chore(release): 0.9.0 [skip ci]

# [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24) ### Bug Fixes * **collabora:** Update to 24.04.5.1.1. ([8a2d951](8a2d951c3b)) * **collabora:** Update to 24.04.5.1.2. ([74d444e](74d444e2d6)) * **docs:** Update workflow.md. ([fd3df7d](fd3df7df67)) * **docu:** Update documentation on integration uses cases ([#95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/95)). ([382af1d](382af1dfb9)) * **helmfile:** Add S3 bucket for migrations. ([972020f](972020f946)) * **helmfile:** Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details. ([26a7641](26a7641a5a)) * **jitsi:** Raise memory limit for jicofo and jvb as required by upstream product. ([fe923bb](fe923bb9cd)) * **keycloak:** Support for custom OIDC Clients and ClientScopes. ([46412d1](46412d1a9e)) * **nextcloud:** Support templating of default quota and `*_retention_obligation` settings ([#93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/93)). ([23ef1d5](23ef1d557b)) * **nextcloud:** Update to 28.0.7 including latest apps for 28. ([671f57a](671f57a809)) * **nextcloud:** Update to 28.0.7 including the apps, fix admin panel warnings ([#94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/94)). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details. ([63f8394](63f8394e04)) * **openproject:** Bump to 14.3.0 and update Helm chart to 7.0.0. ([6b609ed](6b609edc4a)) * **openproject:** Support for adding token to enable OpenProject Premium. ([dfaf4be](dfaf4be640)) * **xwiki:** Add email address mapping to LDAP sync; Fix hostname `null` value in notification links. ([1067e72](1067e725b3)) * **xwiki:** Remove .rtf and .odt export options as they are currently non functional. ([b806d51](b806d51311)) * **xwiki:** Update to 16.4. ([db7f5d6](db7f5d60bd)) * **xwiki:** Update to 16.4.1. ([e54aaab](e54aaab072)) ### Features * **authentication:** Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage. ([b4570a9](b4570a9a87))
fix(docs): Update workflow.md.
2025-12-08 16:28:36 +01:00 · 2024-07-24 12:06:38 +00:00 · 2024-07-24 10:14:06 +00:00 · 2024-07-24 08:27:30 +00:00 · 2024-07-24 09:01:08 +02:00 · 2024-07-18 07:53:49 +02:00
64 changed files with 1488 additions and 482 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -5,8 +5,8 @@
 .yamllint
 # Ignore changes to sample environments
-helmfile/environments/dev/values.yaml.gotmpl
+helmfile/environments/dev/*.yaml.gotmpl
-helmfile/environments/prod/values.yaml.gotmpl
+helmfile/environments/prod/*.yaml.gotmpl
 # Ignore in CI generated files
 .kyverno/opendesk.yaml
@@ -14,3 +14,10 @@ helmfile/environments/prod/values.yaml.gotmpl
 # Ignore editor backup files
 *~
 # Ignore ./log directory and *.log files
 logs
 *.log
 # Ignore backup files, e.g. created by the script that eases the local chart development
 *.bak
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,7 +4,7 @@
 ---
 include:
  - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "v2.3.2"
+    ref: "v2.3.3"
    file:
      - "ci/common/automr.yml"
      - "ci/common/lint.yml"
@@ -15,12 +15,16 @@ include:
    ref: "main"
  - local: "/.gitlab/lint/lint-opendesk.yml"
    rules:
-      - if: "$JOB_OPENDESK_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event|web|trigger|api'"
+      - if: >
            $JOB_OPENDESK_LINTER_ENABLED == 'false' ||
            $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event|web|trigger|api'
        when: "never"
      - when: "always"
  - local: "/.gitlab/lint/lint-kyverno.yml"
    rules:
-      - if: "$JOB_KYVERNO_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event|web|trigger|api'"
+      - if: >
            $JOB_OPENDESK_LINTER_ENABLED == 'false' ||
            $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event|web|trigger|api'
        when: "never"
      - when: "always"
@@ -32,9 +36,11 @@ stages:
  - "env-cleanup"
  - "env"
  - "pre-services-deploy"
  - "migrations-pre"
  - "basic-services-deploy"
  - "component-deploy-stage-1"
  - "component-deploy-stage-2"
  - "migrations-post"
  - "lint"
  - "tests"
  - "env-stop"
@@ -73,6 +79,12 @@ variables:
    options:
      - "yes"
      - "no"
  DEPLOY_MIGRATIONS:
    description: "Deploy K8s job for migrations (pre & post)."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_SERVICES:
    description: "Enable Service deployment."
    value: "no"
@@ -204,6 +216,7 @@ env-cleanup:
        done
        kubectl delete pvc --all --namespace ${NAMESPACE};
        kubectl delete jobs --all --namespace ${NAMESPACE};
        kubectl delete configmaps --all --namespace ${NAMESPACE};
      else
        helmfile destroy --namespace ${NAMESPACE};
      fi
@@ -246,6 +259,30 @@ policies-deploy:
    COMPONENT: "services"
    ADDITIONAL_ARGS: "-l name=opendesk-otterize"
 migrations-pre:
  stage: "migrations-pre"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
      when: "on_success"
  variables:
    COMPONENT: "migrations-pre"
 migrations-post:
  stage: "migrations-post"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
      when: "on_success"
  variables:
    COMPONENT: "migrations-post"
 services-deploy:
  stage: "basic-services-deploy"
  extends: ".deploy-common"
--- a/.gitlab/common/common.yml
+++ b/.gitlab/common/common.yml
@@ -2,10 +2,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.4.3\
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.4.4\
-    @sha256:4630299fddf4248af1ad04528f0435d78f5b2694a154c99fe72b960260a7be61"
+    @sha256:4120fe717071876f4c9ff128f26019d089fda158a4fb1912911e09af2fd3875f"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.4\
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.5\
-    @sha256:386e84e2c85c33537479e4bb1e1fe744c9cce5e87bcb9a3a384dcdc1727c19c0"
+    @sha256:60870adb64b0503d4a6efd16cef4e074b91a4ca52b48811cfcea057bcccd07e4"
 .common:
  cache: {}
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,89 @@
 # [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24)
 ### Bug Fixes
 * **collabora:** Update to 24.04.5.1.1. ([8a2d951](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8a2d951c3b59c3f8ddb508ad8f95798774b7c4b0))
 * **collabora:** Update to 24.04.5.1.2. ([74d444e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/74d444e2d6065082be3ca90373a4d3b1836ea7a8))
 * **docs:** Update workflow.md. ([fd3df7d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fd3df7df6740d8e54b433c039d294843582e8947))
 * **docu:** Update documentation on integration uses cases ([#95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/95)). ([382af1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/382af1dfb966b5d10da4790212d6422a4a8c5618))
 * **helmfile:** Add S3 bucket for migrations. ([972020f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/972020f946d8238e65b1c1e2942682c797306e1a))
 * **helmfile:** Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details. ([26a7641](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/26a7641a5ab764196af6bbe26d97907de86f541e))
 * **jitsi:** Raise memory limit for jicofo and jvb as required by upstream product. ([fe923bb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fe923bb9cd58873957adb018c1410d33bb4d8f3a))
 * **keycloak:** Support for custom OIDC Clients and ClientScopes. ([46412d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/46412d1a9e4547dea8d0da3e322400ea148edf19))
 * **nextcloud:** Support templating of default quota and `*_retention_obligation` settings ([#93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/93)). ([23ef1d5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/23ef1d557bc0fdf6faac59f7a287f1ef1b302404))
 * **nextcloud:** Update to 28.0.7 including latest apps for 28. ([671f57a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/671f57a809eb4bb791698cda39f7711ac4833334))
 * **nextcloud:** Update to 28.0.7 including the apps, fix admin panel warnings ([#94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/94)). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details. ([63f8394](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63f8394e044670a89a642e933600b68ff740a102))
 * **openproject:** Bump to 14.3.0 and update Helm chart to 7.0.0. ([6b609ed](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6b609edc4a60601ca45372b4fc691f0ac7c9ed93))
 * **openproject:** Support for adding token to enable OpenProject Premium. ([dfaf4be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dfaf4be640209f5908815cceaf29db591212ddaa))
 * **xwiki:** Add email address mapping to LDAP sync; Fix hostname `null` value in notification links. ([1067e72](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1067e725b3dabce4ddfeb60b4cbe9e5b4d0db0e5))
 * **xwiki:** Remove .rtf and .odt export options as they are currently non functional. ([b806d51](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b806d51311c6d406ea3c93842601ddf5dbd13bb3))
 * **xwiki:** Update to 16.4. ([db7f5d6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/db7f5d60bdae437cebe58ab10f928a4a348e1ee3))
 * **xwiki:** Update to 16.4.1. ([e54aaab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e54aaab072f31713b5172e4bab9ba7e9ca9c5c26))
 ### Features
 * **authentication:** Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage. ([b4570a9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4570a9a873efa6c896fe543ab0ba3b94fd086c0))
 ## [0.8.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.0...v0.8.1) (2024-07-01)
 ### Bug Fixes
 * **collabora:** Bump image to 24.04.4.1.1. ([368fe13](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/368fe13ddb080f0c8f42cbd3612a29f818308708))
 * **collabora:** Bump image to 24.04.4.2.1. ([01767d3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01767d38061259853e4bd8b2eba31d3b04c4e672))
 * **docs:** Add Ports section to getting started. ([c07b25c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c07b25c4b9a702e214373fe08d95827286ebd866))
 * **docs:** Correction regarding the currently supported ingress controller. ([8514908](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/85149086ae70cb85a1718715747985a3da2a7b64))
 * **docs:** Update regarding the currently supported ingress controller. ([064a5ad](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/064a5ad246ea7217c2fb107787228d7aca9b5028))
 * **element:** Provide the internal cluster domain to `synapse-web`. ([a8692d5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a8692d5506dc65895a562423d8ddb7da9078fc3a))
 * **helmfile:** Add script to ease local development of platform charts. ([d8f3e05](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d8f3e05e584116f6196d43e0ea9bb8946ab2e5ab))
 * **helmfile:** Enable SMTP for XWiki and Element/Synapse; Streamline mail sender addresses within platform based on `<localpart>@<component>.<domain>` and allow configuration of `<localpart>`. ([01c5e6b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01c5e6b359dd5eb42c98e818da301871bea79264))
 * **helmfile:** Include all `.yaml.gotmpl` files for the envs in `environments.yaml`. ([e523434](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e52343440d81c0596177399058b4711cc0d5da67))
 * **helmfile:** Streamline `functional.yaml`. *Upgrade notice:* If you set a non default value for `.Values.portal.enableDeploymentInformation` please change it to `.Values.admin.portal.deploymentInformation.enabled` with this version. ([e89b16a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e89b16a747f95be7661b1fd4f5c90acce638542e))
 * **jitsi:** Update PatchJVB bitnami/kubectl image to 1.30.2. ([6ef3641](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6ef3641d82d88d6fed80652b239bc63115abbf2d))
 * **nubus:** Enable Keycloak's user account console. ([c03e4a5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c03e4a534090dde46363a7cfab718bb307e22621))
 * **nubus:** Remove doublette ingress annotations. ([890b36e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/890b36ecbb8c9311b5048d8d6d50ee5acf00ea61))
 * **open-xchange:** Fixing YAML indentation of updater resources ([0ce346b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0ce346b162feb0bc6fee7f18caee84917117abe1))
 * **openproject:** Bump image to 14.2.0. ([1ad35f1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1ad35f1e12e236607e3830da6d08010eb465b501))
 * **openproject:** Switch DBInit container image to Alpine based version to reduce footprint. ([c90f7c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c90f7c1742d415d5a787ff5832959e2974b77b83))
 * **openproject:** Update PostgreSQL image for DB init to 16.3. ([45e5699](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/45e569955d09c584490e6826651f7564567c1f9b))
 * **services:** Allow Postfix "relayHost" to be empty. ([7268f60](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7268f607a5839c6e940ce07fa15c1ffec9610d19))
 # [0.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.7.1...v0.8.0) (2024-06-10)
 ### Bug Fixes
 * **ci:** Allow CI to be triggered by API authorized personal access token. ([b95fd11](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b95fd1152a2122de0fbc2b31cacb8a1b1c5917b7))
 * **collabora:** Semi-disable update checker. ([d7a127f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d7a127fe269ddf0347adce692f138eb1a6359508))
 * **collabora:** Update to 24.04.3.1.1. ([5869316](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/58693162e6c2f72ba6254dd0168dea48539b7d43))
 * **docs:** Spell check and streamline. ([4d99bf3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4d99bf3bf085a6f8d4dbdef442fa969150dfff4d))
 * **element:** Bump container images (widgets, community artifacts). ([f856205](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f856205afce914ea62a9e309b9400714f4c4d040))
 * **element:** Bump to v1.11.67. ([a4ff89b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a4ff89b213afef9fd35dd6ab3c54bf0e8e8b20c9))
 * **element:** Update Synapse. ([9fa8ace](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9fa8ace80f9af5d5c96073fe836cf606956c4f43))
 * **helmfile:** Remove unused ox-provisioning hostname. ([e31a0a2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e31a0a258e274274e20aab41c4c757d891bff639))
 * **jitsi:** Update jitsi-keycloak-adapter image to Docker tag v20240314. ([6202bc4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6202bc4719e96c537c67a65a9419aa183edc6d55))
 * **nubus:** Change to new Univention upstream registry. ([d7fbc57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d7fbc572ca5b3ee4eca31bf50f4e00f257a72b83))
 * **nubus:** Disable UDM REST API routing by default and always disable UMC local login. ([e1e8a7f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e1e8a7f121c41c3f23db4541211d255dfb06591a))
 * **nubus:** Guardian version bump and refactoring. ([2f88752](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2f88752ae6a9df7ff3cb9a3c2d158589f7defb33))
 * **nubus:** Re-add selfservice-listener image configuration. ([af711b0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/af711b0edb05bb96fe2ad7e51d5862ed97043178))
 * **open-xchange:** Set Nubus LDAP attribute to render manager_name in address book. See https://forge.univention.org/bugzilla/show_bug.cgi?id=53741 for reference. ([4f92001](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4f92001d688416133fcfd3415afb5f4bbceb7356))
 * **openproject:** Bump library/postgres image to v16. ([742c293](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/742c293243e5c8165e065b5b53af7bac6647fad1))
 * **openproject:** Bump to 14.1.0, set default timezone on deployment to `Europe/Berlin` and raise default memory limit to 2Gi. ([6e49721](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6e4972107e8eac498ace98217488f4e07fabb6b1))
 * **openproject:** Update Helm chart to v5.1.4. ([75cd077](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/75cd077351c0a892afcd57c835b77206ea90da66))
 * **openproject:** Update to 14.1.1 and bump PostgreSQL 13 image for InitDB. ([bd2d7cf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bd2d7cf748f8cb6b1693056c4a5fc4a60b598acd))
 * **services:** Update `opendesk-home` to v1.0.2 to fix issue with Element `.well-known` ingress collision. ([b0eb28b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b0eb28bc3f577a46021444832e0cc132f6e4b0e1))
 * **univention-management-stack:** Add functional switch to disable deployment information. ([a31c5f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a31c5f59a68e90ba9e80350ebd5827e7b05d4ef5))
 ### Features
 * **element:** Enable Matrix federation via https. ([ecb566f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ecb566f61e9818ff204501730576af360e4e90d0))
 * **helmfile:** Add support for Ingress parameter configuration (proxy-body-size, proxy-read-timeout, proxy-send-timeout). ([dc39b94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dc39b94e8824683e54e0f2902e8b4bfe1c43442a))
 * **helmfile:** Create child helmfile for GitOps approach. ([a899699](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a899699e21b1d8da9886a93a2e74442799e23e96))
 * **nubus:** Cleanup Keycloak values. ([f3d8cf0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f3d8cf08efbba1b1dd5969821c3af7603202e67f))
 ## [0.7.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.7.0...v0.7.1) (2024-05-21)
--- a/README.md
+++ b/README.md
@@ -29,16 +29,16 @@ openDesk is a Kubernetes based, open-source and cloud-native digital workplace s
 openDesk currently features the following functional main components:
 | Function             | Functional Component        | Component<br/>Version                                                                 | Upstream Documentation                                                                                                                       |
-| -------------------- | --------------------------- | -------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                                 |
 | Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                                 |
 | File management      | Nextcloud                   | [28.0.5](https://nextcloud.com/de/changelog/#28-0-5)                                  | [Nextcloud 28](https://docs.nextcloud.com/)                                                                                                  |
 | Groupware            | OX App Suite                | [8.23](https://documentation.open-xchange.com/appsuite/releases/8.23/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
-| Knowledge management | XWiki                       | [15.10.8](https://www.xwiki.org/xwiki/bin/view/Blog/XWiki15108Released)                                        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                            |
+| Knowledge management | XWiki                       | [16.4.1](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.1/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                            |
 | Portal & IAM         | Nubus                       | Product Preview[^1]                                                                   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html)                                                    |
-| Project management   | OpenProject                 | [14.1.1](https://www.openproject.org/docs/release-notes/14-1-1/)                                               | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
+| Project management   | OpenProject                 | [14.3.0](https://www.openproject.org/docs/release-notes/14-3-0/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
 | Videoconferencing    | Jitsi                       | [2.0.9457](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9457) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
-| Weboffice            | Collabora                   | [24.04.3.1.1](https://www.collaboraoffice.com/collabora-online-24-04-release-notes/)                           | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
+| Weboffice            | Collabora                   | [24.04.5.2.1](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
--- a/cspell.json
+++ b/cspell.json
@@ -60,7 +60,20 @@
        "Nordeck",
        "Nubus",
        "Souveräne",
-        "Arbeitsplatz"
+        "Arbeitsplatz",
        "commandline",
        "helmfiles",
        "SMTPS",
        "IMAPS",
        "xwiki",
        "cryptpad",
        "clamav",
        "templating",
        "localpart",
        "Addressbooks",
        "filestore",
        "trashbin",
        "bootstrap"
    ],
    "ignoreWords": [],
    "import": []
--- a/dev/README.md
+++ b/dev/README.md
@@ -0,0 +1,36 @@
 <!--
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
 <h1>Tools for local development</h1>
 * [charts-local.py](#charts-localpy)
  * [Commandline parameter](#commandline-parameter)
    * [`--branch`](#--branch)
    * [`--revert`](#--revert)
 # charts-local.py
 This script helps you on cloning the platform development Helm charts and referencing them directly in the openDesk
 Helmfile deployment for comfortable local test and development. The charts will be cloned into a directory
 parallel created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
 The name of the chart directory is derived from the branch name you are working with in this `opendesk` repo.
 The script will create `.bak` copies of the helmfiles that have been touched.
 Run the script with `-h` to get information about the script's parameter on commandline.
 ## Commandline parameter
 ### `--branch`
 Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
 does not exist yet. Otherwise it will switch to defined branch.
 If parameter is omitted the current branch of the `opendesk` repo will be used.
 ### `--revert`
 Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
 scripts itself back to their original location.
--- a/dev/charts-local.py
+++ b/dev/charts-local.py
@@ -0,0 +1,170 @@
 #!/usr/bin/env python3
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 import os.path
 import logging
 import yaml
 import sys
 import shutil
 import re
 import configargparse
 from pathlib import Path
 from git import Repo
 p = configargparse.ArgParser()
 p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work with. Will be created by the script if it does not exist yet.')
 p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
 p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
 p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
 options = p.parse_args()
 script_path = os.path.dirname(os.path.realpath(__file__))
 # some static definitions
 log_path = script_path+'/../logs'
 charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml'
 base_repo_path = script_path+'/..'
 base_helmfile = base_repo_path+'/helmfile_generic.yaml'
 helmfile_backup_extension = '.bak'
 Path(log_path).mkdir(parents=True, exist_ok=True)
 logFormatter = logging.Formatter("%(asctime)s %(levelname)-5.5s %(message)s")
 rootLogger = logging.getLogger()
 rootLogger.setLevel(options.loglevel)
 fileHandler = logging.FileHandler("{0}/{1}.log".format(log_path, os.path.basename(__file__)))
 fileHandler.setFormatter(logFormatter)
 rootLogger.addHandler(fileHandler)
 consoleHandler = logging.StreamHandler()
 consoleHandler.setFormatter(logFormatter)
 rootLogger.addHandler(consoleHandler)
 logging.debug(f"Working with relative paths from script location: {script_path}")
 logging.debug(f"Log directory: {log_path}")
 logging.debug(f"charts.yaml  : {charts_yaml}")
 def create_or_switch_branch_base_repo():
    base_repo = Repo(path=base_repo_path)
    current_branch = base_repo.active_branch.name
    if not options.branch:
        branch = current_branch
        logging.debug(f"No branch specified on commandline, working with current branch: {current_branch}")
    else:
        branch = options.branch
        if branch in base_repo.branches:
            if branch != current_branch:
                logging.debug(f"Selected {branch} already exists, switching.")
                # ToDo: Graceful handle: "Please commit your changes or stash them before you switch branches."
                base_repo.git.switch(branch)
            else:
                logging.debug(f"Already on selected brach {branch}")
        else:
            logging.debug(f"Creating branch {branch} and switching")
            base_repo.git.branch(branch)
            base_repo.git.switch(branch)
    return branch
 def clone_charts_locally(branch, charts):
    charts_clone_path = script_path+'/../../'+branch.replace('/', '_')
    charts_dict = {}
    doublette_dict = {}
    if os.path.isdir(charts_clone_path):
        logging.warning(f"Path {charts_clone_path} already exists, will not clone any charts.")
    else:
        logging.debug(f"creating directory {charts_clone_path} to clone charts into")
        Path(charts_clone_path).mkdir(parents=True, exist_ok=True)
    for chart in charts['charts']:
        if 'opendesk/components/platform-development/charts' in charts['charts'][chart]['repository']:
            tag = charts['charts'][chart]['version']
            logging.debug(f"Working on {chart} / tag {tag}")
            repository = charts['charts'][chart]['repository']
            git_url = options.git_hostname+':'+repository
            chart_repo_path = charts_clone_path+'/'+charts['charts'][chart]['name']
            if git_url in doublette_dict:
                logging.debug(f"{chart} located at {git_url} is already checked out to {doublette_dict[git_url]}")
                charts_dict[chart] = doublette_dict[git_url]
            else:
                if os.path.isdir(chart_repo_path):
                    logging.debug(f"Already exists {chart_repo_path} leaving it unmodified")
                else:
                    logging.debug(f"Cloning into {chart_repo_path}")
                    Repo.clone_from(git_url, chart_repo_path)
                    chart_repo = Repo(path=chart_repo_path)
                    chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
                doublette_dict[git_url] = chart_repo_path
                charts_dict[chart] = chart_repo_path
    return charts_dict
 def grep_yaml(file):
    with open(file, 'r') as file:
        content = ''
        for line in file.readlines():
            if not ': {{' in line and not '- {{' in line:
                content += line
    return yaml.safe_load(content)
 def get_child_helmfiles():
    child_helmfiles = []
    root_helmfile = grep_yaml(base_helmfile)
    for entry in root_helmfile['helmfiles']:
        child_helmfiles.append(base_repo_path+'/'+entry['path'])
    return child_helmfiles
 def process_the_helmfiles(charts_dict, charts):
    chart_def_prefix = '    chart: "'
    child_helmfiles = get_child_helmfiles()
    for child_helmfile in child_helmfiles:
        child_helmfile_updated = False
        output = []
        with open(child_helmfile, 'r') as file:
            for line in file:
                if chart_def_prefix in line:
                    for chart_ident in charts_dict:
                        if '.Values.charts.'+chart_ident+'.name' in line:
                            logging.debug(f"found match with {chart_ident} in {line.strip()}")
                            line = chart_def_prefix+charts_dict[chart_ident]+'/charts/'+charts['charts'][chart_ident]['name']+'" # replaced by local-dev script'+"\n"
                            child_helmfile_updated = True
                            break
                output.append(line)
        if child_helmfile_updated:
            child_helmfile_backup = child_helmfile+helmfile_backup_extension
            if os.path.isfile(child_helmfile_backup):
                logging.debug("backup {child_helmfile_backup} already exists, will not create a new one.")
            else:
                logging.debug(f"creating backup {child_helmfile_backup}.")
                shutil.copy2(child_helmfile, child_helmfile_backup)
            logging.debug(f"Updating {child_helmfile}")
            with open(child_helmfile, 'w') as file:
                file.writelines(output)
 def revert_the_helmfiles():
    child_helmfiles = get_child_helmfiles()
    for child_helmfile in child_helmfiles:
        child_helmfile_backup = child_helmfile+helmfile_backup_extension
        if os.path.isfile(child_helmfile_backup):
            logging.debug(f"Reverting {child_helmfile} from backup {child_helmfile_backup}")
            os.rename(child_helmfile_backup, child_helmfile)
        else:
            logging.debug(f"Did not found the backup file {child_helmfile_backup}")
 ##
 ## Main program
 ##
 if options.revert:
    revert_the_helmfiles()
 else:
    branch = create_or_switch_branch_base_repo()
    with open(charts_yaml, 'r') as file:
        charts = yaml.safe_load(file)
    charts_dict = clone_charts_locally(branch, charts)
    process_the_helmfiles(charts_dict, charts)
--- a/dev/requirements.txt
+++ b/dev/requirements.txt
@@ -0,0 +1,6 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 configargparse
 pyyaml
 GitPython
--- a/docs/components.md
+++ b/docs/components.md
@@ -10,11 +10,11 @@ This section covers the internal system requirements as well as external service
 <!-- TOC -->
 * [Overview](#overview)
 * [Component integration](#component-integration)
-  * [Intercom Service (ICS)](#intercom-service-ics)
+  * [Intercom Service / Silent Login](#intercom-service--silent-login)
  * [Filepicker](#filepicker)
  * [Central Navigation](#central-navigation)
-  * [(Read \& write) Central contacts](#read--write-central-contacts)
+  * [Central Contacts](#central-contacts)
-  * [OpenProject file store](#openproject-file-store)
+  * [File Store (OpenProject -\> Nextcloud)](#file-store-openproject---nextcloud)
 * [Identity data flows](#identity-data-flows)
 * [Provisioning](#provisioning)
 <!-- TOC -->
@@ -56,58 +56,91 @@ Some use cases require inter component integration.
 ```mermaid
 flowchart TD
-  OXAppSuiteFrontend-->|SilentLogin, Filepicker, CentralNavigation|IntercomService
+  OX-AppSuite_Frontend-->|Silent Login, Filepicker, Central Navigation|Intercom_Service
-  Element-->|CentralNavigation|IntercomService
+  Element-->|Silent Login, Central Navigation|Intercom_Service
-  IntercomService-->|SilentLogin, TokenExchange|IdP
+  Intercom_Service-->|Silent Login, Token Exchange|IdP
-  IntercomService-->|Filepicker|Nextcloud
+  Intercom_Service-->|Filepicker|Nextcloud
-  IntercomService-->|CentralNavigation|Portal
+  Intercom_Service-->|Central Navigation|Portal
-  OXAppSuiteBackend-->|Filepicker|Nextcloud
+  OX-AppSuite_Backend-->|Filepicker|Nextcloud
  Nextcloud-->|Central Navigation|Portal
  OpenProject-->|Central Navigation|Portal
-  OpenProject-->|File store|Nextcloud
+  OpenProject-->|File Store|Nextcloud
  XWiki-->|Central Navigation|Portal
-  Nextcloud-->|CentralContacts|OXAppSuiteBackend
+  Nextcloud-->|Central Contacts|OX-AppSuite_Backend
-  OXAppSuiteFrontend-->|Filepicker|OXAppSuiteBackend
+  OX-AppSuite_Frontend-->|Filepicker|OX-AppSuite_Backend
 ```
-## Intercom Service (ICS)
+Most details can be found in the upstream documentation that is linked in the respective sections.
-The Univention Intercom Service's role is to enable cross-application integration based on browser interaction.
+## Intercom Service / Silent Login
-Handling authentication when the frontend of an application is using the API from another application is often a
+
 The Intercom Service's role is to enable cross-application integration based on the user's browser interaction as handling
 authentication when the frontend of an application has to call the API from another application is often a
 challenge.
 For more details on the ICS please refer to its own [doc](./components/intercom-service.md).
-To establish a session with the Intercom Service, the application that wants to use the ICS must initiate a silent
+To establish a session with the Intercom Service an application can use the silent login feature within an iframe.
 login.
-Currently only OX AppSuite is using the frontend-based integration, and therefore it is right now the only consumer of
+Currently only OX AppSuite and Element are using the frontend based integration.
-the ICS API.
+
 **Links**
 - [Intercom Service upstream documentation](https://docs.software-univention.de/intercom-service/latest/index.html).
 ## Filepicker
-The Nextcloud filepicker which is integrated into the OX AppSuite allows you to add attachments or links to files from
+The Nextcloud filepicker is integrated into the OX AppSuite supporting the following use cases against the respective openDesk instance's Nextcloud:
-and saving attachments to Nextcloud.
+- Attaching files from Nextcloud to emails.
 - Adding links of Nextcloud files to emails.
 - Saving attachments from emails into Nextcloud.
 - Attaching files from Nextcloud to calendar entries.
-The filepicker is using frontend and backend based integration.
+The filepicker is using frontend and backend based integration:
-Frontend-based integration means that OX AppSuite in the browser is communicating with ICS.
+- For frontend based integration the OX AppSuite frontend uses the Intercom Service.
-While using backend-based integration, OX AppSuite middleware is communicating with Nextcloud, which is especially used
+- Backend based integration is coming from OX AppSuite middleware. The middleware is communicating directly with Nextcloud,
-when adding a file to an email or storing a file into Nextcloud.
+which is used when adding a file to an email or storing a file into Nextcloud, to avoid passing these files through the user's browser.
 **Links**
 - [OX AppSuite Nextcloud Integration upstream documentation](https://gitlab.open-xchange.com/extensions/nextcloud-integration/-/tree/main/documentation).
 ## Central Navigation
-Central navigation is based on an API endpoint in the portal that provides the contents of the portal for a user to
+Central navigation is based on an API endpoint in the Nubus portal that returns a JSON containing the contents of the portal for
-allow components to render the menu showing all available SWP applications for the user.
+a given user. The response from the API endpoint is used in the openDesk applications to render the central navigation.
-## (Read & write) Central contacts
+The API can be called by
 - frontend services through the Intercom Service's `/navigation.json` endpoint or
 - backend services directly at the portal's `/univention/portal/navigation.json` endpoint.
-Open-Xchange App Suite is used to manage contacts within openDesk. There is an API in the AppSuite that is being used by
+The central navigation expects the API caller to present a shared secret for authentication and the username for whom the portal
-Nextcloud to lookup contacts as well as to create contacts. This is maybe done when a file is shared with a not yet
+contents should be returned for.
 available personal contact.
-## OpenProject file store
+A `curl` based request returning the navigation contents looks like this:
-By default, Nextcloud is a configured option for storing attachments in OpenProject.
+```
-The file store can be enabled on a per-project level in OpenProject's project admin section.
+curl 'https://portal.<DOMAIN>/univention/portal/navigation.json?base=https%3A//portal.<DOMAIN>&language=de-DE' -u "<USERNAME>:<SHARED_SECRET>"
 ```
 ## Central Contacts
 OX App Suite is managing contacts in openDesk. Therefore Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
 - create a new contact in the user's contacts folder when a file is shared with a yet unknown email address.
 - retrieve contacts from the user's contacts folder to support search-as-you-type when starting to share a file.
 **Links:**
 - Currently used [OX Contacts API (deprecated)](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Contacts).
 - New [OX Addressbooks API](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Addressbooks) the Central Contacts integration will switch to.
 ## File Store (OpenProject -> Nextcloud)
 While OpenProject allows you to attach files to work packages directly, it is often preferred that the files are
 stored within Nextcloud or to link an existing file from your openDesk Nextcloud to a work package.
 Therefore openDesk pre-configures the trust between the openDesk instance's OpenProject and Nextcloud during the `openproject-boostrap` deployment step. As prerequisite for that openDesk's Nextcloud contains the `integration_openproject` app.
 The file store still needs to be enabled on a per-project level in OpenProject's project admin section.
 **Links:**
 - [OpenProject's documentation on Nextcloud integration](https://www.openproject.org/docs/system-admin-guide/integrations/nextcloud/)
 - [OpenProject Integration Nextcloud app](https://apps.nextcloud.com/apps/integration_openproject)
 # Identity data flows
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -52,7 +52,7 @@ Below you will find some wrap-up notes when it comes to debugging openDesk by ad
 You can add a container by editing and updating an existing deployment, which is quite comfortable with tools like [Lens](https://k8slens.dev/).
- Select the container you want to make use of as debugging container, in the example below it's `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:1.0.0`.
+- Select the container you want to make use of as debugging container, in the example below it's `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
 - Ensure the `shareProcessNamespace` option is enabled for the Pod.
 - Reference the selected container within the `containers` array of the deployment.
 - In case you want to access another containers filesystem, ensure the user/group settings of both containers match.
@@ -64,7 +64,7 @@ The following example can e.g. be used to debug the `openDesk-Nextcloud-PHP` con
      shareProcessNamespace: true
      containers:
        - name: debugging
-          image: registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:1.0.0
+          image: registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest
          command: ["/bin/bash", "-c", "while true; do echo 'This is a temporary container for debugging'; sleep 5 ; done"]
          securityContext:
            capabilities:
--- a/docs/enhanced-configuration/matrix-federation.md
+++ b/docs/enhanced-configuration/matrix-federation.md
@@ -37,6 +37,7 @@ If not used it is also set to `opendesk.domain.tld`.
 The following setting can disable federation:
 ```yaml
 functional:
  externalServices:
    matrix:
      federation:
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -3,7 +3,7 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 -->
-<h1>Getting stated</h1>
+<h1>Getting started</h1>
 This documentation should enable you to create your own evaluation instance of openDesk on your Kubernetes cluster.
@@ -21,6 +21,9 @@ This documentation should enable you to create your own evaluation instance of o
    * [Container runtime](#container-runtime)
    * [Volumes](#volumes)
  * [Connectivity](#connectivity)
    * [Ports](#ports)
      * [Web based user interface](#web-based-user-interface)
      * [Mail clients](#mail-clients)
    * [Mail/SMTP configuration](#mailsmtp-configuration)
    * [TURN configuration](#turn-configuration)
    * [Certificate issuer](#certificate-issuer)
@@ -29,6 +32,7 @@ This documentation should enable you to create your own evaluation instance of o
  * [Install single app](#install-single-app)
  * [Install single release/chart](#install-single-releasechart)
 * [Access deployment](#access-deployment)
  * [Using from external repository](#using-from-external-repository)
 * [Uninstall](#uninstall)
 <!-- TOC -->
@@ -97,7 +101,7 @@ export DOMAIN=domain.tld
 All available apps and their default value can be found in `helmfile/environments/default/workplace.yaml`.
 | Component                   | Name                                | Default | Description                    |
-|-----------------------------|-------------------------------------|---------|--------------------------------|
+| --------------------------- | ----------------------------------- | ------- | ------------------------------ |
 | Certificates                | `certificates.enabled`              | `true`  | TLS certificates               |
 | ClamAV (Distributed)        | `clamavDistributed.enabled`         | `false` | Antivirus engine               |
 | ClamAV (Simple)             | `clamavSimple.enabled`              | `true`  | Antivirus engine               |
@@ -118,7 +122,7 @@ All available apps and their default value can be found in `helmfile/environment
 | PostgreSQL                  | `postgresql.enabled`                | `true`  | Database                       |
 | Redis                       | `redis.enabled`                     | `true`  | Cache Database                 |
 | Univention Management Stack | `univentionManagementStack.enabled` | `true`  | Identity Management & Portal   |
-| XWiki                       | `xwiki.enabled`                     | `true`  | Knowledgebase                  |
+| XWiki                       | `xwiki.enabled`                     | `true`  | Knowledge management           |
 Exemplary, Jitsi can be disabled like:
@@ -191,7 +195,8 @@ If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to pr
 ```yaml
 cluster:
  networking:
-    cidr: "127.0.0.0/8"
+    cidr:
      - "127.0.0.0/8"
 ```
 ### Ingress
@@ -204,6 +209,8 @@ ingress:
  ingressClassName: "cilium"
 ```
 **Note:** Please check the [requirements.md](./requirements.md) for the supported Ingress controllers.
 ### Container runtime
 Some apps require specific configuration for the container runtime. You can set your container runtime like `cri-o`,
@@ -237,9 +244,32 @@ persistence:
 ## Connectivity
 ### Ports
 **Note:** If you use `NodePort` for service exposure, you need to check your deployment for the actual ports.
 #### Web based user interface
 To use the openDesk functionality with its web based user interface you need to publicly expose the following ports:
 | Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
 | Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
 #### Mail clients
 To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need public exposure:
 | Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
 | Dovecot            | IMAPS                   |   993 |  TCP |
 |                    | POP3S                   |   995 |  TCP |
 | Postfix            | SMTP                    |    25 |  TCP |
 |                    | SMTPS                   |   587 |  TCP |
 ### Mail/SMTP configuration
-To use the full potential of the openDesk, you need to set up an SMTP relay which allows to send emails from
+To use the full potential of the openDesk, you need to set up an SMTP relay which allows sending emails from
 the whole subdomain.
 ```yaml
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -0,0 +1,39 @@
 <!--
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
 <h1>Upgrade migrations</h1>
 * [Disclaimer](#disclaimer)
 * [From v0.8.1](#from-v081)
  * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
  * [Updated customizable template attributes](#updated-customizable-template-attributes)
  * [`migrations` S3 bucket](#migrations-s3-bucket)
 # Disclaimer
 We do not offer support for upgrades before we reach openDesk 1.0.
 Though we try to ease the pain when it comes to 0.x upgrades. That is what this document is for.
 # From v0.8.1
 ## Updated `cluster.networking.cidr`
 - Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1), please update your setup accordingly if you explicitly set this value.
 - Reference:[cluster.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/cluster.yaml)
 ## Updated customizable template attributes
 - Action: Please ensure you update you custom deployment values according with the updated default value structure.
 - References:
  - `functional.` prefix for `authentication.*`, `externalServices.*`, `admin.*` and `filestore.*`, see [functional.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/functional.yaml).
  - `debug.` prefix for `cleanup.*`, see [debug.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/debug.yaml).
  - `monitoring.` prefix for `prometheus.*` and `graphana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
  - `smtp.` prefix for `localpartNoReply`, see [smtp.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/smtp.yaml).
 ## `migrations` S3 bucket
 - Action: For self managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
 - Reference: `objectstores.migrations` in [objectstores.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/objectstores.yaml)
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -22,7 +22,7 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)
 - K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
- Ingress controller (supported are nginx-ingress, HAProxy)
+- Ingress controller (Ingress NGINX)
 - [Helm](https://helm.sh/) >= v3.9.0
 - [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v0.157.0**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
@@ -34,9 +34,9 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)
 The following minimal requirements are thought for initial evaluation deployment:
 | Spec | Value                                                 |
-|------|------------------------------------------------------|
+| ---- | ----------------------------------------------------- |
-| CPU  | 8 Cores of x64 or x86 CPU (ARM is not supported yet) |
+| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
-| RAM  | 16 GB, recommended 32 GB                             |
+| RAM  | 32 GB, more recommended                               |
 | Disk | HDD or SSD, >10 GB                                    |
 # Kubernetes
@@ -53,10 +53,11 @@ The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/
 The deployment is intended to use only over HTTPS via a configured FQDN, therefor it is required to have a proper
 configured ingress controller deployed.
-**Maintained controllers:**
+**Supported controllers:**
 - [NGINX Ingress Controller](https://github.com/nginxinc/kubernetes-ingress)
 - [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx)
- [HAProxy Kubernetes Ingress Controller](https://github.com/haproxytech/kubernetes-ingress)
+
 Note: The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/).
 If you have feedback on that topic, please share it with us.
 # Volume provisioner
@@ -75,7 +76,9 @@ openDesk certificate management disabled.
 # External services
-Evaluation the openDesk deployment does not require any external service to start, but features may be limited.
+For development and evaluation of openDesk we bundle some service to start with. Be aware that for production
 deployments you need to make use of your own production grade services, see the
 [external-services.md](./external-services.md) for configuration details.
 | Group    | Type                | Version | Tested against        |
 | -------- | ------------------- | ------- | --------------------- |
--- a/docs/security-context.md
+++ b/docs/security-context.md
@@ -170,6 +170,7 @@ This list gives you an overview of templated security settings and if they compl
 | **nextcloud**/opendesk-nextcloud/apache2 | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/php | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
 | **open-xchange**/dovecot | :x: | no | n/a | yes | n/a | n/a | n/a | yes | no ["CHOWN","DAC_OVERRIDE","KILL","NET_BIND_SERVICE","SETGID","SETUID","SYS_CHROOT"] |
 | **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-imageconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
@@ -196,31 +197,17 @@ This list gives you an overview of templated security settings and if they compl
 | **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-guardian-authorization-api | :x: | no | no | no | yes | 1000 | 1000 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-guardian-management-api | :x: | no | no | no | yes | 1000 | 1000 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-guardian-management-ui | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/ldap-notifier | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
-| **univention-management-stack**/ums-keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-ldap-notifier | :x: | no | no | no | no | 0 | 0 | yes | yes |
+| **univention-management-stack**/ums/stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
-| **univention-management-stack**/ums-ldap-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/stack-gateway | :x: | no | no | no | yes | 1001 | 0 | yes | yes |
-| **univention-management-stack**/ums-notifications-api | :x: | no | no | no | no | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-open-policy-agent | :x: | no | no | no | yes | 1000 | 1000 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums-portal-frontend | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums-portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums-portal-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums-provisioning/dispatcher | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums-provisioning/events-and-consumer-api | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums-provisioning/udm-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums-selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums-stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
 | **univention-management-stack**/ums-stack-data-ums | :x: | no | no | no | no | 0 | 0 | yes | yes |
 | **univention-management-stack**/ums-stack-gateway | :x: | no | no | no | yes | 1001 | 1001 | yes | yes |
 | **univention-management-stack**/ums-store-dav | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums-udm-rest-api | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums-umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums-umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |
--- a/docs/workflow.md
+++ b/docs/workflow.md
@@ -22,8 +22,8 @@ SPDX-License-Identifier: Apache-2.0
      * [Branch workflows](#branch-workflows)
        * [`main`](#main)
        * [`develop`](#develop)
-        * [`docu`](#docu)
+        * [`docs`](#docs)
-        * [`mntn`](#mntn)
+        * [`fix`](#fix)
        * [`feat`](#feat)
      * [Branch names](#branch-names)
      * [Commit messages / Conventional Commits](#commit-messages--conventional-commits)
@@ -169,8 +169,8 @@ The basic facts for the flow are:
  - Developers can create sub-branches from their feature branch(es) as needed.
 - When a *feature* branch gets pushed a Merge Request in `Draft` state is automatically created.
 - We know three types of *feature* branches:
-  - `docu`: Doing just documentation changes
+  - `docs`: Doing just documentation changes
-  - `mntn`: Maintenance of the openDesk software components and minor configurational changes
+  - `fix`: Maintenance of the openDesk software components and minor configurational changes
  - `feat`: All changes that do not fall into the two categories above, especially
    - supplier deliverables and
    - configurational changes that have a significant impact on openDesk users or require migrations[^1]
@@ -185,21 +185,21 @@ gitGraph
    checkout "develop"
    commit id: "QA 'nightly develop'"
    commit id: "  "
-    branch "docu"
+    branch "docs"
-    checkout "docu"
+    checkout "docs"
    commit id: "Documentation commits" type: HIGHLIGHT
    checkout "develop"
-    merge "docu"
+    merge "docs"
    checkout "main"
    merge "develop" tag: "No release"
    checkout "develop"
    commit id: "   "
-    branch "mntn"
+    branch "fix"
-    checkout "mntn"
+    checkout "fix"
    commit id: "Maintenance commits" type: HIGHLIGHT
-    commit id: "QG 'mntn'" type: REVERSE
+    commit id: "QG 'fix'" type: REVERSE
    checkout "develop"
-    merge "mntn"
+    merge "fix"
    commit id: "QA 'release merge'" type: REVERSE
    checkout "main"
    merge "develop" tag: "Patch or minor release"
@@ -231,7 +231,7 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
 1. Linting
   - Blocking
     - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
-     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in the [development](./development.md) docu
+     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in [development.md](./development.md).
   - Non Blocking
     - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
     - Formal: Yaml
@@ -277,8 +277,8 @@ This section will explain the workflow for each branch (type) based on the Gitfl
 - `QA 'nightly main'`: Execute the SQG based on the most recent release. The upgrade test environment should be a long-standing environment that only gets built from scratch with the previous technical release when something breaks the environment.
 - Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release) which itself is based on the [Semantic Versioning (SemVer) notation](https://semver.org) to automatically create technical releases on the merge points.
-  - "No release": When a merge from `develop` includes only changes from `docu` branches the merge into `main` will only consist of `docs` or `chore` commits. No new release will be generated by that merge.
+  - "No release": When a merge from `develop` includes only changes from `docs` branches the merge into `main` will only consist of `docs` or `chore` commits. No new release will be generated by that merge.
-  - "Patch or minor release": When changes from `mntn` branches get merged these might contain `fix` or `feat` commits causing a new technical release to be built with an updated version on Patch or Minor level.
+  - "Patch or minor release": When changes from `fix` branches get merged these might contain `fix` or `feat` commits causing a new technical release to be built with an updated version on Patch or Minor level.
  - "Minor or major release": When changes from `feat` branches get merged these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on Minor or Major level.
 - "Manual Functional Release Activities": Technical releases are loosely coupled to functional releases. The additional activities for a functional release select an existing technical release as a basis to generate the artifacts required for a functional release, for example:
  - Conduct additional manual explorative and regression tests.
@@ -289,19 +289,19 @@ This section will explain the workflow for each branch (type) based on the Gitfl
 - `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based in this case on the head revision of the `develop` branch.
 - `QA 'release merge'`: The Merge Request for this merge has to be created manually by members of the platform development team. It should document:
  - That the SQG was successfully executed upon the to-be merged state - it could be done explicitly or based on a `QA 'nightly develop'`
-  - In case of `mntn` changes that usually how no test automation: Changes have been verified by a member of the platform development team.
+  - In case of `fix` changes that usually how no test automation: Changes have been verified by a member of the platform development team.
  - That the changes have been reviewed by at least two members of the platform development team giving their approval on the Merge Request.
- Merge points (from `docu`, `mntn`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.
+- Merge points (from `docs`, `fix`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.
-##### `docu`
+##### `docs`
-Branches of type `docu` only contain the commits themselves and have to adhere to the workflow basic fact that:
+Branches of type `docs` only contain the commits themselves and have to adhere to the workflow basic fact that:
 > All merges into `develop` or `main` require two approvals from the platform development team.
-##### `mntn`
+##### `fix`
-Besides the actual changes being committed in an `mntn` branch there is only the:
+Besides the actual changes being committed in an `fix` branch there is only the:
- `QG 'mntn'`: In addition to validating the actual change the owner of the branch has to ensure the successful execution of the SQG.
+- `QG 'fix'`: In addition to validating the actual change the owner of the branch has to ensure the successful execution of the SQG.
 ##### `feat`
@@ -318,47 +318,29 @@ This branch type requires the most activities on top of the actual development:
 #### Branch names
-Branches created from the `develop` branch have to adhere to the following notation: `<party[-developer]>/<type>/<component>/<details>`:
+Branches created from the `develop` branch have to adhere to the following notation: `<type>/<responsible_developer>/<details>`:
- `<party[-developer]>`: An identifier for the developing party optionally plus the name of the developer or team working on that branch. The following two-letter shorthand notations should be used for the owner:
+- `<type>`: From the list of branch types explained above:
-  - Suppliers
+  - `docs`
-    - `co`: Collabora
+  - `fix`
    - `cp`: CryptPad
    - `el`: Element
    - `nc`: Nextcloud
    - `nd`: Nordeck
    - `op`: OpenProject
    - `ox`: Open-Xchange
    - `uv`: Univention
    - `xw`: XWiki
  - Other
    - `pd`: (openDesk) Platform Development
    - `xx`: Other, not one of the parties mentioned before
 - `<type>`: Based on the branch types described in this document valid values for type are
  - `docu`
  - `mntn`
  - `feat`
-
+- `<responsible_developer>`: Something that makes you identifiable as owner of the branch, e.g. the first letter of your first name followed by your family name.
- `<component>`: Valid components are
+- `<details>`: A very short note about what is going to happen in the branch and ideally what component is affected from the following list of components:
  - `helmfile`
  - `ci`
  - `cross-functional`
  - `docs`
  - `collabora`
  - `cryptpad`
  - `element`
  - `jitsi`
  - `nextcloud`
  - `nubus`
  - `open-xchange`
  - `openproject`
  - `services`
  - `univention-management-stack`
  - `xwiki`
- `<details>`: A very short note about what is going to happen in the branch
+Example: `feat/tmueller/bump_nextcloud_to_29.0.0`.
 Example: `pd-tom/fix/open-xchange/bump_to_8.76`.
 **Note**: The above naming convention is not enforced yet, but please ensure you make use of it.
@@ -367,7 +349,7 @@ Example: `pd-tom/fix/open-xchange/bump_to_8.76`.
 Commit messages must adhere to the [Conventional Commit standard](https://www.conventionalcommits.org/en/v1.0.0/#summary). Commits that do not adhere to the standard get rejected by either [Gitlab push rules](https://docs.gitlab.com/ee/user/project/repository/push_rules.html) or the CI.
 ```text
-<type>(<scope>): [path/to/issue#1] <short summary>
+<type>(<scope>): [path/to/issue#1] <short summary>.
  │       │              │                │
  │       │              |                └─> Summary in present tense, sentence case, with no period at the end
  │       │              |
@@ -378,7 +360,7 @@ Commit messages must adhere to the [Conventional Commit standard](https://www.co
  └─> Commit Type: chore, ci, docs, feat, fix
 ```
-Example: `fix(univention-management-stack): Update standard session timeout of openDesk realm in Keycloak`
+Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`
 **Beware**: The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.
--- a/helmfile.yaml
+++ b/helmfile.yaml
@@ -5,13 +5,13 @@
 environments:
  dev:
    values:
-      - "helmfile/environments/dev/values.yaml.gotmpl"
+      - "helmfile/environments/dev/*.yaml.gotmpl"
  test:
    values:
-      - "helmfile/environments/test/values.yaml.gotmpl"
+      - "helmfile/environments/test/*.yaml.gotmpl"
  prod:
    values:
-      - "helmfile/environments/prod/values.yaml.gotmpl"
+      - "helmfile/environments/prod/*.yaml.gotmpl"
 ---
 # yamllint disable
 helmfiles:
--- a/helmfile/apps/collabora/values.yaml.gotmpl
+++ b/helmfile/apps/collabora/values.yaml.gotmpl
@@ -7,7 +7,7 @@ autoscaling:
  enabled: false
 collabora:
-  extra_params: "--o:ssl.enable=false --o:ssl.termination=true"
+  extra_params: "--o:ssl.enable=false --o:ssl.termination=true --o:fetch_update_check=0"
  username: "collabora-internal-admin"
  password: {{ .Values.secrets.collabora.adminPassword | quote }}
  aliasgroups:
@@ -17,11 +17,11 @@ fullnameOverride: "collabora"
 grafana:
  dashboards:
-    enabled: {{ .Values.grafana.dashboards.enabled }}
+    enabled: {{ .Values.monitoring.grafana.dashboards.enabled }}
    labels:
-      {{ .Values.grafana.dashboards.labels | toYaml | nindent 6 }}
+      {{ .Values.monitoring.grafana.dashboards.labels | toYaml | nindent 6 }}
    annotations:
-      {{ .Values.grafana.dashboards.annotations | toYaml | nindent 6 }}
+      {{ .Values.monitoring.grafana.dashboards.annotations | toYaml | nindent 6 }}
 image:
  repository: "{{ .Values.global.imageRegistry | default .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
@@ -88,13 +88,13 @@ podSecurityContext:
 prometheus:
  servicemonitor:
-    enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
+    enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
    labels:
-      {{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
+      {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
  rules:
-    enabled: {{ .Values.prometheus.prometheusRules.enabled }}
+    enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
    additionalLabels:
-      {{ .Values.prometheus.prometheusRules.labels | toYaml | nindent 6 }}
+      {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 6 }}
 replicaCount: {{ .Values.replicas.collabora }}
--- a/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
@@ -2,8 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 configuration:
  username: "meetings-bot"
--- a/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
@@ -2,8 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 configuration:
  username: "uvs"
--- a/helmfile/apps/element/values-synapse-web.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-web.yaml.gotmpl
@@ -21,6 +21,7 @@ containerSecurityContext:
 global:
  domain: {{ .Values.global.domain | quote }}
  clusterDomain: {{ .Values.cluster.networking.domain | quote }}
  hosts:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -41,10 +41,20 @@ configuration:
        url: null
        sender_localpart: intercom-service
    smtp:
      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}"
      host: {{ .Values.smtp.host | quote }}
      port: {{ .Values.smtp.port }}
      username: {{ .Values.smtp.username | quote }}
      password: {{ .Values.smtp.password | quote }}
    oidc:
      clientId: "opendesk-matrix"
      clientSecret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
      issuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
      scopes:
        - "openid"
        - "opendesk-matrix-scope"
    turn:
      sharedSecret: {{ .Values.turn.credentials | quote }}
@@ -84,7 +94,7 @@ containerSecurityContext:
    {{ .Values.seLinuxOptions.synapse | toYaml | nindent 4 }}
 federation:
-  enabled: {{ .Values.externalServices.matrix.federation.enabled }}
+  enabled: {{ .Values.functional.externalServices.matrix.federation.enabled }}
  ingress:
    host: "{{ .Values.global.hosts.synapseFederation }}.{{ .Values.global.domain }}"
    enabled: {{ .Values.ingress.enabled }}
--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -27,7 +27,7 @@ containerSecurityContext:
    {{ .Values.seLinuxOptions.jitsiKeycloakAdapter | toYaml | nindent 4 }}
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
--- a/helmfile/apps/migrations-post/helmfile-child.yaml
+++ b/helmfile/apps/migrations-post/helmfile-child.yaml
@@ -0,0 +1,31 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
  # openDesk Migrations
  # Source:
  - name: "openproject-migrations-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.migrations.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/\
      {{ .Values.charts.migrations.repository }}"
 releases:
  - name: "opendesk-migrations-post"
    chart: "openproject-migrations-repo/{{ .Values.charts.migrations.name }}"
    version: "{{ .Values.charts.migrations.version }}"
    wait: true
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
    installed: {{ .Values.migrations.enabled }}
    timeout: 900
 commonLabels:
  deploy-stage: "component-0"
  component: "opendesk-migrations"
 ...
--- a/helmfile/apps/migrations-post/helmfile.yaml
+++ b/helmfile/apps/migrations-post/helmfile.yaml
@@ -0,0 +1,11 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/migrations-post/values.yaml.gotmpl
+++ b/helmfile/apps/migrations-post/values.yaml.gotmpl
@@ -0,0 +1,8 @@
 {{/*
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 migrations:
  stage: "POST"
 ...
--- a/helmfile/apps/migrations-pre/helmfile-child.yaml
+++ b/helmfile/apps/migrations-pre/helmfile-child.yaml
@@ -0,0 +1,31 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
  # openDesk Migrations
  # Source:
  - name: "openproject-migrations-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.migrations.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/\
      {{ .Values.charts.migrations.repository }}"
 releases:
  - name: "opendesk-migrations-pre"
    chart: "openproject-migrations-repo/{{ .Values.charts.migrations.name }}"
    version: "{{ .Values.charts.migrations.version }}"
    wait: true
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
    installed: {{ .Values.migrations.enabled }}
    timeout: 900
 commonLabels:
  deploy-stage: "component-0"
  component: "opendesk-migrations"
 ...
--- a/helmfile/apps/migrations-pre/helmfile.yaml
+++ b/helmfile/apps/migrations-pre/helmfile.yaml
@@ -0,0 +1,11 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml"
    values:
      - {{ toYaml .Values | nindent 8 }}
 ...
--- a/helmfile/apps/migrations-pre/values.yaml.gotmpl
+++ b/helmfile/apps/migrations-pre/values.yaml.gotmpl
@@ -0,0 +1,8 @@
 {{/*
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 migrations:
  stage: "PRE"
 ...
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -14,7 +14,7 @@ additionalAnnotations:
  intents.otterize.com/service-name: "opendesk-nextcloud-php"
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
 configuration:
  administrator:
@@ -35,6 +35,9 @@ configuration:
        value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
    host: {{ .Values.cache.nextcloud.host | quote }}
    port: {{ .Values.cache.nextcloud.port | quote }}
  collabora:
    # internalWopiUrl: ""
    wopiAllowlist: {{ join " " .Values.cluster.networking.cidr | quote }}
  database:
    host: {{ .Values.databases.nextcloud.host | quote }}
    port: {{ .Values.databases.nextcloud.port | quote }}
@@ -78,6 +81,14 @@ configuration:
        value: {{ .Values.smtp.password | quote }}
    host: {{ .Values.smtp.host | quote }}
    port: {{ .Values.smtp.port | quote }}
    fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
    mailDomain: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
  quota:
    default: "{{ .Values.functional.filestore.quota.default }} GB"
    retentionObligation:
      trashbin: {{ .Values.functional.filestore.nextcloud.retentionObligation.trashbin | quote }}
      versions: {{ .Values.functional.filestore.nextcloud.retentionObligation.versions | quote }}
  serverinfo:
    token: {{ .Values.secrets.nextcloud.metricsToken | quote }}
@@ -98,11 +109,11 @@ containerSecurityContext:
    {{ .Values.seLinuxOptions.nextcloudManagement | toYaml | nindent 4 }}
 debug:
-  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"1"{{ end }}
+  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
 image:
  registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudManagement.registry | quote }}
-  repository: "{{ .Values.images.nextcloudManagement.repository }}"
+  repository: {{ .Values.images.nextcloudManagement.repository | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  tag: {{ .Values.images.nextcloudManagement.tag | quote }}
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -34,13 +34,13 @@ exporter:
    tag: {{ .Values.images.nextcloudExporter.tag | quote }}
  prometheus:
    serviceMonitor:
-      enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
+      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
      labels:
-        {{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
+        {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
    prometheusRule:
-      enabled: {{ .Values.prometheus.prometheusRules.enabled }}
+      enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
      additionalLabels:
-        {{ .Values.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
+        {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
  replicaCount: {{ .Values.replicas.nextcloudExporter }}
  resources:
    {{ .Values.resources.nextcloudExporter | toYaml | nindent 4 }}
@@ -66,6 +66,7 @@ php:
          value: "nextcloud_user"
        password:
          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
    trustedProxies: {{ join " " .Values.cluster.networking.cidr | quote }}
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
@@ -84,7 +85,7 @@ php:
  cron:
    successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
  debug:
-    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"1"{{ end }}
+    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
  image:
    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudPHP.registry | quote }}
    repository: "{{ .Values.images.nextcloudPHP.repository }}"
@@ -92,13 +93,13 @@ php:
    tag: {{ .Values.images.nextcloudPHP.tag | quote }}
  prometheus:
    serviceMonitor:
-      enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
+      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
      labels:
-        {{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
+        {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
    prometheusRule:
-      enabled: {{ .Values.prometheus.prometheusRules.enabled }}
+      enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
      additionalLabels:
-        {{ .Values.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
+        {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
  replicaCount: {{ .Values.replicas.nextcloudPHP }}
  resources:
    {{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
@@ -107,6 +108,7 @@ apache2:
  configuration:
    php:
      host: "opendesk-nextcloud-php.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}"
    trustedProxies: {{ join " " .Values.cluster.networking.cidr | quote }}
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
@@ -143,4 +145,5 @@ apache2:
  replicaCount: {{ .Values.replicas.nextcloudApache2 }}
  resources:
    {{ .Values.resources.nextcloudApache2 | toYaml | nindent 4 }}
 ...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -15,7 +15,7 @@ imagePullSecrets:
 {{- end }}
 dovecot:
-  mailDomain: {{ .Values.global.domain | quote }}
+  mailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  password: {{ .Values.secrets.dovecot.doveadm | quote }}
  ldap:
    enabled: true
@@ -31,15 +31,13 @@ dovecot:
    introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
    introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
    usernameAttribute: "opendesk_username"
-  loginTrustedNetworks: {{ .Values.cluster.networking.cidr | quote }}
+  loginTrustedNetworks: {{ join " " .Values.cluster.networking.cidr | quote }}
  submission:
    enabled: true
    ssl: "no"
    host: "postfix:25"
 certificate:
  secretName: {{ .Values.ingress.tls.secretName | quote }}
--- a/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl
@@ -4,8 +4,8 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 image:
  registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeBootstrap.registry | quote }}
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -409,7 +409,7 @@ appsuite:
      {{ .Values.resources.openxchangeCoreUIMiddleware | toYaml | nindent 6 }}
    updater:
      resources:
-        {{ .Values.resources.openxchangeCoreUIMiddlewareUpdater | toYaml | nindent 6 }}
+        {{ .Values.resources.openxchangeCoreUIMiddlewareUpdater | toYaml | nindent 8 }}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
--- a/helmfile/apps/openproject-bootstrap/values.yaml.gotmpl
+++ b/helmfile/apps/openproject-bootstrap/values.yaml.gotmpl
@@ -11,8 +11,8 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 config:
  openproject:
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -33,9 +33,6 @@ environment:
  OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"
  OPENPROJECT_PER__PAGE__OPTIONS: "20, 50, 100, 200"
  OPENPROJECT_EMAIL__DELIVERY__METHOD: "smtp"
  OPENPROJECT_SMTP__AUTHENTICATION: "plain"
  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
  OPENPROJECT_DEFAULT__COMMENT__SORT__ORDER: "desc"
  # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
  OPENPROJECT_SEED_LDAP_OPENDESK_HOST: {{ .Values.ldap.host | quote }}
@@ -61,16 +58,22 @@ environment:
  OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
  OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-  OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.domain | quote }}
+  OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  OPENPROJECT_SMTP__USER__NAME: {{ .Values.smtp.username | quote }}
  OPENPROJECT_SMTP__PASSWORD: {{ .Values.smtp.password | quote }}
  OPENPROJECT_SMTP__PORT: {{ .Values.smtp.port | quote }}
  OPENPROJECT_SMTP__SSL: "false" # (default=false)
  OPENPROJECT_SMTP__ADDRESS: {{ .Values.smtp.host | quote }}
-  OPENPROJECT_MAIL__FROM: "do-not-reply@{{ .Values.global.domain }}"
+  OPENPROJECT_SMTP__AUTHENTICATION: "plain"
  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
  {{- if .Values.enterprise.openproject.token }}
  OPENPROJECT_ENTERPRISE__TOKEN: {{ .Values.enterprise.openproject.token | quote }}
  {{- end }}
 image:
  registry: {{ .Values.global.imageRegistry | default .Values.images.openproject.registry | quote }}
@@ -129,7 +132,7 @@ openproject:
    host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
    identifier: "opendesk-openproject"
    provider: "keycloak"
-    scope: "[openid,opendesk]"
+    scope: "[openid,opendesk-openproject-scope]"
    secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
    tokenEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
    userinfoEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/userinfo"
--- a/helmfile/apps/services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/services/values-certificates.yaml.gotmpl
@@ -12,7 +12,7 @@ issuerRef:
  name: {{ .Values.certificate.issuerRef.name | quote }}
 cleanup:
-  keepRessourceOnDelete: {{ .Values.cleanup.keepRessourceOnDelete }}
+  keepRessourceOnDelete: {{ .Values.debug.cleanup.keepRessourceOnDelete }}
 wildcard: {{ .Values.certificate.wildcard }}
 ...
--- a/helmfile/apps/services/values-mariadb.yaml.gotmpl
+++ b/helmfile/apps/services/values-mariadb.yaml.gotmpl
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/services/values-minio.yaml.gotmpl
+++ b/helmfile/apps/services/values-minio.yaml.gotmpl
@@ -67,9 +67,9 @@ mode: {{ if gt .Values.replicas.minio 1 }}"distributed"{{ else }}"standalone"{{
 metrics:
  serviceMonitor:
-    enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
+    enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
    additionalLabels:
-      {{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
+      {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
 networkPolicy:
  enabled: false
@@ -89,16 +89,43 @@ provisioning:
  extraCommands:
    - "mc anonymous set download provisioning/ums/portal-assets"
  buckets:
    - name: {{ .Values.objectstores.migrations.bucket | quote }}
      versioning: false
      withLock: false
    - name: {{ .Values.objectstores.nextcloud.bucket | quote }}
      versioning: true
      withLock: false
    - name: {{ .Values.objectstores.openproject.bucket | quote }}
      versioning: true
      withLock: false
    - name: {{ .Values.objectstores.univentionManagementStack.bucket | quote }}
      versioning: false
      withLock: false
    - name: {{ .Values.objectstores.nextcloud.bucket | quote }}
      versioning: true
      withLock: false
  policies:
    - name: "migrations-bucket-policy"
      statements:
        - resources:
            - "arn:aws:s3:::migrations"
          effect: "Allow"
          actions:
            - "s3:*"
        - resources:
            - "arn:aws:s3:::migrations/*"
          effect: "Allow"
          actions:
            - "s3:*"
    - name: "nextcloud-bucket-policy"
      statements:
        - resources:
            - "arn:aws:s3:::nextcloud"
          effect: "Allow"
          actions:
            - "s3:*"
        - resources:
            - "arn:aws:s3:::nextcloud/*"
          effect: "Allow"
          actions:
            - "s3:*"
    - name: "openproject-bucket-policy"
      statements:
        - resources:
@@ -123,19 +150,19 @@ provisioning:
          effect: "Allow"
          actions:
            - "s3:*"
    - name: "nextcloud-bucket-policy"
      statements:
        - resources:
            - "arn:aws:s3:::nextcloud"
          effect: "Allow"
          actions:
            - "s3:*"
        - resources:
            - "arn:aws:s3:::nextcloud/*"
          effect: "Allow"
          actions:
            - "s3:*"
  users:
    - username: {{ .Values.objectstores.migrations.username | quote }}
      password: {{ .Values.secrets.minio.migrationsUser | quote }}
      disabled: false
      policies:
        - "migrations-bucket-policy"
      setPolicies: true
    - username: {{ .Values.objectstores.nextcloud.username | quote }}
      password: {{ .Values.secrets.minio.nextcloudUser | quote }}
      disabled: false
      policies:
        - "nextcloud-bucket-policy"
      setPolicies: true
    - username: {{ .Values.objectstores.openproject.username | quote }}
      password: {{ .Values.secrets.minio.openprojectUser | quote }}
      disabled: false
@@ -148,12 +175,6 @@ provisioning:
      policies:
        - "ums-bucket-policy"
      setPolicies: true
    - username: {{ .Values.objectstores.nextcloud.username | quote }}
      password: {{ .Values.secrets.minio.nextcloudUser | quote }}
      disabled: false
      policies:
        - "nextcloud-bucket-policy"
      setPolicies: true
  resources:
    {{ .Values.resources.minio | toYaml | nindent 4 }}
--- a/helmfile/apps/services/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services/values-postfix.yaml.gotmpl
@@ -41,7 +41,7 @@ podSecurityContext:
 postfix:
  amavisHost: ""
  amavisPortIn: ""
-  domain: {{ .Values.global.mailDomain | default .Values.global.domain }}
+  domain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  hostname: "postfix"
  inetProtocols: "ipv4"
  milterDefaultAction: "accept"
@@ -50,8 +50,8 @@ postfix:
      content:
        - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
  rspamdHost: ""
-  relayHost: {{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}
+  relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
-  relayNets: {{ .Values.cluster.networking.cidr | quote}}
+  relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
  smtpSASLAuthEnable: "yes"
  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
  smtpUseTLS: "yes"
@@ -67,7 +67,7 @@ postfix:
  {{- else if .Values.clamavSimple.enabled }}
  smtpdMilters: "inet:clamav-simple:7357"
  {{- end }}
-  virtualMailboxDomains: {{ .Values.global.mailDomain | default .Values.global.domain }}
+  virtualMailboxDomains: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  virtualTransport: "lmtps:dovecot:24"
 replicaCount: {{ .Values.replicas.postfix }}
--- a/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -17,10 +17,15 @@ image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 config:
  custom:
    clientScopes:
      {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
    clients:
      {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
  keycloak:
    adminUser: "kcadmin"
    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
@@ -29,14 +34,20 @@ config:
      enabled: true
      internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
  twoFactorSettings:
-    additionalGroups: {{ .Values.authentication.twoFactor.groups }}
+    additionalGroups: {{ .Values.functional.authentication.twoFactor.groups }}
-  custom:
+  opendesk:
    # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
    # to LDAP group membership to ensure a user cannot access an application without the required
    # group membership.
    # ToDo:
    # - Jitsi does currently not care if it gets scopes/claims as long as the user is authenticated.
    clientScopes:
      - name: "read_contacts"
        protocol: "openid-connect"
      - name: "write_contacts"
        protocol: "openid-connect"
-      - name: "opendesk"
+      - name: "opendesk-openproject-scope"
        description: "Scope for the claims required by openDesk's OpenProject instance."
        protocol: "openid-connect"
        protocolMappers:
          - name: "opendesk_useruuid"
@@ -61,6 +72,306 @@ config:
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
          - name: "opendeskProjectmanagementAdmin"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "opendeskProjectmanagementAdmin"
              id.token.claim: true
              access.token.claim: true
              claim.name: "openproject_admin"
              jsonType.label: "String"
          - name: "email"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              introspection.token.claim: true
              userinfo.token.claim: true
              user.attribute: "email"
              id.token.claim: true
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
          - name: "given name"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              introspection.token.claim: true
              userinfo.token.claim: true
              user.attribute: "firstName"
              id.token.claim: true
              access.token.claim: true
              claim.name: "given_name"
              jsonType.label: "String"
          - name: "family name"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              introspection.token.claim: true
              userinfo.token.claim: true
              user.attribute: "lastName"
              id.token.claim: true
              access.token.claim: true
              claim.name: "family_name"
              jsonType.label: "String"
      - name: "opendesk-jitsi-scope"
        description: "Scope for the claims required by openDesk's Jitsi instance."
        protocol: "openid-connect"
        protocolMappers:
          - name: "opendesk_useruuid"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "entryUUID"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_useruuid"
              jsonType.label: "String"
          - name: "opendesk_username"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "uid"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
          - name: "full name"
            protocol: "openid-connect"
            protocolMapper: "oidc-full-name-mapper"
            consentRequired: false
            config:
              id.token.claim: true
              introspection.token.claim: true
              access.token.claim: true
              userinfo.token.claim: true
          - name: "email"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              introspection.token.claim: true
              userinfo.token.claim: true
              user.attribute: "email"
              id.token.claim: true
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
      - name: "opendesk-nextcloud-scope"
        description: "Scope for the claims required by openDesk's Nextcloud instance."
        protocol: "openid-connect"
        protocolMappers:
          - name: "opendesk_useruuid"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "entryUUID"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_useruuid"
              jsonType.label: "String"
          - name: "opendesk_username"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "uid"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
          - name: "email"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              introspection.token.claim: true
              userinfo.token.claim: true
              user.attribute: "email"
              id.token.claim: true
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
          - name: "context"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "oxContextIDNum"
              id.token.claim: true
              access.token.claim: true
              claim.name: "context"
              jsonType.label: "String"
      - name: "opendesk-matrix-scope"
        description: "Scope for the claims required by openDesk's Matrix instance."
        protocol: "openid-connect"
        protocolMappers:
          - name: "opendesk_useruuid"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "entryUUID"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_useruuid"
              jsonType.label: "String"
          - name: "opendesk_username"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "uid"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
          - name: "full name"
            protocol: "openid-connect"
            protocolMapper: "oidc-full-name-mapper"
            consentRequired: false
            config:
              id.token.claim: true
              introspection.token.claim: true
              access.token.claim: true
              userinfo.token.claim: true
          - name: "email"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              introspection.token.claim: true
              userinfo.token.claim: true
              user.attribute: "email"
              id.token.claim: true
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
      - name: "opendesk-xwiki-scope"
        description: "Scope for the claims required by openDesk's XWiki instance."
        protocol: "openid-connect"
        protocolMappers:
          - name: "opendesk_useruuid"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "entryUUID"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_useruuid"
              jsonType.label: "String"
          - name: "opendesk_username"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "uid"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
          - name: "full name"
            protocol: "openid-connect"
            protocolMapper: "oidc-full-name-mapper"
            consentRequired: false
            config:
              id.token.claim: true
              introspection.token.claim: true
              access.token.claim: true
              userinfo.token.claim: true
          - name: "email"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              introspection.token.claim: true
              userinfo.token.claim: true
              user.attribute: "email"
              id.token.claim: true
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
      - name: "opendesk-dovecot-scope"
        description: "Scope for the claims required by openDesk's Dovecot instance."
        protocol: "openid-connect"
        protocolMappers:
          - name: "opendesk_useruuid"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "entryUUID"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_useruuid"
              jsonType.label: "String"
          - name: "opendesk_username"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "uid"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
      - name: "opendesk-oxappsuite-scope"
        description: "Scope for the claims required by openDesk's OX Appuite instance."
        protocol: "openid-connect"
        protocolMappers:
          - name: "context"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "oxContextIDNum"
              id.token.claim: true
              access.token.claim: true
              claim.name: "context"
              jsonType.label: "String"
          - name: "opendesk_useruuid"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "entryUUID"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_useruuid"
              jsonType.label: "String"
          - name: "opendesk_username"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "uid"
              id.token.claim: true
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
    clients:
      - name: "opendesk-dovecot"
        clientId: "opendesk-dovecot"
@@ -74,7 +385,7 @@ config:
        attributes:
          backchannel.logout.session.required: false
        defaultClientScopes:
-          - "opendesk"
+          - "opendesk-dovecot-scope"
      - name: "opendesk-intercom"
        clientId: "opendesk-intercom"
        protocol: "openid-connect"
@@ -128,7 +439,6 @@ config:
              claim.name: "phoenixusername"
              jsonType.label: "String"
        defaultClientScopes:
          - "opendesk"
          - "offline_access"
      - name: "opendesk-jitsi"
        clientId: "opendesk-jitsi"
@@ -142,8 +452,7 @@ config:
        fullScopeAllowed: true
        authorizationServicesEnabled: false
        defaultClientScopes:
-          - "opendesk"
+          - "opendesk-jitsi-scope"
          - "profile"
      - name: "opendesk-matrix"
        clientId: "opendesk-matrix"
        protocol: "openid-connect"
@@ -165,12 +474,9 @@ config:
          backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
-          - "opendesk"
+          - "opendesk-matrix-scope"
-        optionalClientScopes:
+      # The following is a temporary OIDC client for matrix, as the OIDC logout still uses "matrix" as client ID.
-          - "email"
+      # Unless that is solved and also is able to use "opendesk-matrix" we keep that dummy client that
          - "profile"
        # This is a temporary OIDC client for matrix, as the OIDC logout still uses "matrix" as client ID. Unless that
        # is solved and also is able to use "opendesk-matrix" we keep that dummy client that
      - name: "matrix"
        clientId: "matrix"
        protocol: "openid-connect"
@@ -183,6 +489,8 @@ config:
        authorizationServicesEnabled: false
        attributes:
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
        defaultClientScopes: []
        optionalClientScopes: []
      - name: "opendesk-nextcloud"
        clientId: "opendesk-nextcloud"
        protocol: "openid-connect"
@@ -199,21 +507,8 @@ config:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/index.php/apps/user_oidc/backchannel-logout/opendesk"
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
        protocolMappers:
          - name: "context"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "oxContextIDNum"
              id.token.claim: true
              access.token.claim: true
              claim.name: "context"
              jsonType.label: "String"
        defaultClientScopes:
-          - "opendesk"
+          - "opendesk-nextcloud-scope"
          - "email"
          - "read_contacts"
          - "write_contacts"
      - name: "opendesk-openproject"
@@ -233,22 +528,8 @@ config:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
        protocolMappers:
          - name: "opendeskProjectmanagementAdmin"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "opendeskProjectmanagementAdmin"
              id.token.claim: true
              access.token.claim: true
              claim.name: "openproject_admin"
              jsonType.label: "String"
        defaultClientScopes:
-          - "opendesk"
+          - "opendesk-openproject-scope"
          - "email"
          - "profile"
      - name: "opendesk-oxappsuite"
        clientId: "opendesk-oxappsuite"
        protocol: "openid-connect"
@@ -265,20 +546,8 @@ config:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
        protocolMappers:
          - name: "context"
            protocol: "openid-connect"
            protocolMapper: "oidc-usermodel-attribute-mapper"
            consentRequired: false
            config:
              userinfo.token.claim: true
              user.attribute: "oxContextIDNum"
              id.token.claim: true
              access.token.claim: true
              claim.name: "context"
              jsonType.label: "String"
        defaultClientScopes:
-          - "opendesk"
+          - "opendesk-oxappsuite-scope"
          - "read_contacts"
          - "write_contacts"
      - name: "opendesk-xwiki"
@@ -298,10 +567,7 @@ config:
          backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/oidc/authenticator/backchannel_logout"
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
-          - "opendesk"
+          - "opendesk-xwiki-scope"
          - "address"
          - "email"
          - "profile"
      - name: "guardian-management-api"
        clientId: "guardian-management-api"
        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
@@ -505,7 +771,6 @@ config:
              claim.name: "dn"
              jsonType.label: "String"
        defaultClientScopes:
          - "opendesk"
          - "web-origins"
          - "acr"
          - "roles"
@@ -594,7 +859,6 @@ config:
              access.token.claim: true
              userinfo.token.claim: false
 containerSecurityContext:
  allowPrivilegeEscalation: false
  capabilities:
--- a/helmfile/apps/univention-management-stack/values-umbrella.yaml.gotmpl
+++ b/helmfile/apps/univention-management-stack/values-umbrella.yaml.gotmpl
@@ -613,7 +613,7 @@ stack-data-ums:
    # The openDesk configuration brings its own UMC policies.
    installUmcPolicies: false
    domainname: {{ .Values.global.domain | quote }}
-    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
+    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
    hostname: {{ .Values.global.hosts.univentionManagementStack | quote }}
    ldapHost: {{ .Values.ldap.host | quote }}
    ldapBase: {{ .Values.ldap.baseDn | quote }}
@@ -654,7 +654,7 @@ stack-data-swp:
      {{- end }}
    externalDomainName: {{ .Values.global.domain | quote }}
-    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
+    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
    portalGroupwareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openxchange .Values.global.domain | quote }}
    portalFileshareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.nextcloud .Values.global.domain | quote }}
@@ -674,7 +674,7 @@ stack-data-swp:
  stackDataSwp:
    udmApiPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
-    {{- if .Values.portal.enableDeploymentInformation }}
+    {{- if .Values.functional.admin.portal.deploymentInformation.enabled }}
    systemInformation:
      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
@@ -1062,8 +1062,8 @@ keycloak-bootstrap:
    imagePullPolicy: {{ .Values.global.imagePullPolicy }}
  cleanup:
-    deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+    deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-    keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+    keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
  keycloak:
    connection:
@@ -1172,7 +1172,7 @@ keycloak-extensions:
      ipProtectionEnable: true
      logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
      newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
-      mailFrom: "noreply@{{ .Values.global.domain }}"
+      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
@@ -1202,18 +1202,17 @@ keycloak-extensions:
      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    imagePullSecrets: {{ .Values.global.imagePullSecrets }}
    ingress:
      annotations:
        nginx.org/proxy-buffer-size: "8k"
        nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
      paths:
        {{- if .Values.debug.enabled }}
        - pathType: "Prefix"
-          path: "/admin"
+          path: "/admin/"
        {{- end }}
        - pathType: "Prefix"
-          path: "/realms"
+          path: "/realms/"
        - pathType: "Prefix"
-          path: "/resources"
+          path: "/js/"
        - pathType: "Prefix"
          path: "/resources/"
        - pathType: "Prefix"
          path: "/fingerprintjs"
        - pathType: "Exact"
@@ -1320,7 +1319,7 @@ stack-gateway:
      proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
-      {{ if .Values.externalServices.nubus.udmRestApi.enabled }}
+      {{ if .Values.functional.externalServices.nubus.udmRestApi.enabled }}
      ## udm-rest-api
      location /univention/udm/ {
        # The UDM Rest API does return on some endpoints a lot of headers
--- a/helmfile/apps/xwiki/values.yaml.gotmpl
+++ b/helmfile/apps/xwiki/values.yaml.gotmpl
@@ -60,14 +60,19 @@ customConfigs:
    xwiki.authentication.ldap.base_DN: "dc=swp-ldap,dc=internal"
    ## Allow short update cycles of the LDAP group cache
    xwiki.authentication.ldap.groupcache_expiration: 300
    ## Mapping for XWiki attributes to the respective LDAP attributes
    xwiki.authentication.ldap.fields_mapping: "last_name=sn,first_name=givenName,email=mailPrimaryAddress"
  xwiki.properties:
    wikiInitializer.initialRequest.xwiki.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/distribution/"
    wikiInitializer.initialRequest.xwiki.contextPath: "/"
    wikiInitializer.initialRequest.xwiki.remoteAddress: "{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
    oidc.clientid: "opendesk-xwiki"
    oidc.endpoint.token.auth_method: "client_secret_basic"
    oidc.endpoint.userinfo.method: "GET"
    oidc.logoutMechanism: "rpInitiated"
    oidc.provider: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/opendesk"
-    oidc.scope: "openid,profile,email,address,opendesk"
+    oidc.scope: "openid,opendesk-xwiki-scope"
    oidc.secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
    oidc.skipped: false
    oidc.user.nameFormater: "${oidc.user.opendesk_username._clean._lowerCase}"
@@ -81,6 +86,8 @@ customConfigs:
    workplaceServices.navigationEndpoint: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json"
    workplaceServices.base: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
    workplaceServices.portalSecret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
    openoffice.serverType: "0"
    notifications.emails.live.graceTime: "5"
 ingress:
  enabled: {{ .Values.ingress.enabled }}
@@ -126,6 +133,16 @@ properties:
  "attachment:xwiki:XWiki.DefaultSkin@icons.xwiki.favicon.svg": "data:image/svg+xml;base64,{{ .Values.theme.imagery.faviconSvg | b64enc }}"
  "attachment:xwiki:XWiki.DefaultSkin@icons.xwiki.favicon16.png": "data:image/png;base64,{{ .Values.theme.imagery.favicon16PngB64 }}"
  "attachment:xwiki:XWiki.DefaultSkin@icons.xwiki.favicon144.png": "data:image/png;base64,{{ .Values.theme.imagery.favicon144PngB64 }}"
  "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.secure": 1
  "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.server": "{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
  "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.port": 443
  ## SMTP settings
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ .Values.smtp.host | quote }}
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.port": {{ .Values.smtp.port | quote }}
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.username": {{ .Values.smtp.username | quote }}
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.password": {{ .Values.smtp.password | quote }}
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.properties": "mail.smtp.starttls.enable=true"
  ## Link LDAP users and users authenticated through OIDC
  "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.addOIDCObject": 1
  "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.OIDCIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
@@ -150,7 +167,7 @@ properties:
  "property:xwiki:XWiki.AuthService.Configuration^XWiki.AuthService.ConfigurationClass.authService": "oidc"
  ## Fields to search in when importing users from the administration UI (not completely in scope for now)
  "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.ldapUserAttributes":
-    "sn,givenname,uid"
+    "sn,givenname,uid,mailPrimaryAddress"
  ## Restrict user import in the UI to global administrators
  "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.usersAllowedToImport": "globalAdmin"
  ## Enable group and user synchronization
--- a/helmfile/bases/environments.yaml
+++ b/helmfile/bases/environments.yaml
@@ -10,15 +10,15 @@ environments:
    values:
      - "../../environments/default/*.gotmpl"
      - "../../environments/default/*.yaml"
-      - "../../environments/dev/values.yaml.gotmpl"
+      - "../../environments/dev/*.yaml.gotmpl"
  test:
    values:
      - "../../environments/default/*.gotmpl"
      - "../../environments/default/*.yaml"
-      - "../../environments/test/values.yaml.gotmpl"
+      - "../../environments/test/*.yaml.gotmpl"
  prod:
    values:
      - "../../environments/default/*.gotmpl"
      - "../../environments/default/*.yaml"
-      - "../../environments/prod/values.yaml.gotmpl"
+      - "../../environments/prod/*.yaml.gotmpl"
 ...
--- a/helmfile/environments/default/charts.yaml
+++ b/helmfile/environments/default/charts.yaml
@@ -46,7 +46,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/collabora/charts-mirror"
    name: "collabora-online"
-    version: "1.1.16"
+    version: "1.1.20"
    verify: true
  cryptpad:
    # providerCategory: "Supplier"
@@ -78,7 +78,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-element"
-    version: "3.0.0"
+    version: "3.2.0"
    verify: true
  elementWellKnown:
    # providerCategory: "Platform"
@@ -88,7 +88,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-well-known"
-    version: "3.0.0"
+    version: "3.2.0"
    verify: true
  home:
    # providerCategory: "Platform"
@@ -98,7 +98,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-home"
    name: "opendesk-home"
-    version: "1.0.1"
+    version: "1.0.2"
    verify: true
  intercomService:
    # providerCategory: "Supplier"
@@ -180,7 +180,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-matrix-user-verification-service"
-    version: "3.0.0"
+    version: "3.2.0"
    verify: true
  memcached:
    # providerCategory: "Community"
@@ -192,6 +192,16 @@ charts:
    name: "memcached"
    version: "6.7.1"
    verify: true
  migrations:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry.opencode.de"
    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-migrations"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
    name: "opendesk-migrations"
    version: "1.0.1"
    verify: true
  minio:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -210,7 +220,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud"
-    version: "1.5.2"
+    version: "3.0.0"
    verify: true
  nextcloudManagement:
    # providerCategory: "Platform"
@@ -220,7 +230,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud-management"
-    version: "1.5.2"
+    version: "3.0.0"
    verify: true
  nginx:
    # providerCategory: "Community"
@@ -240,7 +250,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
    name: "opendesk-keycloak-bootstrap"
-    version: "1.1.0"
+    version: "2.1.0"
    verify: true
  openproject:
    # providerCategory: "Supplier"
@@ -252,7 +262,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
    name: "openproject"
-    version: "5.1.4"
+    version: "7.0.0"
    verify: true
  openprojectBootstrap:
    # providerCategory: "Platform"
@@ -346,7 +356,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse"
-    version: "3.0.0"
+    version: "3.2.0"
    verify: true
  synapseCreateAccount:
    # providerCategory: "Platform"
@@ -356,7 +366,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-create-account"
-    version: "3.0.0"
+    version: "3.2.0"
    verify: true
  synapseWeb:
    # providerCategory: "Platform"
@@ -366,7 +376,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-web"
-    version: "3.0.0"
+    version: "3.2.0"
    verify: true
  ums:
    # providerCategory: "Supplier"
@@ -402,6 +412,6 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
    name: "xwiki"
-    version: "1.3.0"
+    version: "1.3.1"
    verify: false
 ...
--- a/helmfile/environments/default/cluster.yaml
+++ b/helmfile/environments/default/cluster.yaml
@@ -15,8 +15,9 @@ cluster:
  networking:
    # Kubernetes internal cluster domain.
    domain: "cluster.local"
-    # Kubernetes cluster network CIDR.
+    # Kubernetes cluster network CIDRs.
-    cidr: "10.0.0.0/8"
+    cidr:
      - "10.0.0.0/8"
    # Ingress-gateway IP - only relevant for "NodePort" cluster services.
    # When ingress and egress gateway use different ips, which results that pods can't self-discover their incoming ip,
    # you need to provide the public (load-balanced) ingress gateways ip address.
--- a/helmfile/environments/default/debug.yaml
+++ b/helmfile/environments/default/debug.yaml
@@ -1,6 +1,7 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 debug:
  cleanup:
    # Keep Pods/Job logs after successful run.
    deletePodsOnSuccess: true
@@ -10,7 +11,6 @@ cleanup:
    keepPVCOnDelete: false
    # Keep additional resources, like certificates on deletion of this release.
    keepRessourceOnDelete: true
 debug:
  # should activate debug output in all components and even allow e.g. successfully executed jobs
  # to stay available. This is going to be implemented on a case by case basis when we actually
  # need debugging in a component.
--- a/helmfile/environments/default/enterprise.yaml
+++ b/helmfile/environments/default/enterprise.yaml
@@ -0,0 +1,9 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 # The variables set in this file are required to upgrade components to their "Enterprise" product variant.
 ---
 enterprise:
  openproject:
    # Enterprise token must match the deployment's OpenProject host name.
    token: ""
 ...
--- a/helmfile/environments/default/functional.yaml
+++ b/helmfile/environments/default/functional.yaml
@@ -1,23 +1,49 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 functional:
  admin:
    portal:
      deploymentInformation:
        # Disable to not provide and update openDesk release version and deployment timestamp for admins in the portal.
        enabled: true
  authentication:
    twoFactor:
      # Define a list of groups to enable 2FA for.
      # Note: Removing a group from the list will not disable 2FA for the removed group.
      groups:
        - "Domain Admins"
    oidc:
      # Define additional/custom OIDC clients to be created in the 'opendesk' realm of Keycloak.
      clients: ~
      # Define additional/custom OIDC client scopes to be created in the 'opendesk' realm of Keycloak.
      clientScopes: ~
  externalServices:
    nubus:
      udmRestApi:
-      # Set to 'true' if you don't want to make the UDM REST API from the Nubus stack externally available
+        # Enable to make the UDM REST API from the Nubus stack externally available.
        enabled: false
    matrix:
      federation:
        # Disable to not support Matrix federation with your installation.
        enabled: true
-portal:
+  filestore:
-  # Display deployment release and date in portal for admins.
+    quota:
-  enableDeploymentInformation: true
+      # Set the default quota for all users in GB
      default: 1
    # Nextcloud specific configuration
    nextcloud:
      retentionObligation:
        # yamllint disable rule:line-length
        # Set Nextcloud's `trashbin_retention_obligation`
        # Ref.: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#trashbin-retention-obligation
        trashbin: "auto"
        # Set Nextcloud's `versions_retention_obligation`
        # Ref.: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#versions-retention-obligation
        versions: "auto"
        # yamllint enable rule:line-length
 ...
--- a/helmfile/environments/default/global.generated.yaml
+++ b/helmfile/environments/default/global.generated.yaml
@@ -3,5 +3,5 @@
 ---
 global:
  systemInformation:
-    releaseVersion: "v0.7.1"
+    releaseVersion: "v0.9.0"
 ...
--- a/helmfile/environments/default/global.gotmpl
+++ b/helmfile/environments/default/global.gotmpl
@@ -23,4 +23,39 @@ global:
  #
  helmRegistry: {{ env "PRIVATE_HELM_REGISTRY_URL" | quote }}
  imageRegistry: {{ env "PRIVATE_IMAGE_REGISTRY_URL" | quote }}
  ## Define ingress/virtualservice host.
  #
  hosts:
    collabora: "collabora"
    cryptpad: "cryptpad"
    element: "chat"
    intercomService: "ics"
    jitsi: "meet"
    keycloak: "id"
    matrixNeoBoardWidget: "matrix-neoboard-widget"
    matrixNeoChoiceWidget: "matrix-neochoice-widget"
    matrixNeoDateFixBot: "matrix-neodatefix-bot"
    matrixNeoDateFixWidget: "matrix-neodatefix-widget"
    minioApi: "minio"
    minioConsole: "minio-console"
    nextcloud: "fs"
    openproject: "project"
    openxchange: "webmail"
    synapse: "matrix"
    synapseFederation: "matrix-federation"
    univentionManagementStack: "portal"
    whiteboard: "whiteboard"
    xwiki: "wiki"
  ## Credentials to fetch images from private registry
  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  #
  imagePullSecrets:
    - "external-registry"
  ## Define the policy to pull container images.
  ## Ref: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
  #
  imagePullPolicy: "IfNotPresent"
 ...
--- a/helmfile/environments/default/global.yaml
+++ b/helmfile/environments/default/global.yaml
@@ -1,43 +0,0 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 ## The global properties are used to configure multiple charts at once.
 #
 global:
  ## Define ingress/virtualservice host.
  #
  hosts:
    collabora: "collabora"
    cryptpad: "cryptpad"
    element: "chat"
    intercomService: "ics"
    jitsi: "meet"
    keycloak: "id"
    matrixNeoBoardWidget: "matrix-neoboard-widget"
    matrixNeoChoiceWidget: "matrix-neochoice-widget"
    matrixNeoDateFixBot: "matrix-neodatefix-bot"
    matrixNeoDateFixWidget: "matrix-neodatefix-widget"
    minioApi: "minio"
    minioConsole: "minio-console"
    nextcloud: "fs"
    openproject: "project"
    openxchange: "webmail"
    openxchangeProvisioning: "ox-provisioning"
    synapse: "matrix"
    synapseFederation: "matrix-federation"
    univentionManagementStack: "portal"
    whiteboard: "whiteboard"
    xwiki: "wiki"
  ## Credentials to fetch images from private registry
  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  #
  imagePullSecrets:
    - "external-registry"
  ## Define the policy to pull container images.
  ## Ref: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
  #
  imagePullPolicy: "IfNotPresent"
 ...
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -20,7 +20,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "24.04.3.1.1@sha256:c1aa824227ea2b09ddef2ca3561a80282cda61c649b1bbdbbfa343e5a513a5a9"
+    tag: "24.04.5.2.1@sha256:583f3764661fdce99c5a97019b732db1bed9f9b333d70640ac99a6953c493666"
  cryptpad:
    # providerCategory: "Supplier"
    # providerResponsible: "XWiki"
@@ -121,7 +121,7 @@ images:
    # upstreamRepository: "bitnami/kubectl"
    registry: "registry-1.docker.io"
    repository: "bitnami/kubectl"
-    tag: "1.30.1@sha256:8087ef69a8bf8c88ca3a0f36f75f91c281810f6181698f0c35c3318922bd2ab7"
+    tag: "1.30.2@sha256:3ec696e5ce1b79f78eb0eac1fed4ef20fa6584662cdf3c7ad933b0b03b9ce3f6"
  jvb:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -198,6 +198,14 @@ images:
    registry: "registry-1.docker.io"
    repository: "bitnami/memcached"
    tag: "1.6.21-debian-11-r107@sha256:247ec29efd6030960047a623aef025021154662edf6b6d6e88c97936f164d99d"
  migrations:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry.opencode.de"
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
    tag: "1.0.2@sha256:fbe21b4e2a276d2c5d052c1bb52158debfcc146188e654661001d4ff45b1b453"
  milter:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -221,7 +229,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-apache2"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-apache2"
-    tag: "1.1.21@sha256:ec63d564eb11d7ed213a5ef8719f2b3380e552f1ffb1251470b84c0c8937b7b8"
+    tag: "1.1.24@sha256:c9222da8be7af12c9076b41d1a14e019725afc075e1aaa2b727be21c1bf45f10"
  nextcloudExporter:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -237,7 +245,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-management"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-management"
-    tag: "1.3.12@sha256:54bb5a90ebe49b33b053e8a7df2fa8d8cb992b17f68a04d08357961c3aded0b0"
+    tag: "1.4.4@sha256:b70c159d6a1827748ca1f8fe0b9fd5b011eaed8719172105e1e9c8b8d776cf97"
  nextcloudPHP:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -245,7 +253,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-php"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-php"
-    tag: "1.8.11@sha256:85b3bbf027c9e6a2ccf411b8e2b3752f6a58a3a14f00fb92ecefd9e7ca0c6954"
+    tag: "1.10.3@sha256:e659ab95d0d3a33d4937354449c12fa46fe2669a866bbf432a9d729bed6d54f7"
  opendeskKeycloakBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -253,7 +261,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
-    tag: "1.0.5@sha256:76ccd9a74ae2c2dabb6beaa0192c15b9c06763abbd632cd0f8db68e5d8d5883c"
+    tag: "1.2.0@sha256:3b364c60bedb9ae001c39cbf84e4b4b326b9559078f21bfc993cf0e601196e6f"
  openproject:
    # providerCategory: "Supplier"
    # providerResponsible: "OpenProject"
@@ -263,7 +271,7 @@ images:
    # upstreamMirrorStartFrom: ["13", "1", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "14.1.1@sha256:ce1fabf4d02534990ebb5c934df8fbd227192a529a2e6e81c7feb412bb3eac8b"
+    tag: "14.3.0@sha256:922621b394c1a60e1c427b866284ac636b35717f03bde89302131ad369fbf9ad"
  openprojectBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -279,7 +287,7 @@ images:
    # upstreamRepository: "library/postgres"
    registry: "registry-1.docker.io"
    repository: "library/postgres"
-    tag: "16@sha256:1bf73ccae25238fa555100080042f0b2f9be08eb757e200fe6afc1fc413a1b3c"
+    tag: "16.3-alpine3.20@sha256:de3d7b6e4b5b3fe899e997579d6dfe95a99539d154abe03f0b6839133ed05065"
  openxchangeBootstrap:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -788,5 +796,5 @@ images:
    # upstreamMirrorStartFrom: ["0", "12"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/xwiki"
-    tag: "0.17-mariadb-jetty-alpine@sha256:9eb67520774c3022aa4485ce348be477f358263b716e647cacd057da3aca9739"
+    tag: "0.19-mariadb-jetty-alpine@sha256:8590ee815bceb7764df681b9239b4606adc5b3750e4eff2d928b62dcd046a623"
 ...
--- a/helmfile/environments/default/monitoring.yaml
+++ b/helmfile/environments/default/monitoring.yaml
@@ -1,6 +1,7 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 monitoring:
  prometheus:
    serviceMonitors:
      enabled: false
@@ -15,7 +16,6 @@ prometheus:
      labels:
        release: "kube-prometheus-stack"
  grafana:
    dashboards:
      enabled: false
--- a/helmfile/environments/default/objectstore.gotmpl
+++ b/helmfile/environments/default/objectstore.gotmpl
@@ -1,9 +1,18 @@
-{{/*
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 objectstores:
  migrations:
    bucket: "migrations"
    endpoint: ""
    region: "eu-west-1"
    secretKey: ""
    username: "migration_user"
    storageClass: "STANDARD"
    useSSL: true
    pathStyle: true
    port: 443
  nextcloud:
    bucket: "nextcloud"
    endpoint: ""
--- a/helmfile/environments/default/opendesk_main.gotmpl
+++ b/helmfile/environments/default/opendesk_main.gotmpl
@@ -0,0 +1,76 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 #
 # Note: Currently only single namespace deployments are supported.
 ---
 certificates:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 clamavDistributed:
  enabled: false
  namespace: {{ env "NAMESPACE" | quote }}
 clamavSimple:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 collabora:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 cryptpad:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 dovecot:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 element:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 home:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 intercom:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 jitsi:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 mariadb:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 memcached:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 migrations:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 minio:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 nextcloud:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 openproject:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 oxAppsuite:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 oxConnector:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 postfix:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 postgresql:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 redis:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 univentionManagementStack:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 xwiki:
  enabled: true
  namespace: {{ env "NAMESPACE" | quote }}
 ...
--- a/helmfile/environments/default/resources.yaml
+++ b/helmfile/environments/default/resources.yaml
@@ -69,10 +69,11 @@ resources:
    requests:
      cpu: 0.1
      memory: "384Mi"
  # The jifico and jvb containers require 3GB memory for the Java process, so we limit it to 3.5Gi overall consumption.
  jicofo:
    limits:
      cpu: 99
-      memory: "512Mi"
+      memory: "3584Mi"
    requests:
      cpu: 0.1
      memory: "256Mi"
@@ -90,10 +91,11 @@ resources:
    requests:
      cpu: "10m"
      memory: "48Mi"
  # The jifico and jvb containers require 3GB memory for the Java process, so we limit it to 3.5Gi overall consumption.
  jvb:
    limits:
      cpu: 99
-      memory: "768Mi"
+      memory: "3584Mi"
    requests:
      cpu: 0.1
      memory: "384Mi"
--- a/helmfile/environments/default/secrets.gotmpl
+++ b/helmfile/environments/default/secrets.gotmpl
@@ -68,10 +68,10 @@ secrets:
    nextcloudUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "mariadb" "nextcloud_user" | sha1sum | quote }}
  minio:
    rootPassword: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "minio" "root_password" | sha1sum | quote) }}
-    openprojectUser: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "minio" "openproject_user" | sha1sum | quote) }}
+    migrationsUser: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "minio" "migrations_user" | sha1sum | quote) }}
    openxchangeUser: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "minio" "openxchange_user" | sha1sum | quote) }}
    umsUser: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "minio" "ums_user" | sha1sum | quote) }}
    nextcloudUser: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "minio" "nextcloud_user" | sha1sum | quote) }}
    openprojectUser: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "minio" "openproject_user" | sha1sum | quote) }}
    umsUser: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "minio" "ums_user" | sha1sum | quote) }}
  keycloak:
    adminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "adminPassword" | sha1sum | quote }}
    clientSecret:
--- a/helmfile/environments/default/selinux.yaml
+++ b/helmfile/environments/default/selinux.yaml
@@ -30,6 +30,7 @@ seLinuxOptions:
  matrixNeoDateFixWidget: ~
  matrixUserVerificationService: ~
  memcached: ~
  migrations: ~
  milter: ~
  minio: ~
  nextcloudApache2: ~
--- a/helmfile/environments/default/smtp.gotmpl
+++ b/helmfile/environments/default/smtp.gotmpl
@@ -8,4 +8,5 @@ smtp:
  port: 587
  username: ""
  password: {{ env "SMTP_PASSWORD" | quote }}
  localpartNoReply: "no-reply"
 ...
--- a/helmfile/environments/default/workplace.yaml
+++ b/helmfile/environments/default/workplace.yaml
@@ -1,49 +0,0 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 certificates:
  enabled: true
 clamavDistributed:
  enabled: false
 clamavSimple:
  enabled: true
 collabora:
  enabled: true
 cryptpad:
  enabled: true
 dovecot:
  enabled: true
 element:
  enabled: true
 home:
  enabled: true
 intercom:
  enabled: true
 jitsi:
  enabled: true
 mariadb:
  enabled: true
 memcached:
  enabled: true
 minio:
  enabled: true
 nextcloud:
  enabled: true
 openproject:
  enabled: true
 oxAppsuite:
  enabled: true
 oxConnector:
  enabled: true
 postfix:
  enabled: true
 postgresql:
  enabled: true
 redis:
  enabled: true
 univentionManagementStack:
  enabled: true
 xwiki:
  enabled: true
 ...
--- a/helmfile/shared/migrations.yaml.gotmpl
+++ b/helmfile/shared/migrations.yaml.gotmpl
@@ -0,0 +1,59 @@
 {{/*
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 migrations:
  runId: 1
  currentOdRelease: {{ .Values.global.systemInformation.releaseVersion | quote }}
  namespace: {{ .Values.migrations.namespace | quote }}
  loglevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
  failOnUnexpectedState: true
  credentials:
    keycloakAdminUsername: "kcadmin"
    keycloakAdminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
  urls:
    keycloakBase: "http://ums-keycloak.{{ .Values.univentionManagementStack.namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
 containerSecurityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - "ALL"
  enabled: true
  privileged: false
  runAsUser: 1000
  runAsGroup: 1000
  seccompProfile:
    type: "RuntimeDefault"
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  seLinuxOptions:
    {{ .Values.seLinuxOptions.migrations | toYaml | nindent 4 }}
 image:
  registry: {{ .Values.global.imageRegistry | default .Values.images.migrations.registry | quote }}
  repository: {{ .Values.images.migrations.repository | quote }}
  tag: {{ .Values.images.migrations.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy |quote }}
 job:
  enabled: true
 podSecurityContext:
  enabled: true
  fsGroup: 1000
  fsGroupChangePolicy: "OnRootMismatch"
 ...
--- a/helmfile_generic.yaml
+++ b/helmfile_generic.yaml
@@ -6,11 +6,13 @@
 #
 helmfiles:
  # Path to the helmfile state file being processed BEFORE releases in this state file
-  - path: "helmfile/apps/services/helmfile-child.yaml"
+  - path: "helmfile/apps/migrations-pre/helmfile-child.yaml"
    values: &values
      - "helmfile/environments/default/*.yaml"
      - "helmfile/environments/default/*.gotmpl"
      - {{ toYaml .Values | nindent 8 }}
  - path: "helmfile/apps/services/helmfile-child.yaml"
    values: *values
  - path: "helmfile/apps/univention-management-stack/helmfile-child.yaml"
    values: *values
  - path: "helmfile/apps/intercom-service/helmfile-child.yaml"
@@ -35,5 +37,7 @@ helmfiles:
    values: *values
  - path: "helmfile/apps/openproject-bootstrap/helmfile-child.yaml"
    values: *values
  - path: "helmfile/apps/migrations-post/helmfile-child.yaml"
    values: *values
 missingFileHandler: "Error"
 ...
Author	SHA1	Message	Date
Thorsten Roßner	be6806f62f	chore(release): 0.9.0 [skip ci] # [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24) ### Bug Fixes * collabora: Update to 24.04.5.1.1. ([`8a2d951`](`8a2d951c3b`)) * collabora: Update to 24.04.5.1.2. ([`74d444e`](`74d444e2d6`)) * docs: Update workflow.md. ([`fd3df7d`](`fd3df7df67`)) * docu: Update documentation on integration uses cases ([#95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/95)). ([`382af1d`](`382af1dfb9`)) * helmfile: Add S3 bucket for migrations. ([`972020f`](`972020f946`)) * helmfile: Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details. ([`26a7641`](`26a7641a5a`)) * jitsi: Raise memory limit for jicofo and jvb as required by upstream product. ([`fe923bb`](`fe923bb9cd`)) * keycloak: Support for custom OIDC Clients and ClientScopes. ([`46412d1`](`46412d1a9e`)) * nextcloud: Support templating of default quota and `_retention_obligation` settings ([#93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/93)). ([`23ef1d5`](`23ef1d557b`)) nextcloud: Update to 28.0.7 including latest apps for 28. ([`671f57a`](`671f57a809`)) * nextcloud: Update to 28.0.7 including the apps, fix admin panel warnings ([#94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/94)). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details. ([`63f8394`](`63f8394e04`)) * openproject: Bump to 14.3.0 and update Helm chart to 7.0.0. ([`6b609ed`](`6b609edc4a`)) * openproject: Support for adding token to enable OpenProject Premium. ([`dfaf4be`](`dfaf4be640`)) * xwiki: Add email address mapping to LDAP sync; Fix hostname `null` value in notification links. ([`1067e72`](`1067e725b3`)) * xwiki: Remove .rtf and .odt export options as they are currently non functional. ([`b806d51`](`b806d51311`)) * xwiki: Update to 16.4. ([`db7f5d6`](`db7f5d60bd`)) * xwiki: Update to 16.4.1. ([`e54aaab`](`e54aaab072`)) ### Features * authentication: Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage. ([`b4570a9`](`b4570a9a87`))	2024-07-24 12:06:38 +00:00
Thorsten Roßner	fd3df7df67	fix(docs): Update workflow.md.	2024-07-24 10:14:06 +00:00
Oliver Günther	6b609edc4a	fix(openproject): Bump to 14.3.0 and update Helm chart to 7.0.0.	2024-07-24 08:27:30 +00:00
Thorsten Roßner	63f8394e04	fix(nextcloud): Update to 28.0.7 including the apps, fix admin panel warnings (#94 ). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details.	2024-07-24 09:01:08 +02:00
openDesk Bot	74d444e2d6	fix(collabora): Update to 24.04.5.1.2.	2024-07-18 07:53:49 +02:00
openDesk Bot	8a2d951c3b	fix(collabora): Update to 24.04.5.1.1.	2024-07-17 10:39:37 +02:00
Thorsten Roßner	46412d1a9e	fix(keycloak): Support for custom OIDC Clients and ClientScopes.	2024-07-17 10:39:37 +02:00
Thorsten Roßner	26a7641a5a	fix(helmfile): Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details.	2024-07-17 10:39:16 +02:00
Thorsten Roßner	671f57a809	fix(nextcloud): Update to 28.0.7 including latest apps for 28.	2024-07-16 08:25:55 +00:00
Thorsten Roßner	fe923bb9cd	fix(jitsi): Raise memory limit for jicofo and jvb as required by upstream product.	2024-07-16 04:35:43 +00:00
Thorsten Roßner	b4570a9a87	feat(authentication): Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage.	2024-07-15 17:50:35 +02:00
Thorsten Roßner	1067e725b3	fix(xwiki): Add email address mapping to LDAP sync; Fix hostname `null` value in notification links.	2024-07-10 16:31:04 +00:00
Thorsten Roßner	dfaf4be640	fix(openproject): Support for adding token to enable OpenProject Premium.	2024-07-10 06:27:27 +02:00
openDesk Bot	e54aaab072	fix(xwiki): Update to 16.4.1.	2024-07-08 08:27:13 +02:00
Thorsten Roßner	b806d51311	fix(xwiki): Remove .rtf and .odt export options as they are currently non functional.	2024-07-05 15:18:42 +02:00
openDesk Bot	db7f5d60bd	fix(xwiki): Update to 16.4.	2024-07-05 09:21:16 +02:00
Thorsten Roßner	972020f946	fix(helmfile): Add S3 bucket for migrations.	2024-07-04 09:17:56 +02:00
Thorsten Roßner	23ef1d557b	fix(nextcloud): Support templating of default quota and `*_retention_obligation` settings (#93 ).	2024-07-03 14:48:05 +02:00
Thorsten Roßner	382af1dfb9	fix(docu): Update documentation on integration uses cases (#95 ).	2024-07-03 09:54:43 +02:00
Thorsten Roßner	7239df2ec1	chore(release): 0.8.1 [skip ci] ## [0.8.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.0...v0.8.1) (2024-07-01) ### Bug Fixes * collabora: Bump image to 24.04.4.1.1. ([`368fe13`](`368fe13ddb`)) * collabora: Bump image to 24.04.4.2.1. ([`01767d3`](`01767d3806`)) * docs: Add Ports section to getting started. ([`c07b25c`](`c07b25c4b9`)) * docs: Correction regarding the currently supported ingress controller. ([`8514908`](`85149086ae`)) * docs: Update regarding the currently supported ingress controller. ([`064a5ad`](`064a5ad246`)) * element: Provide the internal cluster domain to `synapse-web`. ([`a8692d5`](`a8692d5506`)) * helmfile: Add script to ease local development of platform charts. ([`d8f3e05`](`d8f3e05e58`)) * helmfile: Enable SMTP for XWiki and Element/Synapse; Streamline mail sender addresses within platform based on `<localpart>@<component>.<domain>` and allow configuration of `<localpart>`. ([`01c5e6b`](`01c5e6b359`)) * helmfile: Include all `.yaml.gotmpl` files for the envs in `environments.yaml`. ([`e523434`](`e52343440d`)) * helmfile: Streamline `functional.yaml`. Upgrade notice: If you set a non default value for `.Values.portal.enableDeploymentInformation` please change it to `.Values.admin.portal.deploymentInformation.enabled` with this version. ([`e89b16a`](`e89b16a747`)) * jitsi: Update PatchJVB bitnami/kubectl image to 1.30.2. ([`6ef3641`](`6ef3641d82`)) * nubus: Enable Keycloak's user account console. ([`c03e4a5`](`c03e4a5340`)) * nubus: Remove doublette ingress annotations. ([`890b36e`](`890b36ecbb`)) * open-xchange: Fixing YAML indentation of updater resources ([`0ce346b`](`0ce346b162`)) * openproject: Bump image to 14.2.0. ([`1ad35f1`](`1ad35f1e12`)) * openproject: Switch DBInit container image to Alpine based version to reduce footprint. ([`c90f7c1`](`c90f7c1742`)) * openproject: Update PostgreSQL image for DB init to 16.3. ([`45e5699`](`45e569955d`)) * services: Allow Postfix "relayHost" to be empty. ([`7268f60`](`7268f607a5`))	2024-07-01 19:17:48 +00:00
openDesk Bot	86a328bda1	chore(openproject): Update `library/postgres` sha-digest.	2024-07-01 17:23:28 +02:00
Thorsten Roßner	85149086ae	fix(docs): Correction regarding the currently supported ingress controller.	2024-07-01 13:24:19 +02:00
Thorsten Roßner	01c5e6b359	fix(helmfile): Enable SMTP for XWiki and Element/Synapse; Streamline mail sender addresses within platform based on `<localpart>@<component>.<domain>` and allow configuration of `<localpart>`.	2024-07-01 12:34:51 +02:00
Johannes Bornhold	a8692d5506	fix(element): Provide the internal cluster domain to `synapse-web`.	2024-07-01 09:24:01 +00:00
Oliver Günther	1ad35f1e12	fix(openproject): Bump image to 14.2.0.	2024-06-24 17:30:05 +02:00
openDesk Bot	01767d3806	fix(collabora): Bump image to 24.04.4.2.1.	2024-06-24 14:40:54 +00:00
Johannes Bornhold	7268f607a5	fix(services): Allow Postfix "relayHost" to be empty.	2024-06-24 16:37:19 +02:00
Thorsten Roßner	e52343440d	fix(helmfile): Include all `.yaml.gotmpl` files for the envs in `environments.yaml`.	2024-06-17 14:46:51 +02:00
Thorsten Roßner	c03e4a5340	fix(nubus): Enable Keycloak's user account console.	2024-06-17 06:25:46 +00:00
openDesk Bot	c90f7c1742	fix(openproject): Switch DBInit container image to Alpine based version to reduce footprint.	2024-06-17 06:24:35 +00:00
openDesk Bot	ceb09bee8c	chore(renovate): Update collabora-online Docker tag to v1.1.17	2024-06-15 03:36:23 +00:00
Thorsten Roßner	890b36ecbb	fix(nubus): Remove doublette ingress annotations.	2024-06-14 16:04:50 +02:00
openDesk Bot	6ef3641d82	fix(jitsi): Update PatchJVB bitnami/kubectl image to 1.30.2.	2024-06-14 07:32:54 +00:00
openDesk Bot	45e569955d	fix(openproject): Update PostgreSQL image for DB init to 16.3.	2024-06-14 07:32:10 +00:00
Gergely Szabo	0ce346b162	fix(open-xchange): Fixing YAML indentation of updater resources	2024-06-13 17:54:54 +02:00
Thorsten Roßner	c07b25c4b9	fix(docs): Add Ports section to getting started.	2024-06-13 15:26:39 +02:00
Thorsten Roßner	e89b16a747	fix(helmfile): Streamline `functional.yaml`. Upgrade notice: If you set a non default value for `.Values.portal.enableDeploymentInformation` please change it to `.Values.admin.portal.deploymentInformation.enabled` with this version.	2024-06-12 10:42:00 +00:00
Thorsten Roßner	064a5ad246	fix(docs): Update regarding the currently supported ingress controller.	2024-06-12 12:28:52 +02:00
Thorsten Roßner	d8f3e05e58	fix(helmfile): Add script to ease local development of platform charts.	2024-06-11 10:00:36 +00:00
openDesk Bot	368fe13ddb	fix(collabora): Bump image to 24.04.4.1.1.	2024-06-11 11:01:09 +02:00
Thorsten Roßner	fcf33825d5	chore(release): 0.8.0 [skip ci] # [0.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.7.1...v0.8.0) (2024-06-10) ### Bug Fixes * ci: Allow CI to be triggered by API authorized personal access token. ([`b95fd11`](`b95fd1152a`)) * collabora: Semi-disable update checker. ([`d7a127f`](`d7a127fe26`)) * collabora: Update to 24.04.3.1.1. ([`5869316`](`58693162e6`)) * docs: Spell check and streamline. ([`4d99bf3`](`4d99bf3bf0`)) * element: Bump container images (widgets, community artifacts). ([`f856205`](`f856205afc`)) * element: Bump to v1.11.67. ([`a4ff89b`](`a4ff89b213`)) * element: Update Synapse. ([`9fa8ace`](`9fa8ace80f`)) * helmfile: Remove unused ox-provisioning hostname. ([`e31a0a2`](`e31a0a258e`)) * jitsi: Update jitsi-keycloak-adapter image to Docker tag v20240314. ([`6202bc4`](`6202bc4719`)) * nubus: Change to new Univention upstream registry. ([`d7fbc57`](`d7fbc572ca`)) * nubus: Disable UDM REST API routing by default and always disable UMC local login. ([`e1e8a7f`](`e1e8a7f121`)) * nubus: Guardian version bump and refactoring. ([`2f88752`](`2f88752ae6`)) * nubus: Re-add selfservice-listener image configuration. ([`af711b0`](`af711b0edb`)) * open-xchange: Set Nubus LDAP attribute to render manager_name in address book. See https://forge.univention.org/bugzilla/show_bug.cgi?id=53741 for reference. ([`4f92001`](`4f92001d68`)) * openproject: Bump library/postgres image to v16. ([`742c293`](`742c293243`)) * openproject: Bump to 14.1.0, set default timezone on deployment to `Europe/Berlin` and raise default memory limit to 2Gi. ([`6e49721`](`6e4972107e`)) * openproject: Update Helm chart to v5.1.4. ([`75cd077`](`75cd077351`)) * openproject: Update to 14.1.1 and bump PostgreSQL 13 image for InitDB. ([`bd2d7cf`](`bd2d7cf748`)) * services: Update `opendesk-home` to v1.0.2 to fix issue with Element `.well-known` ingress collision. ([`b0eb28b`](`b0eb28bc3f`)) * univention-management-stack: Add functional switch to disable deployment information. ([`a31c5f5`](`a31c5f59a6`)) ### Features * element: Enable Matrix federation via https. ([`ecb566f`](`ecb566f61e`)) * helmfile: Add support for Ingress parameter configuration (proxy-body-size, proxy-read-timeout, proxy-send-timeout). ([`dc39b94`](`dc39b94e88`)) * helmfile: Create child helmfile for GitOps approach. ([`a899699`](`a899699e21`)) * nubus: Cleanup Keycloak values. ([`f3d8cf0`](`f3d8cf08ef`))	2024-06-10 11:19:55 +00:00
Dominik Kaminski	b1d0a05a0c	ci(gitlab): Update opendesk-cli image	2024-06-09 23:05:29 +02:00
Dominik Kaminski	b0eb28bc3f	fix(services): Update `opendesk-home` to v1.0.2 to fix issue with Element `.well-known` ingress collision.	2024-06-07 10:39:19 +00:00
Dominik Kaminski	1a811743df	ci(gitlab): Update to v2.3.3 to fix conventional commits regex bug.	2024-06-07 10:39:19 +00:00
Thorsten Roßner	d7a127fe26	fix(collabora): Semi-disable update checker.	2024-06-06 19:33:11 +02:00
Thorsten Roßner	e31a0a258e	fix(helmfile): Remove unused ox-provisioning hostname.	2024-06-06 19:15:18 +02:00