: false
+          frontchannelLogout: false
+          publicClient: false
+          authorizationServicesEnabled: false
+          attributes:
+            backchannel.logout.session.required: false
+          defaultClientScopes:
+            - "opendesk-dovecot-scope"
+        opendesk-oxappsuite:
+          name: "opendesk-oxappsuite"
+          clientId: "opendesk-oxappsuite"
+          protocol: "openid-connect"
+          clientAuthenticatorType: "client-secret"
+          secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
+          redirectUris:
+            - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
+            - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          consentRequired: false
+          frontchannelLogout: false
+          publicClient: false
+          authorizationServicesEnabled: false
+          attributes:
+            backchannel.logout.session.required: true
+            backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
+            post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          defaultClientScopes:
+            - "opendesk-oxappsuite-scope"
+            - "read_contacts"
+            - "write_contacts"
+        {{ end }}
+        {{ if .Values.apps.jitsi.enabled }}
+        opendesk-jitsi:
+          name: "opendesk-jitsi"
+          clientId: "opendesk-jitsi"
+          protocol: "openid-connect"
+          clientAuthenticatorType: "client-secret"
+          redirectUris:
+            - "https://{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}/*"
+          consentRequired: false
+          frontchannelLogout: false
+          publicClient: true
+          fullScopeAllowed: true
+          authorizationServicesEnabled: false
+          defaultClientScopes:
+            - "opendesk-jitsi-scope"
+        {{ end }}
+        {{ if .Values.apps.element.enabled }}
+        opendesk-matrix:
+          name: "opendesk-matrix"
+          clientId: "opendesk-matrix"
+          protocol: "openid-connect"
+          clientAuthenticatorType: "client-secret"
+          secret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
+          redirectUris:
+            - "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*"
+            - "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*"
+            - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          standardFlowEnabled: true
+          directAccessGrantsEnabled: true
+          serviceAccountsEnabled: true
+          consentRequired: false
+          frontchannelLogout: false
+          publicClient: false
+          authorizationServicesEnabled: false
+          attributes:
+            backchannel.logout.session.required: true
+            backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
+            post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          defaultClientScopes:
+            - "opendesk-matrix-scope"
+        {{ end }}
+        {{ if .Values.apps.nextcloud.enabled }}
+        opendesk-nextcloud:
+          name: "opendesk-nextcloud"
+          clientId: "opendesk-nextcloud"
+          protocol: "openid-connect"
+          clientAuthenticatorType: "client-secret"
+          secret: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
+          redirectUris:
+            - "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*"
+            - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          consentRequired: false
+          frontchannelLogout: false
+          publicClient: false
+          authorizationServicesEnabled: false
+          attributes:
+            backchannel.logout.session.required: true
+            backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/user_oidc/backchannel-logout/opendesk"
+            post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          defaultClientScopes:
+            - "opendesk-nextcloud-scope"
+            - "read_contacts"
+            - "write_contacts"
+        {{ end }}
+        {{ if .Values.apps.openproject.enabled }}
+        opendesk-openproject:
+          name: "opendesk-openproject"
+          clientId: "opendesk-openproject"
+          protocol: "openid-connect"
+          clientAuthenticatorType: "client-secret"
+          secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
+          redirectUris:
+            - "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*"
+            - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          consentRequired: false
+          frontchannelLogout: false
+          publicClient: false
+          serviceAccountsEnabled: true
+          authorizationServicesEnabled: false
+          attributes:
+            backchannel.logout.session.required: true
+            backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
+            post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          defaultClientScopes:
+            - "opendesk-openproject-scope"
+        {{ end }}
+        {{ if .Values.apps.xwiki.enabled }}
+        opendesk-xwiki:
+          name: "opendesk-xwiki"
+          clientId: "opendesk-xwiki"
+          protocol: "openid-connect"
+          clientAuthenticatorType: "client-secret"
+          secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
+          redirectUris:
+            - "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*"
+            - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          consentRequired: false
+          frontchannelLogout: false
+          publicClient: false
+          authorizationServicesEnabled: false
+          attributes:
+            backchannel.logout.session.required: false
+            backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/oidc/authenticator/backchannel_logout"
+            post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          defaultClientScopes:
+            - "opendesk-xwiki-scope"
+        {{ end }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.keycloak.clients.name | quote }}
+        key: {{ .Values.existingSecrets.keycloak.clients.key | quote }}

 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
@@ -24,6 +24,9 @@ dovecot:
    username: {{ .Values.databases.dovecotDictmap.username | quote }}
    password:
      value: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.dovecot.dictmapUser.name | quote }}
+        key: {{ .Values.existingSecrets.dovecot.dictmapUser.key | quote }}
    keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
  sharedMailboxes:
    enabled: true
@@ -32,16 +35,28 @@ dovecot:
    username: {{ .Values.databases.dovecotACL.username | quote }}
    password:
      value: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.dovecot.aclUser.name | quote }}
+        key: {{ .Values.existingSecrets.dovecot.aclUser.key | quote }}
    keyspace: {{ .Values.databases.dovecotACL.name | quote }}
  objectStorage:
    bucket: {{ .Values.objectstores.dovecot.bucket | quote }}
    encryption:
      privateKey:
        value: {{ requiredEnv "DOVECOT_CRYPT_PRIVATE_KEY" | quote }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.dovecot.objectStorage.encryption.privateKey.name | quote }}
+          key: {{ .Values.existingSecrets.dovecot.objectStorage.encryption.privateKey.key | quote }}
      publicKey:
        value: {{ requiredEnv "DOVECOT_CRYPT_PUBLIC_KEY" | quote }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.dovecot.objectStorage.encryption.publicKey.name | quote }}
+          key: {{ .Values.existingSecrets.dovecot.objectStorage.encryption.publicKey.key | quote }}
    fqdn: {{ .Values.objectstores.dovecot.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
    username: {{ .Values.objectstores.dovecot.username | quote }}
    password:
      value: {{ .Values.objectstores.dovecot.secretKey | default .Values.secrets.minio.dovecotUser | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.objectstores.dovecotUser.name | quote }}
+        key: {{ .Values.existingSecrets.objectstores.dovecotUser.key | quote }}
 ...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -25,10 +25,16 @@ dovecot:
  defaultMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  password:
    value: {{ .Values.secrets.dovecot.doveadm | quote }}
+    existingSecret:
+      name: {{ .Values.existingSecrets.dovecot.doveadm.name | quote }}
+      key: {{ .Values.existingSecrets.dovecot.doveadm.key | quote }}
  migration:
    enabled: {{ .Values.functional.migration.oxAppSuite.enabled }}
    masterPassword:
      value: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.oxAppSuite.migrationsMasterPassword.name | quote }}
+        key: {{ .Values.existingSecrets.oxAppSuite.migrationsMasterPassword.key | quote }}
  ldap:
    enabled: true
    host: {{ .Values.ldap.host | quote }}
@@ -37,13 +43,20 @@ dovecot:
    dn: "uid=ldapsearch_dovecot,cn=users,{{ .Values.ldap.baseDn }}"
    password:
      value: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.nubus.ldapSearch.dovecot.name | quote }}
+        key: {{ .Values.existingSecrets.nubus.ldapSearch.dovecot.key | quote }}
  loginTrustedNetworks: {{ join " " .Values.cluster.networking.cidr | quote }}
+
  oidc:
    enabled: true
    clientID:
      value: "opendesk-dovecot"
    clientSecret:
      value: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.keycloak.clientSecret.dovecot.name | quote }}
+        key: {{ .Values.existingSecrets.keycloak.clientSecret.dovecot.key | quote }}
    introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
    introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
    usernameAttribute: "opendesk_username"
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -152,6 +152,7 @@ appsuite:
      drive-client-windows-ox-route:
        annotations:
          {{ .Values.annotations.openxchangeAppsuiteIngress.driveClientWindowsOxRoute | toYaml | nindent 10 }}
+      {{ if .Values.functional.groupware.mail.encryption.enabled }}
      guard-api-route:
        annotations:
          {{ .Values.annotations.openxchangeAppsuiteIngress.guardApiRoute | toYaml | nindent 10 }}
@@ -161,6 +162,7 @@ appsuite:
      guard-pgp-route:
        annotations:
          {{ .Values.annotations.openxchangeAppsuiteIngress.guardPgpRoute | toYaml | nindent 10 }}
+      {{ end }}
      http-api-routes-api:
        annotations:
          {{ .Values.annotations.openxchangeAppsuiteIngress.httpApiRoutesApi | toYaml | nindent 10 }}
@@ -218,6 +220,11 @@ appsuite:
        productName: {{ .Values.theme.texts.productName | quote }}
        oidcLogin: true
        oidcPath: "/oidc/"
+        notificationMails:
+          button:
+            textColor: {{ .Values.theme.colors.white | quote }}
+            backgroundColor: {{ .Values.theme.colors.primary | quote }}
+            borderColor: {{ .Values.theme.colors.primary | quote }}
    defaultScaling:
      nodes:
        default:
@@ -310,7 +317,7 @@ appsuite:
        # enable admin pack
        # admin: enabled
        documents: "disabled"
-        guard: "enabled"
+        guard: {{ ternary "enabled" "disabled" .Values.functional.groupware.mail.encryption.enabled }}
        # disabling admin role breaks webmail
        # {{- if .Values.technical.oxAppSuite.provisioning.dedicatedCoreMwPod }}
        # admin: "disabled"
@@ -347,11 +354,13 @@ appsuite:
          {{ .Values.seLinuxOptions.openxchangeGotenberg | toYaml | nindent 10 }}
      serviceAccount:
        create: false
+    {{ if .Values.functional.groupware.mail.encryption.enabled }}
    hooks:
      beforeAppsuiteStart:
        create-guard-dir.sh: |
          mkdir -p /opt/open-xchange/guard-files
          chown open-xchange:open-xchange /opt/open-xchange/guard-files
+    {{ end }}
    packages:
      status:
        open-xchange-oidc: "enabled"
@@ -377,11 +386,11 @@ appsuite:
        open-xchange-admin-soap-usercopy: "disabled"
        open-xchange-admin-user-copy: "disabled"
        {{- end }}
-        {{- if .Values.functional.groupware.davSupport.enabled }}
-        open-xchange-authentication-application-storage-rdb: "enabled"
-        {{- end }}
+        open-xchange-authentication-application-storage-rdb: {{ ternary "enabled" "disabled" .Values.functional.groupware.davSupport.enabled }}
+        open-xchange-mail-categories: {{ ternary "enabled" "disabled" .Values.functional.groupware.mail.categories.enabled }}
    properties:
      com.openexchange.hostname: {{ printf "%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
+      com.openexchange.share.guestHostname: {{ printf "%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
      com.openexchange.UIWebPath: "/appsuite/"
      com.openexchange.showAdmin: "false"
      # PDF Export
@@ -430,6 +439,7 @@ appsuite:
      com.openexchange.mail.transport.authType: "xoauth2"
      com.openexchange.mail.transportServer: "postfix-ox"
      com.openexchange.mail.transportServerSource: "global"
+      com.openexchange.mail.maxMailSize: {{ mul .Values.functional.groupware.mail.maxSize 1024 1024 | int | printf "%d" | quote }}
      # Mail Login Resolver
      com.openexchange.mail.login.resolver.enabled: "true"
      com.openexchange.mail.login.resolver.ldap.enabled: "true"
@@ -453,18 +463,61 @@ appsuite:
      # Old capability can be used to toggle all integrations with a single switch
      com.openexchange.capability.public-sector: "true"
      # New capabilities in 2.0
-      com.openexchange.capability.public-sector-element: "true"
+      com.openexchange.capability.public-sector-element: {{ .Values.apps.element.enabled | quote }}
      com.openexchange.capability.public-sector-navigation: "true"
      com.openexchange.capability.client-onboarding: "true"
      com.openexchange.capability.dynamic-theme: "true"
      com.openexchange.capability.filestorage_nextcloud: "true"
      com.openexchange.capability.filestorage_nextcloud_oauth: "true"
-      com.openexchange.capability.guard: "true"
-      com.openexchange.capability.guard-mail: "true"
-      com.openexchange.capability.smime: "true"
-      com.openexchange.capability.share_links: "false"
-      com.openexchange.capability.invite_guests: "false"
+      com.openexchange.capability.guard: {{ .Values.functional.groupware.mail.encryption.enabled | quote }}
+      com.openexchange.capability.guard-mail: {{ .Values.functional.groupware.mail.encryption.enabled | quote }}
+      com.openexchange.capability.smime: {{ .Values.functional.groupware.mail.encryption.enabled | quote }}
      com.openexchange.capability.document_preview: "true"
+      # Mail Categories
+      com.openexchange.mail.categories: {{ .Values.functional.groupware.mail.categories.enabled | quote }}
+      {{ if .Values.functional.groupware.mail.categories.enabled }}
+      com.openexchange.mail.categories.general.name.fallback: "General"
+      com.openexchange.mail.categories.general.name.de_DE: "Allgemein"
+      com.openexchange.mail.categories.identifiers: "newsletter,invites,socialmedia"
+      com.openexchange.mail.categories.newsletter.flag: "$newsletter"
+      com.openexchange.mail.categories.newsletter.name.fallback: "Newsletter"
+      com.openexchange.mail.categories.newsletter.name.de_DE: "Newsletter"
+      com.openexchange.mail.categories.newsletter.description: "Emails containing newsletters or promotional content"
+      com.openexchange.mail.categories.newsletter.description.de_DE: "E-Mails mit Newslettern oder Werbeinhalten"
+      com.openexchange.mail.categories.newsletter.icon: "megaphone"
+      com.openexchange.mail.categories.invites.flag: "$invites"
+      com.openexchange.mail.categories.invites.name.fallback: "Invitations"
+      com.openexchange.mail.categories.invites.name.de_DE: "Einladungen"
+      com.openexchange.mail.categories.invites.description: "Emails with event invitations and RSVPs"
+      com.openexchange.mail.categories.invites.description.de_DE: "E-Mails mit Veranstaltungseinladungen und Rückmeldungen"
+      com.openexchange.mail.categories.invites.icon: "calendar-check"
+      com.openexchange.mail.categories.socialmedia.flag: "$socialmedia"
+      com.openexchange.mail.categories.socialmedia.name.fallback: "Social Media"
+      com.openexchange.mail.categories.socialmedia.name.de_DE: "Soziale Medien"
+      com.openexchange.mail.categories.socialmedia.description: "Updates and notifications from social media platforms"
+      com.openexchange.mail.categories.socialmedia.description.de_DE: "Aktualisierungen und Benachrichtigungen von sozialen Medien"
+      com.openexchange.mail.categories.socialmedia.icon: "people"
+      com.openexchange.mail.user.categories.identifiers: "uc1,uc2,uc3"
+      com.openexchange.mail.categories.uc1.flag: "$uc1"
+      com.openexchange.mail.categories.uc1.name.fallback: "Your category 1"
+      com.openexchange.mail.categories.uc1.name.de_DE: "Eigene Kategorie 1"
+      com.openexchange.mail.categories.uc2.flag: "$uc2"
+      com.openexchange.mail.categories.uc2.name.fallback: "Your category 2"
+      com.openexchange.mail.categories.uc2.name.de_DE: "Eigene Kategorie 2"
+      com.openexchange.mail.categories.uc3.flag: "$uc3"
+      com.openexchange.mail.categories.uc3.name.fallback: "Your category 3"
+      com.openexchange.mail.categories.uc3.name.de_DE: "Eigene Kategorie 3"
+      {{- end }}
+      # functional.groupware.mail.inbound.*
+      com.openexchange.capability.public-sector-autonotify: {{ .Values.functional.groupware.mail.inbound.notify.enabled | quote }}
+      {{- if not .Values.functional.groupware.mail.inbound.forward.enabled }}
+      com.openexchange.mail.filter.blacklist.actions: "redirect"
+      {{- end }}
+      com.openexchange.mail.filter.options.apply.blockedActions: "redirect,notify"
+      # functional.groupware.externalSharing.*
+      com.openexchange.capability.share_links: {{ .Values.functional.groupware.externalSharing.shareLinks.enabled | quote }}
+      com.openexchange.capability.invite_guests: {{ .Values.functional.groupware.externalSharing.inviteGuests.enabled | quote }}
+      com.openexchange.share.guestCapabilityMode: "inherit"
      # Secondary Accounts
      com.openexchange.mail.secondary.authType: "XOAUTH2"
      com.openexchange.mail.transport.secondary.authType: "xoauth2"
@@ -473,14 +526,15 @@ appsuite:
      com.openexchange.file.storage.nextcloud.oauth.webdav.username.strategy: "user"
      com.openexchange.nextcloud.filepicker.includeAccessToken: "false"
      # Element integration
-      com.openexchange.conference.element.enabled: "true"
+      com.openexchange.conference.element.enabled: {{ .Values.apps.element.enabled | quote }}
      com.openexchange.conference.element.meetingHostUrl: http://matrix-neodatefix-bot
      com.openexchange.conference.element.matrixLoginUrl: http://opendesk-synapse-web:8008/_matrix/client/v3/login
-      com.openexchange.conference.element.matrixUuidClaimName: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
+      com.openexchange.conference.element.matrixUuidClaimName: {{ ternary "opendesk_useruuid" "opendesk_username" .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}
      # GDPR
      com.openexchange.gdpr.dataexport.enabled: "false"
      com.openexchange.gdpr.dataexport.active: "false"
      # Guard
+      {{- if .Values.functional.groupware.mail.encryption.enabled }}
      com.openexchange.guard.storage.file.fileStorageType: "file"
      com.openexchange.guard.storage.file.uploadDirectory: "/opt/open-xchange/guard-files/"
      com.openexchange.guard.guestSMTPMailFrom: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
@@ -494,6 +548,7 @@ appsuite:
      # http = (await import('./io.ox/core/http.js')).default
      # await http.POST({ module: 'oxguard/smime', params: { action: 'test' } })
      com.openexchange.smime.test: {{ .Values.debug.enabled | quote }}
+      {{- end }}
      {{- if or (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "NodePort") (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "LoadBalancer") }}
      # Client Onboarding
      com.openexchange.client.onboarding.mail.imap.host: {{ .Values.global.domain | quote }}
@@ -597,6 +652,8 @@ appsuite:
    uiSettings:
      io.ox.nextcloud//server: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/fs/"
      io.ox.public-sector//ics/url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/"
+      # Is user allowed to edit own display name
+      io.ox/mail//editRealName: {{ .Values.functional.groupware.userProfile.editRealName | quote }}
      # Show the Enterprise Picker in the top right corner instead of the launcher drop-down
      io.ox/core//features/enterprisePicker/showLauncher: "false"
      io.ox/core//features/enterprisePicker/showTopRightLauncher: "true"
@@ -607,8 +664,9 @@ appsuite:
      # Resources
      io.ox/core//features/resourceCalendars: "true"
      io.ox/core//features/managedResources: "true"
-      # Categories
-      io.ox/core//features/categories: "true"
+      # Features
+      io.ox/core//features/signatureDesigner: "true"
+      io.ox/core//features/categories: {{ .Values.functional.groupware.mail.categories.enabled | quote }}
      io.ox/core//categories/predefined: >
        [{ "name": "Predefined", "color": "orange", "icon": "bi/exclamation-circle.svg" }]
      # Nextcloud integration
@@ -635,6 +693,7 @@ appsuite:
      io.ox/dynamic-theme//folderHover: {{ .Values.theme.colors.secondaryGreyLight | quote }}
      # openDesk logo in top bar links to portal
      io.ox/core//logoAction: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain | quote }}
+    {{ if .Values.functional.groupware.mail.encryption.enabled }}
    secretETCFiles:
      # Format of the OX Guard master key:
      # MC+base64(20 random bytes)
@@ -642,6 +701,7 @@ appsuite:
      oxguardpass: |
        {{ .Values.secrets.oxAppSuite.oxguardMC }}
        {{ .Values.secrets.oxAppSuite.oxguardRC }}
+    {{ end }}
    redis: &redisConfiguration
      enabled: true
      mode: "standalone"
@@ -911,7 +971,7 @@ appsuite:
      create: false

  guard-ui:
-    enabled: true
+    enabled: {{ .Values.functional.groupware.mail.encryption.enabled }}
    imagePullSecrets:
    {{- range .Values.global.imagePullSecrets }}
      - name: {{ . | quote }}
@@ -941,6 +1001,7 @@ appsuite:
        {{ .Values.seLinuxOptions.openxchangeGuardUI | toYaml | nindent 8 }}
    serviceAccount:
      create: false
+
  core-spellcheck:
    enabled: false

--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -49,11 +49,11 @@ oxConnector:
  oxMasterAdmin: "admin"
  oxMasterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
  oxSmtpServer: "smtp://127.0.0.1:587"
-  oxSoapServer: "http://open-xchange-core-mw-admin"
+  oxSoapServer: {{ printf "http://%s.%s.svc.%s" "open-xchange-core-mw-admin" (.Values.apps.oxAppSuite.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}

 provisioningApi:
  connection:
-    baseUrl: "http://ums-provisioning-api"
+    baseUrl: {{ printf "http://%s.%s.svc.%s" "ums-provisioning-api" (.Values.apps.nubus.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
  auth:
    username: "ox-connector"
    password: {{ .Values.secrets.oxConnector.provisioningApiPassword | quote }}
--- a/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
@@ -45,14 +45,13 @@ postfix:
  domain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  hostname: "postfix"
  inetProtocols: "ipv4"
+  messageSizeLimit: {{ mul .Values.functional.groupware.mail.maxSize 1024 1024 | int | printf "%d" | quote }}
  milterDefaultAction: "tempfail"
  {{- if .Values.apps.dkimpy.enabled }}
  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
  {{- end }}
-
-  minTLSVersion: "TLSv1.3"
-  smtpdTLSMandatoryCiphers: "high"
-
+  minTLSVersion: "TLSv1.2"
+  smtpdTLSMandatoryCiphers: "medium"
  rspamdHost: ""
  {{- if .Values.smtp.host }}
  relayHost:
@@ -62,12 +61,17 @@ postfix:
    authentication:
      username:
        value: {{ .Values.smtp.username }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.smtp.username.name | quote }}
+          key: {{ .Values.existingSecrets.smtp.username.key | quote }}
      password:
        value: {{ .Values.smtp.password }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.smtp.password.name | quote }}
+          key: {{ .Values.existingSecrets.smtp.password.key | quote }}
+  smtpSASLAuthEnable: "yes"
  {{- end }}
  allowRelayNets: false
-  smtpSASLAuthEnable: "yes"
-  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
  smtpTLSSecurityLevel: "encrypt"
  smtpdSASLAuthEnable: "yes"
  smtpdSASLSecurityOptions: "noanonymous"
--- a/helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl
@@ -25,14 +25,26 @@ config:
    admin:
      username:
        value: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.openproject.apiAdmin.username.name | quote }}
+          key: {{ .Values.existingSecrets.openproject.apiAdmin.username.key | quote }}
      password:
        value: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.openproject.apiAdmin.password.name | quote }}
+          key: {{ .Values.existingSecrets.openproject.apiAdmin.password.key | quote }}
  nextcloud:
    admin:
      username:
        value: "nextcloud"
+        secret:
+          name: {{ .Values.existingSecrets.nextcloud.admin.username.name | quote }}
+          key: {{ .Values.existingSecrets.nextcloud.admin.username.key | quote }}
      password:
        value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.nextcloud.admin.password.name | quote }}
+          key: {{ .Values.existingSecrets.nextcloud.admin.password.key | quote }}

 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
@@ -71,6 +71,9 @@ selfSigned:
      enabled: true
      password:
        value: {{ .Values.secrets.certificates.password | quote }}
+        secret:
+          name: {{ .Values.existingSecrets.certificates.password.name | quote }}
+          key: {{ .Values.existingSecrets.certificates.password.key | quote }}

 wildcard: {{ .Values.certificate.wildcard }}
 ...
--- a/helmfile/apps/opendesk-services/values-opendesk-static-files.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-opendesk-static-files.yaml.gotmpl
@@ -39,14 +39,17 @@ assets:
      - path: "/apps/integration_swp/logo"
        data: {{ .Values.theme.imagery.logoHeaderSvgB64 }}
        mimeType: "image/svg+xml"
+      - path: "/apps/theming/img/background/jenna-kim-the-globe-dark.webp"
+        data: {{ .Values.theme.imagery.login.backgroundJpg }}
+        mimeType: "image/jpeg"
  notes:
    subdomain: {{ .Values.global.hosts.notes }}
    paths:
-      - path: "/favicon.ico"
+      - path: "/assets/favicon-light.ico"
        data: {{ .Values.theme.imagery.notes.faviconIco }}
-      - path: "/favicon.png"
+      - path: "/assets/favicon-dark.png"
        data: {{ .Values.theme.imagery.notes.faviconPng }}
-      - path: "/favicon-dark.png"
+      - path: "/assets/favicon-light.png"
        data: {{ .Values.theme.imagery.notes.faviconPng }}
  openproject:
    subdomain: {{ .Values.global.hosts.openproject }}
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -36,9 +36,17 @@ dbInit:
    {{ .Values.resources.openprojectDbInit | toYaml | nindent 4 }}

 environment:
-  {{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.openproject.token }}
+  {{- if and (not .Values.existingSecrets.openproject.environment)
+             (and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.openproject.token) }}
  OPENPROJECT_SEED__ENTERPRISE__TOKEN: {{ .Values.enterpriseKeys.openproject.token | quote }}
  {{- end }}
+  {{- if not .Values.existingSecrets.openproject.environment }}
+  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.nubus.ldapSearch.openproject | quote }}
+  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_USER: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
+  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
+  OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  OPENPROJECT_SMTP__PASSWORD: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+  {{- end }}
 # For more details and more options see
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
  OPENPROJECT_APP__TITLE: "Projekte - {{ .Values.theme.texts.productName }}"
@@ -52,7 +60,6 @@ environment:
  # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
  OPENPROJECT_SEED_LDAP_OPENDESK_HOST: {{ .Values.ldap.host | quote }}
  OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
-  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.nubus.ldapSearch.openproject | quote }}
  OPENPROJECT_SEED_LDAP_OPENDESK_SECURITY: "plain_ldap"
  OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,{{ .Values.ldap.baseDn }}"
  OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "{{ .Values.ldap.baseDn }}"
@@ -69,13 +76,9 @@ environment:
    "(&(objectClass=opendeskProjectmanagementGroup)(opendeskProjectmanagementEnabled=TRUE))"
  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_SYNC__USERS: "true"
  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_GROUP__ATTRIBUTE: "cn"
-  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_USER: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
-  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
-  OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
  OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  OPENPROJECT_SMTP__USER__NAME: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
-  OPENPROJECT_SMTP__PASSWORD: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
  OPENPROJECT_SMTP__PORT: 587
  OPENPROJECT_SMTP__SSL: "false" # (default=false)
  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
@@ -95,6 +98,7 @@ environment:
  OPENPROJECT_SEED_DESIGN_MAIN__MENU__BG__HOVER__BACKGROUND: {{ .Values.theme.colors.secondaryGreyLight | quote }}
  OPENPROJECT_SEED_DESIGN_LOGO: "data:image/svg+xml;base64,{{ .Values.theme.imagery.logoHeaderSvgB64 }}"
  OPENPROJECT_SEED_DESIGN_FAVICON: "data:image/svg+xml;base64,{{ .Values.theme.imagery.projects.faviconSvg }}"
+  OPENPROJECT_PLUGIN__OPENPROJECT__AVATARS: '{enable_gravatars: false, enable_local_avatars: true}'

  {{- if .Values.certificate.selfSigned }}
  SSL_CERT_FILE: "/etc/ssl/certs/ca-certificates.crt"
@@ -138,6 +142,10 @@ postgresql:
    password: {{ .Values.databases.openproject.password | default .Values.secrets.postgresql.openprojectUser | quote }}
    username: {{ .Values.databases.openproject.username | quote }}
    database: {{ .Values.databases.openproject.name | quote }}
+    existingSecret: {{ .Values.existingSecrets.databases.openproject.name | quote }}
+    secretKeys:
+      adminPasswordKey: {{ .Values.existingSecrets.databases.openproject.adminPasswordKey | quote }}
+      userPasswordKey: {{ .Values.existingSecrets.databases.openproject.userPasswordKey | quote }}
  connection:
    host: {{ .Values.databases.openproject.host | quote }}
    port: {{ .Values.databases.openproject.port }}
@@ -163,6 +171,9 @@ openproject:
    # Lock the admin user, preventing internal logins.
    # Switch to true once the NC filestore bootstrapping is optimized.
    locked: false
+    secret: {{ .Values.existingSecrets.openproject.adminUserPassword.name | quote }}
+    secretKeys:
+      password: {{ .Values.existingSecrets.openproject.adminUserPassword.key | quote }}
  oidc:
    enabled: true
    authorizationEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/auth"
@@ -172,6 +183,10 @@ openproject:
    provider: "keycloak"
    scope: "[openid,opendesk-openproject-scope]"
    secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
+    existingSecret: {{ .Values.existingSecrets.keycloak.clientSecret.openproject.name | quote }}
+    secretKeys:
+      identifier: {{ .Values.existingSecrets.keycloak.clientSecret.openproject.identifier | quote }}
+      secret: {{ .Values.existingSecrets.keycloak.clientSecret.openproject.key | quote }}
    tokenEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
    userinfoEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/userinfo"
    attribute_map:
@@ -180,6 +195,7 @@ openproject:
  useTmpVolumes: true
  tmpVolumesAnnotations:
    {{ .Values.annotations.openproject.openprojectTempVolumes | toYaml | nindent 4 }}
+  extraEnvVarsSecret: {{ .Values.existingSecrets.openproject.environment | quote }}

 serviceAccount:
  annotations:
@@ -223,6 +239,10 @@ s3:
  auth:
    accessKeyId: {{ .Values.objectstores.openproject.username | quote }}
    secretAccessKey: {{ .Values.objectstores.openproject.secretKey | default .Values.secrets.minio.openprojectUser | quote }}
+    existingSecret: {{ .Values.existingSecrets.objectstores.openproject.name | quote }}
+    secretKeys:
+      accessKeyId: {{ .Values.existingSecrets.objectstores.openproject.accessKeyId | quote }}
+      secretAccessKey: {{ .Values.existingSecrets.objectstores.openproject.secretAccessKey | quote }}

 seederJob:
  annotations:
--- a/helmfile/apps/services-external/values-cassandra.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-cassandra.yaml.gotmpl
@@ -20,7 +20,10 @@ containerSecurityContext:
 dbUser:
  user: "root"
  password: {{ .Values.secrets.cassandra.rootPassword | quote }}
-
+  existingSecret:
+    name: {{ .Values.existingSecrets.cassandra.existingSecret.name | quote }}
+    keyMapping:
+      cassandra-password: {{ .Values.existingSecrets.cassandra.existingSecret.passwordKey | quote }}
 global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
@@ -35,6 +38,7 @@ ingress:
  annotations:
    {{ .Values.annotations.cassandra.ingress | toYaml | nindent 6 }}

+{{- if not .Values.existingSecrets.cassandra.initDBSecret }}
 initDB:
  initUserData.cql: >
    CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
@@ -45,6 +49,9 @@ initDB:
    CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotACL.username | quote }};
    ALTER ROLE {{ .Values.databases.dovecotACL.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotACLUser "''" | squote }} AND LOGIN = true;
    GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotACL.name | quote }} TO {{ .Values.databases.dovecotACL.username | quote }};
+{{- end }}
+
+initDBSecret: {{ .Values.existingSecrets.cassandra.initDBSecret | quote }}

 # Will print a warning if unset but is automatically calculated:
 jvm:
--- a/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
@@ -53,6 +53,7 @@ job:
      password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
 {{ end }}
+  usersExistingSecret: {{ .Values.existingSecrets.mariadb.users | quote }}
  databases:
    # OX uses root user and auto automanages the database, we add a dummy user and create a dummy/empty database.
    - name: "openxchange_dummy"
@@ -66,10 +67,14 @@ job:
    - name: {{ .Values.databases.xwiki.name | quote }}
      user: "xwiki_user"
 {{ end }}
+  databasesExistingSecret: {{ .Values.existingSecrets.mariadb.databases | quote }}

 mariadb:
  rootPassword:
    value: {{ .Values.secrets.mariadb.rootPassword | quote }}
+    existingSecret:
+      name: {{ .Values.existingSecrets.mariadb.rootPassword.name | quote }}
+      key: {{ .Values.existingSecrets.mariadb.rootPassword.key | quote }}

 persistence:
  size: {{ .Values.persistence.storages.mariadb.size | quote }}
--- a/helmfile/apps/services-external/values-minio.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-minio.yaml.gotmpl
@@ -19,6 +19,9 @@ apiIngress:

 auth:
  rootPassword: {{ .Values.secrets.minio.rootPassword | quote }}
+  existingSecret: {{ .Values.existingSecrets.minio.existingSecret | quote }}
+  rootUserSecretKey: {{ .Values.existingSecrets.minio.rootUserSecretKey | quote }}
+  rootPasswordSecretKey: {{ .Values.existingSecrets.minio.rootPasswordSecretKey | quote }}

 commonAnnotations:
  {{ .Values.annotations.servicesExternalMinio.common | toYaml | nindent 2 }}
@@ -222,6 +225,7 @@ provisioning:
          actions:
            - "s3:*"
    {{- end }}
+  {{- if not .Values.existingSecrets.minio.usersExistingSecrets }}
  users:
    - username: {{ .Values.objectstores.migrations.username | quote }}
      password: {{ .Values.secrets.minio.migrationsUser | quote }}
@@ -267,6 +271,9 @@ provisioning:
        - "dovecot-bucket-policy"
      setPolicies: true
    {{- end }}
+  {{- else }}
+  usersExistingSecrets: {{ .Values.existingSecrets.minio.usersExistingSecrets }}
+  {{- end }}
  resources:
    {{ .Values.resources.minio | toYaml | nindent 4 }}

--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -66,18 +66,21 @@ postfix:
    authentication:
      username:
        value: {{ .Values.smtp.username }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.smtp.username.name | quote }}
+          key: {{ .Values.existingSecrets.smtp.username.key | quote }}
      password:
        value: {{ .Values.smtp.password }}
+        existingSecret:
+          name: {{ .Values.existingSecrets.smtp.password.name | quote }}
+          key: {{ .Values.existingSecrets.smtp.password.key | quote }}
+  smtpSASLAuthEnable: "yes"
  {{- end }}
  # Warning: This setting allows unauthenticated mail relay from relayNets!
  allowRelayNets: true
  relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
-
-  minTLSVersion: "TLSv1.3"
-  smtpdTLSMandatoryCiphers: "high"
-
-  smtpSASLAuthEnable: "yes"
-  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
+  minTLSVersion: "TLSv1.2"
+  smtpdTLSMandatoryCiphers: "medium"
  smtpTLSSecurityLevel: "encrypt"
  smtpdSASLAuthEnable: "yes"
  smtpdSASLSecurityOptions: "noanonymous"
@@ -91,8 +94,14 @@ postfix:
    enabled: true
    username:
      value: "opendesk-system"
+      existingSecret:
+        name: {{ .Values.existingSecrets.postfix.opendeskSystem.username.name | quote }}
+        key: {{ .Values.existingSecrets.postfix.opendeskSystem.username.key | quote }}
    password:
      value: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+      existingSecret:
+        name: {{ .Values.existingSecrets.postfix.opendeskSystem.password.name | quote }}
+        key: {{ .Values.existingSecrets.postfix.opendeskSystem.password.key | quote }}

  {{- if .Values.antivirus.milter.host }}
  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
--- a/helmfile/apps/services-external/values-postgresql.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postgresql.yaml.gotmpl
@@ -80,6 +80,7 @@ job:
      password: {{ .Values.secrets.postgresql.xwikiUser | quote }}
      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
 {{ end }}
+  usersExistingSecret: {{ .Values.existingSecrets.postgresql.users | quote }}
  databases:
    - name: {{ .Values.databases.keycloak.name | quote }}
      user: {{ .Values.databases.keycloak.username | quote }}
@@ -107,6 +108,7 @@ job:
      user: {{ .Values.databases.xwiki.username | quote }}
      additionalParams: "ENCODING 'UNICODE' template=template0"
 {{ end }}
+  databasesExistingSecret: {{ .Values.existingSecrets.postgresql.databases | quote }}

 persistence:
  size: {{ .Values.persistence.storages.postgresql.size | quote }}
@@ -123,7 +125,11 @@ podAnnotations:

 postgres:
  user: "postgres"
-  password: {{ .Values.secrets.postgresql.postgresUser | quote }}
+  password:
+    value: {{ .Values.secrets.postgresql.postgresUser | quote }}
+    existingSecret:
+      name: {{ .Values.existingSecrets.postgresql.rootPassword.name | quote }}
+      key: {{ .Values.existingSecrets.postgresql.rootPassword.key | quote }}

 resources:
  {{ .Values.resources.postgresql | toYaml | nindent 2 }}
--- a/helmfile/apps/services-external/values-redis.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-redis.yaml.gotmpl
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
@@ -6,6 +6,8 @@ architecture: "standalone"

 auth:
  password: {{ .Values.secrets.redis.password | quote }}
+  existingSecret: {{ .Values.existingSecrets.redis.existingSecret | quote }}
+  existingSecretPasswordKey: {{ .Values.existingSecrets.redis.existingSecretPasswordKey | quote }}

 commonAnnotations:
  {{ .Values.annotations.servicesExternalRedis.common | toYaml | nindent 2 }}
--- a/helmfile/apps/xwiki/values.yaml.gotmpl
+++ b/helmfile/apps/xwiki/values.yaml.gotmpl
@@ -20,13 +20,19 @@ imagePullSecrets:
  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}

 javaOpts:
-  {{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense .Values.enterpriseKeys.xwiki.proApplicationslicense }}
-  - "-Dlicenses={{ .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense }},{{ .Values.enterpriseKeys.xwiki.proApplicationslicense }}"
-  {{- end }}
  {{- if .Values.certificate.selfSigned }}
  - "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks"
  - "-Djavax.net.ssl.trustStoreType=jks"
-  - {{ printf "%s=%s" "-Djavax.net.ssl.trustStorePassword" .Values.secrets.certificates.password | quote }}
+  {{- end }}
+
+javaOptsSecrets:
+  {{- if .Values.certificate.selfSigned }}
+  trustStorePassword:
+    option: "-Djavax.net.ssl.trustStorePassword="
+    value: {{ .Values.secrets.certificates.password }}
+    secret:
+      name: {{ .Values.existingSecrets.certificates.password.name | quote }}
+      key: {{ .Values.existingSecrets.certificates.password.key | quote }}
  {{- end }}

 externalDB:
@@ -39,7 +45,13 @@ externalDB:
  user: {{ .Values.databases.xwiki.username | quote }}
  host: {{ printf "%s:%d" .Values.databases.xwiki.host .Values.databases.xwiki.port | quote }}
  customKeyRef:
+    {{- if .Values.existingSecrets.databases.xwiki.password.name }}
+    enabled: true
+    name: {{ .Values.existingSecrets.databases.xwiki.password.name | quote }}
+    key: {{ .Values.existingSecrets.databases.xwiki.password.key | quote }}
+    {{- else }}
    enabled: false
+    {{- end }}

 securityContext:
  enabled: true
@@ -70,16 +82,11 @@ customConfigs:
    xwiki.authentication.ldap.photo_attribute: "jpegPhoto"
    ## Enable the synchronization of the LDAP profile picture
    xwiki.authentication.ldap.update_photo: 1
-    {{ if .Values.debug.enabled }}
-    ## Password of "superadmin" user, disables account if not password is set
-    xwiki.superadminpassword: {{ .Values.secrets.xwiki.superadminpassword | quote }}
-    {{ end }}
    ## LDAP Server configuration
    xwiki.authentication.ldap.server: {{ .Values.ldap.host | quote }}
    xwiki.authentication.ldap.port: 389
    ## Authentication to the LDAP server
    xwiki.authentication.ldap.bind_DN: "uid=ldapsearch_xwiki,cn=users,{{ .Values.ldap.baseDn }}"
-    xwiki.authentication.ldap.bind_pass: {{ .Values.secrets.nubus.ldapSearch.xwiki | quote }}
    ## Base DN used for searching for users
    xwiki.authentication.ldap.base_DN: "{{ .Values.ldap.baseDn }}"
    ## Allow short update cycles of the LDAP group cache
@@ -99,7 +106,6 @@ customConfigs:
    oidc.logoutMechanism: "rpInitiated"
    oidc.provider: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/opendesk"
    oidc.scope: "openid,opendesk-xwiki-scope"
-    oidc.secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
    oidc.skipped: false
    oidc.user.nameFormater: "${oidc.user.opendesk_username._clean._lowerCase}"
    oidc.user.subjectFormater: "${oidc.user.opendesk_username._lowerCase}"
@@ -111,12 +117,38 @@ customConfigs:
    url.trustedDomains: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
    workplaceServices.navigationEndpoint: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/navigation.json"
    workplaceServices.base: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
-    workplaceServices.portalSecret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
    openoffice.serverType: "0"
    openoffice.autoStart: "false"
    openoffice.homePath: "/tmp"
    notifications.emails.live.graceTime: "5"

+customConfigsSecrets:
+  xwiki.cfg:
+    {{ if .Values.debug.enabled }}
+    ## Password of "superadmin" user, disables account if not password is set
+    xwiki.superadminpassword:
+      value: {{ .Values.secrets.xwiki.superadminpassword | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.xwiki.xwikiSuperadminpassword.name | quote }}
+        key: {{ .Values.existingSecrets.xwiki.xwikiSuperadminpassword.key | quote }}
+    {{ end }}
+    xwiki.authentication.ldap.bind_pass:
+      value: {{ .Values.secrets.nubus.ldapSearch.xwiki | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.nubus.ldapSearch.xwiki.name | quote }}
+        key: {{ .Values.existingSecrets.nubus.ldapSearch.xwiki.key | quote }}
+  xwiki.properties:
+    oidc.secret:
+      value: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.keycloak.clientSecret.xwiki.name | quote }}
+        key: {{ .Values.existingSecrets.keycloak.clientSecret.xwiki.key | quote }}
+    workplaceServices.portalSecret:
+      value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+      secret:
+        name: {{ .Values.existingSecrets.centralnavigation.apiKey.name | quote }}
+        key: {{ .Values.existingSecrets.centralnavigation.apiKey.key | quote }}
+
 ingress:
  enabled: {{ .Values.ingress.enabled }}
  className: {{ .Values.ingress.ingressClassName | quote }}
@@ -218,6 +250,14 @@ properties:
  "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.ldapGroupImportSearchFilter":
    "(&(objectClass=opendeskKnowledgemanagementGroup)(opendeskKnowledgemanagementEnabled=TRUE))"
  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.title": "Wissen - $!tdoc.displayTitle - {{ .Values.theme.texts.productName }}"
+  {{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense .Values.enterpriseKeys.xwiki.proApplicationslicense }}
+  "licenses": "{{ .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense }},{{ .Values.enterpriseKeys.xwiki.proApplicationslicense }}"
+  {{- end }}
+
+## Properties listed in the secret file will overwrite plain values
+propertiesSecret:
+  name: {{ .Values.existingSecrets.xwiki.propertiesSecret.name | quote }}
+  key: {{ .Values.existingSecrets.xwiki.propertiesSecret.key | quote }}

 cluster:
  replicas: {{ .Values.replicas.xwiki }}
--- a/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
@@ -6,12 +6,12 @@ charts:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/product-development/charts/opendesk-dovecot-pro"
    name: "dovecot"
-    version: "3.1.8"
+    version: "3.2.0-authcache"
    verify: true
  oxAppSuite:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/charts-mirror"
    name: "appsuite-public-sector-pro-chart"
-    version: "1.20.412"
+    version: "1.21.244"
    verify: false
 ...
--- a/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
@@ -5,7 +5,7 @@ images:
  collabora:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "25.04.4.3.1@sha256:b0b5fa9b061df1e8473dff9bb2cf295ab41bd7b35a78b785de518883b07e97c2"
+    tag: "25.04.5.3.1@sha256:d22407cd3bd83dd832f986a697d81c1a4642f55129c76a5a20e637274ce7bf62"
  dovecot:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/dovecot-pro"
@@ -13,9 +13,9 @@ images:
  nextcloud:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/nextcloud/images/opendesk-nextcloud"
-    tag: "1.6.8@sha256:605b560f736f6130e2927472a7379bf758fdf08aaaf20b8e9e816eba8692ab99"
+    tag: "1.6.11@sha256:79bab3b5745eb2c0fdd5a8858d277495deb7f6e43b42c7046d5bfbee039aed0a"
  openxchangeCoreMW:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/middleware-public-sector-pro"
-    tag: "8.40.63@sha256:aabe36ff1e04013691f05dd2df6667c4b7106849cb8685bd7cd43efebb43c06c"
+    tag: "8.41.58@sha256:da4aff1b890a463b01cc2c6b75c56fc5fe887d9ec5d2c7065535c083385044b6"
 ...
--- a/helmfile/environments/default/charts.yaml.gotmpl
+++ b/helmfile/environments/default/charts.yaml.gotmpl
@@ -24,7 +24,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-certificates"
    name: "opendesk-certificates"
-    version: "3.1.2"
+    version: "3.1.3"
    verify: true
  clamav:
    # providerCategory: "Platform"
@@ -34,7 +34,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav"
    name: "opendesk-clamav"
-    version: "4.0.6"
+    version: "4.0.7"
    verify: true
  clamavSimple:
    # providerCategory: "Platform"
@@ -44,7 +44,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav"
    name: "clamav-simple"
-    version: "4.0.6"
+    version: "4.0.7"
    verify: true
  collabora:
    # providerCategory: "Supplier"
@@ -97,7 +97,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-dovecot"
    name: "dovecot"
-    version: "3.1.5"
+    version: "3.2.0"
    verify: true
  element:
    # providerCategory: "Platform"
@@ -107,7 +107,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-element"
-    version: "6.1.3"
+    version: "6.1.7"
    verify: true
  elementWellKnown:
    # providerCategory: "Platform"
@@ -117,7 +117,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-well-known"
-    version: "6.1.3"
+    version: "6.1.7"
    verify: true
  home:
    # providerCategory: "Platform"
@@ -149,7 +149,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
    name: "opendesk-jitsi"
-    version: "3.2.0"
+    version: "3.3.2"
    verify: true
  mariadb:
    # providerCategory: "Platform"
@@ -209,7 +209,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-matrix-user-verification-service"
-    version: "6.1.3"
+    version: "6.1.7"
    verify: true
  memcached:
    # providerCategory: "Community"
@@ -249,27 +249,27 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud"
-    version: "4.4.1"
+    version: "4.4.4"
    verify: true
  nextcloudManagement:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry.opencode.de"
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-nextcloud/opendesk-nextcloud-management
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud/opendesk-nextcloud-management"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud-management"
-    version: "4.4.1"
+    version: "4.4.4"
    verify: true
  nextcloudNotifyPush:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry.opencode.de"
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-nextcloud/opendesk-nextcloud-notifypush
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud/opendesk-nextcloud-notifypush"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud-notifypush"
-    version: "4.4.1"
+    version: "4.4.4"
    verify: true
  nginx:
    # providerCategory: "Community"
@@ -285,7 +285,7 @@ charts:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry.opencode.de"
-    # packageName=bmi/opendesk/components/platform-development/charts/nginx-s3-gateway/nginx-s3-gateway
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/nginx-s3-gateway/nginx-s3-gateway"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/nginx-s3-gateway"
    name: "nginx-s3-gateway"
@@ -295,11 +295,21 @@ charts:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry.opencode.de"
-    # packageName=bmi/opendesk/components/platform-development/charts/opendesk-impress
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-impress/impress"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-impress"
    name: "impress"
-    version: "1.0.1"
+    version: "1.0.2"
+    verify: true
+  notesCustomization:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-impress-customization/impress-customization"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-impress-customization"
+    name: "impress-customization"
+    version: "1.0.0"
    verify: true
  nubus:
    # providerCategory: "Supplier"
@@ -311,7 +321,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
    name: "nubus"
-    version: "1.13.1"
+    version: "1.14.0"
    verify: true
  opendeskAlerts:
    # providerCategory: "Platform"
@@ -395,7 +405,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
    name: "appsuite-public-sector"
-    version: "2.22.355"
+    version: "2.23.206"
    verify: false
  oxAppSuiteBootstrap:
    # providerCategory: "Platform"
@@ -427,7 +437,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix"
    name: "postfix"
-    version: "5.0.0"
+    version: "5.0.1"
    verify: true
  postgresql:
    # providerCategory: "Platform"
@@ -457,7 +467,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse"
-    version: "6.1.3"
+    version: "6.1.7"
    verify: true
  synapseAdmin:
    # Enterprise Component
@@ -485,7 +495,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-create-account"
-    version: "6.1.3"
+    version: "6.1.7"
    verify: true
  synapseGroupsync:
    # Enterprise Component
@@ -513,7 +523,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-web"
-    version: "6.1.3"
+    version: "6.1.7"
    verify: true
  xwiki:
    # providerCategory: "Supplier"
@@ -525,6 +535,6 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
    name: "xwiki"
-    version: "1.4.4"
+    version: "1.5.4"
    verify: false
 ...
--- a/helmfile/environments/default/customization.yaml.gotmpl
+++ b/helmfile/environments/default/customization.yaml.gotmpl
@@ -51,6 +51,7 @@ customization:
    opendeskNextcloudNotifyPush: {}
    # notes
    notes: {}
+    notesCustomization: {}
    # nubus
    ums: {}
    intercomService: {}
--- a/helmfile/environments/default/database.yaml.gotmpl
+++ b/helmfile/environments/default/database.yaml.gotmpl
@@ -99,6 +99,14 @@ databases:
    connectionPoolMin: "3"
    connectionPoolMax: "5"
    connectionLimit: ~
+  umsAuthSession:
+    type: "postgresql"
+    name: "nubus_authsession"
+    host: "postgresql"
+    port: 5432
+    username: "authsession_user"
+    password: ""
+    connectionLimit: 10
  umsGuardianManagementApi:
    type: "postgresql"
    name: "guardianmanagementapi"
--- a/helmfile/environments/default/existing_secrets.yaml.gotmpl
+++ b/helmfile/environments/default/existing_secrets.yaml.gotmpl
@@ -0,0 +1,273 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+existingSecrets:
+  ai:
+    apiKey:
+      name: ~
+      key: ~
+  cache:
+    intercom:
+      password:
+        name: ~
+        key: ~
+    nextcloud:
+      username:
+        name: ~
+        key: ~
+      password:
+        name: ~
+        key: ~
+  cassandra:
+    initDBSecret: ~
+    existingSecret:
+      name: ~
+      passwordKey: ~
+  centralnavigation:
+    apiKey:
+      name: ~
+      key: ~
+  certificates:
+    password:
+      name: ~
+      key: ~
+  collabora:
+    existingSecret:
+      name: ~
+      passwordKey: ~
+      usernameKey: ~
+  databases:
+    keycloak:
+      password:
+        name: ~
+        key: ~
+    keycloakExtension:
+      password:
+        name: ~
+        key: ~
+    nextcloud:
+      password:
+        name: ~
+        key: ~
+      username:
+        name: ~
+        key: ~
+    notes:
+      password:
+        name: ~
+        key: ~
+      user:
+        name: ~
+        key: ~
+    openproject:
+      name: ~
+      adminPasswordKey: ~
+      userPasswordKey: ~
+    umsGuardianManagementApi:
+      password:
+        name: ~
+        key: ~
+    xwiki:
+      password:
+        name:  ~
+        key: ~
+  dovecot:
+    doveadm:
+      name: ~
+      key: ~
+    aclUser:
+      name: ~
+      key: ~
+    dictmapUser:
+      name: ~
+      key: ~
+    objectStorage:
+      encryption:
+        privateKey:
+          name: ~
+          key: ~
+        publicKey:
+          name: ~
+          key: ~
+  functional:
+    authentication:
+      clients:
+        name: ~
+        key: ~
+      ssoFederation:
+        name: ~
+        key: ~
+  keycloak:
+    adminSecret:
+      name: ~
+    adminPassword:
+      name: ~
+      key: ~
+    clientSecret:
+      dovecot:
+        name: ~
+        key: ~
+      guardian:
+        name: ~
+        key: ~
+      intercom:
+        name: ~
+        key: ~
+      nextcloudOidc:
+        name: ~
+        key: ~
+      notes:
+        name: ~
+        key: ~
+      openproject:
+        name: ~
+        key: ~
+        identifier: ~
+      xwiki:
+        name: ~
+        key: ~
+    clients:
+      name: ~
+      key: ~
+  mariadb:
+    rootPassword:
+      name: ~
+      key: ~
+    databases: ~
+    users: ~
+  minio:
+    existingSecret: ~
+    rootUserSecretKey: ~
+    rootPasswordSecretKey: ~
+    usersExistingSecrets: []
+  nextcloud:
+    admin:
+      password:
+        name: ~
+        key: ~
+      username:
+        name: ~
+        key: ~
+    metricsToken:
+      name: ~
+      key: ~
+  notes:
+    collaborationSecret:
+      name: ~
+      key: ~
+    django:
+      secretKey:
+        name: ~
+        key: ~
+      superuserEmail:
+        name: ~
+        key: ~
+      superuserPassword:
+        name: ~
+        key: ~
+    redisUrl:
+      name: ~
+      key: ~
+  nubus:
+    ics:
+      session:
+        name: ~
+        key: ~
+      synapseAsToken:
+        name: ~
+        key: ~
+    ldapSearch:
+      dovecot:
+        name: ~
+        key: ~
+      keycloak:
+        name: ~
+      nextcloud:
+        name: ~
+        key: ~
+      xwiki:
+        name: ~
+        key: ~
+  objectstores:
+    dovecotUser:
+      name: ~
+      key: ~
+    nextcloud:
+      accessKey:
+        name: ~
+        key: ~
+      secretKey:
+        name: ~
+        key: ~
+    notes:
+      s3AccessKeyId:
+        name: ~
+        key: ~
+      s3SecretAccessKey:
+        name: ~
+        key: ~
+    nubus:
+      accessKey:
+        name: ~
+        key: ~
+      secretKey:
+        name: ~
+        key: ~
+    openproject:
+      name: ~
+      accessKeyId: ~
+      secretAccessKey: ~
+  openproject:
+    adminUserPassword:
+      name: ~
+      key: ~
+    apiAdmin:
+      password:
+        name: ~
+        key: ~
+      username:
+        name: ~
+        key: ~
+    environment: ~
+  openxchangeConnector:
+    provisioningApiPassword:
+      name: ~
+      key: ~
+  oxAppSuite:
+    migrationsMasterPassword:
+      name: ~
+      key: ~
+  postgresql:
+    rootPassword:
+      name: ~
+      key: ~
+    databases: ~
+    users: ~
+  postfix:
+    opendeskSystem:
+      password:
+        name: ~
+        key: ~
+      username:
+        name: ~
+        key: ~
+  redis:
+    existingSecret: ~
+    existingSecretPasswordKey: ~
+  smtp:
+    username:
+      name: ~
+      key: ~
+    password:
+      name: ~
+      key: ~
+  xwiki:
+    xwikiSuperadminpassword:
+      name: ~
+      key: ~
+    propertiesSecret:
+      name: ~
+      key: ~
+...
--- a/helmfile/environments/default/functional.yaml.gotmpl
+++ b/helmfile/environments/default/functional.yaml.gotmpl
@@ -22,11 +22,11 @@ functional:
        - "Domain Admins"
    oidc:
      # Define additional/custom OIDC clients to be created in the 'opendesk' realm within Keycloak.
-      clients: ~
+      clients: {}
      # Define additional/custom OIDC client scopes to be created in the 'opendesk' realm within Keycloak.
-      clientScopes: ~
-    # Global settings of the 'opendesk' realm within Keycloak. The values are used to set Keycloak's realm attributes
-    # of the same name and are applied by `opendesk-keycloak-bootstrap`.
+      clientScopes: {}
+    # Configure global settings of the 'opendesk' realm within Keycloak. The values are directly
+    # passed into the `realmSettings` section of the `opendesk-keycloak-bootstrap` chart.
    # Ref.: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap
    # Note: Global settings can potentially be overridden on a client level.
    # Note: All numeric "Lifespan" values are defined in seconds.
@@ -75,12 +75,12 @@ functional:
      # Enabling SSO federation requires an upstream IdP specific configuration in `idpDetails` below.
      enabled: false
      # When enforcing the federated login all users are immediately redirected to the federated IdP when a login
-      # is requested or required.
-      enforceFederatedLogin: false
-      # Name of the SSO federation, if you do not enforce the login the name is shown as a login option the user can select
+      # is requested or required. This has to be the exact key like configured in the 'idpDetails' dictionary.
+      enforceFederatedLogin: ""
+      # A dictionary with configured IdPs containing:
+      # 1. Name of the SSO federation, if you do not enforce the login the name is shown as a login option the user can select
      # within the openDesk login dialog.
-      name: "My upstream IdP"
-      # Configuration details for your upstream IdP, when you configured them manually in the Keycloak UI e.g. for
+      # 2. Configuration details underneath 'idpDetails' for your upstream IdP, when you configured them manually in the Keycloak UI e.g. for
      # testing the setup, you can get them from a Keycloak realm export in the `identityProviders` list.
      # Notes:
      # - You have to convert the configuration into YAML to apply it below.
@@ -90,8 +90,54 @@ functional:
      #  - `alias`
      #  - `firstBrokerLoginFlowAlias`
      #  - `internalId`
-      idpDetails: {}
-
+      # Example:
+      # myUpstreamIdP:
+      #   name: "My upstream IdP"
+      #   idpDetails:
+      #     providerId: "oidc"
+      #     enabled: true
+      #     updateProfileFirstLoginMode: 'on'
+      #     trustEmail: true
+      #     storeToken: true
+      #     addReadTokenRoleOnCreate: false
+      #     authenticateByDefault: false
+      #     linkOnly: false
+      #     config:
+      #       userInfoUrl: https://id.yourDomainHere/realms/opendesk/protocol/openid-connect/userinfo
+      #       validateSignature: 'true'
+      #       clientId: "yourSecretValueHere"
+      #       clientSecret: "yourSecretValueHere"
+      #       tokenUrl: https://id.yourDomainHere/realms/opendesk/protocol/openid-connect/token
+      #       jwksUrl: https://id.yourDomainHere/realms/opendesk/protocol/openid-connect/certs
+      #       issuer: https://id.yourDomainHere/realms/opendesk
+      #       useJwksUrl: 'true'
+      #       metadataDescriptorUrl: https://id.yourDomainHere/realms/opendesk/.well-known/openid-configuration
+      #       pkceEnabled: 'false'
+      #       authorizationUrl: https://id.yourDomainHere/realms/opendesk/protocol/openid-connect/auth
+      #       clientAuthMethod: client_secret_post
+      #       logoutUrl: https://id.yourDomainHere/realms/opendesk/protocol/openid-connect/logout
+      #       syncMode: LEGACY
+      #       guiOrder: ''
+      #       clientAssertionSigningAlg: ''
+      #       loginHint: 'false'
+      #       passMaxAge: 'false'
+      #       uiLocales: 'false'
+      #       backchannelSupported: 'true'
+      #       sendIdTokenOnLogout: 'true'
+      #       sendClientIdOnLogout: 'false'
+      #       disableUserInfo: 'false'
+      #       disableNonce: 'false'
+      #       defaultScope: ''
+      #       prompt: ''
+      #       acceptsPromptNoneForwardFromClient: 'false'
+      #       allowedClockSkew: 0
+      #       forwardParameters: ''
+      #       isAccessTokenJWT: 'false'
+      #       hideOnLoginPage: 'false'
+      #       filteredByClaim: 'false'
+      #       caseSensitiveOriginalUsername: 'true'
+      #     postBrokerLoginFlowAlias: ''
+      idpDict: {}
  chat:
    matrix:
      profile:
@@ -128,6 +174,25 @@ functional:
      enabled: true

  filestore:
+    # Settings related to directory and filenames
+    naming:
+      # Disallowed characters for directory and file names.
+      # Some operating systems do not support these characters, preventing affected clients from syncing files.
+      #
+      # Note: After changing the settings below and redeploying Nextcloud, restart the `aio` Pod(s) to
+      # apply the changes.
+      forbiddenChars:
+        - '*'
+        - '"'
+        - '|'
+        - '?'
+        - ';'
+        - ':'
+        - '\'
+        - '/'
+        - '~'
+        - '<'
+        - '>'
    quota:
      # Set the default quota for all users in gigabyte
      default: 1
@@ -136,8 +201,12 @@ functional:
    sharing:
      # External shares
      external:
-        # Enables sharing of files with external participants (create external links, send links by mail and allow external upload in shared folders).
-        # If you disable this option existing external shares stop working, when re-enabling it the old shares are available again.
+        # Enables sharing of files with external participants (create external links, send links by mail and allow
+        # external upload in shared folders).
+        # When you enable external sharing it is still possible to use the groupfolder feature and block external
+        # sharing for defined groupfolder(s).
+        # Note: If you disable this option existing external shares stop working, when re-enabling it the old
+        # shares are available again.
        enabled: false
        # Enforces passwords to be used on external shares.
        enforcePasswords: false
@@ -176,22 +245,65 @@ functional:
  groupware:
    # Related settings for the CalDAV and CardCAV support of the groupware module.
    davSupport:
-      # Enabled by default it is available at:
+      # Enabled by default CalDAV and CardDAV support is available at:
      # - https://<.Values.global.hosts.openxchangeDav>.<.Values.global.domain>/caldav/[folderId]"
      # - https://<.Values.global.hosts.openxchangeDav>.<.Values.global.domain>/carddav/[folderId]"
      # Can be switched off using the below feature toggle.
      enabled: true
+    # Control access for external users to groupware data
+    # Ref.: https://documentation.open-xchange.com/8/middleware/miscellaneous/sharing_and_guest_mode.html
+    externalSharing:
+      # Allow anonymous guest users to access resources via share links.
+      # Ref.: https://documentation.open-xchange.com/8/middleware/miscellaneous/sharing_and_guest_mode.html#share-links
+      shareLinks:
+        enabled: false
+      # Allow sharing of resources with guest users created on demand by App Suite.
+      # Ref.: https://documentation.open-xchange.com/8/middleware/miscellaneous/sharing_and_guest_mode.html#invite-guests
+      inviteGuests:
+        enabled: false
+    # Mail related settings
+    mail:
+      # Mail categories related settings
+      # Ref.: https://documentation.open-xchange.com/8/middleware/mail/mail_categories.html
+      categories:
+        # Toggle the availability of the mail categories feature.
+        # Ref.:
+        enabled: true
+      # Control options for handling incoming emails
+      inbound:
+        # Allow users to configure a notification address that receives a notification whenever a new email arrives
+        # in their inbox.
+        # Ref.: https://gitlab.open-xchange.com/extensions/public-sector/-/blob/main/documentation/ui/030_autonotify.md
+        notify:
+          enabled: true
+        # Allow users to automatically forward all incoming emails to an email address of their choice.
+        forward:
+          enabled: false
+      # Email encryption related settings.
+      encryption:
+        # Toggle the availability of OX Guard
+        # Ref.: https://www.open-xchange.com/products/ox-guard/
+        enabled: true
+      # Define the maximum size for emails (including their attachments) in Megabyte
+      maxSize: 25
    quota:
      # Set the default mail storage quota for users in gigabyte.
      # Just provide the plain number without quoting. It will allow a quota grace of 10% and +20% in trash storage.
      # If you need different rules you can use customizing on Dovecot's `quotaRules` and `quotaGrace` templating.
      default: 1
+    # User profile related control options
+    userProfile:
+      # The user's display name is managed by openDesk IAM and should not be manually changed by the user.
+      # Ref.: https://documentation.open-xchange.com/8/ui/configuration/settings-list-of.html#mail-misc
+      editRealName: false

  migration:
    oxAppSuite:
      # Note: Only available in openDesk Enterprise.
-      # Turn on temporary for migration purposes only. Will enable master password auth in OX AppSuite and Dovecot using
-      # `secrets.oxAppSuite.migrationsMasterPassword`.
+      # Note: Turn on temporary for migration purposes only.
+      # Will enable master password auth in Dovecot and add an additional OX App Suite Core Middelware Pod in the
+      # role `migration` that is master password enabled. The Pod is accessible through a ClusterIP.
+      # Master password is defined in `secrets.oxAppSuite.migrationsMasterPassword`.
      enabled: false

  portal:
@@ -204,8 +316,8 @@ functional:
    linkPrivacyStatement: "https://www.zendis.de/datenschutzerklarung"
    # Link to documentation, shown in the right lower corner of the portal, set to "~" if you want to remove the link
    linkDocumentation: "https://docs.opendesk.eu/"
-    # Link to support, shown in the right lower corner of the portal, set to "~" if you want to remove the link
-    linkSupport: "https://opendesk.eu/support"
+    # Link to support for your deployment, shown in the right lower corner of the portal,
+    linkSupport: ~
    # Link to feedback, shown in the right lower corner of the portal, set to "~" if you want to remove the link
    linkFeedback: "https://opendesk.eu/feedback"
    # Newsfeed related settings
--- a/helmfile/environments/default/global.generated.yaml.gotmpl
+++ b/helmfile/environments/default/global.generated.yaml.gotmpl
@@ -3,5 +3,5 @@
 ---
 global:
  systemInformation:
-    releaseVersion: "v1.7.1"
+    releaseVersion: "v1.8.0"
 ...
--- a/helmfile/environments/default/images.yaml.gotmpl
+++ b/helmfile/environments/default/images.yaml.gotmpl
@@ -50,7 +50,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "25.04.4.3.1@sha256:2ba934fb0dc18965bfaf19151017205b0a85af8b069bc34c994a8eae0b4bee34"
+    tag: "25.04.5.3.1@sha256:0e1ccf43308121c657936510de27244057c3826777a491495a0f7e55a196bc59"
  collaboraController:
    # Enterprise Component
    # providerCategory: "Supplier"
@@ -63,10 +63,11 @@ images:
    # providerResponsible: "XWiki"
    # upstreamRegistry: "https://registry-1.docker.io"
    # upstreamRepository: "cryptpad/cryptpad"
-    # upstreamMirrorTagFilterRegEx: '^opendesk-(\d+)$'
+    # upstreamMirrorTagFilterRegEx: '^version-(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["2025", "6", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/cryptpad"
-    tag: "opendesk-20241022@sha256:3e5bf06cb9d0a7ec8257874b8b347599200eb677fc428a2e043ccab06ef2be17"
+    tag: "version-2025.6.0@sha256:7711c08792637534445e6f1e42407149c2568ae0490b83ea36c06ba395389dec"
  dkimpy:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -90,16 +91,13 @@ images:
    # upstreamRepository: "alpine/k8s"
    registry: "registry-1.docker.io"
    repository: "alpine/k8s"
-    tag: "1.33.1@sha256:7f8133af0dd210cb5b168f889c5bc77dd65ecc935f3e3cb72d1b98ff96bfed40"
+    tag: "1.34.0@sha256:b5f6edfeac5279f3e182d938d1ffecb62f7c980756ac4b6b66d7f0d566782f77"
  element:
    # providerCategory: "Supplier"
    # providerResponsible: "Element"
-    # upstreamRegistry: "https://ghcr.io"
-    # upstreamRepository: "element-hq/element-web-modules/opendesk-plugin"
-    # upstreamMirrorTagFilterRegEx: '^latest-\d+$'
    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/element/images-mirror/opendesk-plugin"
-    tag: "latest-250304@sha256:b997a9245c5a85ddb9935e6a9f8f8da60fed58aad17df8f1e1e2fabafdbf0dd1"
+    repository: "bmi/opendesk/components/supplier/element/images/opendesk-element-web"
+    tag: "v1.12.0@sha256:a2ff739dc3eee008a5046c4d3a8721f4dd2a27dd6c80a12cb9baf64525c9b617"
  elementAdminBot:
    # Enterprise Component
    # providerCategory: "Supplier"
@@ -170,7 +168,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jibri"
-    tag: "stable-9955@sha256:a07b82f2758389b2071c794810145111641e78f1b768b1bbfa6d3d1dc76d3da9"
+    tag: "stable-10431@sha256:21ae6f3e9139ca1beea630756060b66f1a6221005f45e35df35d4bf9f69a4cc3"
  jicofo:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -180,7 +178,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jicofo"
-    tag: "stable-9955@sha256:f1a1478d231bc4891b5eea06443d72187c378d5e38403bb545aab281446f8d50"
+    tag: "stable-10431@sha256:6857b0cad627cde79f6e21c1c40843b14d70dd43e627537c60449d448ce14769"
  jigasi:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -190,7 +188,7 @@ images:
    # upstreamMirrorStartFrom: ["9955"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jigasi"
-    tag: "stable-9955@sha256:0e191ac39d3e7299d0bcc070fa1867cceb17fe8d92e9d5cd492aec4c268fa56f"
+    tag: "stable-10431@sha256:9bcb35444296ab007b24a8ccecd6c1eacc0f01fccf4223e7f8ac340464f4a52e"
  jitsi:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -200,7 +198,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/web"
-    tag: "stable-9955@sha256:81fdcfa14287fe3358532c363875584d0cdd40ff4030695b713af6e60192d306"
+    tag: "stable-10431@sha256:47f57fb67d95a2d3b5fa6edf93916b4922e1599278c0f9dd16cc30f432c75511"
  jitsiKeycloakAdapter:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -210,7 +208,7 @@ images:
    # upstreamMirrorStartFrom: ["2023", "12", "14"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jitsi-keycloak-adapter"
-    tag: "v20250314@sha256:2e24db127ab266b90b8fd371ce547e7f9619b6be3fefed30906867b1ce368697"
+    tag: "v20250911@sha256:716fb9ba2e866d74cbbd6241a8c75335e48ba25ec2d35f4678e83dd3156bc87c"
  jitsiPatchJVB:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -220,7 +218,7 @@ images:
    # upstreamMirrorStartFrom: ["1", "32", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/community/images-mirror/kubectl"
-    tag: "1.32.0@sha256:48c81b7aaf4fabf2733a0b888960f6982181fbcd2c3f8dfcebc4a1a065631162"
+    tag: "1.33.4@sha256:681609aff6bf316acf464d9c9e369d84c49d50be6379247291b01ac311a7f5f5"
  jvb:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -230,7 +228,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jvb"
-    tag: "stable-9955@sha256:27753ac320910e04f5c4f4f628d20995ea969ea38523d90a9066adc52f9bc022"
+    tag: "stable-10431@sha256:64f8a368f593a30d5388d9643b1b0af7b4a09f03f6e585e50cdbff398b5f8918"
  mariadb:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -248,7 +246,7 @@ images:
    # upstreamMirrorStartFrom: ["1", "4", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-neoboard-widget"
-    tag: "2.2.1@sha256:db404ba5b8e76cbd1166529dc2156d84506f1c2d341a1798d25a074e531b9d3d"
+    tag: "2.3.1@sha256:fc93cc8dce43a4e7ee23cf4ab5a85101103a6ed5cb1981c3223d8b5459365f1b"
  matrixNeoChoiceWidget:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -258,7 +256,7 @@ images:
    # upstreamMirrorStartFrom: ["1", "4", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-poll-widget"
-    tag: "1.5.2@sha256:8d0cce2b4f71787cab6cd1b6e6ff52205224a5d01ba384b3ebfbf05bc3228930"
+    tag: "1.6.0@sha256:637b93d6cd6090682a5d3e7c45d9767f385c53eaef8e3bc3f30425a65c1648e8"
  matrixNeoDateFixBot:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -268,7 +266,7 @@ images:
    # upstreamMirrorStartFrom: ["2", "7", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-meetings-bot"
-    tag: "2.8.3@sha256:5bc9b8d67b4ecb38b618e84d54e759ba57c0533706300154a60423dfcf86f7e1"
+    tag: "2.8.5@sha256:30038eb480d8ef1173a5496bcb05470e8c7a36cad1338cccd14e38531e526f32"
  matrixNeoDateFixWidget:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -278,7 +276,7 @@ images:
    # upstreamMirrorStartFrom: ["1", "6", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-meetings-widget"
-    tag: "1.7.1@sha256:c03917f78ba197b2f93a59eb3d6596447de1e2bf5836194afa121fae8ea18593"
+    tag: "1.7.2@sha256:f876267ed81148ece68cc95bdad7be9c3cce89ce944dbf1b97161e16f72c0cda"
  matrixUserVerificationService:
    # providerCategory: "Supplier"
    # providerResponsible: "Element"
@@ -332,7 +330,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.10.8@sha256:3fdc0b099d2c8343ea404708002e900c1ec74966384db3696948cc3a7a34300a"
+    tag: "2.10.12@sha256:8a4cd73fdceb1da2c58a22a85d605eba575a2b1487e3927ab1971c9f1120549a"
  nextcloudExporter:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -356,7 +354,7 @@ images:
    # upstreamRepository: "lasuite/impress-backend"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-notes"
-    tag: "1.9.0-docs-v3.2.1-backend@sha256:17c16e4e00b15e4637d01553d56e7eecb7a477bec48677d1e7fb07b04c48d2b8"
+    tag: "1.11.0-docs-v3.4.0-backend@sha256:a07acb86ee260fd9242c4173a01c67c36552d149a2af91220348bdb588c19bf5"
  notesFrontend:
    # providerCategory: "Supplier"
    # providerResponsible: "DINUM"
@@ -364,7 +362,7 @@ images:
    # upstreamRepository: "lasuite/impress-frontend"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-notes"
-    tag: "1.9.0-docs-v3.2.1-frontend@sha256:328d5a8bf41875eb5945229adfc4a52eb2fef109e25d980910ee77edd4bc1887"
+    tag: "1.11.0-docs-v3.4.0-frontend@sha256:e7316700442455419ebb2e37fe2ae246bb90a7d09ad30477df608b5eb6089095"
  notesYProvider:
    # providerCategory: "Supplier"
    # providerResponsible: "DINUM"
@@ -382,7 +380,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "34", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/blocklist-cleanup"
-    tag: "0.39.1@sha256:a08a36d0c0558a71f164ef24b3b8f897fa4b87217f9063ae493d4c66c7348c5c"
+    tag: "0.40.0@sha256:1b4d388196b144327bc55376225675b1df8d23fdaffc85bb9e350c3c94fa0eb5"
  nubusDataLoader:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -392,7 +390,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "41", "5"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/data-loader"
-    tag: "0.97.5@sha256:43371a04f951d733419e508af4dc4fe7d27a71fd6b616d93568bb304d5d8fe4c"
+    tag: "0.99.0@sha256:52ef05c1e682e6c706f70632206be1b427a1a346a32ae3bff1566386f75e68af"
  nubusGuardianAuthorizationApi:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -452,7 +450,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "1", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-bootstrap"
-    tag: "0.16.3@sha256:8b455b329b6364580b7ab85d704c6ac5f025da7b313611b1f7cf66ca07f41c52"
+    tag: "0.17.5@sha256:08e2aa0bc0eb7b4bb80498e71ae21ee3de74eb985b46e7c3dd1502e96312d080"
  nubusKeycloakExtensionHandler:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -482,7 +480,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "8", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-notifier"
-    tag: "0.46.2@sha256:96cfd086f7df7f60ab18ee2c76a6b910011d506c488863d7819727977ee32f72"
+    tag: "0.47.0@sha256:1d00e0bb1575defce42c84eb5139b5b4f7d0942111b339044c2bdf58ed0b025e"
  nubusLdapServer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -492,7 +490,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "8", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server"
-    tag: "0.46.2@sha256:88a7fb8ca353cd5e32357489cca75eec9b0cfc1802e66ad14365cc1971f7f639"
+    tag: "0.47.0@sha256:3be012680b2da2db4ac468ae948d8514622a245b4e3e00385bbf778e836720b1"
  nubusLdapServerDhInitContainer:
    # providerCategory: 'Community'
    # providerResponsible: 'Univention'
@@ -510,7 +508,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "29", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server-elector"
-    tag: "0.46.2@sha256:8314b3d683168bd33e3bc5ba8b4689db10f302d409c8966d7620d2c7617bd7f3"
+    tag: "0.47.0@sha256:9b6754e7213f1fa13a12cb593bfe718643f6945ad111bbe1d5f71d7ce5729225"
  nubusLdapUpdateUniventionObjectIdentifier:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -520,7 +518,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "34", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-update-univention-object-identifier"
-    tag: "0.39.4@sha256:49677ee61dd6aff0e87ff9bde2f032a939749e4097f461307d064566c380c6e2"
+    tag: "0.40.0@sha256:1ad952c039140ef1985712201f7bae7cbe9eba66086e0d3f475759e1c181b843"
  nubusNats:
    # providerCategory: 'Community'
    # providerResponsible: 'Univention'
@@ -554,7 +552,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/notifications-api"
-    tag: "0.79.4@sha256:b4e2fc6631e35a97ad920437b645fa4212a3ef7c563c1b048dc282535f9f7634"
+    tag: "0.80.2@sha256:94b18841018cb7353a95a9c4ef2d5460f82a9ceb0bba97275b8064806e3e8a1c"
  nubusOpendeskExtension:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -562,7 +560,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-    tag: "1.14.9@sha256:a2c7a5e302ed5cc52445fd1b18b277de4a3d45b2a2940f1a3970447dc13eb16c"
+    tag: "1.15.0@sha256:5ffb3106bf896a215fd7ae5d6646f19b50f0e46c11561d763938479d95aaa807"
  nubusOpendeskExtensionA2gMapper:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -600,7 +598,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "27", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-consumer"
-    tag: "0.79.4@sha256:757bfea13aba02805e671b6dfee98f5e97e7ed83d8cbd933e33dc8f3e06e140c"
+    tag: "0.80.2@sha256:c719ada025e0ad629516017ed26803c15cee50572f45896b41a6b066b1fe593e"
  nubusPortalExtension:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -610,7 +608,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "28", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-extension"
-    tag: "0.79.4@sha256:15a01dd58bdb309a54acaeb6722c497dd8f40e1269b7ae023813c4d33f73ac97"
+    tag: "0.80.2@sha256:cde5547ef1c2d5da55fb41bdae7248ba8514ab4f200822709ca9a99f483a1cc8"
  nubusPortalFrontend:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -620,7 +618,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "67", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-frontend"
-    tag: "0.79.4@sha256:8dd1ac0122312e81413699c7d7535c0a35b0e7f9d36fbda0edba388bc1d91917"
+    tag: "0.80.2@sha256:8b40acc66459058dc0cade33793aba2737cdc20ef75968ca2b21d9aa569c9ecc"
  nubusPortalServer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -630,7 +628,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-server"
-    tag: "0.79.4@sha256:a4ed5cad22516e153cdffec2d658724d68effd22b60478f179fa7d6e5e0451ad"
+    tag: "0.80.2@sha256:9a8f6950e7bf1086075d1c36ea0ad914a61e1198883e8d4926d688c88b8e67cc"
  nubusProvisioningDispatcher:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -700,7 +698,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/udm-rest-api"
-    tag: "0.39.4@sha256:195a1889d67e3848bad238e400dba446521f689649b0e691a788b734b4b5a26a"
+    tag: "0.40.0@sha256:7d39c0defda20fc58da19389216d9a80f479a731dca682d834dd8bd00b80e20f"
  nubusUmcGateway:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -710,7 +708,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "7", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-gateway"
-    tag: "0.50.3@sha256:faf08a490d9e99b4b07398bf23a0694ea2ff2e58296dfa6f712a6b7f12583c9d"
+    tag: "0.51.2@sha256:c76860852133b9bbc91eb6d81a6592a5f451be9234376933ddb4d827e0f08515"
  nubusUmcServer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -720,7 +718,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "7", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-server"
-    tag: "0.50.3@sha256:41f68c7636253763a18779ff4c38fd02a9903cdb38d955d23cc79cf97efcbe5c"
+    tag: "0.51.3@sha256:00f8cc2e7ee98d3988b1db924ca67783e9a645204ae2c388c7afadc50f22bb12"
  nubusUmcServerProxy:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -764,7 +762,7 @@ images:
    # upstreamMirrorStartFrom: ["13", "1", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "16.3.2@sha256:07dfc96b97cb309d1c233b4bb65060e9cf96a586807de9b616be6ae066aa7a6c"
+    tag: "16.4.1@sha256:b80443fc9fe1bf9ed475897316208b394cca4e730ae8ca34944373245cc0a4f5"
  openprojectBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -788,7 +786,7 @@ images:
    # upstreamRepository: "alpine/k8s"
    registry: "registry-1.docker.io"
    repository: "alpine/k8s"
-    tag: "1.33.0@sha256:60333a52c38e9a8df0a9b93a5a24a4870f0db2c7ea3266b185386bd0a500d7dc"
+    tag: "1.34.0@sha256:b5f6edfeac5279f3e182d938d1ffecb62f7c980756ac4b6b66d7f0d566782f77"
  openxchangeCoreGuidedtours:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -808,7 +806,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "51"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/middleware-public-sector"
-    tag: "8.40.63@sha256:7714be24df57cedf7d8e040504e7ab5b0580b068c2f66c3759a91175562b56ea"
+    tag: "8.41.58@sha256:a4c169d13a928d5532fc200be6c7c76c1d18f0579b8dbdb514583f62ac9fe8c7"
  openxchangeCoreUI:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -818,7 +816,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui"
-    tag: "8.40.3@sha256:7ba6011d1fb080e86e8f0fca01ce6f1959bdc1dc11f4e2502dda89002ec14155"
+    tag: "8.41.1@sha256:108974ea42a4cf22ea1b37b975928881b6c23a2949b51781812f5b1260873aa4"
  openxchangeCoreUIMiddleware:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -838,7 +836,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "799279"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-user-guide"
-    tag: "8.40.1510916@sha256:5956c792fecfbed864116bdc10c6fa8c602614cd88452a4f864d26fb9decd3e6"
+    tag: "8.41.1547156@sha256:fadee7a76ffa91e0be7ec643f3315806787ac2eea4b0bb271201a58580a5f456"
  openxchangeDocumentConverter:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -848,7 +846,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "50"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/documentconverter"
-    tag: "8.40.1862@sha256:89c4b2b78d023bd730133e4c494068d476a50248f99f25a26b3173a874356bcd"
+    tag: "8.41.1875@sha256:839d73bdc7b158beee5e157df4b49004c9f4f2df1afb65c1e4bae51f9f67a213"
  openxchangeGotenberg:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -878,7 +876,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "50"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/imageconverter"
-    tag: "8.40.2187@sha256:8a018244d6ea8c6fbb2f1bf2fdd56709d7011ee0fb9ba84c81c3300cf7d23802"
+    tag: "8.41.2194@sha256:8b3085642fea2bc0ab64b6a8256ce4c00952e84d4c233edd05d458a8d82045f9"
  openxchangeNextcloudIntegrationUI:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -924,7 +922,7 @@ images:
    # upstreamRepository: "alpine/k8s"
    registry: "registry-1.docker.io"
    repository: "alpine/k8s"
-    tag: "1.33.0@sha256:60333a52c38e9a8df0a9b93a5a24a4870f0db2c7ea3266b185386bd0a500d7dc"
+    tag: "1.34.0@sha256:b5f6edfeac5279f3e182d938d1ffecb62f7c980756ac4b6b66d7f0d566782f77"
  postgresql:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -942,7 +940,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/prosody"
-    tag: "stable-9955@sha256:fa66872338c7c3b6fdb1f1a67ad770f2b62948f4193b91a58f12c0aa5ca2e783"
+    tag: "stable-10431@sha256:792618fff60c6e0eb4facb221e3477b2249cabeaf0479753ac7a6b98c075fd20"
  redis:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -962,7 +960,7 @@ images:
    # upstreamMirrorStartFrom: ["1", "91", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse"
-    tag: "v1.129.0@sha256:13ac3293547d8c06e1e03fca4e02ef9a47f132acc2e2cdb4143a01495dd924cf"
+    tag: "v1.137.0@sha256:ae2f7ae1329d4ce66292ee2aed78f9187ab25104288c44413b0de4c0ae8ac7f9"
  synapseCreateUser:
    # providerCategory: "Community"
    # providerResponsible: "Nordeck"
@@ -970,7 +968,7 @@ images:
    # upstreamRepository: "alpine/k8s"
    registry: "registry-1.docker.io"
    repository: "alpine/k8s"
-    tag: "1.33.0@sha256:60333a52c38e9a8df0a9b93a5a24a4870f0db2c7ea3266b185386bd0a500d7dc"
+    tag: "1.34.0@sha256:b5f6edfeac5279f3e182d938d1ffecb62f7c980756ac4b6b66d7f0d566782f77"
  synapseGuestModule:
    # providerCategory: "Supplier"
    # providerResponsible: "Element"
@@ -1002,19 +1000,19 @@ images:
    # providerResponsible: "XWiki"
    # upstreamRegistry: "https://git.xwikisas.com:5050"
    # upstreamRepository: "xwikisas/swp/xwiki"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)-mariadb.+$'
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)-?\d?-mariadb.+$'
    # upstreamMirrorStartFrom: ["17", "4", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/xwiki"
-    tag: "17.4.4-mariadb-jetty-alpine@sha256:069dfcc11b7373eb1b30757144adb90cf661386503bece866a0c728ee89bb47d"
+    tag: "17.4.4-1-mariadb-jetty-alpine@sha256:0182dbb610a4c80b253e63e73ccc2487a07579baf259df4c874d860754127b4c"
  xwikiPostgres:
    # providerCategory: "Supplier"
    # providerResponsible: "XWiki"
    # upstreamRegistry: "https://git.xwikisas.com:5050"
    # upstreamRepository: "xwikisas/swp/xwiki"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)-postgres.+$'
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)-?\d?-postgres.+$'
    # upstreamMirrorStartFrom: ["17", "4", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/xwiki"
-    tag: "17.4.4-postgres-jetty-alpine@sha256:fd567fe4f499d0a0919ed02558e313284f4475d928f126c6800c2410d2a61d39"
+    tag: "17.4.4-1-postgres-jetty-alpine@sha256:2da4c175a418b1b8a09e8b25006bfc6f6f22fd449bc2e77dac31c0b56c444b94"
 ...
--- a/helmfile/environments/default/resources.yaml.gotmpl
+++ b/helmfile/environments/default/resources.yaml.gotmpl
@@ -50,10 +50,10 @@ resources:
  dovecot:
    limits:
      cpu: 99
-      memory: "256Mi"
+      memory: "512Mi"
    requests:
      cpu: 0.1
-      memory: "32Mi"
+      memory: "64Mi"
  element:
    limits:
      cpu: 99
--- a/helmfile/environments/default/secrets.yaml.gotmpl
+++ b/helmfile/environments/default/secrets.yaml.gotmpl
@@ -64,6 +64,7 @@ secrets:
    nextcloudUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "nextcloud_user" | sha1sum | quote }}
    notesUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "notes_user" | sha1sum | quote }}
    openprojectUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "openproject_user" | sha1sum | quote }}
+    umsAuthSessionUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "authsession_user" | sha1sum | quote }}
    umsNotificationsApiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "notificationsapi_user" | sha1sum | quote }}
    umsGuardianManagementApiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "guardianmanagementapi_user" | sha1sum | quote }}
    umsSelfserviceUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "selfservice_user" | sha1sum | quote }}
@@ -85,6 +86,7 @@ secrets:
  keycloak:
    adminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "adminPassword" | sha1sum | quote }}
    clientSecret:
+      portal: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "portal_client_secret" | sha1sum | quote }}
      dovecot: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "dovecot_client_secret" | sha1sum | quote }}
      intercom: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "intercom_client_secret" | sha1sum | quote }}
      matrix: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "matrix_client_secret" | sha1sum | quote }}
--- a/helmfile/files/theme/login/background.jpg
+++ b/helmfile/files/theme/login/background.jpg
--- a/helmfile/shared/migrations.yaml.gotmpl
+++ b/helmfile/shared/migrations.yaml.gotmpl
@@ -22,7 +22,7 @@ migrations:
  loglevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
  failOnUnexpectedState: true
  environmentDetails:
-    {{ ( omit .Values "theme" ) | toYaml | nindent 4 }}
+    {{ ( omit .Values "theme" "functional" ) | toYaml | nindent 4 }}
  cleanup: false

 containerSecurityContext:
--- a/publiccode.yml
+++ b/publiccode.yml
@@ -22,8 +22,8 @@ name: "openDesk"
 platforms:
  - "web"
 developmentStatus: "stable"
-softwareVersion: "1.7.1"
-releaseDate: "2025-08-26"
+softwareVersion: "1.8.0"
+releaseDate: "2025-09-25"
 softwareType: "standalone/web"
 url: "https://gitlab.opencode.de/bmi/opendesk/"
 logo: ".opencode/openDesk-logo-rgb-color.svg"
Author	SHA1	Message	Date
Axel Lender	1ec6f794e6	feat(postgresql): Add template support for existing secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-12-03 21:26:07 +01:00
Axel Lender	c656786bc0	feat(mariadb): Add template support for existing secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-12-03 21:18:21 +01:00
Axel Lender	3890df064e	fix(gotmpl): Refactor from external to existing secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-11-27 14:03:07 +01:00
Axel Lender	3f2cf149e7	feat(openproject): Template external secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-11-13 11:15:16 +01:00
Axel Lender	c98aa3a0cd	fix(intercom-service): Correct key for external secret mapping Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-11-13 11:15:16 +01:00
Axel Lender	e687444765	feat(migrations): Add documentation about the changes regarding oD keycloak-bootstrap Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-11-13 11:15:16 +01:00
Axel Lender	b92e776585	feat(keycloak-bootstrap): Adapt to oD-keycloak-bootstrap changes Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-11-13 11:15:16 +01:00
Axel Lender	bb67fd9641	fix(lint): Satisfy linter Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:44:49 +02:00
Axel Lender	c6a0caeac5	feat(nubus): Template external secrets for keycloak-bootstrap Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:44:49 +02:00
Axel Lender	369242181f	feat(nubus): Templating for external secrets to supersede extraSecrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:44:49 +02:00
Axel Lender	1fb1c9892b	fix(helmfile): Remove testing values from external secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:44:48 +02:00
Axel Lender	7367d16287	feat(notes): Add templating for Notes in oD Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:44:48 +02:00
Axel Lender	602f3b659d	feat(openxchange): Templating external secrets for Dovecot and Postfix also SMTP credentials Co-Author: Thomas Kaltenbrunner <tom@kaltenbrunner.it> Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:44:48 +02:00
Axel Lender	66a5a8a484	fix(helmfile): Streamline naming in externalSecrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:43:00 +02:00
Axel Lender	1fd7cd7d34	feat(nubus): Add templating support for Nubus Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:43:00 +02:00
Axel Lender	cac1e9850d	fix(gotmpl): Structure of the externalSecrets dictionary Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:43:00 +02:00
Axel Lender	03bb231e44	fix(helmfile): Unify database credentials Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:43:00 +02:00
Axel Lender	0187c2571a	feat(documentation): Fix, reorder docs regarding external secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:43:00 +02:00
Axel Lender	70bc05055e	feat(helm): Update upstream version Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:43:00 +02:00
Axel Lender	ed0096a919	feat(helm): Template support for XWiki external secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:43:00 +02:00
Axel Lender	3c0487dc58	feat(helmfile): Add support for external secrets in XWiki Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:43:00 +02:00
Axel Lender	76229cf35d	feat(helmfile): Add external secrets template support for OpenProject bootstrap Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:42:59 +02:00
Axel Lender	9a17064eb7	feat(helmfile): Add external secrets template support for Nextcloud Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:42:59 +02:00
Axel Lender	6a3c73a09d	feat(helmfile): Add templating support for Cassandra external secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:42:59 +02:00
Axel Lender	42773e62eb	feat(helmfile): Add templating support for collabora external secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:42:59 +02:00
Axel Lender	7352e48221	feat(helmfile): Add template support for external secrets for opendesk-services Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:42:59 +02:00
Axel Lender	38c5ca436b	feat(helmfile): Add external secrets support for Redis Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:42:59 +02:00
Axel Lender	311c05c420	feat(docs): Add initial documentation for external secrets Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:42:59 +02:00
Axel Lender	2c13b9672e	feat(helmfile): Add external secrets support for minio Signed-off-by: Axel Lender <lender@b1-systems.de>	2025-10-10 12:42:59 +02:00
Thomas Kaltenbrunner	ff3b221870	fix(open-xchange): Don't enable sasl auth when no relay host is set	2025-10-08 13:37:44 +00:00
Thomas Kaltenbrunner	c4279d11bb	fix(notes): Fix python path for self signed certs	2025-10-03 23:03:08 +02:00
Thorsten Roßner	98283aeef7	docs(requirements.md): Explicitly state that `local-path-provisioner` does not support sticky bit	2025-10-01 11:27:48 +02:00
Thorsten Roßner	26da7e3667	fix(gitlab): Add issue templates	2025-10-01 11:12:43 +02:00
Thorsten Roßner	8593d5f2bd	fix(ox-connector): Use FQDN for internal service URLs	2025-10-01 08:53:30 +02:00
Thorsten Roßner	4fd991b110	docs(misc): [bmi/opendesk/documentation/handbooks#1] Fixes broken external links	2025-09-30 09:30:24 +02:00
Thorsten Roßner	e0128e6ccf	fix(collabora): Update from 25.04.4.3.1 to 25.04.5.3.1	2025-09-26 09:46:08 +02:00
Thorsten Roßner	1da66c502c	chore(publiccode.yml): Bump to 1.8.0	2025-09-25 17:32:37 +02:00
Thorsten Roßner	e1b202bae2	chore(release): 1.8.0 [skip ci] # [1.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.7.1...v1.8.0) (2025-09-25) ### Bug Fixes * clamav: [bmi/opendesk/deployment/opendesk[#234](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/234)] Update Helm chart to support conditional proxy credentials ([`dee7525`](`dee7525649`)) * element: Let Synapse create room `v12` by default; review `migrations.md` for details ([`af9d4cd`](`af9d4cda6c`)) * helmfile: Add more detailed descriptions on `functional.authentication.realmSettings` and provide two `accessCodeLifespan` options ([`0314a70`](`0314a7076a`)) helmfile: Do not set portal "Support" link by default ([`776fe92`](`776fe92ae1`)) * intercom-service: Update from v2.19.0 to v2.19.5 ([`3305dfa`](`3305dfa5fb`)) * jitsi: [bmi/opendesk/deployment/opendesk[#228](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/228)] Turn off Gravatar option, by default this still keeps the input field in the Jitsi UI, but does not longer issue requests to gravatar.com; check `migrations.md` in case the option should be enabled ([`083fa98`](`083fa9842d`)) * nextcloud: App "Spreed" and core app "Comments" not enabled by default; review `migrations.md` for potential upgrade steps ([`31d35b2`](`31d35b25c6`)) * nextcloud: Update from 31.0.6 to 31.0.7 including the latest app versions ([`f848b9a`](`f848b9a0f4`)) * open-xchange: Add client onboarding for mail ([`d8fc3e0`](`d8fc3e04f5`)) * open-xchange: Set guest mode to inherit theming and set theme for notification mail button ([`f2ce251`](`f2ce25193a`)) * open-xchange: Switch off Element integration when `apps.element.enabled: [secure]` ([`7a2dbc5`](`7a2dbc5f8c`)) * open-xchange: Update Dovecot charts with improved auth cache defaults ([`836d8a4`](`836d8a494d`)) * opendesk-certificates: [bmi/opendesk/deployment/opendesk[#236](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/236)] Update Helm chart to add `commonName` to certificate ([`2e708a7`](`2e708a75b6`)) * openproject: [bmi/opendesk/deployment/opendesk[#228](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/228)] Turn off Gravatar option by default; check `migrations.md` in case the option should be enabled ([`628e914`](`628e91435c`)) * ox-connector: Update from v0.27.7 to v0.27.9 ([`ba77f2b`](`ba77f2b11c`)) * postfix: Relax TLS settings to `TLSv1.2`/`medium` for broader SMTP relay compatibility ([`31cbd9a`](`31cbd9af1a`)) * xwiki: Update image to set new default for user self-registration; review migrations.md for required actions on existing deployments ([`c75abaf`](`c75abaf1e6`)) ### Features * collabora: Support for macro execution controlled by `functional.weboffice.macros.enabled` (default: `[secure]`) ([`38f2bdd`](`38f2bdd2b9`)) * cryptpad: Update from 2024.6.1 to 2025.6.0 ([`23dfe0a`](`23dfe0aaa6`)) * element: Update Element-Web from 1.11.89 or 1.12.0 and Synapse from 1.129.0 to 1.137.0 ([`f895bcc`](`f895bcc2b8`)) * element: Update NeoBoard widget to v2.3.1, NeoChoice widget to v1.6.0, NeoDateFix widget to v1.7.2 and NeoDateFix bot to 2.8.5 ([`b377a5e`](`b377a5e0e2`)) * jitsi: Upgrade from stable-9955 to stable-10431 ([`e138610`](`e138610d29`)) * nextcloud: Expose `forbiddenChars` in `functional.yaml.gotmpl`; review `migrations.md` for required upgrade steps ([`5a2c1fc`](`5a2c1fcf98`)) * notes: Update from 3.2.1 to 3.4.0 ([`c636650`](`c63665040c`)) * nubus: Update from 1.12.0 to 1.13.1 ([`35424b8`](`35424b88d6`)) * nubus: Update from v1.13.1 to v1.14.0 using OIDC instead of SAML for portal SSO; review `migrations.md` for required upgrade steps ([`d3b1f57`](`d3b1f575cc`)) * open-xchange: Add options to `functional.groupware`; review `migrations.md` for details on new defaults/required upgrade steps ([`8a7cc3b`](`8a7cc3b8c7`)) * open-xchange: Enable mail categories ([`4da1c5d`](`4da1c5d9e3`)) * open-xchange: Update from 8.39 to 8.40 ([`c70a0bd`](`c70a0bdc4c`)) * open-xchange: Update from 8.40 to 8.41 ([`c50b817`](`c50b817795`)) * openproject: Update OpenProject from 16.2.1 to 16.3.2 ([`f77f329`](`f77f3291ca`)) * openproject: Update OpenProject from 16.3.2 to 16.4.1 ([`f5483d1`](`f5483d1a3b`)) * xwiki: Update from 16.10.5 to 17.4.4 and configure openDesk's Collabora for `.odt`, `.rtf` and `.docx` export of wiki pages ([`813e92c`](`813e92c1b0`))	2025-09-25 14:41:02 +00:00
Thorsten Roßner	cf2725c76c	chore(helmfile): Raising memory limits due to OOMKill during testautomation	2025-09-25 14:25:41 +02:00
Thorsten Roßner	0c603941aa	docs(migrations.md): Add missing `yaml` annotations on code blocks	2025-09-25 13:03:19 +02:00
Thorsten Roßner	0736c92987	ci(user-import): Bump to newer image that will add more user accounts when `CREATE_DEFAULT_ACCOUNTS` is enabled	2025-09-25 12:26:18 +02:00
Thorsten Roßner	083fa9842d	fix(jitsi): [bmi/opendesk/deployment/opendesk#228] Turn off Gravatar option, by default this still keeps the input field in the Jitsi UI, but does not longer issue requests to gravatar.com; check `migrations.md` in case the option should be enabled	2025-09-25 11:55:09 +02:00
Oliver Günther	628e91435c	fix(openproject): [bmi/opendesk/deployment/opendesk#228] Turn off Gravatar option by default; check `migrations.md` in case the option should be enabled	2025-09-25 11:52:25 +02:00
Thorsten Roßner	af9d4cda6c	fix(element): Let Synapse create room `v12` by default; review `migrations.md` for details	2025-09-24 18:21:09 +02:00
Thorsten Roßner	f895bcc2b8	feat(element): Update Element-Web from 1.11.89 or 1.12.0 and Synapse from 1.129.0 to 1.137.0	2025-09-24 18:21:05 +02:00
MTRNord	b377a5e0e2	feat(element): Update NeoBoard widget to v2.3.1, NeoChoice widget to v1.6.0, NeoDateFix widget to v1.7.2 and NeoDateFix bot to 2.8.5	2025-09-24 17:56:39 +02:00
Thorsten Roßner	31d35b25c6	fix(nextcloud): App "Spreed" and core app "Comments" not enabled by default; review `migrations.md` for potential upgrade steps	2025-09-24 17:49:52 +02:00
Thorsten Roßner	c75abaf1e6	fix(xwiki): Update image to set new default for user self-registration; review migrations.md for required actions on existing deployments	2025-09-24 16:47:18 +02:00
Thorsten Roßner	836d8a494d	fix(open-xchange): Update Dovecot charts with improved auth cache defaults	2025-09-24 14:14:17 +02:00
Thorsten Roßner	31cbd9af1a	fix(postfix): Relax TLS settings to `TLSv1.2`/`medium` for broader SMTP relay compatibility	2025-09-24 14:14:17 +02:00
Thorsten Roßner	776fe92ae1	fix(helmfile): Do not set portal "Support" link by default	2025-09-24 14:14:17 +02:00
Thorsten Roßner	7a2dbc5f8c	fix(open-xchange): Switch off Element integration when `apps.element.enabled: false`	2025-09-24 14:14:16 +02:00
Thorsten Roßner	f2ce25193a	fix(open-xchange): Set guest mode to inherit theming and set theme for notification mail button	2025-09-24 14:14:12 +02:00
Thorsten Roßner	8673ff7a57	docs(getting-started.md): Mark smtp relay as optional	2025-09-24 13:48:00 +02:00
Thorsten Roßner	8a7cc3b8c7	feat(open-xchange): Add options to `functional.groupware`; review `migrations.md` for details on new defaults/required upgrade steps	2025-09-24 13:47:56 +02:00
Norbert Tretkowski	d3b1f575cc	feat(nubus): Update from v1.13.1 to v1.14.0 using OIDC instead of SAML for portal SSO; review `migrations.md` for required upgrade steps	2025-09-23 12:39:04 +02:00
Thorsten Roßner	ca05ff9c1c	docs(self-signed-certificates.md): [bmi/opendesk/deployment/opendesk#230] Add missing `caCertificate` setting to example	2025-09-19 14:15:53 +00:00
Thorsten Roßner	795bb7394e	chore(functional.yaml.gotmpl): Improve comment on `filestore.sharing.external.enabled`	2025-09-19 14:15:53 +00:00
Thomas Kaltenbrunner	c63665040c	feat(notes): Update from 3.2.1 to 3.4.0	2025-09-19 14:15:53 +00:00
Thorsten Roßner	69f20057cd	chore(helmfile): Streamline `upstreamRepository` entries in `charts.yaml.gotmpl`	2025-09-19 14:15:53 +00:00
Viktor Pracht	4da1c5d9e3	feat(open-xchange): Enable mail categories	2025-09-19 15:22:26 +02:00
Thorsten Roßner	2e708a75b6	fix(opendesk-certificates): [bmi/opendesk/deployment/opendesk#236] Update Helm chart to add `commonName` to certificate	2025-09-18 08:54:08 +02:00
Thorsten Roßner	dee7525649	fix(clamav): [bmi/opendesk/deployment/opendesk#234] Update Helm chart to support conditional proxy credentials	2025-09-18 08:49:28 +02:00
Viktor Pracht	c50b817795	feat(open-xchange): Update from 8.40 to 8.41	2025-09-18 08:46:12 +02:00
Thorsten Roßner	21e6d7fd8b	chore(collabora): Add context information on `securityContext.capabilities.add`	2025-09-18 06:36:03 +00:00
Thorsten Roßner	6f9f926cc5	docs(self-signed-certificates): Update "Option 1" regarding the JKS secret	2025-09-18 06:36:03 +00:00
Thorsten Roßner	40f15fbd36	chore(mr-templates): Cleanup	2025-09-18 06:36:03 +00:00
emrah	e138610d29	feat(jitsi): Upgrade from stable-9955 to stable-10431	2025-09-18 06:36:03 +00:00
Franz Kuntke	7b1f9a7e9b	chore(helmfile): Set `global.systemInformation.releaseVersion` to `v1.8.0`	2025-09-17 15:26:18 +02:00
Oliver Günther	f5483d1a3b	feat(openproject): Update OpenProject from 16.3.2 to 16.4.1	2025-09-17 13:05:58 +02:00
Thorsten Roßner	23dfe0aaa6	feat(cryptpad): Update from 2024.6.1 to 2025.6.0	2025-09-15 12:32:35 +02:00
Thorsten Roßner	2dc76ae34c	chore(kyverno): Remove `functional.*` from migration details	2025-09-15 12:11:39 +02:00
Thorsten Roßner	6703eb03d5	docs(debugging.md): Add info how to set fine granular log levels for Keycloak	2025-09-15 11:35:57 +02:00
Thorsten Roßner	49e3fbf533	chore(functional.yaml.gotmpl): Update comment on `migration.oxAppSuite.enabled`	2025-09-11 16:39:12 +02:00
Thorsten Roßner	5a2c1fcf98	feat(nextcloud): Expose `forbiddenChars` in `functional.yaml.gotmpl`; review `migrations.md` for required upgrade steps	2025-09-11 16:39:08 +02:00