fix(notes): Avoid access for unauthorized user

2025-12-06 15:31:38 +01:00 · 2025-02-26 14:59:34 +01:00
116 changed files with 679 additions and 660 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -73,6 +73,12 @@ variables:
    options:
      - "yes"
      - "no"
+  OPENDESK_ENTERPRISE:
+    description: "Set to `true` if you want to deploy openDesk EE (but be sure you provide the required EE keys/tokens for the application)"
+    value: "false"
+    options:
+      - "true"
+      - "false"
  DEPLOY_ALL_COMPONENTS:
    description: "Enable all component deployment (overwrites 'no' setting on component level)."
    value: "no"
@@ -286,7 +292,7 @@ env-start:
  after_script:
    # Set credentials for openDesk Enterprise Registry
    - |
-      if [[ -n "${OPENDESK_ENTERPRISE}" ]]; then
+      if [ "${OPENDESK_ENTERPRISE}" = "true" ]; then
        kubectl create secret
        --namespace "${NAMESPACE}"
        docker-registry enterprise-registry
@@ -575,6 +581,7 @@ run-tests:
          \"screenshot_redirect_step\": \"yes\", \
          \"testset\": \"${TESTS_TESTSET}\", \
          \"testprofile\": \"Namespace\", \
+          \"OPENDESK_ENTERPRISE\": \"${OPENDESK_ENTERPRISE}\", \
          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\", \
          \"NUMBER_OF_THREADS\": \"${TESTS_NUMBER_OF_THREADS}\" \
        } \
--- a/.gitlab/common/common.yml
+++ b/.gitlab/common/common.yml
@@ -2,8 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.1\
-    @sha256:f09e36a4ad4b3a3a9ed260d6f36293002e39866a877c0a6b1efa16a88b8fd107"
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.2\
+    @sha256:e33a6327b9c8f89f6e86d13804d5d81e9fdf6974a2f280874d6901067c22fd83"
  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.14\
    @sha256:34d2a96e5fc25155abd48fef4d335b131c71d8cbc00ad531df0cae9918b9f2ab"

--- a/README-EE.md
+++ b/README-EE.md
@@ -38,10 +38,10 @@ The following components have - at least partially - Enterprise specific artifac

 # Enabling the Enterprise deployment

-To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value.
+To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value that does not evaluate to boolean *false* for [Helm flow control](https://helm.sh/docs/chart_template_guide/control_structures/#ifelse), e.g. `"true"`, `"yes"` or `"1"`:

 ```shell
-OPENDESK_ENTERPRISE=any_value
+OPENDESK_ENTERPRISE=true
 ```

 # Configuring the oD EE deployment for self-hosted installations
--- a/dev/README.md
+++ b/dev/README.md
@@ -7,30 +7,40 @@ SPDX-License-Identifier: Apache-2.0

 * [charts-local.py](#charts-localpy)
  * [Commandline parameter](#commandline-parameter)
-    * [`--branch`](#--branch)
+    * [`--match <your_string>`](#--match-your_string)
    * [`--revert`](#--revert)
+    * [`--branch` (deprecated)](#--branch-deprecated)

 # charts-local.py

-This script helps you on cloning the platform development Helm charts and referencing them directly in the openDesk
-Helmfile deployment for comfortable local test and development. The charts will be cloned into a directory
-parallel created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
-The name of the chart directory is derived from the branch name you are working with in this `opendesk` repo.
+This script helps you with cloning/pulling Helm charts and referencing them directly in the openDesk
+Helmfile deployment for comfortable local test and development. The charts will be cloned/pulled into a directory
+created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.

-The script will create `.bak` copies of the helmfiles that have been touched.
+The name of the directory containing the charts is based on the (currently) selected branch of the openDesk
+repo prefixed with `charts-`.
+
+The script will create `.bak` copies of the helmfiles that have been touched that can easily be reverted to
+using the `--revert` option.

 Run the script with `-h` to get information about the script's parameter on commandline.

 ## Commandline parameter

-### `--branch`
+### `--match <your_string>`
+
+Will only fetch repos or pull images for charts which name matches `<your_string>`.
+
+### `--revert`
+
+Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
+scripts itself back to their original location.
+
+### `--branch` (deprecated)

 Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
 does not exist yet. Otherwise it will switch to defined branch.

 If parameter is omitted the current branch of the `opendesk` repo will be used.

-### `--revert`
-
-Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
-scripts itself back to their original location.
+As this parameter was used rarely, we might remove the support in a later version.
--- a/dev/charts-local.py
+++ b/dev/charts-local.py
@@ -18,7 +18,6 @@ p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work
 p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
 p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
 p.add('--match', default='', help="Clone/pull only charts that contain the given string in their name.")
-p.add('--pull', default=False, action='store_true', help='Will also pull and unpack Helm charts that are not developed by product development.')
 p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
 options = p.parse_args()

@@ -78,13 +77,10 @@ def create_path_if_not_exists(path):
        Path(path).mkdir(parents=True, exist_ok=True)

 def clone_charts_locally(branch, charts):
-    charts_clone_path = script_path+'/../../chart-repo/'+branch.replace('/', '_')
-    charts_pull_path = script_path+'/../../chart-pull/'+branch.replace('/', '_')
+    charts_path = script_path+'/../../charts-'+branch.replace('/', '_')
    charts_dict = {}
    doublette_dict = {}
-    create_path_if_not_exists(charts_clone_path)
-    if options.pull:
-        create_path_if_not_exists(charts_pull_path)
+    create_path_if_not_exists(charts_path)

    for chart in charts['charts']:
        tag = charts['charts'][chart]['version']
@@ -92,41 +88,41 @@ def clone_charts_locally(branch, charts):
        registry = charts['charts'][chart]['registry']
        name = charts['charts'][chart]['name']
        logging.debug(f"Working on {chart} / tag {tag} / repo {repository}")
+        chart_local_path = charts_path+'/'+name
        if not options.match in name:
            logging.info(f"Chart name {name} does not match {options.match} - skipping...")
+            continue
        elif registry == '':
            logging.info("Empty registry definition - skipping...")
+            continue
+        if os.path.isdir(chart_local_path):
+            logging.debug(f"Found pre-existing {chart_local_path} skipping clone/pull, but will still reference chart in Helmfile...")
+            charts_dict[chart] = chart_local_path
+            continue
        elif 'opendesk/components/platform-development/charts' in repository:
            logging.info("Cloning the charts repo")
            git_url = options.git_hostname+':'+repository
-            chart_repo_path = charts_clone_path+'/'+charts['charts'][chart]['name']
            if git_url in doublette_dict:
                logging.debug(f"{chart} located at {git_url} is already checked out to {doublette_dict[git_url]}")
                charts_dict[chart] = doublette_dict[git_url]
            else:
-                if os.path.isdir(chart_repo_path):
-                    logging.debug(f"Already exists {chart_repo_path} leaving it unmodified")
-                else:
-                    logging.debug(f"Cloning into {chart_repo_path}")
-                    Repo.clone_from(git_url, chart_repo_path)
-                    chart_repo = Repo(path=chart_repo_path)
-                    chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
-                doublette_dict[git_url] = chart_repo_path
-                charts_dict[chart] = chart_repo_path
-        elif options.pull:
+                logging.debug(f"Cloning into {chart_local_path}")
+                Repo.clone_from(git_url, chart_local_path)
+                chart_repo = Repo(path=chart_local_path)
+                chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
+                doublette_dict[git_url] = chart_local_path
+                charts_dict[chart] = chart_local_path
+        else:
            logging.info("Pulling the chart")
-            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_pull_path}"
+            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_path}"
            logging.debug(f"CLI command: {helm_command}")
            try:
-                output = subprocess.check_output(helm_command, shell = True)
+                subprocess.check_output(helm_command, shell = True)
            except subprocess.CalledProcessError:
                sys.exit(f"! CLI command '{helm_command}' failed")
-        else:
-            logging.debug("Not a product development chart and `--pull` option not enabled - skipping...")
-
+            charts_dict[chart] = chart_local_path
    return charts_dict

-
 def grep_yaml(file):
    with open(file, 'r') as file:
        content = ''
@@ -156,7 +152,12 @@ def process_the_helmfiles(charts_dict, charts):
                    for chart_ident in charts_dict:
                        if '.Values.charts.'+chart_ident+'.name' in line:
                            logging.debug(f"found match with {chart_ident} in {line.strip()}")
-                            line = chart_def_prefix+charts_dict[chart_ident]+'/charts/'+charts['charts'][chart_ident]['name']+'" # replaced by local-dev script'+"\n"
+                            line = charts_dict[chart_ident]
+                            if os.path.isdir(line+'/charts/'+chart_ident):
+                                line += '/charts/'+charts['charts'][chart_ident]['name']
+                            elif not os.path.isdir(line):
+                                sys.exit(f"! Did not find directory to reference in Helmfile: '{line}'")
+                            line = chart_def_prefix+line+'" # replaced by local-dev script'+"\n"
                            child_helmfile_updated = True
                            break
                output.append(line)
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -168,7 +168,7 @@ While you will find all the details for the CLI tool in [the online documentatio

 `occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).

-You can run occ commands in the `opendesk-nextcloud-php` pod like this: `php /var/www/html/occ config:list`
+You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`

 ## OpenProject

--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -9,6 +9,9 @@ SPDX-License-Identifier: Apache-2.0
 * [Disclaimer](#disclaimer)
 * [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
 * [Manual checks/actions](#manual-checksactions)
+  * [From v1.1.1](#from-v111)
+    * [Pre-upgrade from v1.1.1](#pre-upgrade-from-v111)
+      * [Helmfile feature update: App settings wrapped in `apps.` element](#helmfile-feature-update-app-settings-wrapped-in-apps-element)
  * [From v1.1.0](#from-v110)
    * [Pre-upgrade from v1.1.0](#pre-upgrade-from-v110)
      * [Helmfile feature update: Component specific `storageClassName`](#helmfile-feature-update-component-specific-storageclassname)
@@ -86,6 +89,37 @@ When interested in more details about the automated migrations, please read sect

 Be sure you check all the sections for the releases your are going to update your current deployment from.

+## From v1.1.1
+
+### Pre-upgrade from v1.1.1
+
+#### Helmfile feature update: App settings wrapped in `apps.` element
+
+We require now [Helmfile v1.0.0-rc.8](https://github.com/helmfile/helmfile/releases/tag/v1.0.0-rc.8) for the deployment. This enables openDesk to lay the foundation for some significant cleanups where the information for the different apps especially on their `enabled` state is needed.
+
+Therefore it was required to introduce the `apps` level in [`opendesk_main.yaml.gotmpl`](../helmfile/environments/default/opendesk_main.yaml.gotmpl).
+
+If you have a deployment where you specify settings that can be found in the aforementioned file, usually to disable components or enable others, please ensure you insert the top-level attribute `apps` like shown in the following example:
+
+So a setting of:
+
+```
+certificates:
+  enabled: false
+notes:
+  enabled: true
+```
+
+needs to be changed to:
+
+```
+apps:
+  certificates:
+    enabled: false
+  notes:
+    enabled: true
+```
+
 ## From v1.1.0

 ### Pre-upgrade from v1.1.0
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -26,7 +26,7 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
 - Domain and DNS Service
 - Ingress controller (Ingress NGINX)
 - [Helm](https://helm.sh/) >= v3.9.0
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc5**
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc8**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
 - Volume provisioner supporting RWO (read-write-once)
 - Certificate handling with [cert-manager](https://cert-manager.io/)
--- a/docs/security-context.md
+++ b/docs/security-context.md
@@ -1,8 +1,7 @@
 <!--
-SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
-
 <h1>Kubernetes Security Context</h1>

 <!-- TOC -->
@@ -63,7 +62,7 @@ containerSecurityContext:
 ## privileged


-Privileged Pods disable most security mechanisms and must be disallowed.
+Privileged Pods eliminate most security mechanisms and must be disallowed.

 ```yaml
 containerSecurityContext:
@@ -93,7 +92,7 @@ containerSecurityContext:
 ## seccompProfile


-Seccomp profile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
+The seccompProfile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.

 ```yaml
 containerSecurityContext:
@@ -113,7 +112,7 @@ containerSecurityContext:
 ## readOnlyRootFilesystem


-Containers should have an immutable file systems, so that attackers could not modify application code or download malicious code.
+Containers should have an immutable file systems, so that attackers can not modify application code or download malicious code.

 ```yaml
 containerSecurityContext:
@@ -133,10 +132,10 @@ containerSecurityContext:
 # Status quo


-openDesk aims to achieve that all security relevant settings are explicitly templated and comply with security recommendations.
+openDesk aims to ensure that all security relevant settings are explicitly templated and comply with security recommendations.


-The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are also properly templated by the given Helm charts.
+The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are properly templated by the Helm charts.


 This list gives you an overview of templated security settings and if they comply with security standards:
@@ -144,11 +143,11 @@ This list gives you an overview of templated security settings and if they compl

 - **yes**: Value is set to `true`
 - **no**: Value is set to `false`
- - **n/a**: No explicitly templated in openDesk and default is used.
+ - **n/a**: Not explicitly templated in openDesk; default is used.

 | process | status | allowPrivilegeEscalation | privileged | readOnlyRootFilesystem | runAsNonRoot | runAsUser | runAsGroup | seccompProfile | capabilities |
 | ------- | ------ | ------------------------ | ---------- | ---------------------- | ------------ | --------- | ---------- | -------------- | ------------ |
-| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT","MKNOD"] |
+| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","FOWNER","SYS_CHROOT"] |
 | **cryptpad**/cryptpad | :x: | no | no | no | yes | 4001 | 4001 | yes | yes |
 | **element**/matrix-neoboard-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/matrix-neochoice-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
@@ -169,10 +168,36 @@ This list gives you an overview of templated security settings and if they compl
 | **jitsi**/jitsi/jitsi/prosody | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/web | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/patchJVB | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 65532 | 65532 | yes | yes |
-| **nextcloud**/opendesk-nextcloud/apache2 | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 101 | 101 | yes | yes |
+| **nextcloud**/opendesk-nextcloud/aio | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
-| **nextcloud**/opendesk-nextcloud/php | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **notes**/impress/backend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **notes**/impress/frontend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **notes**/impress/yProvider | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **nubus**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/intercom-service/provisioning | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/keycloak | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/authorizationApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/managementApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/managementUi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/openPolicyAgent | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusKeycloakBootstrap | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusKeycloakExtensions/handler | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusKeycloakExtensions/proxy | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusLdapNotifier | :x: | no | n/a | yes | yes | 101 | 102 | yes | yes |
+| **nubus**/ums/nubusNotificationsApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusPortalConsumer | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusPortalFrontend | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusPortalServer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusProvisioning | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusProvisioning/nats | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusSelfServiceConsumer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusStackDataUms | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUdmListener | :x: | no | n/a | yes | yes | 102 | 65534 | yes | yes |
+| **nubus**/ums/nubusUdmRestApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUmcGateway | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUmcServer | :x: | no | n/a | yes | no | 0 | 0 | yes | yes |
 | **open-xchange**/dovecot | :x: | no | n/a | yes | n/a | n/a | n/a | yes | no ["CHOWN","DAC_OVERRIDE","KILL","NET_BIND_SERVICE","SETGID","SETUID","SYS_CHROOT"] |
 | **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
@@ -184,34 +209,26 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/appsuite/guard-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/nextcloud-integration-ui | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/opendesk-open-xchange-bootstrap | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-migrations-post**/opendesk-migrations-post | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-migrations-pre**/opendesk-migrations-pre | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-services**/opendesk-static-files | :x: | no | n/a | yes | yes | 101 | 101 | yes | yes |
 | **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **open-xchange**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
-| **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/minio | :x: | no | no | no | yes | 1000 | 0 | yes | yes |
-| **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
-| **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **univention-management-stack**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/ldap-notifier | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
-| **univention-management-stack**/ums/portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
-| **univention-management-stack**/ums/stack-gateway | :x: | no | no | no | yes | 1001 | 0 | yes | yes |
-| **univention-management-stack**/ums/umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **services-external**/cassandra | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
+| **services-external**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/minio | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/opendesk-dkimpy-milter | :x: | yes | no | yes | yes | 1000 | 1000 | yes | no |
+| **services-external**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
+| **services-external**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |


--- a/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"

  # Collabora Controller - Enterprise Only
  # Source: https://github.com/CollaboraOnline/online
@@ -20,7 +20,7 @@ repositories:
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"

 releases:
  - name: "collabora-online"
@@ -28,24 +28,24 @@ releases:
    version: "{{ .Values.charts.collabora.version }}"
    values:
      - "values.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      - "values-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.collaboraOnline }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.collabora.enabled }}
+    installed: {{ .Values.apps.collabora.enabled }}
  - name: "collabora-controller"
    chart: "collabora-controller-repo/{{ .Values.charts.collaboraController.name }}"
    version: "{{ .Values.charts.collaboraController.version }}"
    values:
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      - "values-coco-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.collaboraController }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.collaboraController.enabled }}
+    installed: {{ .Values.apps.collaboraController.enabled }}

 commonLabels:
  deployStage: "050-components"
--- a/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
+++ b/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
@@ -12,7 +12,7 @@ controller:
  # Therefore we use the default of `collabora-online` for the `resourceName`
  resourceName: "collabora-online"
  statsInterval: 2000
-  watchNamespace: {{ (.Values.collabora.namespace | default .Release.Namespace | quote) }}
+  watchNamespace: {{ (.Values.apps.collabora.namespace | default .Release.Namespace | quote) }}

  documentMigrator:
    enabled: true
--- a/helmfile/apps/collabora/values-enterprise.yaml.gotmpl
+++ b/helmfile/apps/collabora/values-enterprise.yaml.gotmpl
@@ -6,7 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 image:
  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
 autoscaling:
-  enabled: {{ .Values.collaboraController.enabled }}
+  enabled: {{ .Values.apps.collaboraController.enabled }}
  minReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.minReplicas }}
  maxReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.maxReplicas }}
  targetMemoryUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}
--- a/helmfile/apps/collabora/values.yaml.gotmpl
+++ b/helmfile/apps/collabora/values.yaml.gotmpl
@@ -27,7 +27,7 @@ collabora:
    {{- else }}
    --o:logging.anonymize.anonymize_user_data=true
    {{- end }}
-    {{- if .Values.collaboraController.enabled }}
+    {{- if .Values.apps.collaboraController.enabled }}
    --o:indirection_endpoint.url=https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/routeToken
    --o:monitors.monitor[0]=wss://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/ws
    --o:monitors.monitor[0][@retryInterval]=5
@@ -49,7 +49,7 @@ imagePullSecrets:

 ingress:
  annotations:
-    {{- if .Values.collaboraController.enabled }}
+    {{- if .Values.apps.collaboraController.enabled }}
    nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_RouteToken"
    {{- else }}
    nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
--- a/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"

 releases:
  - name: "cryptpad"
@@ -21,7 +21,7 @@ releases:
      {{- range .Values.customization.release.cryptpad }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.cryptpad.enabled }}
+    installed: {{ .Values.apps.cryptpad.enabled }}

 commonLabels:
  deployStage: "050-components"
--- a/helmfile/apps/element/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/element/helmfile-child.yaml.gotmpl
@@ -10,35 +10,35 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
  - name: "element-well-known-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.elementWellKnown.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
  - name: "synapse-web-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseWeb.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
  - name: "synapse-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapse.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
  - name: "synapse-create-account-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseCreateAccount.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"

  # openDesk Matrix Widgets
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
@@ -48,35 +48,35 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
  - name: "matrix-neoboard-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neochoice-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neodatefix-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
  - name: "matrix-neodatefix-bot-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"

  # openDesk Enterprise Repositories

@@ -88,28 +88,28 @@ repositories:
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
  - name: "synapse-adminbot-web-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseAdminbotWeb.verify }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
  - name: "synapse-groupsync-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseGroupsync.verify }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
  - name: "synapse-pipe-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapsePipe.verify }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"

 releases:
  - name: "opendesk-element"
@@ -120,7 +120,7 @@ releases:
      {{- range .Values.customization.release.opendeskElement }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-well-known"
@@ -131,7 +131,7 @@ releases:
      {{- range .Values.customization.release.opendeskWellKnown }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-synapse-web"
@@ -142,7 +142,7 @@ releases:
      {{- range .Values.customization.release.opendeskSynapseWeb }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-synapse"
@@ -153,7 +153,7 @@ releases:
      {{- range .Values.customization.release.opendeskSynapse }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-matrix-user-verification-service-bootstrap"
@@ -161,7 +161,7 @@ releases:
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
      - "values-matrix-user-verification-service-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-matrix-user-verification-service"
@@ -169,7 +169,7 @@ releases:
    version: "{{ .Values.charts.matrixUserVerificationService.version }}"
    values:
      - "values-matrix-user-verification-service.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neoboard-widget"
@@ -177,7 +177,7 @@ releases:
    version: "{{ .Values.charts.matrixNeoboardWidget.version }}"
    values:
      - "values-matrix-neoboard-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neochoice-widget"
@@ -185,7 +185,7 @@ releases:
    version: "{{ .Values.charts.matrixNeochoiseWidget.version }}"
    values:
      - "values-matrix-neochoice-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neodatefix-widget"
@@ -193,7 +193,7 @@ releases:
    version: "{{ .Values.charts.matrixNeodatefixWidget.version }}"
    values:
      - "values-matrix-neodatefix-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neodatefix-bot-bootstrap"
@@ -201,7 +201,7 @@ releases:
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
      - "values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neodatefix-bot"
@@ -209,7 +209,7 @@ releases:
    version: "{{ .Values.charts.matrixNeodatefixBot.version }}"
    values:
      - "values-matrix-neodatefix-bot.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  # openDesk Enterprise Releases
@@ -221,7 +221,7 @@ releases:
      {{- range .Values.customization.release.opendeskSynapseAdmin }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-adminbot-bootstrap"
@@ -232,7 +232,7 @@ releases:
      {{- range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-adminbot-pipe"
@@ -243,7 +243,7 @@ releases:
      {{- range .Values.customization.release.opendeskSynapseAdminbotPipe }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-adminbot-web"
@@ -254,7 +254,7 @@ releases:
      {{- range .Values.customization.release.opendeskSynapseAdminbotWeb }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-auditbot-bootstrap"
@@ -265,7 +265,7 @@ releases:
      {{- range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-auditbot-pipe"
@@ -276,7 +276,7 @@ releases:
      {{- range .Values.customization.release.opendeskSynapseAuditbotPipe }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-groupsync"
@@ -287,7 +287,7 @@ releases:
      {{- range .Values.customization.release.opendeskSynapseGroupsync }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.elementGroupsync.enabled }}
+    installed: {{ .Values.apps.elementGroupsync.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -69,8 +69,8 @@ configuration:
              regex: "@.*"
        url: null
        sender_localpart: ox-appsuite
-    {{- if (env "OPENDESK_ENTERPRISE") }}
-      {{- if .Values.elementAdmin.enabled }}
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{- if .Values.apps.elementAdmin.enabled }}
      - as_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
        hs_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
        id: "element-adminbot-pipe"
@@ -106,7 +106,7 @@ configuration:
        rate_limited: false
        sender_localpart: "auditbot-sendernotinuse"
      {{- end }}
-      {{- if .Values.elementGroupsync.enabled }}
+      {{- if .Values.apps.elementGroupsync.enabled }}
      - as_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
        hs_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
        id: "gps"
@@ -132,7 +132,7 @@ configuration:

    smtp:
      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
-      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
      port: 25
      tls: false
      starttls: false
--- a/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"

 releases:
  - name: "jitsi"
@@ -21,7 +21,7 @@ releases:
      {{- range .Values.customization.release.jitsi }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.jitsi.enabled }}
+    installed: {{ .Values.apps.jitsi.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
@@ -10,14 +10,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
  - name: "nextcloud-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.nextcloud.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"

 releases:
  - name: "opendesk-nextcloud-management"
@@ -25,7 +25,7 @@ releases:
    version: "{{ .Values.charts.nextcloudManagement.version }}"
    values:
      - "values-nextcloud-mgmt.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      - "values-nextcloud-mgmt-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.opendeskNextcloudManagement }}
@@ -33,14 +33,14 @@ releases:
      {{- end }}
    waitForJobs: true
    wait: true
-    installed: {{ .Values.nextcloud.enabled }}
+    installed: {{ .Values.apps.nextcloud.enabled }}
    timeout: 900
  - name: "opendesk-nextcloud"
    chart: "nextcloud-repo/{{ .Values.charts.nextcloud.name }}"
    version: "{{ .Values.charts.nextcloud.version }}"
    values:
      - "values-nextcloud.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      - "values-nextcloud-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.opendeskNextcloud }}
@@ -48,7 +48,7 @@ releases:
      {{- end }}
    needs:
      - "opendesk-nextcloud-management"
-    installed: {{ .Values.nextcloud.enabled }}
+    installed: {{ .Values.apps.nextcloud.enabled }}

 commonLabels:
  deployStage: "050-components"
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -31,9 +31,9 @@ configuration:
    host: {{ .Values.antivirus.icap.host | quote }}
    port: {{ .Values.antivirus.icap.port | quote }}
    {{- else }}
-    {{- if .Values.clamavDistributed.enabled }}
+    {{- if .Values.apps.clamavDistributed.enabled }}
    host: "clamav-icap"
-    {{- else if .Values.clamavSimple.enabled }}
+    {{- else if .Values.apps.clamavSimple.enabled }}
    host: "clamav-simple"
    {{- end }}
    port: 1344
@@ -55,13 +55,13 @@ configuration:
      contacts:
        enabled: false
      cryptpad:
-        enabled: {{ .Values.cryptpad.enabled }}
+        enabled: {{ .Values.apps.cryptpad.enabled }}
      filesZip:
        enabled: true
      groupfolders:
        enabled: true
      integrationOpenproject:
-        enabled: {{ .Values.openproject.enabled }}
+        enabled: {{ .Values.apps.openproject.enabled }}
      spreed:
        enabled: true
    circles:
@@ -147,7 +147,7 @@ configuration:
        value: ""
      password:
        value: ""
-    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
    port: 25
    fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
    mailDomain: "{{ .Values.global.domain }}"
--- a/helmfile/apps/notes/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/notes/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"

 releases:
  - name: "impress"
@@ -22,7 +22,7 @@ releases:
      {{- range .Values.customization.release.notes }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.notes.enabled }}
+    installed: {{ .Values.apps.notes.enabled }}
    timeout: 1800

 commonLabels:
--- a/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url:
-      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
+      "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
  # Intercom Service
  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
  - name: "intercom-service-repo"
@@ -19,7 +19,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
  # openDesk Keycloak Bootstrap Chart
  - name: "opendesk-keycloak-bootstrap-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
@@ -27,7 +27,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
  # NGINX S3 Gateway Chart
  - name: "nginx-s3-gateway-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
@@ -35,7 +35,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"

 releases:
  # Univention Management Stack Umbrella Chart
@@ -47,7 +47,7 @@ releases:
      {{- range .Values.customization.release.ums }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.nubus.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}
    timeout: 900
  # Intercom-Service
  - name: "intercom-service"
@@ -58,7 +58,7 @@ releases:
      {{- range .Values.customization.release.intercomService }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.nubus.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}

  # openDesk Keycloak Bootstrap Chart
  - name: "opendesk-keycloak-bootstrap"
@@ -71,7 +71,7 @@ releases:
      {{- end }}
    needs:
      - "ums"
-    installed: {{ .Values.nubus.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}
    timeout: 900

  # NGINX S3 Gateway (when cluster minio is not used)
@@ -83,7 +83,7 @@ releases:
      {{- range .Values.customization.release.nginxS3Gateway }}
      - {{ . }}
      {{- end }}
-    installed: {{ not .Values.minio.enabled }}
+    installed: {{ not .Values.apps.minio.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -119,7 +119,7 @@ global:

 ingress:
  # temporary fix
-  {{- if not .Values.minio.enabled }}
+  {{- if not .Values.apps.minio.enabled }}
  enabled: false
  {{- end }}
  certManager:
@@ -377,6 +377,7 @@ nubusGuardian:
      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 nubusNotificationsApi:
+  enabled: false
  additionalAnnotations:
    intents.otterize.com/service-name: "ums-notifications-api"
  containerSecurityContext:
@@ -524,7 +525,7 @@ nubusKeycloakExtensions:
          password: "umcKeycloakExtensionsDatabasePassword"
  smtp:
    connection:
-      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
      port: 25
      ssl: false
      starttls: false
@@ -736,6 +737,7 @@ nubusUdmRestApi:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
  ingress:
+    enabled: {{ .Values.functional.externalServices.nubus.udmRestApi.enabled }}
    certManager:
      enabled: false
    tls:
@@ -1095,7 +1097,7 @@ nubusStackDataUms:
    umcMemcachedUsername: ""
    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
    umcHtmlTitle: "Portal - {{ .Values.theme.texts.productName }}"
-    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
    smtpPort: 25
    smtpUser: ""
    smtpStartTls: false
@@ -1118,7 +1120,7 @@ nubusStackDataUms:
    portalTitleEN: "Portal - {{ .Values.theme.texts.productName }}"
    oxDefaultContext: "1"
    componentEnabled:
-      notes: {{ .Values.notes.enabled }}
+      notes: {{ .Values.apps.notes.enabled }}
    ldapSearchUsers:
      {{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
      - username: {{ printf "ldapsearch_%s" $username | quote }}
@@ -1151,7 +1153,7 @@ nubusStackDataUms:
    portaltileGroupNotes:
      - 'cn=managed-by-attribute-Notes,cn=groups,{{ .Values.ldap.baseDn }}'
    systemInformation:
-      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}{{ if (env "OPENDESK_ENTERPRISE") }}-ee{{ end }}"
+      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}{{ if eq (env "OPENDESK_ENTERPRISE") "true" }}-ee{{ end }}"
      {{- if .Values.functional.admin.portal.deploymentTimestamp.enabled }}
      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
      {{- else }}
--- a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -57,7 +57,7 @@ config:
      scope: "opendesk-dovecot-scope"
      role: "opendesk-dovecot-access-control"
      group: "managed-by-attribute-Groupware"
-    {{- if .Values.notes.enabled }}
+    {{- if .Values.apps.notes.enabled }}
    notes:
      client: "opendesk-notes"
      scope: "opendesk-notes-scope"
@@ -66,7 +66,7 @@ config:
    {{- end }}

  componentEnabled:
-    notes: {{ .Values.notes.enabled }}
+    notes: {{ .Values.apps.notes.enabled }}
  custom:
    clientScopes:
      {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
@@ -431,7 +431,7 @@ config:
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
-{{ if .Values.notes.enabled }}
+{{ if .Values.apps.notes.enabled }}
      - name: "opendesk-notes-scope"
        description: "Scope for the claims required by openDesk's Notes instance."
        protocol: "openid-connect"
@@ -522,7 +522,7 @@ config:
              jsonType.label: "String"
        defaultClientScopes:
          - "offline_access"
-{{ if .Values.notes.enabled }}
+{{ if .Values.apps.notes.enabled }}
      - name: "opendesk-notes"
        clientId: "opendesk-notes"
        protocol: "openid-connect"
--- a/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
@@ -7,19 +7,31 @@ repositories:
  - name: "dovecot-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.dovecot.verify }}
+    oci: true
+  {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    username: {{ env "ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+  {{- else }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+  {{- end }}

  # Open-Xchange
  - name: "open-xchange-repo"
    keyring: "../../files/gpg-pubkeys/open-xchange-com.gpg"
    verify: {{ .Values.charts.oxAppSuite.verify }}
+    oci: true
+  {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    username: {{ env "ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+  {{- else }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+  {{- end }}

  # openDesk Open-Xchange Bootstrap
  # Source:
@@ -30,14 +42,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"

  # OX Connector
  - name: "ox-connector-repo"
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"

 releases:
  - name: "dovecot"
@@ -45,10 +57,13 @@ releases:
    version: "{{ .Values.charts.dovecot.version }}"
    values:
      - "values-dovecot.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-dovecot-enterprise.yaml.gotmpl"
+      {{- end }}
      {{- range .Values.customization.release.dovecot }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.dovecot.enabled }}
+    installed: {{ .Values.apps.dovecot.enabled }}
    timeout: 900

  - name: "open-xchange"
@@ -57,13 +72,13 @@ releases:
    values:
      - "values-openxchange.yaml.gotmpl"
      - "values-openxchange-contact-picker.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      - "values-openxchange-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.openxchange }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.oxAppSuite.enabled }}
+    installed: {{ .Values.apps.oxAppSuite.enabled }}
    timeout: 900

  - name: "opendesk-open-xchange-bootstrap"
@@ -74,7 +89,7 @@ releases:
      {{- range .Values.customization.release.opendeskOpenxchangeBootstrap }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.oxAppSuite.enabled }}
+    installed: {{ .Values.apps.oxAppSuite.enabled }}
    timeout: 900

  - name: "ox-connector"
@@ -85,7 +100,7 @@ releases:
      {{- range .Values.customization.release.oxConnector }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.oxAppSuite.enabled }}
+    installed: {{ .Values.apps.oxAppSuite.enabled }}
    needs:
      - "open-xchange"

--- a/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
@@ -0,0 +1,45 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.dovecot.registry | quote }}
+  repository: {{ .Values.images.dovecot.repository | quote }}
+  tag: {{ .Values.images.dovecot.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+imageInitCassandra:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandra.registry | quote }}
+  repository: {{ .Values.images.cassandra.repository | quote }}
+  tag: {{ .Values.images.cassandra.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+imagePullSecrets:
+  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
+
+dovecot:
+  dictmap:
+    enabled: true
+    host: {{ .Values.databases.dovecotDictmap.host | quote }}
+    port: {{ .Values.databases.dovecotDictmap.port }}
+    username: {{ .Values.databases.dovecotDictmap.username | quote }}
+    password: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
+    keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
+  sharedMailboxes:
+    enabled: false
+    host: {{ .Values.databases.dovecotACL.host | quote }}
+    port: {{ .Values.databases.dovecotACL.port }}
+    username: {{ .Values.databases.dovecotACL.username | quote }}
+    password: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
+    keyspace: {{ .Values.databases.dovecotACL.name | quote }}
+  objectStorage:
+    encryption:
+      privateKey:
+        value: {{ env "DOVECOT_CRYPT_PRIVATE_KEY" | quote }}
+      publicKey:
+        value: {{ env "DOVECOT_CRYPT_PUBLIC_KEY" | quote }}
+    fqdn: {{ .Values.objectstores.dovecot.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    username: {{ .Values.objectstores.dovecot.username | quote }}
+    password: {{ .Values.secrets.minio.dovecotUser | quote }}
+...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -34,11 +34,10 @@ dovecot:
    introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
    usernameAttribute: "opendesk_username"
  loginTrustedNetworks: {{ join " " .Values.cluster.networking.cidr | quote }}
-
  submission:
    enabled: true
    ssl: "no"
-    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
+    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"

 certificate:
  secretName: {{ .Values.ingress.tls.secretName | quote }}
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -340,9 +340,9 @@ appsuite:
        com.openexchange.antivirus.server: {{ .Values.antivirus.icap.host | quote }}
        com.openexchange.antivirus.port: {{ .Values.antivirus.icap.port | quote }}
        {{- else }}
-        {{- if .Values.clamavDistributed.enabled }}
+        {{- if .Values.apps.clamavDistributed.enabled }}
        com.openexchange.antivirus.server: "clamav-icap"
-        {{- else if .Values.clamavSimple.enabled }}
+        {{- else if .Values.apps.clamavSimple.enabled }}
        com.openexchange.antivirus.server: "clamav-simple"
        {{- end }}
        com.openexchange.antivirus.port: "1344"
--- a/helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl
@@ -4,17 +4,17 @@
 repositories:
  # openDesk Migrations
  # Source:
-  - name: "openproject-migrations-repo"
+  - name: "opendesk-migrations-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.migrations.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"

 releases:
  - name: "opendesk-migrations-post"
-    chart: "openproject-migrations-repo/{{ .Values.charts.migrations.name }}"
+    chart: "opendesk-migrations-repo/{{ .Values.charts.migrations.name }}"
    version: "{{ .Values.charts.migrations.version }}"
    wait: true
    waitForJobs: true
@@ -24,7 +24,7 @@ releases:
      {{- range .Values.customization.release.migrationsPost }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.migrations.enabled }}
+    installed: {{ .Values.apps.migrations.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"

 releases:
  - name: "opendesk-migrations-pre"
@@ -24,7 +24,7 @@ releases:
      {{- range .Values.customization.release.migrationsPre }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.migrations.enabled }}
+    installed: {{ .Values.apps.migrations.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"

 releases:
  - name: "opendesk-openproject-bootstrap"
@@ -23,7 +23,7 @@ releases:
      {{- range .Values.customization.release.opendeskOpenprojectBootstrap }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.openproject.enabled }}
+    installed: {{ .Values.apps.openproject.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/opendesk-services/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"

  # openDesk Home
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
@@ -20,7 +20,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"

  # openDesk Certificates
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
@@ -30,7 +30,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"

    # openDesk Alerts
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts
@@ -40,7 +40,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"

    # openDesk Grafana Dashboards
    # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards
@@ -50,7 +50,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"

    # openDesk Static Files
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-static-files
@@ -60,7 +60,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskStaticFiles.registry }}/{{ .Values.charts.opendeskStaticFiles.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskStaticFiles.registry }}/{{ .Values.charts.opendeskStaticFiles.repository }}"

 releases:
  - name: "opendesk-otterize"
@@ -82,7 +82,7 @@ releases:
      {{- range .Values.customization.release.opendeskHome }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.home.enabled }}
+    installed: {{ .Values.apps.home.enabled }}

  - name: "opendesk-certificates"
    chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
@@ -92,7 +92,7 @@ releases:
      {{- range .Values.customization.release.opendeskCertificates }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.certificates.enabled }}
+    installed: {{ .Values.apps.certificates.enabled }}
    timeout: 900

  - name: "opendesk-alerts"
@@ -125,7 +125,7 @@ releases:
      {{- range .Values.customization.release.opendeskStaticFiles }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.staticFiles.enabled }}
+    installed: {{ .Values.apps.staticFiles.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
@@ -7,13 +7,13 @@ SPDX-License-Identifier: Apache-2.0
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
-    {{- if .Values.collabora.enabled }}
+    {{- if .Values.apps.collabora.enabled }}
    collabora: {{ .Values.global.hosts.collabora }}
    {{- end }}
-    {{- if .Values.cryptpad.enabled }}
+    {{- if .Values.apps.cryptpad.enabled }}
    cryptpad: {{ .Values.global.hosts.cryptpad }}
    {{- end }}
-    {{- if .Values.element.enabled }}
+    {{- if .Values.apps.element.enabled }}
    element: {{ .Values.global.hosts.element }}
    matrixNeoBoardWidget: {{ .Values.global.hosts.matrixNeoBoardWidget }}
    matrixNeoChoiceWidget: {{ .Values.global.hosts.matrixNeoChoiceWidget }}
@@ -23,30 +23,30 @@ global:
    synapseFederation: {{ .Values.global.hosts.synapseFederation }}
    whiteboard: {{ .Values.global.hosts.whiteboard }}
    {{- end }}
-    {{- if .Values.nubus.enabled }}
+    {{- if .Values.apps.nubus.enabled }}
    intercomService: {{ .Values.global.hosts.intercomService }}
    {{- end }}
-    {{- if .Values.jitsi.enabled }}
+    {{- if .Values.apps.jitsi.enabled }}
    jitsi: {{ .Values.global.hosts.jitsi }}
    {{- end }}
-    {{- if .Values.minio.enabled }}
+    {{- if .Values.apps.minio.enabled }}
    minioApi: {{ .Values.global.hosts.minioApi }}
    minioConsole: {{ .Values.global.hosts.minioConsole }}
    {{- end }}
-    {{- if .Values.nextcloud.enabled }}
+    {{- if .Values.apps.nextcloud.enabled }}
    nextcloud: {{ .Values.global.hosts.nextcloud }}
    {{- end }}
-    {{- if .Values.openproject.enabled }}
+    {{- if .Values.apps.openproject.enabled }}
    openproject: {{ .Values.global.hosts.openproject }}
    {{- end }}
-    {{- if .Values.oxAppSuite.enabled }}
+    {{- if .Values.apps.oxAppSuite.enabled }}
    openxchange: {{ .Values.global.hosts.openxchange }}
    {{- end }}
-    {{- if .Values.nubus.enabled }}
+    {{- if .Values.apps.nubus.enabled }}
    keycloak: {{ .Values.global.hosts.keycloak }}
    nubus: {{ .Values.global.hosts.nubus }}
    {{- end }}
-    {{- if .Values.xwiki.enabled }}
+    {{- if .Values.apps.xwiki.enabled }}
    xwiki: {{ .Values.global.hosts.xwiki }}
    {{- end }}

--- a/helmfile/apps/opendesk-services/values-opendesk-alerts.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-opendesk-alerts.yaml.gotmpl
@@ -10,43 +10,43 @@ additionalLabels:

 config:
  collabora:
-    enable: {{ .Values.collabora.enabled }}
+    enable: {{ .Values.apps.collabora.enabled }}
    selectors:
-      namespace: {{ .Values.collabora.namespace | quote }}
+      namespace: {{ .Values.apps.collabora.namespace | quote }}
  matrix:
-    enable: {{ .Values.element.enabled }}
+    enable: {{ .Values.apps.element.enabled }}
    selectors:
-      namespace: {{ .Values.element.namespace | quote }}
+      namespace: {{ .Values.apps.element.namespace | quote }}
  diagrams:
-    enable: {{ .Values.cryptpad.enabled }}
+    enable: {{ .Values.apps.cryptpad.enabled }}
    selectors:
-      namespace: {{ .Values.cryptpad.namespace | quote }}
+      namespace: {{ .Values.apps.cryptpad.namespace | quote }}
  nextcloud:
-    enable: {{ .Values.nextcloud.enabled }}
+    enable: {{ .Values.apps.nextcloud.enabled }}
    selectors:
-      namespace: {{ .Values.nextcloud.namespace | quote }}
+      namespace: {{ .Values.apps.nextcloud.namespace | quote }}
  openXChange:
-    enable: {{ .Values.oxAppSuite.enabled }}
+    enable: {{ .Values.apps.oxAppSuite.enabled }}
    selectors:
-      namespace: {{ .Values.oxAppSuite.namespace | quote }}
+      namespace: {{ .Values.apps.oxAppSuite.namespace | quote }}
  xwiki:
-    enable: {{ .Values.xwiki.enabled }}
+    enable: {{ .Values.apps.xwiki.enabled }}
    selectors:
-      namespace: {{ .Values.xwiki.namespace | quote }}
+      namespace: {{ .Values.apps.xwiki.namespace | quote }}
  nubus:
-    enable: {{ .Values.nubus.enabled }}
+    enable: {{ .Values.apps.nubus.enabled }}
    selectors:
-      namespace: {{ .Values.nubus.namespace | quote }}
+      namespace: {{ .Values.apps.nubus.namespace | quote }}
  openProject:
-    enable: {{ .Values.openproject.enabled }}
+    enable: {{ .Values.apps.openproject.enabled }}
    selectors:
-      namespace: {{ .Values.openproject.namespace | quote }}
+      namespace: {{ .Values.apps.openproject.namespace | quote }}
  jitsi:
-    enable: {{ .Values.jitsi.enabled }}
+    enable: {{ .Values.apps.jitsi.enabled }}
    selectors:
-      namespace: {{ .Values.jitsi.namespace | quote }}
+      namespace: {{ .Values.apps.jitsi.namespace | quote }}
  collabora:
-    enable: {{ .Values.collabora.enabled }}
+    enable: {{ .Values.apps.collabora.enabled }}
    selectors:
-      namespace: {{ .Values.collabora.namespace | quote }}
+      namespace: {{ .Values.apps.collabora.namespace | quote }}

--- a/helmfile/apps/opendesk-services/values-opendesk-dashboards.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-opendesk-dashboards.yaml.gotmpl
@@ -12,43 +12,43 @@ additionalLabels:
 config:
  apps:
    collabora:
-      enable: {{ .Values.collabora.enabled }}
+      enable: {{ .Values.apps.collabora.enabled }}
      selectors:
-        namespace: {{ .Values.collabora.namespace | quote }}
+        namespace: {{ .Values.apps.collabora.namespace | quote }}
    matrixElement:
-      enable: {{ .Values.element.enabled }}
+      enable: {{ .Values.apps.element.enabled }}
      selectors:
-        namespace: {{ .Values.element.namespace | quote }}
+        namespace: {{ .Values.apps.element.namespace | quote }}
    diagrams:
-      enable: {{ .Values.cryptpad.enabled }}
+      enable: {{ .Values.apps.cryptpad.enabled }}
      selectors:
-        namespace: {{ .Values.cryptpad.namespace | quote }}
+        namespace: {{ .Values.apps.cryptpad.namespace | quote }}
    nextcloud:
-      enable: {{ .Values.nextcloud.enabled }}
+      enable: {{ .Values.apps.nextcloud.enabled }}
      selectors:
-        namespace: {{ .Values.nextcloud.namespace | quote }}
+        namespace: {{ .Values.apps.nextcloud.namespace | quote }}
    openxchange:
-      enable: {{ .Values.oxAppSuite.enabled }}
+      enable: {{ .Values.apps.oxAppSuite.enabled }}
      selectors:
-        namespace: {{ .Values.oxAppSuite.namespace | quote }}
+        namespace: {{ .Values.apps.oxAppSuite.namespace | quote }}
    xwiki:
-      enable: {{ .Values.xwiki.enabled }}
+      enable: {{ .Values.apps.xwiki.enabled }}
      selectors:
-        namespace: {{ .Values.xwiki.namespace | quote }}
+        namespace: {{ .Values.apps.xwiki.namespace | quote }}
    nubus:
-      enable: {{ .Values.nubus.enabled }}
+      enable: {{ .Values.apps.nubus.enabled }}
      selectors:
-        namespace: {{ .Values.nubus.namespace | quote }}
+        namespace: {{ .Values.apps.nubus.namespace | quote }}
    openproject:
-      enable: {{ .Values.openproject.enabled }}
+      enable: {{ .Values.apps.openproject.enabled }}
      selectors:
-        namespace: {{ .Values.openproject.namespace | quote }}
+        namespace: {{ .Values.apps.openproject.namespace | quote }}
    jitsi:
-      enable: {{ .Values.jitsi.enabled }}
+      enable: {{ .Values.apps.jitsi.enabled }}
      selectors:
-        namespace: {{ .Values.jitsi.namespace | quote }}
+        namespace: {{ .Values.apps.jitsi.namespace | quote }}
    collabora:
-      enable: {{ .Values.collabora.enabled }}
+      enable: {{ .Values.apps.collabora.enabled }}
      selectors:
-        namespace: {{ .Values.collabora.namespace | quote }}
+        namespace: {{ .Values.apps.collabora.namespace | quote }}
 ...
--- a/helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl
@@ -10,47 +10,47 @@ global:

 apps:
  clamavDistributed:
-    enabled: {{ .Values.clamavDistributed.enabled }}
+    enabled: {{ .Values.apps.clamavDistributed.enabled }}
  clamavSimple:
-    enabled: {{ .Values.clamavSimple.enabled }}
+    enabled: {{ .Values.apps.clamavSimple.enabled }}
  collabora:
-    enabled: {{ .Values.collabora.enabled }}
+    enabled: {{ .Values.apps.collabora.enabled }}
  cryptpad:
-    enabled: {{ .Values.cryptpad.enabled }}
+    enabled: {{ .Values.apps.cryptpad.enabled }}
  dkimpy:
-    enabled: {{ .Values.dkimpy.enabled }}
+    enabled: {{ .Values.apps.dkimpy.enabled }}
  dovecot:
-    enabled: {{ .Values.dovecot.enabled }}
+    enabled: {{ .Values.apps.dovecot.enabled }}
  element:
-    enabled: {{ .Values.element.enabled }}
+    enabled: {{ .Values.apps.element.enabled }}
  jitsi:
-    enabled: {{ .Values.jitsi.enabled }}
+    enabled: {{ .Values.apps.jitsi.enabled }}
  mariadb:
-    enabled: {{ .Values.mariadb.enabled }}
+    enabled: {{ .Values.apps.mariadb.enabled }}
  memcached:
-    enabled: {{ .Values.memcached.enabled }}
+    enabled: {{ .Values.apps.memcached.enabled }}
  migrations:
-    enabled: {{ .Values.migrations.enabled }}
+    enabled: {{ .Values.apps.migrations.enabled }}
  minio:
-    enabled: {{ .Values.minio.enabled }}
+    enabled: {{ .Values.apps.minio.enabled }}
  nextcloud:
-    enabled: {{ .Values.nextcloud.enabled }}
+    enabled: {{ .Values.apps.nextcloud.enabled }}
  notes:
-    enabled: {{ .Values.notes.enabled }}
+    enabled: {{ .Values.apps.notes.enabled }}
  nubus:
-    enabled: {{ .Values.nubus.enabled }}
+    enabled: {{ .Values.apps.nubus.enabled }}
  openproject:
-    enabled: {{ .Values.openproject.enabled }}
+    enabled: {{ .Values.apps.openproject.enabled }}
  oxAppsuite:
-    enabled: {{ .Values.oxAppSuite.enabled }}
+    enabled: {{ .Values.apps.oxAppSuite.enabled }}
  postfix:
-    enabled: {{ .Values.postfix.enabled }}
+    enabled: {{ .Values.apps.postfix.enabled }}
  postgresql:
-    enabled: {{ .Values.postgresql.enabled }}
+    enabled: {{ .Values.apps.postgresql.enabled }}
  redis:
-    enabled: {{ .Values.redis.enabled }}
+    enabled: {{ .Values.apps.redis.enabled }}
  xwiki:
-    enabled: {{ .Values.xwiki.enabled }}
+    enabled: {{ .Values.apps.xwiki.enabled }}

 ingressController:
  {{ .Values.security.ingressController | toYaml | nindent 2 }}
--- a/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"

 releases:
  - name: "openproject"
@@ -23,7 +23,7 @@ releases:
      {{- range .Values.customization.release.openproject }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.openproject.enabled }}
+    installed: {{ .Values.apps.openproject.enabled }}
    timeout: 1800

 commonLabels:
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -38,7 +38,7 @@ dbInit:
    {{ .Values.resources.openprojectDbInit | toYaml | nindent 4 }}

 environment:
-  {{- if and (env "OPENDESK_ENTERPRISE") .Values.enterpriseKeys.openproject.token }}
+  {{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.openproject.token }}
  OPENPROJECT_ENTERPRISE__TOKEN: {{ .Values.enterpriseKeys.openproject.token | quote }}
  {{- end }}
 # For more details and more options see
@@ -80,7 +80,7 @@ environment:
  OPENPROJECT_SMTP__PASSWORD: ""
  OPENPROJECT_SMTP__PORT: 25
  OPENPROJECT_SMTP__SSL: "false" # (default=false)
-  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
  OPENPROJECT_SMTP__AUTHENTICATION: "none"
  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "false"
  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "none"
--- a/helmfile/apps/services-external/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/services-external/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"

  # openDesk MariaDB
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
@@ -20,7 +20,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"

  # openDesk dkimpy-milter
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter
@@ -30,7 +30,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"

  # openDesk Postfix
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
@@ -40,7 +40,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"

  # openDesk ClamAV
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
@@ -50,14 +50,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
  - name: "clamav-simple-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.clamavSimple.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"

  # VMWare Bitnami
  # Source: https://github.com/bitnami/charts/
@@ -67,21 +67,21 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
  - name: "redis-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.redis.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
  - name: "minio-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.minio.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"

  # openDesk Enterprise
  # Cassandra
@@ -92,7 +92,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"

 releases:
  - name: "redis"
@@ -103,7 +103,7 @@ releases:
      {{- range .Values.customization.release.redis }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.redis.enabled }}
+    installed: {{ .Values.apps.redis.enabled }}
    timeout: 900

  - name: "memcached"
@@ -114,7 +114,7 @@ releases:
      {{- range .Values.customization.release.memcached }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.memcached.enabled }}
+    installed: {{ .Values.apps.memcached.enabled }}
    timeout: 900

  - name: "postgresql"
@@ -125,7 +125,7 @@ releases:
      {{- range .Values.customization.release.postgresql }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.postgresql.enabled }}
+    installed: {{ .Values.apps.postgresql.enabled }}
    timeout: 900

  - name: "mariadb"
@@ -136,7 +136,7 @@ releases:
      {{- range .Values.customization.release.mariadb }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.mariadb.enabled }}
+    installed: {{ .Values.apps.mariadb.enabled }}
    timeout: 900

  - name: "postfix"
@@ -147,7 +147,7 @@ releases:
      {{- range .Values.customization.release.postfix }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.postfix.enabled }}
+    installed: {{ .Values.apps.postfix.enabled }}
    timeout: 900

  - name: "opendesk-dkimpy-milter"
@@ -158,7 +158,7 @@ releases:
      {{- range .Values.customization.release.opendeskDkimpyMilter }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.dkimpy.enabled }}
+    installed: {{ .Values.apps.dkimpy.enabled }}
    timeout: 900

  - name: "clamav"
@@ -169,7 +169,7 @@ releases:
      {{- range .Values.customization.release.clamav }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.clamavDistributed.enabled }}
+    installed: {{ .Values.apps.clamavDistributed.enabled }}
    timeout: 900

  - name: "clamav-simple"
@@ -180,7 +180,7 @@ releases:
      {{- range .Values.customization.release.clamavSimple }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.clamavSimple.enabled }}
+    installed: {{ .Values.apps.clamavSimple.enabled }}
    timeout: 900

  - name: "minio"
@@ -191,7 +191,7 @@ releases:
      {{- range .Values.customization.release.minio }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.minio.enabled }}
+    installed: {{ .Values.apps.minio.enabled }}
    timeout: 900

  # openDesk Enterprise Releases
@@ -203,7 +203,7 @@ releases:
      {{- range .Values.customization.release.cassandra }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.cassandra.enabled }}
+    installed: {{ .Values.apps.cassandra.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/services-external/values-minio.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-minio.yaml.gotmpl
@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -116,6 +116,11 @@ provisioning:
    - name: {{ .Values.objectstores.nubus.bucket | quote }}
      versioning: "Suspended"
      withLock: false
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    - name: {{ .Values.objectstores.dovecot.bucket | quote }}
+      versioning: "Suspended"
+      withLock: false
+    {{- end }}
  policies:
    - name: "migrations-bucket-policy"
      statements:
@@ -177,6 +182,20 @@ provisioning:
          effect: "Allow"
          actions:
            - "s3:*"
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    - name: "dovecot-bucket-policy"
+      statements:
+        - resources:
+            - "arn:aws:s3:::dovecot"
+          effect: "Allow"
+          actions:
+            - "s3:*"
+        - resources:
+            - "arn:aws:s3:::dovecot/*"
+          effect: "Allow"
+          actions:
+            - "s3:*"
+    {{- end }}
  users:
    - username: {{ .Values.objectstores.migrations.username | quote }}
      password: {{ .Values.secrets.minio.migrationsUser | quote }}
@@ -208,6 +227,14 @@ provisioning:
      policies:
        - "ums-bucket-policy"
      setPolicies: true
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    - username: {{ .Values.objectstores.dovecot.username | quote }}
+      password: {{ .Values.secrets.minio.dovecotUser | quote }}
+      disabled: false
+      policies:
+        - "dovecot-bucket-policy"
+      setPolicies: true
+    {{- end }}
  resources:
    {{ .Values.resources.minio | toYaml | nindent 4 }}

--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -52,7 +52,7 @@ postfix:
    - fileName: "sasl_passwd.map"
      content:
        - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
-  {{- if .Values.dkimpy.enabled }}
+  {{- if .Values.apps.dkimpy.enabled }}
  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
  {{- end }}
  rspamdHost: ""
@@ -71,9 +71,9 @@ postfix:
  {{- if .Values.antivirus.milter.host }}
  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
  {{- else }}
-  {{- if .Values.clamavDistributed.enabled }}
+  {{- if .Values.apps.clamavDistributed.enabled }}
  smtpdMilters: "inet:clamav-milter:7357"
-  {{- else if .Values.clamavSimple.enabled }}
+  {{- else if .Values.apps.clamavSimple.enabled }}
  smtpdMilters: "inet:clamav-simple:7357"
  {{- end }}
  {{- end }}
--- a/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"

 releases:
  - name: "xwiki"
@@ -22,7 +22,7 @@ releases:
      {{- range .Values.customization.release.xwiki }}
      - {{ . }}
      {{- end }}
-    installed: {{ .Values.xwiki.enabled }}
+    installed: {{ .Values.apps.xwiki.enabled }}
    timeout: 1800

 commonLabels:
--- a/helmfile/apps/xwiki/values.yaml.gotmpl
+++ b/helmfile/apps/xwiki/values.yaml.gotmpl
@@ -18,7 +18,7 @@ image:
 imagePullSecrets: {{ .Values.global.imagePullSecrets }}

 javaOpts:
-  {{- if and (env "OPENDESK_ENTERPRISE") .Values.enterprise.xwiki.opendeskEnterpriseLicense .Values.enterprise.xwiki.proApplicationslicense }}
+  {{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense .Values.enterpriseKeys.xwiki.proApplicationslicense }}
  - "-Dlicenses={{ .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense }},{{ .Values.enterpriseKeys.xwiki.proApplicationslicense }}"
  {{- end }}
  {{- if .Values.certificate.selfSigned }}
@@ -86,7 +86,7 @@ customConfigs:
    xwiki.authentication.ldap.fields_mapping: "last_name=sn,first_name=givenName,email=mailPrimaryAddress"

  xwiki.properties:
-    {{- if (env "OPENDESK_ENTERPRISE") }}
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
    distribution.defaultUI: "com.xwiki.projects.swp:xwiki-swp-flavor-enterprise-main"
    {{- end }}
    wikiInitializer.initialRequest.xwiki.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/distribution/"
@@ -165,7 +165,7 @@ properties:
  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.ldap_group_mapping": "xwiki:XWiki.XWikiAdminGroup=cn=managed-by-attribute-KnowledgemanagementAdmin,cn=groups,dc=swp-ldap,dc=internal"
  ## SMTP settings
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.port": 25
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.properties": "mail.smtp.starttls.enable=false"
  ## Link LDAP users and users authenticated through OIDC
--- a/helmfile/bases/environments.yaml.gotmpl
+++ b/helmfile/bases/environments.yaml.gotmpl
@@ -5,27 +5,27 @@ environments:
  default:
    values:
      - "../../environments/default/*.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
      {{- end }}
  dev:
    values:
      - "../../environments/default/*.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
      {{- end }}
      - "../../environments/dev/*.yaml.gotmpl"
  test:
    values:
      - "../../environments/default/*.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
      {{- end }}
      - "../../environments/test/*.yaml.gotmpl"
  prod:
    values:
      - "../../environments/default/*.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
      {{- end }}
      - "../../environments/prod/*.yaml.gotmpl"
--- a/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
@@ -1,7 +1,13 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 charts:
+  dovecot:
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/product-development/charts/opendesk-dovecot-pro"
+    name: "dovecot"
+    version: "1.0.0"
+    verify: true
  oxAppSuite:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/charts-mirror"
--- a/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
@@ -6,10 +6,14 @@ images:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/collabora/images/collabora-online-for-opendesk"
    tag: "24.04.9.4.2@sha256:7c38f2568855ec33c11296d65384766230ea3097a245a60b9e8b0b62cb9cc17f"
+  dovecot:
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/dovecot-pro"
+    tag: "3.0.1-rev3@sha256:b87f16562dd486c0f97e8147a797af16a54f25f1ac64826f4f53bd8177ec9a33"
  nextcloud:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/nextcloud/images/opendesk-nextcloud"
-    tag: "1.0.5@sha256:a541b29dad10deb99dbae6c3a463e994a054ac5c7ffc0a5c524c7b0f65544748"
+    tag: "1.0.7@sha256:3c0afeb7fb41e3ffa32ab3d3b96b41f5afd7a2b066a27b4478a64e06d2f0bd06"
  openxchangeCoreMW:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/core-mw"
--- a/helmfile/environments/default-enterprise-overrides/objectstores.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/objectstores.yaml.gotmpl
@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+objectstores:
+  dovecot:
+    bucket: "dovecot"
+    endpoint: ""
+    region: "eu-west-1"
+    secretKey: ""
+    username: "dovecot_user"
+    storageClass: "STANDARD"
+    useSSL: true
+    pathStyle: true
+    port: 443
+...
--- a/helmfile/environments/default/charts.yaml.gotmpl
+++ b/helmfile/environments/default/charts.yaml.gotmpl
@@ -111,16 +111,6 @@ charts:
    name: "opendesk-element"
    version: "6.0.2"
    verify: true
-  elementWeb:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
-    name: "opendesk-element-web"
-    version: "6.0.2"
-    verify: true
  elementWellKnown:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
--- a/helmfile/environments/default/global.generated.yaml.gotmpl
+++ b/helmfile/environments/default/global.generated.yaml.gotmpl
@@ -3,5 +3,5 @@
 ---
 global:
  systemInformation:
-    releaseVersion: "v1.1.1"
+    releaseVersion: "v1.1.2"
 ...
--- a/helmfile/environments/default/images.yaml.gotmpl
+++ b/helmfile/environments/default/images.yaml.gotmpl
@@ -294,7 +294,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
-    tag: "1.4.0@sha256:0c74011e4c1216857b73695741196908afcacc2f531fd1c894b8f574ac98f9a2"
+    tag: "1.4.1@sha256:c831f3bb27da483cbf46239d8f96df9597f710fbe3804f198ee1d89b1be71936"
  milter:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -318,7 +318,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.4.0@sha256:03d3273b49a3a51fc2d418302070657ad4198ee014f15ff4320e2164625431a1"
+    tag: "2.4.2@sha256:1f5d1378ac2cb00f6918fa49298bffe7da5e8c1eb02ae1ab3783870df2250841"
  nextcloudExporter:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -350,7 +350,7 @@ images:
    # upstreamRepository: "lasuite/impress-frontend"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-notes"
-    tag: "1.5.1@sha256:dad7dd60a5eb39b71b4911558cf7eac9ed6dc050593a046f5da0eaa75c65d344"
+    tag: "1.6.0-new-ui@sha256:96273e429d9ae6ebfb3173e09357f32d7b6cbe8189c12eacd149ed6da387d75d"
  notesYProvider:
    # providerCategory: "Supplier"
    # providerResponsible: "DINUM"
@@ -448,7 +448,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "0", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-proxy"
-    tag: "0.11.0@sha256:9b2079ed4078daee00d95ac2de4d72497131e699b967943db5be1c655048edb0"
+    tag: "0.15.3@sha256:087a8f242ac40f01bdc8326b220ec5b0034b64b3a3be6cf3968563c3d48eb056"
  nubusLdapNotifier:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -528,7 +528,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-    tag: "1.9.1@sha256:4cc4d4bc39167d7dc305ab1787763fd1091fa1284ddf373e081c595d4dce39a9"
+    tag: "1.9.1-trossner-improve-notes-permission@sha256:784a4fd2e49ca35d497ba5deddb11635d074e72708d729bc2cc19d1fac1feaef"
  nubusOpenPolicyAgent:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -576,7 +576,7 @@ images:
    # upstreamRepository: "nubus/images/portal-frontend"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus-portal-update"
-    tag: "1.10.13@sha256:2f84f50af5d6ed31587e5ea9d043c9c30599d91350e13ea1ca31c9c9737a32cc"
+    tag: "1.10.14@sha256:fbdec057958fd7e728431cf96896b8453c2f5b390ce3d2f169a7766f49926b1b"
  nubusPortalServer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
--- a/helmfile/environments/default/opendesk_main.yaml.gotmpl
+++ b/helmfile/environments/default/opendesk_main.yaml.gotmpl
@@ -4,88 +4,89 @@
 #
 # Note: Currently only single namespace deployments are supported.
 ---
-cassandra:
-  enabled: {{ if (env "OPENDESK_ENTERPRISE") }}true{{ else }}false{{ end }}
-  namespace: ~
-certificates:
-  enabled: true
-  namespace: ~
-clamavDistributed:
-  enabled: false
-  namespace: ~
-clamavSimple:
-  enabled: true
-  namespace: ~
-collabora:
-  enabled: true
-  namespace: ~
-collaboraController:
-  enabled: {{ if (env "OPENDESK_ENTERPRISE") }}true{{ else }}false{{ end }}
-  namespace: ~
-cryptpad:
-  enabled: true
-  namespace: ~
-dkimpy:
-  enabled: false
-  namespace: ~
-dovecot:
-  enabled: true
-  namespace: ~
-element:
-  enabled: true
-  namespace: ~
-elementAdmin:
-  enabled: {{ if (env "OPENDESK_ENTERPRISE") }}true{{ else }}false{{ end }}
-  namespace: ~
-elementGroupsync:
-  enabled: {{ if (env "OPENDESK_ENTERPRISE") }}true{{ else }}false{{ end }}
-  namespace: ~
-home:
-  enabled: true
-  namespace: ~
-jitsi:
-  enabled: true
-  namespace: ~
-mariadb:
-  enabled: true
-  namespace: ~
-memcached:
-  enabled: true
-  namespace: ~
-migrations:
-  enabled: true
-  namespace: ~
-minio:
-  enabled: true
-  namespace: ~
-nextcloud:
-  enabled: true
-  namespace: ~
-notes:
-  enabled: false
-  namespace: ~
-nubus:
-  enabled: true
-  namespace: ~
-openproject:
-  enabled: true
-  namespace: ~
-oxAppSuite:
-  enabled: true
-  namespace: ~
-postfix:
-  enabled: true
-  namespace: ~
-postgresql:
-  enabled: true
-  namespace: ~
-redis:
-  enabled: true
-  namespace: ~
-staticFiles:
-  enabled: true
-  namespace: ~
-xwiki:
-  enabled: true
-  namespace: ~
+apps:
+  cassandra:
+    enabled: {{ if eq (env "OPENDESK_ENTERPRISE") "true" }}true{{ else }}false{{ end }}
+    namespace: ~
+  certificates:
+    enabled: true
+    namespace: ~
+  clamavDistributed:
+    enabled: false
+    namespace: ~
+  clamavSimple:
+    enabled: true
+    namespace: ~
+  collabora:
+    enabled: true
+    namespace: ~
+  collaboraController:
+    enabled: {{ if eq (env "OPENDESK_ENTERPRISE") "true" }}true{{ else }}false{{ end }}
+    namespace: ~
+  cryptpad:
+    enabled: true
+    namespace: ~
+  dkimpy:
+    enabled: false
+    namespace: ~
+  dovecot:
+    enabled: true
+    namespace: ~
+  element:
+    enabled: true
+    namespace: ~
+  elementAdmin:
+    enabled: {{ if eq (env "OPENDESK_ENTERPRISE") "true" }}true{{ else }}false{{ end }}
+    namespace: ~
+  elementGroupsync:
+    enabled: {{ if eq (env "OPENDESK_ENTERPRISE") "true" }}true{{ else }}false{{ end }}
+    namespace: ~
+  home:
+    enabled: true
+    namespace: ~
+  jitsi:
+    enabled: true
+    namespace: ~
+  mariadb:
+    enabled: true
+    namespace: ~
+  memcached:
+    enabled: true
+    namespace: ~
+  migrations:
+    enabled: true
+    namespace: ~
+  minio:
+    enabled: true
+    namespace: ~
+  nextcloud:
+    enabled: true
+    namespace: ~
+  notes:
+    enabled: false
+    namespace: ~
+  nubus:
+    enabled: true
+    namespace: ~
+  openproject:
+    enabled: true
+    namespace: ~
+  oxAppSuite:
+    enabled: true
+    namespace: ~
+  postfix:
+    enabled: true
+    namespace: ~
+  postgresql:
+    enabled: true
+    namespace: ~
+  redis:
+    enabled: true
+    namespace: ~
+  staticFiles:
+    enabled: true
+    namespace: ~
+  xwiki:
+    enabled: true
+    namespace: ~
 ...
--- a/helmfile/environments/default/replicas.yaml.gotmpl
+++ b/helmfile/environments/default/replicas.yaml.gotmpl
@@ -100,6 +100,8 @@ replicas:
  # -- scalable: true
  umsLdapServerSecondary: 0
  # -- scalable: true
+  # -- comment: The LDAP proxy is only required in situations where there are clients outside of UDM writing into the
+  # LDAP like Samba. This is not a use case within openDesk so the LDAP Proxy's replica count should be kept at `0`
  umsLdapServerProxy: 0
  # -- scalable: tbd
  umsNotificationsApi: 1
--- a/helmfile/environments/default/theme.yaml.gotmpl
+++ b/helmfile/environments/default/theme.yaml.gotmpl
@@ -55,8 +55,8 @@ theme:
      logoSvg: {{ readFile "./../../files/theme/login/logo.svg" | b64enc | quote }}

    groupware:
-      faviconIco: {{ readFile "./../../files/theme/groupware/favicon.ico" | b64enc | quote }}
-      faviconSvg: {{ readFile "./../../files/theme/groupware/favicon.svg" | b64enc | quote }}
+      faviconIco: {{ readFile "./../../files/theme/groupware_mail/favicon.ico" | b64enc | quote }}
+      faviconSvg: {{ readFile "./../../files/theme/groupware_mail/favicon.svg" | b64enc | quote }}

    knowledge:
      faviconSvg: {{ readFile "./../../files/theme/knowledge/favicon.svg" | b64enc | quote }}
@@ -70,31 +70,32 @@ theme:
      waitingSpinnerSvg: {{ readFile "./../../files/theme/portal/waiting-spinner.svg" | b64enc  }}
      backgroundSvg: {{ readFile "./../../files/theme/portal/background.svg" | b64enc | quote }}
    portalTiles:
-      adminAnnouncement: {{ readFile "./../../files/theme/portal-tiles/admin_announcement.svg" | b64enc | quote }}
-      adminContext: {{ readFile "./../../files/theme/portal-tiles/admin_context.svg" | b64enc | quote }}
-      adminFunctionalmailbox: {{ readFile "./../../files/theme/portal-tiles/admin_functionalmailbox.svg" | b64enc | quote }}
-      adminGroup: {{ readFile "./../../files/theme/portal-tiles/admin_group.svg" | b64enc | quote }}
-      adminResource: {{ readFile "./../../files/theme/portal-tiles/admin_resource.svg" | b64enc | quote }}
-      adminUser: {{ readFile "./../../files/theme/portal-tiles/admin_user.svg" | b64enc | quote }}
-      anonymousLogin: {{ readFile "./../../files/theme/portal-tiles/anonymous_login.svg" | b64enc | quote }}
-      dummyCircle: {{ readFile "./../../files/theme/portal-tiles/dummy_circle.svg" | b64enc | quote }}
-      fileshareActivity: {{ readFile "./../../files/theme/portal-tiles/fileshare_activity.svg" | b64enc | quote }}
-      fileshareDirectdocOdp: {{ readFile "./../../files/theme/portal-tiles/fileshare_directdoc_odp.svg" | b64enc | quote }}
-      fileshareDirectdocOds: {{ readFile "./../../files/theme/portal-tiles/fileshare_directdoc_ods.svg" | b64enc | quote }}
-      fileshareDirectdocOdt: {{ readFile "./../../files/theme/portal-tiles/fileshare_directdoc_odt.svg" | b64enc | quote }}
-      fileshareFiles: {{ readFile "./../../files/theme/portal-tiles/fileshare_files.svg" | b64enc | quote }}
-      groupwareCalendar: {{ readFile "./../../files/theme/portal-tiles/groupware_calendar.svg" | b64enc | quote }}
-      groupwareContacts: {{ readFile "./../../files/theme/portal-tiles/groupware_contacts.svg" | b64enc | quote }}
-      groupwareMail: {{ readFile "./../../files/theme/portal-tiles/groupware_mail.svg" | b64enc | quote }}
-      groupwareTasks: {{ readFile "./../../files/theme/portal-tiles/groupware_tasks.svg" | b64enc | quote }}
-      managementKnowledge: {{ readFile "./../../files/theme/portal-tiles/management_knowledge.svg" | b64enc | quote }}
-      managementProject: {{ readFile "./../../files/theme/portal-tiles/management_project.svg" | b64enc | quote }}
-      notes: {{ readFile "./../../files/theme/portal-tiles/misc_notes.svg" | b64enc | quote }}
-      realtimeCollaboration: {{ readFile "./../../files/theme/portal-tiles/realtime_collaboration.svg" | b64enc | quote }}
-      realtimeVideoconference: {{ readFile "./../../files/theme/portal-tiles/realtime_videoconference.svg" | b64enc | quote }}
-      selfserviceChangepassword: {{ readFile "./../../files/theme/portal-tiles/selfservice_changepassword.svg" | b64enc | quote }}
-      selfserviceEditprofile: {{ readFile "./../../files/theme/portal-tiles/selfservice_editprofile.svg" | b64enc | quote }}
-      selfserviceProtectaccount: {{ readFile "./../../files/theme/portal-tiles/selfservice_protectaccount.svg" | b64enc | quote }}
+      adminAnnouncement: {{ readFile "./../../files/theme/admin_announcements/favicon.svg" | b64enc | quote }}
+      adminFunctionalmailbox: {{ readFile "./../../files/theme/admin_functionalmailbox/favicon.svg" | b64enc | quote }}
+      adminGroup: {{ readFile "./../../files/theme/admin_groups/favicon.svg" | b64enc | quote }}
+      adminResource: {{ readFile "./../../files/theme/admin_resource/favicon.svg" | b64enc | quote }}
+      adminUser: {{ readFile "./../../files/theme/admin_user/favicon.svg" | b64enc | quote }}
+      anonymousLogin: {{ readFile "./../../files/theme/login/favicon.svg" | b64enc | quote }}
+      fileshareDirectdocOdp: {{ readFile "./../../files/theme/directdocs_odp/favicon.svg" | b64enc | quote }}
+      fileshareDirectdocOds: {{ readFile "./../../files/theme/directdocs_ods/favicon.svg" | b64enc | quote }}
+      fileshareDirectdocOdt: {{ readFile "./../../files/theme/directdocs_odt/favicon.svg" | b64enc | quote }}
+      fileshareFiles: {{ readFile "./../../files/theme/files/favicon.svg" | b64enc | quote }}
+      groupwareCalendar: {{ readFile "./../../files/theme/groupware_calendar/favicon.svg" | b64enc | quote }}
+      groupwareContacts: {{ readFile "./../../files/theme/groupware_contacts/favicon.svg" | b64enc | quote }}
+      groupwareMail: {{ readFile "./../../files/theme/groupware_mail/favicon.svg" | b64enc | quote }}
+      groupwareTasks: {{ readFile "./../../files/theme/groupware_tasks/favicon.svg" | b64enc | quote }}
+      managementKnowledge: {{ readFile "./../../files/theme/knowledge/favicon.svg" | b64enc | quote }}
+      managementProject: {{ readFile "./../../files/theme/projects/favicon.svg" | b64enc | quote }}
+      notes: {{ readFile "./../../files/theme/notes/favicon.svg" | b64enc | quote }}
+      realtimeCollaboration: {{ readFile "./../../files/theme/chat/favicon.svg" | b64enc | quote }}
+      realtimeVideoconference: {{ readFile "./../../files/theme/videoconference/favicon.svg" | b64enc | quote }}
+      # empty.svg
+      dummyCircle: {{ readFile "./../../files/theme/_dev/empty.svg" | b64enc | quote }}
+      fileshareActivity: {{ readFile "./../../files/theme/_dev/empty.svg" | b64enc | quote }}
+      adminContext: {{ readFile "./../../files/theme/_dev/empty.svg" | b64enc | quote }}
+      selfserviceChangepassword: {{ readFile "./../../files/theme/_dev/empty.svg" | b64enc | quote }}
+      selfserviceEditprofile: {{ readFile "./../../files/theme/_dev/empty.svg" | b64enc | quote }}
+      selfserviceProtectaccount: {{ readFile "./../../files/theme/_dev/empty.svg" | b64enc | quote }}

    projects:
      faviconSvg: {{ readFile "./../../files/theme/projects/favicon.svg" | b64enc | quote }}
--- a/helmfile/files/theme/portal-tiles/dummy_circle.svg
+++ b/helmfile/files/theme/portal-tiles/dummy_circle.svg
--- a/helmfile/files/theme/portal-tiles/admin_announcement.svg
+++ b/helmfile/files/theme/portal-tiles/admin_announcement.svg
--- a/helmfile/files/theme/portal-tiles/admin_functionalmailbox.svg
+++ b/helmfile/files/theme/portal-tiles/admin_functionalmailbox.svg
--- a/helmfile/files/theme/portal-tiles/admin_group.svg
+++ b/helmfile/files/theme/portal-tiles/admin_group.svg
--- a/helmfile/files/theme/portal-tiles/admin_resource.svg
+++ b/helmfile/files/theme/portal-tiles/admin_resource.svg
--- a/helmfile/files/theme/portal-tiles/admin_user.svg
+++ b/helmfile/files/theme/portal-tiles/admin_user.svg
--- a/helmfile/files/theme/chat/favicon.ico
+++ b/helmfile/files/theme/chat/favicon.ico
--- a/helmfile/files/theme/chat/favicon.png
+++ b/helmfile/files/theme/chat/favicon.png
--- a/helmfile/files/theme/chat/favicon.svg
+++ b/helmfile/files/theme/chat/favicon.svg
@@ -0,0 +1,5 @@
+<svg width="111" height="111" viewBox="0 0 111 111" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" y="0.5" width="110" height="110" rx="20" fill="white"/>
+<path d="M58.6115 47.7521C62.9105 47.7521 66.4069 44.2667 66.4069 39.9568V32.1614C66.4069 27.8624 62.9215 24.3661 58.6115 24.3661H27.4412C23.1422 24.3661 19.6459 27.8514 19.6459 32.1614V63.3317L35.2255 47.7521H58.6005H58.6115Z" fill="#341291"/>
+<path d="M83.5478 55.5476H52.3775C48.0785 55.5476 44.5822 59.033 44.5822 63.3429V71.1383C44.5822 75.4372 48.0675 78.9336 52.3775 78.9336H75.7525L91.3321 94.5133V63.3429C91.3321 59.044 87.8468 55.5476 83.5368 55.5476H83.5478Z" fill="#571EFA"/>
+</svg>
--- a/helmfile/files/theme/portal-tiles/fileshare_directdoc_odp.svg
+++ b/helmfile/files/theme/portal-tiles/fileshare_directdoc_odp.svg
--- a/helmfile/files/theme/portal-tiles/fileshare_directdoc_ods.svg
+++ b/helmfile/files/theme/portal-tiles/fileshare_directdoc_ods.svg
--- a/helmfile/files/theme/portal-tiles/fileshare_directdoc_odt.svg
+++ b/helmfile/files/theme/portal-tiles/fileshare_directdoc_odt.svg
--- a/helmfile/files/theme/files/favicon.ico
+++ b/helmfile/files/theme/files/favicon.ico
--- a/helmfile/files/theme/files/favicon.png
+++ b/helmfile/files/theme/files/favicon.png
--- a/helmfile/files/theme/files/favicon.svg
+++ b/helmfile/files/theme/files/favicon.svg
@@ -0,0 +1,5 @@
+<svg width="111" height="111" viewBox="0 0 111 111" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" y="0.5" width="110" height="110" rx="20" fill="white"/>
+<path d="M24.0718 43.8214H78.6146C82.9134 43.8214 86.4096 47.3176 86.4096 51.6164V74.9903C86.4096 79.2891 82.9134 82.7852 78.6146 82.7852H31.8667C27.568 82.7852 24.0718 79.2891 24.0718 74.9903V43.8214Z" fill="#571EFA"/>
+<path d="M50.5571 36.0266H24.0718V31.354C24.0718 27.0442 27.557 23.559 31.8667 23.559H44.3343L50.5681 36.0266H50.5571Z" fill="#341291"/>
+</svg>
--- a/helmfile/files/theme/groupware/favicon.svg
+++ b/helmfile/files/theme/groupware/favicon.svg
@@ -1,5 +0,0 @@
-<svg width="110" height="110" viewBox="0 0 110 110" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="110" height="110" rx="20" fill="white"/>
-<path d="M83.0501 33.75H26.8501L54.9501 54.75L83.0501 33.75Z" fill="#571EFA"/>
-<path d="M54.95 63.65L26.65 42.35V69.15C26.65 73.05 29.85 76.25 33.75 76.25H76.25C80.15 76.25 83.35 73.05 83.35 69.15V42.35C83.35 42.35 55.05 63.65 54.95 63.65Z" fill="#571EFA" fill-opacity="0.7"/>
-</svg>
--- a/helmfile/files/theme/groupware_calendar/favicon.ico
+++ b/helmfile/files/theme/groupware_calendar/favicon.ico
--- a/helmfile/files/theme/groupware_calendar/favicon.png
+++ b/helmfile/files/theme/groupware_calendar/favicon.png
--- a/helmfile/files/theme/groupware_calendar/favicon.svg
+++ b/helmfile/files/theme/groupware_calendar/favicon.svg
@@ -0,0 +1,8 @@
+<svg width="111" height="111" viewBox="0 0 111 111" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" y="0.5" width="110" height="110" rx="20" fill="white"/>
+<path d="M36.7979 60.2203H14.9841V83.5953H36.7979V60.2203Z" fill="#571EFA"/>
+<path d="M66.4069 60.2203H44.5931V83.5953H66.4069V60.2203Z" fill="#571EFA"/>
+<path d="M36.7979 29.0609H14.9841V52.4359H36.7979V29.0609Z" fill="#341291"/>
+<path d="M66.4069 29.0609H44.5931V52.4359H66.4069V29.0609Z" fill="#571EFA"/>
+<path d="M96.0159 29.0609H74.2021V52.4359H96.0159V29.0609Z" fill="#571EFA"/>
+</svg>
--- a/helmfile/files/theme/groupware_contacts/favicon.ico
+++ b/helmfile/files/theme/groupware_contacts/favicon.ico
--- a/helmfile/files/theme/groupware_contacts/favicon.png
+++ b/helmfile/files/theme/groupware_contacts/favicon.png
--- a/helmfile/files/theme/groupware_contacts/favicon.svg
+++ b/helmfile/files/theme/groupware_contacts/favicon.svg
@@ -0,0 +1,7 @@
+<svg width="111" height="111" viewBox="0 0 111 111" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" y="0.5" width="110" height="110" rx="20" fill="white"/>
+<path d="M33.6863 53.9861C40.1411 53.9861 45.3738 48.7534 45.3738 42.2986C45.3738 35.8438 40.1411 30.6111 33.6863 30.6111C27.2315 30.6111 21.9988 35.8438 21.9988 42.2986C21.9988 48.7534 27.2315 53.9861 33.6863 53.9861Z" fill="#571EFA"/>
+<path d="M77.3137 53.9861C83.7685 53.9861 89.0012 48.7534 89.0012 42.2986C89.0012 35.8438 83.7685 30.6111 77.3137 30.6111C70.8589 30.6111 65.6262 35.8438 65.6262 42.2986C65.6262 48.7534 70.8589 53.9861 77.3137 53.9861Z" fill="#341291"/>
+<path d="M14.9841 80.4836C14.9841 70.1594 23.3512 61.7814 33.6863 61.7814C44.0215 61.7814 52.3885 70.1484 52.3885 80.4836H14.9841Z" fill="#571EFA"/>
+<path d="M58.6116 80.4836C58.6116 70.1594 66.9786 61.7814 77.3138 61.7814C87.6489 61.7814 96.016 70.1484 96.016 80.4836H58.6116Z" fill="#341291"/>
+</svg>
--- a/helmfile/files/theme/groupware_mail/favicon.ico
+++ b/helmfile/files/theme/groupware_mail/favicon.ico
--- a/helmfile/files/theme/groupware_mail/favicon.png
+++ b/helmfile/files/theme/groupware_mail/favicon.png
--- a/helmfile/files/theme/groupware_mail/favicon.svg
+++ b/helmfile/files/theme/groupware_mail/favicon.svg
@@ -0,0 +1,5 @@
+<svg width="111" height="111" viewBox="0 0 111 111" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" y="0.5" width="110" height="110" rx="20" fill="white"/>
+<path d="M55.671 55.5L84.2136 34.0931C82.8392 32.8726 81.036 32.125 79.046 32.125H32.296C30.3169 32.125 28.5028 32.8726 27.1284 34.0931L55.671 55.5Z" fill="#571EFA"/>
+<path d="M62.1689 60.3707L55.6709 65.2414L49.173 60.3707L24.5006 41.8664V71.0796C24.5006 75.3786 27.986 78.8749 32.2959 78.8749H79.0459C83.3449 78.8749 86.8413 75.3896 86.8413 71.0796V41.8664L62.1689 60.3707Z" fill="#341291"/>
+</svg>
--- a/helmfile/files/theme/groupware_tasks/favicon.ico
+++ b/helmfile/files/theme/groupware_tasks/favicon.ico
--- a/helmfile/files/theme/groupware_tasks/favicon.png
+++ b/helmfile/files/theme/groupware_tasks/favicon.png
--- a/helmfile/files/theme/groupware_tasks/favicon.svg
+++ b/helmfile/files/theme/groupware_tasks/favicon.svg
@@ -0,0 +1,7 @@
+<svg width="111" height="111" viewBox="0 0 111 111" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" y="0.5" width="110" height="110" rx="20" fill="white"/>
+<path d="M26.6716 52.436C33.1265 52.436 38.3591 47.2033 38.3591 40.7485C38.3591 34.2936 33.1265 29.061 26.6716 29.061C20.2168 29.061 14.9841 34.2936 14.9841 40.7485C14.9841 47.2033 20.2168 52.436 26.6716 52.436Z" fill="#571EFA"/>
+<path d="M92.9043 36.8455H46.1543V44.6408H92.9043V36.8455Z" fill="#341291"/>
+<path d="M26.6716 82.0341C33.1265 82.0341 38.3591 76.8014 38.3591 70.3466C38.3591 63.8917 33.1265 58.6591 26.6716 58.6591C20.2168 58.6591 14.9841 63.8917 14.9841 70.3466C14.9841 76.8014 20.2168 82.0341 26.6716 82.0341Z" fill="#571EFA"/>
+<path d="M92.9043 66.4543H46.1543V74.2497H92.9043V66.4543Z" fill="#341291"/>
+</svg>
--- a/helmfile/files/theme/knowledge/favicon.ico
+++ b/helmfile/files/theme/knowledge/favicon.ico
--- a/helmfile/files/theme/knowledge/favicon.png
+++ b/helmfile/files/theme/knowledge/favicon.png
--- a/helmfile/files/theme/knowledge/favicon.svg
+++ b/helmfile/files/theme/knowledge/favicon.svg
@@ -1,5 +1,5 @@
-<svg width="110" height="110" viewBox="0 0 110 110" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="110" height="110" rx="20" fill="white"/>
-<path d="M65.65 72.7C65.65 78.6 60.85 83.3 55.05 83.3C49.25 83.3 44.45 78.5 44.45 72.7V69.2H65.75V72.7H65.65Z" fill="#571EFA" fill-opacity="0.7"/>
-<path d="M55.05 26.7C43.35 26.7 33.75 36.2 33.75 48C33.75 53.5 35.85 58.4 39.25 62.2H70.85C74.25 58.4 76.25 53.5 76.25 48C76.25 36.3 66.75 26.7 54.95 26.7H55.05Z" fill="#571EFA"/>
+<svg width="111" height="111" viewBox="0 0 111 111" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" y="0.5" width="110" height="110" rx="20" fill="white"/>
+<path d="M67.1875 75.0302C67.1875 81.4842 61.954 86.7177 55.5 86.7177C49.046 86.7177 43.8125 81.4842 43.8125 75.0302V71.1381H67.1875V75.0302Z" fill="#341291"/>
+<path d="M55.5 24.3772C42.5921 24.3772 32.125 34.8443 32.125 47.7522C32.125 53.7444 34.4009 59.1978 38.1172 63.3319H72.8828C76.5991 59.1978 78.875 53.7444 78.875 47.7522C78.875 34.8443 68.4079 24.3772 55.5 24.3772Z" fill="#571EFA"/>
 </svg>
--- a/helmfile/files/theme/login/favicon.ico
+++ b/helmfile/files/theme/login/favicon.ico
--- a/helmfile/files/theme/login/favicon.png
+++ b/helmfile/files/theme/login/favicon.png
--- a/helmfile/files/theme/login/favicon.svg
+++ b/helmfile/files/theme/login/favicon.svg
@@ -0,0 +1,5 @@
+<svg width="111" height="111" viewBox="0 0 111 111" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" y="0.5" width="110" height="110" rx="20" fill="white"/>
+<path d="M68.6778 80.1145V81.6565C68.6778 88.1647 63.4498 93.4567 57.0203 93.4567H29.6574C23.2279 93.4567 17.9999 88.1647 17.9999 81.6565V53.9586C17.9999 47.4503 23.2279 42.1583 29.6574 42.1583H31.1807V80.1218H68.6849L68.6778 80.1145Z" fill="#8E75FA"/>
+<path d="M69.1856 70.877H40.2993V38.553C40.2993 27.5202 49.1676 18.5433 60.067 18.5433H69.1927C81.7656 18.5433 91.9999 28.9029 91.9999 41.6298V47.7833C91.9999 60.5102 81.7656 70.8697 69.1927 70.8697L69.1856 70.877ZM53.473 57.5348H69.1856C74.4922 57.5348 78.8119 53.1622 78.8119 47.7905V41.637C78.8119 36.2654 74.4922 31.8928 69.1856 31.8928H60.0598C56.4267 31.8928 53.473 34.8827 53.473 38.5603V57.542V57.5348Z" fill="#571EFA"/>
+</svg>
--- a/helmfile/files/theme/notes/favicon.ico
+++ b/helmfile/files/theme/notes/favicon.ico
--- a/helmfile/files/theme/notes/favicon.png
+++ b/helmfile/files/theme/notes/favicon.png
--- a/helmfile/files/theme/notes/favicon.svg
+++ b/helmfile/files/theme/notes/favicon.svg
@@ -0,0 +1,5 @@
+<svg width="111" height="111" viewBox="0 0 111 111" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="0.5" y="0.5" width="110" height="110" rx="20" fill="white"/>
+<path d="M83.5479 78.9225H27.5952V86.7178H83.5479V78.9225Z" fill="#341291"/>
+<path d="M66.5497 26.5211L72.0582 32.0295C75.1037 35.0751 75.1037 40.0008 72.0582 43.0463L66.2089 48.8956L43.9774 71.1271H27.4521V54.6019L49.6837 32.3704L55.5329 26.5211C58.5785 23.4755 63.5042 23.4755 66.5497 26.5211Z" fill="#571EFA"/>
+</svg>
--- a/helmfile/files/theme/portal-tiles/admin_context.svg
+++ b/helmfile/files/theme/portal-tiles/admin_context.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#5e27dd"><path d="M160-440v-295.38q0-27.62 18.5-46.12Q197-800 224.62-800H440v360H160Zm240-40Zm120-320h215.38q27.62 0 46.12 18.5Q800-763 800-735.13V-600H520v-200Zm0 640v-360h280v295.38q0 27.62-18.5 46.12Q763-160 735.38-160H520ZM160-360h280v200H224.62q-27.62 0-46.12-18.5Q160-197 160-224.87V-360Zm240 40Zm160-320Zm0 160Zm-360 0h200v-280H224.62q-10.77 0-17.7 6.92-6.92 6.93-6.92 17.7V-480Zm360-160h200v-95.38q0-10.77-6.92-17.7-6.93-6.92-17.7-6.92H560v120Zm0 160v280h175.38q10.77 0 17.7-6.92 6.92-6.93 6.92-17.7V-480H560ZM200-320v95.38q0 10.77 6.92 17.7 6.93 6.92 17.7 6.92H400v-120H200Z"/></svg>
--- a/helmfile/files/theme/portal-tiles/anonymous_login.svg
+++ b/helmfile/files/theme/portal-tiles/anonymous_login.svg
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #927afa;
-      }
-    </style>
-  </defs>
-  <path class="cls-2" d="M83.1,97.26v2.12c0,8.97-7.3,16.27-16.27,16.27H28.62c-8.97,0-16.27-7.3-16.27-16.27v-38.2c0-8.97,7.3-16.27,16.27-16.27h2.12v52.35h52.35Z"/>
-  <path class="cls-1" d="M83.81,84.52h-40.33v-44.57c0-15.22,12.38-27.59,27.59-27.59h12.74c17.56,0,31.84,14.28,31.84,31.84v8.49c0,17.56-14.28,31.84-31.84,31.84ZM61.88,66.12h21.93c7.41,0,13.44-6.03,13.44-13.44v-8.49c0-7.41-6.03-13.44-13.44-13.44h-12.74c-5.07,0-9.2,4.13-9.2,9.2v26.18Z"/>
-</svg>
--- a/helmfile/files/theme/portal-tiles/fileshare_activity.svg
+++ b/helmfile/files/theme/portal-tiles/fileshare_activity.svg
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.56 127.56">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #341291;
-      }
-    </style>
-  </defs>
-  <polygon class="cls-1" points="63.35 55.28 54.85 63.78 63.35 72.28 107.13 72.28 107.13 55.28 63.35 55.28"/>
-  <polygon class="cls-2" points="44.48 63.78 62.52 45.74 50.49 33.71 32.45 51.75 20.43 63.78 32.45 75.81 50.49 93.85 62.52 81.82 44.48 63.78"/>
-</svg>
--- a/helmfile/files/theme/portal-tiles/fileshare_files.svg
+++ b/helmfile/files/theme/portal-tiles/fileshare_files.svg
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.56 127.56">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #341291;
-      }
-    </style>
-  </defs>
-  <path class="cls-1" d="M29.76,55.28h59.53c4.69,0,8.5,3.81,8.5,8.5v25.51c0,4.69-3.81,8.5-8.5,8.5h-51.02c-4.69,0-8.5-3.81-8.5-8.5v-34.02h0Z"/>
-  <path class="cls-2" d="M55.28,29.76h-17.01c-4.7,0-8.5,3.81-8.5,8.5v8.5h34.02l-8.5-17.01Z"/>
-</svg>
--- a/helmfile/files/theme/portal-tiles/groupware_calendar.svg
+++ b/helmfile/files/theme/portal-tiles/groupware_calendar.svg
@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.56 127.56">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #341291;
-      }
-    </style>
-  </defs>
-  <rect class="cls-1" x="17.01" y="68.03" width="25.51" height="25.51"/>
-  <rect class="cls-1" x="51.02" y="68.03" width="25.51" height="25.51"/>
-  <rect class="cls-2" x="17.01" y="34.02" width="25.51" height="25.51"/>
-  <rect class="cls-1" x="51.02" y="34.02" width="25.51" height="25.51"/>
-  <rect class="cls-1" x="85.04" y="34.02" width="25.51" height="25.51"/>
-</svg>
--- a/helmfile/files/theme/portal-tiles/groupware_contacts.svg
+++ b/helmfile/files/theme/portal-tiles/groupware_contacts.svg
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.56 127.56">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #341291;
-      }
-    </style>
-  </defs>
-  <circle class="cls-1" cx="39.12" cy="49.32" r="12.76"/>
-  <circle class="cls-2" cx="88.44" cy="49.32" r="12.76"/>
-  <path class="cls-1" d="M18.71,90.99c0-11.27,9.14-20.41,20.41-20.41s20.41,9.14,20.41,20.41H18.71Z"/>
-  <path class="cls-2" d="M68.03,90.99c0-11.27,9.14-20.41,20.41-20.41s20.41,9.14,20.41,20.41h-40.82Z"/>
-</svg>
--- a/helmfile/files/theme/portal-tiles/groupware_mail.svg
+++ b/helmfile/files/theme/portal-tiles/groupware_mail.svg
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.56 127.56">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #341291;
-      }
-    </style>
-  </defs>
-  <polygon class="cls-1" points="97.51 38.27 30.05 38.27 63.78 63.57 97.51 38.27"/>
-  <path class="cls-2" d="M63.78,74.2l-34.02-25.51v32.1c0,4.7,3.81,8.5,8.5,8.5h51.02c4.7,0,8.5-3.81,8.5-8.5v-32.1l-34.02,25.51Z"/>
-</svg>
--- a/helmfile/files/theme/portal-tiles/groupware_tasks.svg
+++ b/helmfile/files/theme/portal-tiles/groupware_tasks.svg
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.56 127.56">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #341291;
-      }
-    </style>
-  </defs>
-  <circle class="cls-2" cx="34.02" cy="46.77" r="12.76"/>
-  <rect class="cls-1" x="55.28" y="38.27" width="51.02" height="17.01"/>
-  <circle class="cls-2" cx="34.02" cy="80.79" r="12.76"/>
-  <rect class="cls-1" x="55.28" y="72.28" width="51.02" height="17.01"/>
-</svg>
--- a/helmfile/files/theme/portal-tiles/management_knowledge.svg
+++ b/helmfile/files/theme/portal-tiles/management_knowledge.svg
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.56 127.56">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #341291;
-      }
-    </style>
-  </defs>
-  <path class="cls-2" d="M76.54,85.04c0,7.04-5.71,12.76-12.76,12.76s-12.76-5.71-12.76-12.76v-4.25h25.51v4.25Z"/>
-  <path class="cls-1" d="M63.78,29.76h0c-14.09,0-25.51,11.42-25.51,25.51h0c0,6.54,2.48,12.5,6.54,17.01h37.95c4.06-4.51,6.54-10.46,6.54-17.01h0c0-14.09-11.42-25.51-25.51-25.51Z"/>
-</svg>
--- a/helmfile/files/theme/portal-tiles/management_project.svg
+++ b/helmfile/files/theme/portal-tiles/management_project.svg
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.56 127.56">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #341291;
-      }
-    </style>
-  </defs>
-  <rect class="cls-1" x="-4.25" y="55.28" width="59.53" height="17.01" transform="translate(89.29 38.27) rotate(90)"/>
-  <rect class="cls-1" x="59.53" y="68.03" width="51.02" height="25.51" rx="8.5" ry="8.5"/>
-  <rect class="cls-2" x="42.33" y="34.02" width="42.71" height="25.51" rx="8.5" ry="8.5"/>
-</svg>
--- a/helmfile/files/theme/portal-tiles/misc_notes.svg
+++ b/helmfile/files/theme/portal-tiles/misc_notes.svg
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.56 127.56">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #571efa;
-      }
-
-      .cls-2 {
-        fill: #341291;
-      }
-    </style>
-  </defs>
-  <rect class="cls-2" x="34.09" y="85.12" width="59.53" height="17.01"/>
-  <path class="cls-1" d="M76.61,27.92l6.01,6.01c3.32,3.32,3.32,8.71,0,12.03l-6.39,6.39-24.26,24.26h-18.04v-18.04l24.26-24.26,6.39-6.39c3.32-3.32,8.71-3.32,12.03,0Z"/>
-</svg>
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				<svg xmlns="http://www.w3.org/2000/svg" height="24px" viewBox="0 -960 960 960" width="24px" fill="#5e27dd"><path d="M160-440v-295.38q0-27.62 18.5-46.12Q197-800 224.62-800H440v360H160Zm240-40Zm120-320h215.38q27.62 0 46.12 18.5Q800-763 800-735.13V-600H520v-200Zm0 640v-360h280v295.38q0 27.62-18.5 46.12Q763-160 735.38-160H520ZM160-360h280v200H224.62q-27.62 0-46.12-18.5Q160-197 160-224.87V-360Zm240 40Zm160-320Zm0 160Zm-360 0h200v-280H224.62q-10.77 0-17.7 6.92-6.92 6.93-6.92 17.7V-480Zm360-160h200v-95.38q0-10.77-6.92-17.7-6.93-6.92-17.7-6.92H560v120Zm0 160v280h175.38q10.77 0 17.7-6.92 6.92-6.93 6.92-17.7V-480H560ZM200-320v95.38q0 10.77 6.92 17.7 6.93 6.92 17.7 6.92H400v-120H200Z"/></svg>