mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-06 15:31:38 +01:00
Compare commits
31 Commits
schneemann
...
trossner/n
| Author | SHA1 | Date | |
|---|---|---|---|
|
ed314824e8 | ||
|
|
61d94a8de6 | ||
|
|
4e21129456 | ||
|
|
1323ef142e | ||
|
|
03ec70435c | ||
|
|
40aa9d0e63 | ||
|
|
1cdfcf2784 | ||
|
|
ccb51a0de3 | ||
|
|
9d8e9c3ade | ||
|
|
d096fb1154 | ||
|
|
a0f52ee7d4 | ||
|
|
335806a53e | ||
|
|
d5e73feb88 | ||
|
|
3662b5cd25 | ||
|
|
bacf51efb1 | ||
|
|
033cb558dd | ||
|
|
5496317fee | ||
|
|
b4b714ff41 | ||
|
|
04ab28c029 | ||
|
|
ae27a35f5a | ||
|
|
b0e665b031 | ||
|
|
9d0f6daad0 | ||
|
|
5aae75a152 | ||
|
|
054c39c124 | ||
|
|
ba18e6f61c | ||
|
|
a16d9071c9 | ||
|
|
0b230fa2cc | ||
|
|
6f2f7cd5db | ||
|
|
fab862eec6 | ||
|
|
b71c2e57ee | ||
|
|
33ff9227b7 |
@@ -1,12 +1,11 @@
|
||||
# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
include:
|
||||
- project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
|
||||
ref: "v2.4.8"
|
||||
file:
|
||||
- "ci/common/automr.yml"
|
||||
- "ci/common/lint.yml"
|
||||
- "ci/release-automation/semantic-release.yml"
|
||||
- local: "/.gitlab/generate/generate-docs.yml"
|
||||
@@ -32,7 +31,6 @@ stages:
|
||||
- ".pre"
|
||||
- "renovate"
|
||||
- "scan"
|
||||
- "automr"
|
||||
- "env-cleanup"
|
||||
- "env"
|
||||
- "pre-services-deploy"
|
||||
@@ -75,6 +73,12 @@ variables:
|
||||
options:
|
||||
- "yes"
|
||||
- "no"
|
||||
OPENDESK_ENTERPRISE:
|
||||
description: "Set to `true` if you want to deploy openDesk EE (but be sure you provide the required EE keys/tokens for the application)"
|
||||
value: "false"
|
||||
options:
|
||||
- "true"
|
||||
- "false"
|
||||
DEPLOY_ALL_COMPONENTS:
|
||||
description: "Enable all component deployment (overwrites 'no' setting on component level)."
|
||||
value: "no"
|
||||
@@ -188,6 +192,9 @@ variables:
|
||||
description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail.
|
||||
GRACE_PERIOD is the period in seconds that should be waited before running the tests."
|
||||
value: "0"
|
||||
TESTS_NUMBER_OF_THREADS:
|
||||
description: "How many threads are used for executing the tests in parallel?"
|
||||
value: "8"
|
||||
|
||||
# Declare .environments which is in `opendesk-env` repository. In case it is not available
|
||||
# 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
|
||||
@@ -282,6 +289,18 @@ env-start:
|
||||
ca:
|
||||
secretName: opendesk-root-cert-secret
|
||||
EOF
|
||||
after_script:
|
||||
# Set credentials for openDesk Enterprise Registry
|
||||
- |
|
||||
if [ "${OPENDESK_ENTERPRISE}" = "true" ]; then
|
||||
kubectl create secret
|
||||
--namespace "${NAMESPACE}"
|
||||
docker-registry enterprise-registry
|
||||
--docker-server "registry.opencode.de"
|
||||
--docker-username "${OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME}"
|
||||
--docker-password "${OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD}"
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
fi
|
||||
stage: "env"
|
||||
|
||||
policies-deploy:
|
||||
@@ -562,7 +581,9 @@ run-tests:
|
||||
\"screenshot_redirect_step\": \"yes\", \
|
||||
\"testset\": \"${TESTS_TESTSET}\", \
|
||||
\"testprofile\": \"Namespace\", \
|
||||
\"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\" \
|
||||
\"OPENDESK_ENTERPRISE\": \"${OPENDESK_ENTERPRISE}\", \
|
||||
\"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\", \
|
||||
\"NUMBER_OF_THREADS\": \"${TESTS_NUMBER_OF_THREADS}\" \
|
||||
} \
|
||||
}" \
|
||||
"https://${TESTS_PROJECT_URL}/trigger/pipeline"
|
||||
|
||||
@@ -2,8 +2,8 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
variables:
|
||||
OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.1\
|
||||
@sha256:f09e36a4ad4b3a3a9ed260d6f36293002e39866a877c0a6b1efa16a88b8fd107"
|
||||
OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.2\
|
||||
@sha256:e33a6327b9c8f89f6e86d13804d5d81e9fdf6974a2f280874d6901067c22fd83"
|
||||
OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.14\
|
||||
@sha256:34d2a96e5fc25155abd48fef4d335b131c71d8cbc00ad531df0cae9918b9f2ab"
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ metadata:
|
||||
policies.kyverno.io/subject: "Pod"
|
||||
policies.kyverno.io/description: >-
|
||||
This policy validates if `.Values.persistence.storageClassNames` variables are used in templates and if the size
|
||||
of volumes can be customized by `.Values.persistence.size` variable.
|
||||
of volumes can be customized by `.Values.persistence.storages.<COMPONENT>.size` variable.
|
||||
spec:
|
||||
background: true
|
||||
rules:
|
||||
|
||||
33
CHANGELOG.md
33
CHANGELOG.md
@@ -1,3 +1,36 @@
|
||||
## [1.1.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.0...v1.1.1) (2025-01-27)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **docs:** Add permissions.md ([04ab28c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/04ab28c029bb60575c1936ca5acdd2f829b26c06))
|
||||
* **element:** MatrixID for Element "Welcome User" to support deployments where matrix domain differs from homeserver FQDN ([ccb51a0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ccb51a0de32525a93fd982d52dc8e6a35db8f09a))
|
||||
* **element:** Update Element to 1.11.90 ([335806a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/335806a53e51c3fc6a03440316e909aa51af5be8))
|
||||
* **element:** Update Helm chart to v6.0.2 for a fix when using non generated secrets in `opendesk-synapse` ([d5e73fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d5e73feb880c33e8127f284fcc685ffdc15874a8))
|
||||
* **element:** Update Synapse to 1.121.1 ([33ff922](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/33ff9227b745f99e3abdde6dbbe6b00042fca655))
|
||||
* **helmfile:** Move the access restriction configuration for Keycloak client scopes into helmfile templating, instead of hardcoded Helm chart values ([3662b5c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3662b5cd255b37321d3a3625f78feff07b7e633c))
|
||||
* **helmfile:** Remove duplicate entries from `secrets.yaml.gotmpl` ([a13cf63](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a13cf630242343dc8f759cfeb423ff626480b086))
|
||||
* **helmfile:** Support component specific storageClassNames. **Note:** Please check the migration.md if you upgrade a deployment that has set custom PVC sizes using `persistence.size` settings. ([bacf51e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bacf51efb1b042b80f13f5cf3f50557006f32374))
|
||||
* **helmfile:** Support PostgreSQL as alternative database backend for Nextcloud and XWiki. **Note:** PostgreSQL is likely to become the preferred option/default in the future and MariaDB might be deprecated at a later point. ([a0f52ee](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a0f52ee7d4f6a9b82c9d4e288bc4c6cc96018985))
|
||||
* **helmfile:** Update `opendesk-alerts` and `opendesk-dashboards` to get predictable sort order, improving GitOps deployments ([0c91117](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0c91117575a3b56ff9f0b4ae72a501b9f3b4384c))
|
||||
* **helmfile:** Update upstream images for k8s/kubectl to v1.32.0 ([b71c2e5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b71c2e57eec10093d96804e249fbaf81c51fb22e))
|
||||
* **intercom:** Remove legacy OIDC claims ([6796f32](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6796f320f72db02d67b73685aa6356cda9ac86d1))
|
||||
* **nextcloud:** Update image and Helm chart to support app toggles during deployment ([1cdfcf2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1cdfcf2784271f2b8ea61d2e8e534db2aa386f4b))
|
||||
* **nextcloud:** Update to Nextcloud 29.0.10 ([d096fb1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d096fb1154dbcd092e105d4450e7996dfda0388e))
|
||||
* **nubus:** Fix `pullPolicy` setting for `ldapServer.leaderElector` to satisfy Kyverno linter ([6f2f7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6f2f7cd5db6708c1fc523e3cf3160f39f1dba2bb))
|
||||
* **nubus:** Merge yaml files for better maintainability ([6c67eca](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6c67eca7aa68c3f597cc5790ba1046ca0855c329))
|
||||
* **nubus:** Pre-create groups in Keycloak to avoid race condition on group sync when initial users login parallel ([5496317](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5496317fee1ca47a80d0798b9048a1474ca8e2a6))
|
||||
* **nubus:** Remove `extra` settings from ldapServer needed for openDesk 1.0.0 LDAP migration ([fab862e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fab862eec689bf8ef547c4bd06244313f24f6d0b))
|
||||
* **nubus:** Remove b64 encoded files from CSS, instead use `opendesk-static-files` ([2926e2c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2926e2c93a2b4be24abd1e6dd4ce02071a629cb4))
|
||||
* **nubus:** Template `secrets.nubus.masterpassword`. **Note:** Please check migrations.md for details. ([5aae75a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5aae75a1521f73e497859fe3d3b89a8752bb47a1))
|
||||
* **nubus:** Update customizations for group cleanup ([0b230fa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0b230fa2cc841edfde99f5d94dc9c8054bfbb5ec))
|
||||
* **open-xchange:** Add missing `registryOpencodeDe` to OX-Connector's `waitForDependency` image ([a16d907](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a16d9071c96ef7fde87e6579c328e1e05509824b))
|
||||
* **openproject:** Update to 15.1.1 ([b4b714f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4b714ff41a8f01d4b44c6d5ced3f036f7d90699))
|
||||
* **openproject:** Update to 15.2.0 ([9d8e9c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d8e9c3ade9917fb8044331ebdea8d7bca4066b0))
|
||||
* **static-files:** Update Helm chart to use more generic `assets` over `theme.imagery.assets` ([63562c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63562c1aae6b2c33ea39b93c11e842c2ab1e2c25))
|
||||
* **static-files:** Update Helm chart to v4.0.1 to support longer domain names ([b0e665b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b0e665b031baf36c59eea85b3d575f1a49290bf1))
|
||||
* **xwiki:** Update Helm chart to v1.4.1 to fix support for custom `ingressClassName` values. Ref [#144](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/144) ([033cb55](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/033cb558ddc0b47d17b006cdc75c593c5c356147))
|
||||
|
||||
# [1.1.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.0.0...v1.1.0) (2024-12-24)
|
||||
|
||||
|
||||
|
||||
102
README-EE.md
Normal file
102
README-EE.md
Normal file
@@ -0,0 +1,102 @@
|
||||
<!--
|
||||
SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
-->
|
||||
|
||||
<h1>openDesk Enterprise Edition</h1>
|
||||
|
||||
<!-- TOC -->
|
||||
* [Components](#components)
|
||||
* [Enabling the Enterprise deployment](#enabling-the-enterprise-deployment)
|
||||
* [Configuring the oD EE deployment for self-hosted installations](#configuring-the-od-ee-deployment-for-self-hosted-installations)
|
||||
* [Registry access](#registry-access)
|
||||
* [License keys](#license-keys)
|
||||
<!-- TOC -->
|
||||
|
||||
openDesk Enterprise Edition is recommended for production use. It receives support and patches from ZenDiS and the suppliers of the components due to the included product subscriptions.
|
||||
|
||||
The document refers to openDesk Community Edition as "oD CE" and for the openDesk Enterprise Edition it is "oD EE".
|
||||
|
||||
Please contact [ZenDiS](mailto:opendesk@zendis.de) to get openDesk Enterprise, either as SaaS offering or for you on-premise installation.
|
||||
|
||||
# Components
|
||||
|
||||
The following components using the same codebase and artifacts for their Enterprise and Community offering:
|
||||
- Cryptpad
|
||||
- Jitsi
|
||||
- Nubus
|
||||
- OpenProject
|
||||
- XWiki
|
||||
|
||||
The following components have - at least partially - Enterprise specific artifacts:
|
||||
|
||||
- Collabora: Collabora Online image version `<major>.<minor>.<patch>.3` will be used once available, at the same time the Collabora Development Edition image will be updated to `<major>.<minor>.<patch>.2` for oD CE.
|
||||
- Element: Some artifacts providing additional functionality are only available in oD EE. For the shared artifacts we keep the ones in oD CE and oD EE in sync.
|
||||
- Nextcloud: Specific enterprise image based on the NC Enterprise package is build based on the same release version as used in oD CE.
|
||||
- OX AppSuite: oD CE and EE are using the same release version, in EE an enterprise-built container of the AppSuite's Core-Middleware is being integrated.
|
||||
- OX Dovecot Pro 3: Dovecot Pro provides support for S3 storage and this feature is used by default.
|
||||
|
||||
# Enabling the Enterprise deployment
|
||||
|
||||
To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value that does not evaluate to boolean *false* for [Helm flow control](https://helm.sh/docs/chart_template_guide/control_structures/#ifelse), e.g. `"true"`, `"yes"` or `"1"`:
|
||||
|
||||
```shell
|
||||
OPENDESK_ENTERPRISE=true
|
||||
```
|
||||
|
||||
# Configuring the oD EE deployment for self-hosted installations
|
||||
|
||||
## Registry access
|
||||
|
||||
With openDesk EE you get access to the related artifact registry owned by ZenDiS.
|
||||
|
||||
Three steps are required to access the registry - for step #1 and #2 you can set some variables. You can to define a `<your_name_for_the_secret>` freely, like `enterprise-secret`, as long as it consistent in step #1 and #3.
|
||||
|
||||
```shell
|
||||
NAMESPACE=<your_namespace>
|
||||
NAME_FOR_THE_SECRET=<your_name_for_the_secret>
|
||||
YOUR_ENTERPRISE_REGISTRY_USERNAME=<your_registry_credential_username>
|
||||
YOUR_ENTERPRISE_REGISTRY_PASSWORD=<your_registry_credential_password>
|
||||
```
|
||||
|
||||
1. Add your registry credentials as secret to the namespace you want to deploy openDesk to. Do not forget to create the namespace if it does not exist yet (`kubectl create namespace ${NAMESPACE}`).
|
||||
|
||||
```shell
|
||||
kubectl create secret --namespace "${NAMESPACE}" \
|
||||
docker-registry "${NAME_FOR_THE_SECRET}" \
|
||||
--docker-server "registry.opencode.de" \
|
||||
--docker-username "${YOUR_ENTERPRISE_REGISTRY_USERNAME}" \
|
||||
--docker-password "${YOUR_ENTERPRISE_REGISTRY_PASSWORD}" \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
```
|
||||
|
||||
2. Docker login to the registry to access Helm charts for local deployments:
|
||||
|
||||
```shell
|
||||
docker login registry.opencode.de -u ${YOUR_ENTERPRISE_REGISTRY_USERNAME} -p ${YOUR_ENTERPRISE_REGISTRY_PASSWORD}
|
||||
```
|
||||
|
||||
3. Reference the secret from step #1 in the deployment as well as the registry itself for `images` and `helm` charts:
|
||||
|
||||
```yaml
|
||||
global:
|
||||
imagePullSecrets:
|
||||
- "<your_name_for_the_secret>"
|
||||
repositories:
|
||||
image:
|
||||
registryOpencodeDeEnterprise: "registry.opencode.de"
|
||||
helm:
|
||||
registryOpencodeDeEnterprise: "registry.opencode.de"
|
||||
```
|
||||
|
||||
## License keys
|
||||
|
||||
Some applications require license information for their Enterprise features to be enabled. With the aforementioned registry credentials you will also receive a file called `enterprise.yaml` containing the relevant license keys.
|
||||
|
||||
Please place the file next your other `.yaml.gotmpl` file(s) that configure your deployment.
|
||||
|
||||
Details regarding the scope/limitation of the component's licenses:
|
||||
|
||||
- Nextcloud: Enterprise license to enable [Nextcloud Enterprise](https://nextcloud.com/de/enterprise/) specific features, can be used across multiple installations until the licensed number of users is reached.
|
||||
- OpenProject: Domain specific enterprise license to enable [OpenProject's Enterprise feature set](https://www.openproject.org/enterprise-edition/), domain matching can use regular expressions.
|
||||
- XWiki: Deployment specific enterprise license (key pair) to activate the [XWiki Pro](https://xwiki.com/en/offerings/products/xwiki-pro) apps.
|
||||
13
README.md
13
README.md
@@ -13,6 +13,7 @@ SPDX-License-Identifier: Apache-2.0
|
||||
* [Getting started](#getting-started)
|
||||
* [Advanced customization](#advanced-customization)
|
||||
* [Architecture](#architecture)
|
||||
* [Permissions](#permissions)
|
||||
* [Releases](#releases)
|
||||
* [Data Storage](#data-storage)
|
||||
* [Feedback](#feedback)
|
||||
@@ -26,17 +27,19 @@ SPDX-License-Identifier: Apache-2.0
|
||||
openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the
|
||||
*Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH*.
|
||||
|
||||
For production use the [openDesk Enterprise Edition](./README-EE.md) is required.
|
||||
|
||||
openDesk currently features the following functional main components:
|
||||
|
||||
| Function | Functional Component | Component<br/>Version | Upstream Documentation |
|
||||
| -------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Chat & collaboration | Element ft. Nordeck widgets | [1.11.87](https://github.com/element-hq/element-desktop/releases/tag/v1.11.87) | [For the most recent release](https://element.io/user-guide) |
|
||||
| Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89) | [For the most recent release](https://element.io/user-guide) |
|
||||
| Diagram editor | CryptPad ft. diagrams.net | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0) | [For the most recent release](https://docs.cryptpad.org/en/) |
|
||||
| File management | Nextcloud | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8) | [Nextcloud 29](https://docs.nextcloud.com/) |
|
||||
| Groupware | OX App Suite | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/) | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
|
||||
| Knowledge management | XWiki | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/) | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation) |
|
||||
| Portal & IAM | Nubus | [1.4.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html) |
|
||||
| Project management | OpenProject | [15.1.0](https://www.openproject.org/docs/release-notes/15-1-0/) | [For the most recent release](https://www.openproject.org/docs/user-guide/) |
|
||||
| Portal & IAM | Nubus | [1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html) |
|
||||
| Project management | OpenProject | [15.2.0](https://www.openproject.org/docs/release-notes/15-2-0/) | [For the most recent release](https://www.openproject.org/docs/user-guide/) |
|
||||
| Videoconferencing | Jitsi | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823) | [For the most recent release](https://jitsi.github.io/handbook/docs/category/user-guide/) |
|
||||
| Weboffice | Collabora | [24.04.9.2](https://www.collaboraoffice.com/code-24-04-release-notes/) | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/) |
|
||||
|
||||
@@ -78,6 +81,10 @@ You would like to install openDesk in your own infrastructure?
|
||||
|
||||
More information on openDesk's architecture can be found in our [Architecture docs](./docs/architecture.md).
|
||||
|
||||
# Permissions
|
||||
|
||||
Find out more about the permission system in the[roles & permissions concept](./docs/permissions.md)
|
||||
|
||||
# Releases
|
||||
|
||||
All technical releases are created using [Semantic Versioning](https://semver.org/lang/de/).
|
||||
|
||||
@@ -78,7 +78,8 @@
|
||||
"Weboffice",
|
||||
"Xchange",
|
||||
"xwiki",
|
||||
"Zentrum"
|
||||
"Zentrum",
|
||||
"analysed"
|
||||
],
|
||||
"ignoreWords": [],
|
||||
"import": []
|
||||
|
||||
@@ -7,30 +7,40 @@ SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
* [charts-local.py](#charts-localpy)
|
||||
* [Commandline parameter](#commandline-parameter)
|
||||
* [`--branch`](#--branch)
|
||||
* [`--match <your_string>`](#--match-your_string)
|
||||
* [`--revert`](#--revert)
|
||||
* [`--branch` (deprecated)](#--branch-deprecated)
|
||||
|
||||
# charts-local.py
|
||||
|
||||
This script helps you on cloning the platform development Helm charts and referencing them directly in the openDesk
|
||||
Helmfile deployment for comfortable local test and development. The charts will be cloned into a directory
|
||||
parallel created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
|
||||
The name of the chart directory is derived from the branch name you are working with in this `opendesk` repo.
|
||||
This script helps you with cloning/pulling Helm charts and referencing them directly in the openDesk
|
||||
Helmfile deployment for comfortable local test and development. The charts will be cloned/pulled into a directory
|
||||
created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
|
||||
|
||||
The script will create `.bak` copies of the helmfiles that have been touched.
|
||||
The name of the directory containing the charts is based on the (currently) selected branch of the openDesk
|
||||
repo prefixed with `charts-`.
|
||||
|
||||
The script will create `.bak` copies of the helmfiles that have been touched that can easily be reverted to
|
||||
using the `--revert` option.
|
||||
|
||||
Run the script with `-h` to get information about the script's parameter on commandline.
|
||||
|
||||
## Commandline parameter
|
||||
|
||||
### `--branch`
|
||||
### `--match <your_string>`
|
||||
|
||||
Will only fetch repos or pull images for charts which name matches `<your_string>`.
|
||||
|
||||
### `--revert`
|
||||
|
||||
Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
|
||||
scripts itself back to their original location.
|
||||
|
||||
### `--branch` (deprecated)
|
||||
|
||||
Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
|
||||
does not exist yet. Otherwise it will switch to defined branch.
|
||||
|
||||
If parameter is omitted the current branch of the `opendesk` repo will be used.
|
||||
|
||||
### `--revert`
|
||||
|
||||
Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
|
||||
scripts itself back to their original location.
|
||||
As this parameter was used rarely, we might remove the support in a later version.
|
||||
|
||||
@@ -18,7 +18,6 @@ p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work
|
||||
p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
|
||||
p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
|
||||
p.add('--match', default='', help="Clone/pull only charts that contain the given string in their name.")
|
||||
p.add('--pull', default=False, action='store_true', help='Will also pull and unpack Helm charts that are not developed by product development.')
|
||||
p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
|
||||
options = p.parse_args()
|
||||
|
||||
@@ -78,13 +77,10 @@ def create_path_if_not_exists(path):
|
||||
Path(path).mkdir(parents=True, exist_ok=True)
|
||||
|
||||
def clone_charts_locally(branch, charts):
|
||||
charts_clone_path = script_path+'/../../chart-repo/'+branch.replace('/', '_')
|
||||
charts_pull_path = script_path+'/../../chart-pull/'+branch.replace('/', '_')
|
||||
charts_path = script_path+'/../../charts-'+branch.replace('/', '_')
|
||||
charts_dict = {}
|
||||
doublette_dict = {}
|
||||
create_path_if_not_exists(charts_clone_path)
|
||||
if options.pull:
|
||||
create_path_if_not_exists(charts_pull_path)
|
||||
create_path_if_not_exists(charts_path)
|
||||
|
||||
for chart in charts['charts']:
|
||||
tag = charts['charts'][chart]['version']
|
||||
@@ -92,41 +88,41 @@ def clone_charts_locally(branch, charts):
|
||||
registry = charts['charts'][chart]['registry']
|
||||
name = charts['charts'][chart]['name']
|
||||
logging.debug(f"Working on {chart} / tag {tag} / repo {repository}")
|
||||
chart_local_path = charts_path+'/'+name
|
||||
if not options.match in name:
|
||||
logging.info(f"Chart name {name} does not match {options.match} - skipping...")
|
||||
continue
|
||||
elif registry == '':
|
||||
logging.info("Empty registry definition - skipping...")
|
||||
continue
|
||||
if os.path.isdir(chart_local_path):
|
||||
logging.debug(f"Found pre-existing {chart_local_path} skipping clone/pull, but will still reference chart in Helmfile...")
|
||||
charts_dict[chart] = chart_local_path
|
||||
continue
|
||||
elif 'opendesk/components/platform-development/charts' in repository:
|
||||
logging.info("Cloning the charts repo")
|
||||
git_url = options.git_hostname+':'+repository
|
||||
chart_repo_path = charts_clone_path+'/'+charts['charts'][chart]['name']
|
||||
if git_url in doublette_dict:
|
||||
logging.debug(f"{chart} located at {git_url} is already checked out to {doublette_dict[git_url]}")
|
||||
charts_dict[chart] = doublette_dict[git_url]
|
||||
else:
|
||||
if os.path.isdir(chart_repo_path):
|
||||
logging.debug(f"Already exists {chart_repo_path} leaving it unmodified")
|
||||
else:
|
||||
logging.debug(f"Cloning into {chart_repo_path}")
|
||||
Repo.clone_from(git_url, chart_repo_path)
|
||||
chart_repo = Repo(path=chart_repo_path)
|
||||
chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
|
||||
doublette_dict[git_url] = chart_repo_path
|
||||
charts_dict[chart] = chart_repo_path
|
||||
elif options.pull:
|
||||
logging.debug(f"Cloning into {chart_local_path}")
|
||||
Repo.clone_from(git_url, chart_local_path)
|
||||
chart_repo = Repo(path=chart_local_path)
|
||||
chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
|
||||
doublette_dict[git_url] = chart_local_path
|
||||
charts_dict[chart] = chart_local_path
|
||||
else:
|
||||
logging.info("Pulling the chart")
|
||||
helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_pull_path}"
|
||||
helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_path}"
|
||||
logging.debug(f"CLI command: {helm_command}")
|
||||
try:
|
||||
output = subprocess.check_output(helm_command, shell = True)
|
||||
subprocess.check_output(helm_command, shell = True)
|
||||
except subprocess.CalledProcessError:
|
||||
sys.exit(f"! CLI command '{helm_command}' failed")
|
||||
else:
|
||||
logging.debug("Not a product development chart and `--pull` option not enabled - skipping...")
|
||||
|
||||
charts_dict[chart] = chart_local_path
|
||||
return charts_dict
|
||||
|
||||
|
||||
def grep_yaml(file):
|
||||
with open(file, 'r') as file:
|
||||
content = ''
|
||||
@@ -156,7 +152,12 @@ def process_the_helmfiles(charts_dict, charts):
|
||||
for chart_ident in charts_dict:
|
||||
if '.Values.charts.'+chart_ident+'.name' in line:
|
||||
logging.debug(f"found match with {chart_ident} in {line.strip()}")
|
||||
line = chart_def_prefix+charts_dict[chart_ident]+'/charts/'+charts['charts'][chart_ident]['name']+'" # replaced by local-dev script'+"\n"
|
||||
line = charts_dict[chart_ident]
|
||||
if os.path.isdir(line+'/charts/'+chart_ident):
|
||||
line += '/charts/'+charts['charts'][chart_ident]['name']
|
||||
elif not os.path.isdir(line):
|
||||
sys.exit(f"! Did not find directory to reference in Helmfile: '{line}'")
|
||||
line = chart_def_prefix+line+'" # replaced by local-dev script'+"\n"
|
||||
child_helmfile_updated = True
|
||||
break
|
||||
output.append(line)
|
||||
|
||||
@@ -5,6 +5,7 @@ SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
<h1>Architecture</h1>
|
||||
|
||||
<!-- TOC -->
|
||||
* [Overview](#overview)
|
||||
* [Nubus (IAM)](#nubus-iam)
|
||||
* [Authentication](#authentication)
|
||||
@@ -37,6 +38,7 @@ SPDX-License-Identifier: Apache-2.0
|
||||
* [XWiki (Knowledge management)](#xwiki-knowledge-management)
|
||||
* [Application specific user accounts](#application-specific-user-accounts)
|
||||
* [Footnotes](#footnotes)
|
||||
<!-- TOC -->
|
||||
|
||||
openDesk is designed as a [Kubernetes](https://kubernetes.io) deployment.
|
||||
|
||||
@@ -235,7 +237,7 @@ The [OX SOAP API](https://oxpedia.org/wiki/index.php?title=Open-Xchange_Provisio
|
||||
- (Managed) Resources
|
||||
- Users
|
||||
|
||||
To find out more, see [Roles & Permissions](roles-and-permissions.md).
|
||||
To find out more, see [Roles & Permissions](permissions.md).
|
||||
|
||||
## SCIM
|
||||
|
||||
|
||||
@@ -51,6 +51,10 @@ This chapter presents APIs available in openDesk grouped by applications.
|
||||
* [Matrix Server-Server API](#matrix-server-server-api)
|
||||
* [Matrix Push Gateway API](#matrix-push-gateway-api)
|
||||
* [Matrix Identity Service API](#matrix-identity-service-api)
|
||||
* [Matrix React SDK Module API](#matrix-react-sdk-module-api)
|
||||
* [Matrix Widget API](#matrix-widget-api)
|
||||
* [NeoBoard Data Model API](#neoboard-data-model-api)
|
||||
* [NeoDateFix REST API](#neodatefix-rest-api)
|
||||
* [Knowledge management - XWiki](#knowledge-management---xwiki)
|
||||
* [REST API](#rest-api-1)
|
||||
* [Scripting API](#scripting-api)
|
||||
@@ -647,7 +651,56 @@ Following are APIs used by the Project management application:
|
||||
|
||||
While Jitsi is available as standalone videoconferencing in openDesk, it is also used in [Element as videoconferencing backend](https://github.com/element-hq/element-web/blob/develop/docs/jitsi.md).
|
||||
|
||||
|
||||
```mermaid
|
||||
---
|
||||
config:
|
||||
class:
|
||||
hideEmptyMembersBox: true
|
||||
---
|
||||
classDiagram
|
||||
class CommunicationService["Communication Service"] {
|
||||
<<interface>>
|
||||
}
|
||||
|
||||
class MxChat["Element Matrix Chat"] {
|
||||
<<interface>>
|
||||
}
|
||||
class JitsiVideoConference["Jitsi Video Conference"] {
|
||||
<<interface>>
|
||||
}
|
||||
|
||||
CommunicationService <|.. MxChat
|
||||
CommunicationService <|.. JitsiVideoConference
|
||||
MxChat <-- JitsiVideoConference
|
||||
|
||||
class MxAppServiceApi["Matrix Application Service API"]
|
||||
class MxClientServerApi["Matrix Client Server API"]
|
||||
class MxServerServerApi["Matrix Server Server API"]
|
||||
class MxPushGatewayApi["Matrix Push Gateway API"]
|
||||
class MxIdentityServiceApi["Matrix Identity Service API"]
|
||||
class MxRtc["Matrix RTC"]
|
||||
class MxElementWebModuleApi["Matrix React SDK Module API"]
|
||||
class MxWidgetApi["Matrix Widget API"]
|
||||
class NeoBoardDataModelApi["NeoBoard Data Model API"]
|
||||
class NeoDateFixRestApi["NeoDateFix REST API"]
|
||||
|
||||
MxChat *-- MxAppServiceApi
|
||||
MxChat *-- MxClientServerApi
|
||||
MxChat *-- MxServerServerApi
|
||||
MxChat *-- MxPushGatewayApi
|
||||
MxChat *-- MxIdentityServiceApi
|
||||
MxChat *-- MxRtc
|
||||
MxChat *-- MxElementWebModuleApi
|
||||
MxChat *-- MxWidgetApi
|
||||
|
||||
class JitsiIframeApi["Jitsi iFrame API"]
|
||||
class JitsiMeetApi["Jitsi Meet API"]
|
||||
class JitsiMeetReactSdk["Jitsi Meet React SDK"]
|
||||
|
||||
JitsiVideoConference *-- JitsiIframeApi
|
||||
JitsiVideoConference *-- JitsiMeetApi
|
||||
JitsiVideoConference *-- JitsiMeetReactSdk
|
||||
```
|
||||
|
||||
Following are APIs used by the Chat application:
|
||||
|
||||
@@ -741,6 +794,74 @@ Following are APIs used by the Chat application:
|
||||
| Supported standards | [Matrix](https://spec.matrix.org/latest/identity-service-api/) |
|
||||
| Documentation | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
|
||||
|
||||
## Matrix React SDK Module API
|
||||
|
||||
| Name | Matrix React SDK Module API |
|
||||
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Purpose | The module system in Element Web is a way to add or modify functionality of Element Web itself, bundled at compile time for the app. |
|
||||
| Versioning | [Releases in the Git repository](https://github.com/matrix-org/matrix-react-sdk-module-api/releases); [Dependency in `package.json` in Element (Chat Web-UI)](https://github.com/element-hq/element-web/blob/develop/package.json) |
|
||||
| Authentication | n/a - used as a library |
|
||||
| In openDesk provided by | Element (Chat Web-UI) |
|
||||
| Transport protocol | n/a - used as a library |
|
||||
| Usage within component | [Element (Chat-Web-UI) Modules](https://github.com/nordeck/element-web-modules/) |
|
||||
| Usage within openDesk | none |
|
||||
| Usage for external integration | n/a - uses as a library |
|
||||
| Parallel access | Allowed |
|
||||
| Message protocol | n/a - used as a library |
|
||||
| Supported standards | n/a - Element (Chat Web-UI) specific |
|
||||
| Documentation | [Element (Chat Web-UI) Documentation](https://github.com/element-hq/element-web/blob/develop/docs/modules.md); [matrix-react-sdk-module-api Git repository](https://github.com/matrix-org/matrix-react-sdk-module-api) |
|
||||
|
||||
## Matrix Widget API
|
||||
|
||||
| Name | Matrix Widget API |
|
||||
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Purpose | Matrix Widgets are HTML and Javascript content / applications that can be embedded within, and communicate with Matrix clients. |
|
||||
| Versioning | n/a |
|
||||
| Authentication | Widgets request capabilities. They must be confirmed by a user or by the [Widget Lifecycle Module](https://github.com/nordeck/element-web-modules/blob/main/packages/element-web-widget-lifecycle-module/README.md). |
|
||||
| In openDesk provided by | Element (Chat Web-UI) |
|
||||
| Transport protocol | [HTML window.postMessage API](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage) |
|
||||
| Usage within component | [NeoDateFix](https://github.com/nordeck/matrix-meetings/), [NeoBoard](https://github.com/nordeck/matrix-neoboard), [NeoChoice](https://github.com/nordeck/matrix-poll) |
|
||||
| Usage within openDesk | none |
|
||||
| Usage for external integration | none |
|
||||
| Parallel access | Allowed |
|
||||
| Message protocol | JSON |
|
||||
| Supported standards | [Matrix - MSC2764](https://github.com/matrix-org/matrix-spec-proposals/pull/2764) |
|
||||
| Documentation | [Matrix - MSC2764](https://github.com/matrix-org/matrix-spec-proposals/pull/2764) |
|
||||
|
||||
## NeoBoard Data Model API
|
||||
|
||||
| Name | NeoBoard Data Model API |
|
||||
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Purpose | The NeoBoard data model can be used to generate whiteboard documents. |
|
||||
| Versioning | `version` field in the [NeoBoard data model](https://github.com/nordeck/matrix-neoboard/blob/main/docs/model/export-format.md#fields) |
|
||||
| Authentication | n/a |
|
||||
| In openDesk provided by | [NeoBoard](https://github.com/nordeck/matrix-neoboard) |
|
||||
| Transport protocol | n/a |
|
||||
| Usage within component | [NeoBoard](https://github.com/nordeck/matrix-neoboard) |
|
||||
| Usage within openDesk | none |
|
||||
| Usage for external integration | none |
|
||||
| Parallel access | n/a |
|
||||
| Message protocol | JSON |
|
||||
| Supported standards | n/a |
|
||||
| Documentation | [NeoBoard data model](https://github.com/nordeck/matrix-neoboard/tree/main/docs/model) |
|
||||
|
||||
## NeoDateFix REST API
|
||||
|
||||
| Name | NeoDateFix REST API |
|
||||
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Purpose | Can be used to query and set up NeoDateFix Matrix meetings. |
|
||||
| Versioning | Path segment in the [Meetings Bot API](https://github.com/nordeck/matrix-meetings/blob/main/docs/data-model.md#http-api) |
|
||||
| Authentication | n/a |
|
||||
| In openDesk provided by | [NeoDateFix](https://github.com/nordeck/matrix-meetings) |
|
||||
| Transport protocol | HTTP(S) |
|
||||
| Usage within component | [NeoDateFix](https://github.com/nordeck/matrix-meetings) |
|
||||
| Usage within openDesk | Used by OX to sync calendar entries to NeoDateFix |
|
||||
| Usage for external integration | none |
|
||||
| Parallel access | n/a |
|
||||
| Message protocol | JSON |
|
||||
| Supported standards | n/a |
|
||||
| Documentation | [NeoDateFix ADR001](https://github.com/nordeck/matrix-meetings/blob/main/docs/adrs/adr001-use-the-widget-api-to-interact-with-the-meetings-bot.md) |
|
||||
|
||||
# Knowledge management - XWiki
|
||||
|
||||
Following are APIs used by the Knowledge management application:
|
||||
@@ -804,7 +925,7 @@ Following are APIs used by the Knowledge management application:
|
||||
|
||||
## JavaScript API
|
||||
|
||||
| Name | Javascript API |
|
||||
| Name | JavaScript API |
|
||||
| ------------------------------ | -------------------------------------------------------------------------------------------- |
|
||||
| Purpose | Include dynamic components in XWiki/web pages |
|
||||
| Versioning | |
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 28 KiB |
@@ -95,8 +95,8 @@ XWiki,PersistentVolume,1
|
||||
| **OpenProject** | PostgreSQL | Yes | Application's main database | `openproject` | |
|
||||
| | S3 | Yes | Attachments, custom styles | `openproject` | |
|
||||
| | Memcached | No | Cache | | |
|
||||
| | PVC | No | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs | `openproject-<web|worker>-*-tmp` | `/tmp` |
|
||||
| | | No | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs | `openproject-<web|worker>-app-*-tmp` | `/app/tmp` |
|
||||
| | PVC | No | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs | `openproject-<web/worker>-*-tmp` | `/tmp` |
|
||||
| | | No | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs | `openproject-<web/worker>-app-*-tmp` | `/app/tmp` |
|
||||
| **Open-Xchange** | MariaDB | Yes | Application's control database to coordiate dynamically created ones | `configdb` | |
|
||||
| | | Yes | Dynamically creates databases of schema `PRIMARYDB_n`containing multiple contexts | `PRIMARYDB_*` | |
|
||||
| | | Yes | OX Guard related settings | `oxguard*` | |
|
||||
@@ -113,5 +113,5 @@ Additionally, the following persistent volumes are mounted by pods that serve as
|
||||
| ---------- | ---------------- | ------------ | --------------------------- | --------------------- |
|
||||
| MariaDB | `mariadb-*` | `data` | `data-mariadb-0` | `/var/lib/mysql` |
|
||||
| MinIO | `minio-*-*` | `data` | `minio` | `/bitnami/minio/data` |
|
||||
| PostgreSQK | `postgresql-*` | `data` | `data-postgresql-0` | `/mnt/postgresql` |
|
||||
| PostgreSQL | `postgresql-*` | `data` | `data-postgresql-0` | `/mnt/postgresql` |
|
||||
| Redis | `redis-master-*` | `redis-data` | `redis-data-redis-master-0` | `/data` |
|
||||
|
||||
@@ -30,7 +30,7 @@ We for sure do not want to reinvent the wheel, so we might link to external sour
|
||||
information where available.
|
||||
|
||||
> **Warning**<br>
|
||||
> You should never enable the debug option in production environments! By looking up `debug.enable` in the deployment, you
|
||||
> You should never enable the debug option in production environments! By looking up `debug.enabled` in the deployment, you
|
||||
will find the various places changes are applied when enabling debugging. So, outside of development and test
|
||||
environments, you should use them thoughtfully and carefully if needed.
|
||||
|
||||
@@ -39,7 +39,7 @@ environments, you should use them thoughtfully and carefully if needed.
|
||||
Check the openDesk [`debug.yaml.gotmpl`](../helmfile/environments/default/debug.yaml.gotmpl) and set for your deployment
|
||||
```
|
||||
debug:
|
||||
enable: true
|
||||
enabled: true
|
||||
```
|
||||
|
||||
This will result in:
|
||||
@@ -168,7 +168,7 @@ While you will find all the details for the CLI tool in [the online documentatio
|
||||
|
||||
`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
|
||||
|
||||
You can run occ commands in the `opendesk-nextcloud-php` pod like this: `php /var/www/html/occ config:list`
|
||||
You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`
|
||||
|
||||
## OpenProject
|
||||
|
||||
|
||||
@@ -6,7 +6,6 @@ SPDX-License-Identifier: Apache-2.0
|
||||
<h1>Federation with external identity provider (IdP)</h1>
|
||||
|
||||
<!-- TOC -->
|
||||
* [Context](#context)
|
||||
* [References](#references)
|
||||
* [Prerequisites](#prerequisites)
|
||||
* [User accounts](#user-accounts)
|
||||
@@ -153,10 +152,9 @@ The following configuration is taking place in the Keycloak realm `opendesk`.
|
||||
- *Client authentication*: `Client secret sent as post` (default)
|
||||
- *Client ID*: Use the client ID you took from your organization's IdP config (`opendesk-federation-client` in this example)
|
||||
- *Client Secret*: Use the secret you took from your organization's IdP config
|
||||
- When completed with *Add*, you get to the detailed IdP configured that also needs some updates (you may need to open the *Advanced* section to access some settings)
|
||||
- *Back-channel logout*: `On`
|
||||
- *Disable user info*: `On`
|
||||
- When completed with *Add*, you get to the detailed IdP configuration that at least needs some the following update:
|
||||
- *First login flow override*: `auto-federate-flow`
|
||||
- Depending on your organizations IdP and process preferences additional setting may be required
|
||||
|
||||
- In case you want to forcefully redirect all users to your organization's IdP (disabling login with local openDesk accounts):
|
||||
- *Authentication* > `2fa-browser`
|
||||
|
||||
@@ -11,6 +11,7 @@ This document will cover the additional configuration for external services like
|
||||
* [Database](#database)
|
||||
* [Object storage](#object-storage)
|
||||
* [Cache](#cache)
|
||||
* [Footnotes](#footnotes)
|
||||
<!-- TOC -->
|
||||
|
||||
# Database
|
||||
@@ -18,93 +19,134 @@ This document will cover the additional configuration for external services like
|
||||
When deploying this suite to production, you need to configure the applications to use your production-grade database
|
||||
service.
|
||||
|
||||
| Component | Name | Type | Parameter | Key | Default |
|
||||
| ------------ | ------------------ | ---------- | --------- | ---------------------------------------- | -------------------------- |
|
||||
| Element | Synapse | PostgreSQL | | | |
|
||||
| | | | Name | `databases.synapse.name` | `matrix` |
|
||||
| | | | Host | `databases.synapse.host` | `postgresql` |
|
||||
| | | | Port | `databases.synapse.port` | `5432` |
|
||||
| | | | Username | `databases.synapse.username` | `matrix_user` |
|
||||
| | | | Password | `databases.synapse.password` | |
|
||||
| Keycloak | Keycloak | PostgreSQL | | | |
|
||||
| | | | Name | `databases.keycloak.name` | `keycloak` |
|
||||
| | | | Host | `databases.keycloak.host` | `postgresql` |
|
||||
| | | | Port | `databases.keycloak.port` | `5432` |
|
||||
| | | | Username | `databases.keycloak.username` | `keycloak_user` |
|
||||
| | | | Password | `databases.keycloak.password` | |
|
||||
| | Keycloak Extension | PostgreSQL | | | |
|
||||
| | | | Name | `databases.keycloakExtension.name` | `keycloak_extensions` |
|
||||
| | | | Host | `databases.keycloakExtension.host` | `postgresql` |
|
||||
| | | | Port | `databases.keycloakExtension.port` | `5432` |
|
||||
| | | | Username | `databases.keycloakExtension.username` | `keycloak_extensions_user` |
|
||||
| | | | Password | `databases.keycloakExtension.password` | |
|
||||
| UMS | Notifications API | PostgreSQL | | | |
|
||||
| | | | Name | `databases.umsNotificationsApi.name` | `notificationsapi` |
|
||||
| | | | Host | `databases.umsNotificationsApi.host` | `postgresql` |
|
||||
| | | | Port | `databases.umsNotificationsApi.port` | `5432` |
|
||||
| | | | Username | `databases.umsNotificationsApi.username` | `notificationsapi_user` |
|
||||
| | | | Password | `databases.umsNotificationsApi.password` | |
|
||||
| | Self Service | PostgreSQL | | | |
|
||||
| | | | Name | `databases.umsSelfservice.name` | `selfservice` |
|
||||
| | | | Host | `databases.umsSelfservice.host` | `postgresql` |
|
||||
| | | | Port | `databases.umsSelfservice.port` | `5432` |
|
||||
| | | | Username | `databases.umsSelfservice.username` | `selfservice_user` |
|
||||
| | | | Password | `databases.umsSelfservice.password` | |
|
||||
| Nextcloud | Nextcloud | MariaDB | | | |
|
||||
| | | | Name | `databases.nextcloud.name` | `nextcloud` |
|
||||
| | | | Host | `databases.nextcloud.host` | `mariadb` |
|
||||
| | | | Username | `databases.nextcloud.username` | `nextcloud_user` |
|
||||
| | | | Password | `databases.nextcloud.password` | |
|
||||
| OpenProject | OpenProject | PostgreSQL | | | |
|
||||
| | | | Name | `databases.openproject.name` | `openproject` |
|
||||
| | | | Host | `databases.openproject.host` | `postgresql` |
|
||||
| | | | Port | `databases.openproject.port` | `5432` |
|
||||
| | | | Username | `databases.openproject.username` | `openproject_user` |
|
||||
| | | | Password | `databases.openproject.password` | |
|
||||
| OX App Suite | OX App Suite | MariaDB | | | |
|
||||
| | | | Name | `databases.oxAppSuite.name` | `CONFIGDB` |
|
||||
| | | | Host | `databases.oxAppSuite.host` | `mariadb` |
|
||||
| | | | Username | `databases.oxAppSuite.username` | `root` |
|
||||
| | | | Password | `databases.oxAppSuite.password` | |
|
||||
| XWiki | XWiki | MariaDB | | | |
|
||||
| | | | Name | `databases.xwiki.name` | `xwiki` |
|
||||
| | | | Host | `databases.xwiki.host` | `mariadb` |
|
||||
| | | | Username | `databases.xwiki.username` | `xwiki_user` |
|
||||
| | | | Password | `databases.xwiki.password` | |
|
||||
> **Note**<br>
|
||||
> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely become the preferred option/default in the future and MariaDB might be deprecated at a later point requiring migrations[^1] if you do not select PostgreSQL for new installations.
|
||||
|
||||
| Component | Name | Parameter | Key | Default |
|
||||
| ---------------- | ------------------ | --------- | --------------------------------------------- | ---------------------------- |
|
||||
| Element | Synapse | | | |
|
||||
| | | Type | `databases.synapse.type` | `postgresql` |
|
||||
| | | Name | `databases.synapse.name` | `matrix` |
|
||||
| | | Host | `databases.synapse.host` | `postgresql` |
|
||||
| | | Port | `databases.synapse.port` | `5432` |
|
||||
| | | Username | `databases.synapse.username` | `matrix_user` |
|
||||
| | | Password | `databases.synapse.password` | |
|
||||
| Nubus | Guardian Mgmt API | | | |
|
||||
| | | Type | `databases.umsGuardianManagementApi.type` | `postgresql` |
|
||||
| | | Name | `databases.umsGuardianManagementApi.name` | `guardianmanagementapi` |
|
||||
| | | Host | `databases.umsGuardianManagementApi.host` | `postgresql` |
|
||||
| | | Port | `databases.umsGuardianManagementApi.port` | `5432` |
|
||||
| | | Username | `databases.umsGuardianManagementApi.username` | `guardianmanagementapi_user` |
|
||||
| | | Password | `databases.umsGuardianManagementApi.password` | |
|
||||
| | Keycloak | | | |
|
||||
| | | Type | `databases.keycloak.type` | `postgresql` |
|
||||
| | | Name | `databases.keycloak.name` | `keycloak` |
|
||||
| | | Host | `databases.keycloak.host` | `postgresql` |
|
||||
| | | Port | `databases.keycloak.port` | `5432` |
|
||||
| | | Username | `databases.keycloak.username` | `keycloak_user` |
|
||||
| | | Password | `databases.keycloak.password` | |
|
||||
| | Keycloak Extension | | | |
|
||||
| | | Type | `databases.keycloakExtension.type` | `postgresql` |
|
||||
| | | Name | `databases.keycloakExtension.name` | `keycloak_extensions` |
|
||||
| | | Host | `databases.keycloakExtension.host` | `postgresql` |
|
||||
| | | Port | `databases.keycloakExtension.port` | `5432` |
|
||||
| | | Username | `databases.keycloakExtension.username` | `keycloak_extensions_user` |
|
||||
| | | Password | `databases.keycloakExtension.password` | |
|
||||
| | Notifications API | | | |
|
||||
| | | Type | `databases.umsNotificationsApi.type` | `postgresql` |
|
||||
| | | Name | `databases.umsNotificationsApi.name` | `notificationsapi` |
|
||||
| | | Host | `databases.umsNotificationsApi.host` | `postgresql` |
|
||||
| | | Port | `databases.umsNotificationsApi.port` | `5432` |
|
||||
| | | Username | `databases.umsNotificationsApi.username` | `notificationsapi_user` |
|
||||
| | | Password | `databases.umsNotificationsApi.password` | |
|
||||
| | Self Service | | | |
|
||||
| | | Type | `databases.umsSelfservice.type` | `postgresql` |
|
||||
| | | Name | `databases.umsSelfservice.name` | `selfservice` |
|
||||
| | | Host | `databases.umsSelfservice.host` | `postgresql` |
|
||||
| | | Port | `databases.umsSelfservice.port` | `5432` |
|
||||
| | | Username | `databases.umsSelfservice.username` | `selfservice_user` |
|
||||
| | | Password | `databases.umsSelfservice.password` | |
|
||||
| Nextcloud | Nextcloud | | | |
|
||||
| | | Type | `databases.nextcloud.type` | `mariadb` |
|
||||
| | | Name | `databases.nextcloud.name` | `nextcloud` |
|
||||
| | | Host | `databases.nextcloud.host` | `mariadb` |
|
||||
| | | Port | `databases.nextcloud.port` | `3306` |
|
||||
| | | Username | `databases.nextcloud.username` | `nextcloud_user` |
|
||||
| | | Password | `databases.nextcloud.password` | |
|
||||
| Notes | Notes | | | |
|
||||
| | | Type | `databases.notes.type` | `postgresql` |
|
||||
| | | Name | `databases.notes.name` | `notes` |
|
||||
| | | Host | `databases.notes.host` | `postgresql` |
|
||||
| | | Port | `databases.notes.port` | `5432` |
|
||||
| | | Username | `databases.notes.username` | `notes_user` |
|
||||
| | | Password | `databases.notes.password` | |
|
||||
| OpenProject | OpenProject | | | |
|
||||
| | | Type | `databases.openproject.type` | `postgresql` |
|
||||
| | | Name | `databases.openproject.name` | `openproject` |
|
||||
| | | Host | `databases.openproject.host` | `postgresql` |
|
||||
| | | Port | `databases.openproject.port` | `5432` |
|
||||
| | | Username | `databases.openproject.username` | `openproject_user` |
|
||||
| | | Password | `databases.openproject.password` | |
|
||||
| OX App Suite[^2] | OX App Suite | | | |
|
||||
| | | Type | `databases.oxAppSuite.type` | `mariadb` |
|
||||
| | | Name | `databases.oxAppSuite.name` | `openxchange` |
|
||||
| | | Host | `databases.oxAppSuite.host` | `mariadb` |
|
||||
| | | Port | `databases.oxAppSuite.port` | `3306` |
|
||||
| | | Username | `databases.oxAppSuite.username` | `root` |
|
||||
| | | Password | `databases.oxAppSuite.password` | |
|
||||
| XWiki[^3] | XWiki | | | |
|
||||
| | | Type | `databases.xwiki.type` | `mariadb` |
|
||||
| | | Name | `databases.xwiki.name` | `xwiki` |
|
||||
| | | Host | `databases.xwiki.host` | `mariadb` |
|
||||
| | | Port | `databases.xwiki.port` | `3306` |
|
||||
| | | Username | `databases.xwiki.username` | `root` |
|
||||
| | | Password | `databases.xwiki.password` | |
|
||||
|
||||
# Object storage
|
||||
|
||||
When deploying this suite to production, you need to configure the applications to use your production-grade object
|
||||
storage service.
|
||||
|
||||
| Component | Name | Parameter | Key | Default |
|
||||
| Component | Name | Parameter | Key | Default |
|
||||
|-------------|-------------|-----------------|------------------------------------------|--------------------|
|
||||
| OpenProject | OpenProject | | | |
|
||||
| | | Backend | `objectstores.openproject.backend` | `minio` |
|
||||
| | | Bucket | `objectstores.openproject.bucket` | `openproject` |
|
||||
| | | Endpoint | `objectstores.openproject.endpoint` | |
|
||||
| | | Provider | `objectstores.openproject.provider` | `AWS` |
|
||||
| | | Region | `objectstores.openproject.region` | |
|
||||
| | | Secret | `objectstores.openproject.secret` | |
|
||||
| | | Username | `objectstores.openproject.username` | `openproject_user` |
|
||||
| | | Use IAM profile | `objectstores.openproject.useIAMProfile` | |
|
||||
| OpenProject | OpenProject | | | |
|
||||
| | | Backend | `objectstores.openproject.backend` | `minio` |
|
||||
| | | Bucket | `objectstores.openproject.bucket` | `openproject` |
|
||||
| | | Endpoint | `objectstores.openproject.endpoint` | |
|
||||
| | | Provider | `objectstores.openproject.provider` | `AWS` |
|
||||
| | | Region | `objectstores.openproject.region` | |
|
||||
| | | Secret | `objectstores.openproject.secret` | |
|
||||
| | | Username | `objectstores.openproject.username` | `openproject_user` |
|
||||
| | | Use IAM profile | `objectstores.openproject.useIAMProfile` | |
|
||||
|
||||
# Cache
|
||||
|
||||
When deploying this suite to production, you need to configure the applications to use your production-grade cache
|
||||
service.
|
||||
|
||||
| Component | Name | Type | Parameter | Key | Default |
|
||||
| Component | Name | Type | Parameter | Key | Default |
|
||||
|------------------|------------------|-----------|-----------|------------------------------|------------------|
|
||||
| Intercom Service | Intercom Service | Redis | | | |
|
||||
| | | | Host | `cache.intercomService.host` | `redis-headless` |
|
||||
| | | | Port | `cache.intercomService.port` | `6379` |
|
||||
| Nextcloud | Nextcloud | Redis | | | |
|
||||
| | | | Host | `cache.nextcloud.host` | `redis-headless` |
|
||||
| | | | Port | `cache.nextcloud.port` | `6379` |
|
||||
| OpenProject | OpenProject | Memcached | | | |
|
||||
| | | | Host | `cache.openproject.host` | `memcached` |
|
||||
| | | | Port | `cache.openproject.port` | `11211` |
|
||||
| UMS | Self Service | Memcached | | | |
|
||||
| | | | Host | `cache.umsSelfservice.host` | `memcached` |
|
||||
| | | | Port | `cache.umsSelfservice.port` | `11211` |
|
||||
| Intercom Service | Intercom Service | Redis | | | |
|
||||
| | | | Host | `cache.intercomService.host` | `redis-headless` |
|
||||
| | | | Port | `cache.intercomService.port` | `6379` |
|
||||
| Nextcloud | Nextcloud | Redis | | | |
|
||||
| | | | Host | `cache.nextcloud.host` | `redis-headless` |
|
||||
| | | | Port | `cache.nextcloud.port` | `6379` |
|
||||
| OpenProject | OpenProject | Memcached | | | |
|
||||
| | | | Host | `cache.openproject.host` | `memcached` |
|
||||
| | | | Port | `cache.openproject.port` | `11211` |
|
||||
| UMS | Self Service | Memcached | | | |
|
||||
| | | | Host | `cache.umsSelfservice.host` | `memcached` |
|
||||
| | | | Port | `cache.umsSelfservice.port` | `11211` |
|
||||
|
||||
# Footnotes
|
||||
|
||||
[^1] The upstream product provide some valuable information regarding database migrations:
|
||||
- Nextcloud: https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
|
||||
- XWiki:
|
||||
- https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
|
||||
- https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
|
||||
|
||||
[^2] OX App Suite only supports MariaDB and requires root access, as it manages its databases itself.
|
||||
|
||||
[^3] XWiki requires root access when using MariaDB as sub-wikis are using separate databases that are managed by XWiki. When using PostgreSQL with XWiki no root user is required as the sub-wikis are managed within multiple schemes within a single database.
|
||||
|
||||
@@ -41,7 +41,7 @@ deploy openDesk onto your Kubernetes infrastructure.
|
||||
|
||||
# Requirements
|
||||
|
||||
Detailed system requirements are covered on the [requirements](requirements.md) page.
|
||||
Detailed system requirements are covered on the [requirements](./docs/requirements.md) page.
|
||||
|
||||
# Customize environment
|
||||
|
||||
|
||||
@@ -7,22 +7,30 @@ SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
<!-- TOC -->
|
||||
* [Disclaimer](#disclaimer)
|
||||
* [openDesk supported upgrade path](#opendesk-supported-upgrade-path)
|
||||
* [Releases upgrade details](#releases-upgrade-details)
|
||||
* [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
|
||||
* [Manual checks/actions](#manual-checksactions)
|
||||
* [From v1.1.1](#from-v111)
|
||||
* [Pre-upgrade from v1.1.1](#pre-upgrade-from-v111)
|
||||
* [Helmfile feature update: App settings wrapped in `apps.` element](#helmfile-feature-update-app-settings-wrapped-in-apps-element)
|
||||
* [From v1.1.0](#from-v110)
|
||||
* [Pre-upgrade from v1.1.0](#pre-upgrade-from-v110)
|
||||
* [Helmfile feature update: Component specific `storageClassName`](#helmfile-feature-update-component-specific-storageclassname)
|
||||
* [Helmfile new secret: `secrets.nubus.masterpassword`](#helmfile-new-secret-secretsnubusmasterpassword)
|
||||
* [From v1.0.0](#from-v100)
|
||||
* [Pre-upgrade: Manual checks/steps from v1.0.0](#pre-upgrade-manual-checkssteps-from-v100)
|
||||
* [Helmfile Cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
|
||||
* [Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
|
||||
* [Helmfile Cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
|
||||
* [Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
|
||||
* [Pre-upgrade from v1.0.0](#pre-upgrade-from-v100)
|
||||
* [Helmfile cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
|
||||
* [Helmfile cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
|
||||
* [Helmfile cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
|
||||
* [Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
|
||||
* [Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names](#helmfile-cleanup-streamlining-openxchange-and-oxappsuite-attribute-names)
|
||||
* [Helmfile feature update: Dicts to define `customization.release`](#helmfile-feature-update-dicts-to-define-customizationrelease)
|
||||
* [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
|
||||
* [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
|
||||
* [External requirements: Redis 7.4](#external-requirements-redis-74)
|
||||
* [Automated migrations from v1.0.0](#automated-migrations-from-v100)
|
||||
* [Post-upgrade from v1.0.0](#post-upgrade-from-v100)
|
||||
* [XWiki fix-ups](#xwiki-fix-ups)
|
||||
* [From v0.9.0](#from-v090)
|
||||
* [Pre-upgrade: Manual steps](#pre-upgrade-manual-steps)
|
||||
* [Pre-upgrade from v0.9.0](#pre-upgrade-from-v090)
|
||||
* [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
|
||||
* [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
|
||||
* [Changed openDesk defaults: Matrix presence status disabled](#changed-opendesk-defaults-matrix-presence-status-disabled)
|
||||
@@ -30,58 +38,152 @@ SPDX-License-Identifier: Apache-2.0
|
||||
* [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
|
||||
* [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
|
||||
* [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
|
||||
* [Automated migrations from v0.9.0](#automated-migrations-from-v090)
|
||||
* [Post-upgrade: Manual steps](#post-upgrade-manual-steps)
|
||||
* [Post-upgrade from v0.9.0](#post-upgrade-from-v090)
|
||||
* [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
|
||||
* [Optional Cleanup](#optional-cleanup)
|
||||
* [From v0.8.1](#from-v081)
|
||||
* [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
|
||||
* [Updated customizable template attributes](#updated-customizable-template-attributes)
|
||||
* [`migrations` S3 bucket](#migrations-s3-bucket)
|
||||
* [Related components and artifacts](#related-components-and-artifacts)
|
||||
* [Pre-upgrade from v0.8.1](#pre-upgrade-from-v081)
|
||||
* [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
|
||||
* [Updated customizable template attributes](#updated-customizable-template-attributes)
|
||||
* [`migrations` S3 bucket](#migrations-s3-bucket)
|
||||
* [Automated migrations - Details](#automated-migrations---details)
|
||||
* [From v1.0.0 (automated)](#from-v100-automated)
|
||||
* [From v0.9.0 (automated)](#from-v090-automated)
|
||||
* [Related components and artifacts](#related-components-and-artifacts)
|
||||
* [Development](#development)
|
||||
<!-- TOC -->
|
||||
|
||||
# Disclaimer
|
||||
|
||||
With openDesk 1.0, we aim to offer hassle-free updates/upgrades.
|
||||
Starting with openDesk 1.0, we aim to offer hassle-free updates/upgrades.
|
||||
|
||||
But openDesk requires a defined upgrade path that is described in the section [openDesk supported upgrade path](#opendesk-supported-upgrade-path).
|
||||
Therefore openDesk contains automated migrations between versions to lower the requirements for manual interaction. These automated migrations can have limitations in the way that they need a certain openDesk version to be installed causing a mandatory upgrade path that is described in the section [Automated migrations](#automated-migrations).
|
||||
|
||||
Some upgrades even require manual interaction, which are referenced in the aforementioned section and described further down this document.
|
||||
Manual checks and possible activities are also required by openDesk updates, they are described in the section [Manual update steps](#manual-update-steps).
|
||||
|
||||
> **Known limitations:**<br>
|
||||
> **Note**<br>
|
||||
> Please be sure you read / follow the requirements before you update / upgrade thoroughly.
|
||||
|
||||
> **Known limitations**<br>
|
||||
> We assume that the PV reclaim policy is set to `delete`, resulting in PVs getting deleted as soon as the related PVC was deleted; we will not address explicit deletion for PVs.
|
||||
|
||||
# openDesk supported upgrade path
|
||||
# Automated migrations - Overview and mandatory upgrade path
|
||||
|
||||
When updating your openDesk installation you have to install the releases listed below in the sequential order from
|
||||
the lowest version number you are already on to the more current version you are looking to install.
|
||||
The following table gives an overview of the mandatory upgrade path of openDesk for the automated migrations to work as expected.
|
||||
|
||||
Explanation of the table's columns:
|
||||
- *Coming from*: Check the column for the release you are currently on.
|
||||
- *Mandatory release*: Defines which release(s) support the upgrade from your currently installed version.
|
||||
- *Automatic migration*: Summary of, or link to openDesk's automatic migration details.
|
||||
- *Manual activities*: Reference to required manual steps to upgrade your openDesk installation to the *Mandatory release*.
|
||||
To upgrade existing deployments, you cannot skip any version mentioned in the column *Mandatory version*. When a version number is not fully defined (e.g. `v1.1.x`), you can install any version matching the given schema.
|
||||
|
||||
| Coming from | Mandatory (minimum) release | Manual steps required | Details |
|
||||
| ------------- | --------------------------- | --------------------------------------------------------------------------------- | ----------------------------- |
|
||||
| v1.0.0 | v1.1.0 | [Before upgrade](#pre-upgrade-manual-checkssteps-from-v100) | See [From v1.0.0](#from-v100) |
|
||||
| v0.9.0 | v1.0.0 | [Before](#pre-upgrade-manual-steps) & [After upgrade](#post-upgrade-manual-steps) | See [From v0.9.0](#from-v090) |
|
||||
| v0.8.1 | v0.9.0 | Initializes migration system | See [From v0.8.1](#from-v081) |
|
||||
| not supported | v0.8.1 | First release that supporting updates | |
|
||||
| Mandatory version |
|
||||
| ----------------- |
|
||||
| v1.1.x |
|
||||
| v1.0.0 |
|
||||
| v0.9.0 |
|
||||
| v0.8.1 |
|
||||
|
||||
# Releases upgrade details
|
||||
> **Note**<br>
|
||||
> Be sure you check out the table in the release version you are going to install, an not the one that is currently installed.
|
||||
|
||||
When interested in more details about the automated migrations, please read section [Automated migrations - Details](#automated-migrations---details).
|
||||
|
||||
# Manual checks/actions
|
||||
|
||||
Be sure you check all the sections for the releases your are going to update your current deployment from.
|
||||
|
||||
## From v1.1.1
|
||||
|
||||
### Pre-upgrade from v1.1.1
|
||||
|
||||
#### Helmfile feature update: App settings wrapped in `apps.` element
|
||||
|
||||
We require now [Helmfile v1.0.0-rc.8](https://github.com/helmfile/helmfile/releases/tag/v1.0.0-rc.8) for the deployment. This enables openDesk to lay the foundation for some significant cleanups where the information for the different apps especially on their `enabled` state is needed.
|
||||
|
||||
Therefore it was required to introduce the `apps` level in [`opendesk_main.yaml.gotmpl`](../helmfile/environments/default/opendesk_main.yaml.gotmpl).
|
||||
|
||||
If you have a deployment where you specify settings that can be found in the aforementioned file, usually to disable components or enable others, please ensure you insert the top-level attribute `apps` like shown in the following example:
|
||||
|
||||
So a setting of:
|
||||
|
||||
```
|
||||
certificates:
|
||||
enabled: false
|
||||
notes:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
needs to be changed to:
|
||||
|
||||
```
|
||||
apps:
|
||||
certificates:
|
||||
enabled: false
|
||||
notes:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
## From v1.1.0
|
||||
|
||||
### Pre-upgrade from v1.1.0
|
||||
|
||||
#### Helmfile feature update: Component specific `storageClassName`
|
||||
|
||||
With openDesk 1.1.1 we support component specific `storageClassName` definitions beside the global ones, but we had to adapt the structure that can be found in `persistence.yaml.gotmpl` to achieve this in a clean manner.
|
||||
|
||||
If you have set custom `persistence.size.*`-values for your deployment, please continue reading as you need to adapt your `persistence` settings to the new structure.
|
||||
|
||||
When comparing the [old 1.1.0 structure](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.0/helmfile/environments/default/persistence.yaml.gotmpl) with the [new one](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.1/helmfile/environments/default/persistence.yaml.gotmpl) you can spot the changes:
|
||||
|
||||
- We replaced `persistence.size` with `persistence.storages`.
|
||||
- Below each component you can define now the `size` and the optional component specific `storageClassName`.
|
||||
- We streamlined all components to be on the same level, as Nubus had an additional level of nesting before.
|
||||
|
||||
So a setting of:
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
size:
|
||||
synapse: "1Gi"
|
||||
```
|
||||
|
||||
needs to be changed to:
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
storages:
|
||||
synapse:
|
||||
size: "1Gi"
|
||||
```
|
||||
|
||||
or for the Nubus related entries, the following:
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
size:
|
||||
nubus:
|
||||
ldapServerData: "1Gi"
|
||||
```
|
||||
|
||||
needs to be changed to:
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
storages:
|
||||
nubusLdapServerData:
|
||||
size: "1Gi"
|
||||
```
|
||||
|
||||
#### Helmfile new secret: `secrets.nubus.masterpassword`
|
||||
|
||||
A not yet templated secret was discovered in the Nubus deployment that is now defined in [`secrets.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl) with the key `secrets.nubus.masterpassword`. If you define your own secrets, please be sure this new secret is set to the value of the `MASTER_PASSWORD` environment variable used in your deployment.
|
||||
|
||||
## From v1.0.0
|
||||
|
||||
### Pre-upgrade: Manual checks/steps from v1.0.0
|
||||
### Pre-upgrade from v1.0.0
|
||||
|
||||
#### Helmfile Cleanup: Restructured `/helmfile/files/theme` folder
|
||||
#### Helmfile cleanup: Restructured `/helmfile/files/theme` folder
|
||||
|
||||
If you make use of the [theme folder](../helmfile/files/theme/) or the [`theme.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl), e.g. to applying your own imagery, please ensure you adhere to the new structure of the folder and the yaml-file.
|
||||
|
||||
#### Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`
|
||||
#### Helmfile cleanup: Consistent use of `*.yaml.gotmpl`
|
||||
|
||||
In v1.0.0 the files in [`/helmfile/environments/default`](../helmfile/environments/default/) had mixed extensions,
|
||||
we have streamlined them to consistently use `*.yaml.gotmpl`.
|
||||
@@ -91,7 +193,7 @@ This change requires manual action likely in two situations:
|
||||
1. You are referencing our upstream files from the aforementioned directory, e.g. in your Argo CD deployment. Please update your references to use the filenames with the new extension.
|
||||
2. You have custom files containing configuration information that are named just `*.yaml`: Please rename them to `*.yaml.gotmpl`.
|
||||
|
||||
#### Helmfile Cleanup: Prefixing certain app directories with `opendesk-`
|
||||
#### Helmfile cleanup: Prefixing certain app directories with `opendesk-`
|
||||
|
||||
To make it more obvious that some elements from below the [`apps`](../helmfile/apps/) directory are completely
|
||||
provided by openDesk, we have prefixed these app directories with `opendesk-`.
|
||||
@@ -106,7 +208,7 @@ The described changes most likely require manual action in the following situati
|
||||
|
||||
- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
|
||||
|
||||
#### Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services
|
||||
#### Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services
|
||||
|
||||
In v1.0.0 there was a directory `/helmfile/apps/services` that was intended to contain all the services an operator had to provide externally for production deployments.
|
||||
|
||||
@@ -236,20 +338,34 @@ The update from openDesk 1.0.0 contains Redis 7.4.1, like the other openDesk bun
|
||||
|
||||
Please ensure for the Redis you are using that it is updated to at least 7.4 to support the requirement of OX App Suite.
|
||||
|
||||
### Automated migrations from v1.0.0
|
||||
### Post-upgrade from v1.0.0
|
||||
|
||||
With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.
|
||||
#### XWiki fix-ups
|
||||
|
||||
openDesk's automated migrations takes care of this upgrade requirement described here for
|
||||
[Nubus 1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.5.1/en/changelog.html#migrate-existing-ldap-server-to-mirror-mode-readiness),
|
||||
creating the config map with the mentioned label.
|
||||
Unfortunately XWiki does not upgrade itself as expected. A bug with the supplier has already been filed. The following additional steps are required:
|
||||
|
||||
> **Note**<br>
|
||||
> Details can be found in [run_3.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
|
||||
1. To enforce re-indexing of the now fixed full-text search access the XWiki Pod and run the following commands to delete two search related directories. To complete this you need to restart the XWiki Pod, but that is anyway part of the next step:
|
||||
```
|
||||
rm -rf /usr/local/xwiki/data/store/solr/search_9
|
||||
rm -rf /usr/local/xwiki/data/cache/solr/search_9
|
||||
```
|
||||
|
||||
2. This is necessary if the openDesk single sign-on does not longer work and you get a standard XWiki login dialogue instead.
|
||||
- Find the XWiki ConfigMap `xwiki-init-scripts` and find in its `entrypoint` key data the lines beginning with `xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg"`
|
||||
- Before those lines add the following line, of course setting `<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>` to a value you are happy with.
|
||||
```
|
||||
xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg" 'xwiki.superadminpassword' '<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>'
|
||||
```
|
||||
- Restart the XWiki Pod.
|
||||
- Access XWiki's web UI and login with `superadmin` and the above set password.
|
||||
- Once XWiki UI is fully rendered, remove the line with the temporary `superadmin` password from the aforementioned ConfigMap.
|
||||
- Restart the XWiki Pod.
|
||||
|
||||
You should have now a properly working XWiki instance with single sign-on and full-text search.
|
||||
|
||||
## From v0.9.0
|
||||
|
||||
### Pre-upgrade: Manual steps
|
||||
### Pre-upgrade from v0.9.0
|
||||
|
||||
#### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus
|
||||
|
||||
@@ -433,16 +549,7 @@ The IAMs admin account `Administrator` is a member of this group by default, but
|
||||
|
||||
If you need other accounts to use the API, please assign them to the aforementioned group.
|
||||
|
||||
### Automated migrations from v0.9.0
|
||||
|
||||
The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.
|
||||
|
||||
The permissions required to execute the migrations can be found in the migration's Helm chart [`role.yaml'](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/v1.3.5/charts/opendesk-migrations/templates/role.yaml?ref_type=tags#L29)
|
||||
|
||||
> **Note**<br>
|
||||
> Details can be found in [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
|
||||
|
||||
### Post-upgrade: Manual steps
|
||||
### Post-upgrade from v0.9.0
|
||||
|
||||
#### Configuration Improvement: Separate user permission for using Video Conference component
|
||||
|
||||
@@ -474,12 +581,14 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
|
||||
|
||||
## From v0.8.1
|
||||
|
||||
### Updated `cluster.networking.cidr`
|
||||
### Pre-upgrade from v0.8.1
|
||||
|
||||
#### Updated `cluster.networking.cidr`
|
||||
|
||||
- Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1); please update your setup accordingly if you explicitly set this value.
|
||||
- Reference:[cluster.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/cluster.yaml)
|
||||
|
||||
### Updated customizable template attributes
|
||||
#### Updated customizable template attributes
|
||||
|
||||
- Action: Please update your custom deployment values according to the updated default value structure.
|
||||
- References:
|
||||
@@ -488,12 +597,34 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
|
||||
- `monitoring.` prefix for `prometheus.*` and `graphana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
|
||||
- `smtp.` prefix for `localpartNoReply`, see [smtp.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/smtp.yaml).
|
||||
|
||||
### `migrations` S3 bucket
|
||||
#### `migrations` S3 bucket
|
||||
|
||||
- Action: For self-managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
|
||||
- Reference: `objectstores.migrations` in [objectstores.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/objectstores.yaml)
|
||||
|
||||
# Related components and artifacts
|
||||
# Automated migrations - Details
|
||||
|
||||
## From v1.0.0 (automated)
|
||||
|
||||
With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.
|
||||
|
||||
openDesk's automated migrations takes care of this upgrade requirement described here for
|
||||
[Nubus 1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.5.1/en/changelog.html#migrate-existing-ldap-server-to-mirror-mode-readiness),
|
||||
creating the config map with the mentioned label.
|
||||
|
||||
> **Note**<br>
|
||||
> Details can be found in [run_3.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
|
||||
|
||||
## From v0.9.0 (automated)
|
||||
|
||||
The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.
|
||||
|
||||
The permissions required to execute the migrations can be found in the migration's Helm chart [`role.yaml'](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/v1.3.5/charts/opendesk-migrations/templates/role.yaml?ref_type=tags#L29)
|
||||
|
||||
> **Note**<br>
|
||||
> Details can be found in [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
|
||||
|
||||
## Related components and artifacts
|
||||
|
||||
openDesk comes with two upgrade steps as part of the deployment; they can be found in the folder [/helmfile/apps](../helmfile/apps/) as all other components:
|
||||
|
||||
|
||||
202
docs/permissions.md
Normal file
202
docs/permissions.md
Normal file
@@ -0,0 +1,202 @@
|
||||
<!--
|
||||
SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
-->
|
||||
|
||||
<h1>Roles & Permissions</h1>
|
||||
|
||||
openDesk uses role-based access control (RBAC) to manage permissions. This system ensures that users have access only to the resources necessary for their role.
|
||||
|
||||
<!-- TOC -->
|
||||
* [Identity and Access Management (IAM)](#identity-and-access-management-iam)
|
||||
* [Permissions](#permissions)
|
||||
* [Roles](#roles)
|
||||
* [Application usage](#application-usage)
|
||||
* [Application administration](#application-administration)
|
||||
* [Groups](#groups)
|
||||
* [Global groups](#global-groups)
|
||||
* [Application groups](#application-groups)
|
||||
* [Standard access to applications](#standard-access-to-applications)
|
||||
* [Administrative access to applications](#administrative-access-to-applications)
|
||||
* [Custom groups](#custom-groups)
|
||||
* [Assigning roles/groups and permissions](#assigning-rolesgroups-and-permissions)
|
||||
* [Predefined roles / user templates](#predefined-roles--user-templates)
|
||||
* [*openDesk User*](#opendesk-user)
|
||||
* [*openDesk Administrator*](#opendesk-administrator)
|
||||
* [Managing permissions](#managing-permissions)
|
||||
* [Hierarchies and delegation](#hierarchies-and-delegation)
|
||||
* [Audit/Logging](#auditlogging)
|
||||
* [Reporting](#reporting)
|
||||
* [Delegation](#delegation)
|
||||
* [Regular review](#regular-review)
|
||||
* [Applications](#applications)
|
||||
* [Roles/groups](#rolesgroups)
|
||||
<!-- TOC -->
|
||||
|
||||
# Identity and Access Management (IAM)
|
||||
|
||||
Within openDesk's Identity and Access Management component Nubus the openDesk user accounts are managed, as well as some core roles and permissions.
|
||||
|
||||
## Permissions
|
||||
|
||||
A permission represents a specific authorization that defines an action a user is allowed to perform on a resource.
|
||||
|
||||
As openDesk consists of multiple applications, each application may have different needs regarding its fine-grained internal permissions, usually these permissions are manged within each component.
|
||||
|
||||
The overall permissions to access the application as well as group membership of users is managed in the IAM.
|
||||
|
||||
## Roles
|
||||
|
||||
Roles are defined sets of permissions that can be assigned to users. Each role corresponds to a specific set of tasks and responsibilities within the system. In openDesk's IAM, two roles are defined by default:
|
||||
|
||||
- **openDesk Administrator**: Manages openDesk-global settings, such as users and groups.
|
||||
- **openDesk User**: Can login to openDesk to make use of defined openDesk applications.
|
||||
|
||||
> **Note**<br>
|
||||
> It is strongly recommended that a user account is not granted both roles at the same time to address the segregation of duties, though it is not enforced by openDesk.
|
||||
|
||||
### Application usage
|
||||
|
||||
To access and use applications in openDesk and to address [the principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), a user needs to have the necessary permissions set. openDesk defines the following permissions to access applications:
|
||||
|
||||
- **Groupware**: Use email, calendar and address book applications.
|
||||
- **Chat**: Use the chat application.
|
||||
- **Knowledge Management**: Use the wiki application.
|
||||
- **Project Management**: Use the project management application.
|
||||
- **File Sharing**: Use the file sharing application.
|
||||
- **Video Conference**: Use the video conferencing application.
|
||||
|
||||
### Application administration
|
||||
|
||||
For applications that provide application-specific administrative settings, openDesk defines the following permissions:
|
||||
|
||||
- **Knowledge Management Admin**: Manage the wiki application.
|
||||
- **Project Management Admin**: Manage the project management application settings.
|
||||
- **File Sharing Admin**: Manage the file sharing administrative settings.
|
||||
|
||||
## Groups
|
||||
|
||||
Groups help in clustering users with similar responsibilities and enable easier assignment of roles or permissions. It is often the case that a group maps directly to a role.
|
||||
|
||||
openDesk predefines the following groups.
|
||||
|
||||
### Global groups
|
||||
|
||||
- **Domain Users**: Members of this group are *openDesk Users*.
|
||||
- **Domain Admins**: Members of this group are *openDesk IAM Administrators*. By default this group is also enable for two-factor authentication (2FA).
|
||||
- **2fa-users**: Members of this group that are forced to use two-factor authentication (2FA).
|
||||
- **IAM API - Full Access**: Members of this group have full (read and write) access to the IAM's REST API.
|
||||
|
||||
### Application groups
|
||||
|
||||
When editing a user in the IAM you can select if a user can access or get elevated admin permission for a specific application within the "openDesk" tab. The selection is stored as an attribute on the user object, but for other applications it is helpful to also expose the information as a group membership. Therefore openDesk comes with the following [groups](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/63-groups.yaml).
|
||||
|
||||
To easily identify these groups all of them are prefixed with `managed-by-Attribute-`.
|
||||
|
||||
> **Note**<br>
|
||||
> The membership of these groups is automatically managed, based on the user's attributes from the "openDesk" tab. So any changes directly to the groups will be overwritten, please always use the "openDesk" of the respective user. The IAM supports to edit user attributes in multiple accounts at once.
|
||||
|
||||
#### Standard access to applications
|
||||
|
||||
Unless a user is member of a group the respective application is not shown in the portal.
|
||||
|
||||
> **Note**<br>
|
||||
> In openDesk's identity provider the required OIDC claims to access an application are only granted when the respective group membership is available. So even if a user who is not a member of an application group, knows the link to the application and calls it directly, the single sign-on will not be successful.
|
||||
|
||||
- **managed-by-Attribute-Groupware**: Members of this group have access to the groupware applications.
|
||||
- **managed-by-Attribute-Fileshare**: Members of this group have access to the file sharing application.
|
||||
- **managed-by-Attribute-Projectmanagement**: Members of this group have access to the project management application.
|
||||
- **managed-by-Attribute-Knowledgemanagement**: Members of this group have access to the wiki application.
|
||||
- **managed-by-Attribute-Livecollaboration**: Members of this group have access to the chat application.
|
||||
- **managed-by-Attribute-Videoconference**: Members of this group have access to the video conferencing application.
|
||||
|
||||
#### Administrative access to applications
|
||||
|
||||
Within some applications it is possible to grant users elevated permissions, these are also primarily managed by attributes from the "openDesk" tab when editing a user, but are also automatically mapped to the following groups:
|
||||
|
||||
- **managed-by-Attribute-FileshareAdmin**: Members of this group can administrate the file sharing application.
|
||||
- **managed-by-Attribute-ProjectmanagementAdmin**: Members of this group can administrate the project management application.
|
||||
- **managed-by-Attribute-KnowledgemanagementAdmin**: Members of this group can administrate the wiki application.
|
||||
|
||||
### Custom groups
|
||||
|
||||
While openDesk ships with predefined groups, additional groups can be [created](https://docs.opendesk.eu/administration/gruppen/) by an *IAM Administrator*.
|
||||
|
||||
## Assigning roles/groups and permissions
|
||||
|
||||
Users get roles assigned based on their responsibilities and the tasks they need to perform. This assignment can be done by an admin through the [administration portal](https://docs.opendesk.eu/administration/).
|
||||
|
||||
## Predefined roles / user templates
|
||||
|
||||
openDesk defines [templates](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/65-usertemplate.yaml) for the *User* and *Administrator* roles. The templates can be used to create users with these roles by an *openDesk Administrator* using the [administration portal](https://docs.opendesk.eu/administration/).
|
||||
|
||||
> **Notes**<br>
|
||||
> Additional/custom templates can be created using the UDM REST API.
|
||||
|
||||
### *openDesk User*
|
||||
|
||||
The *openDesk User* template sets the primary group to *Domain Users* and initially sets the following permissions:
|
||||
|
||||
- **Groupware**: Enabled
|
||||
- **Chat**: Enabled
|
||||
- **Knowledge Management**: Enabled
|
||||
- **Project Management**: Enabled
|
||||
- **File Sharing**: Enabled
|
||||
- **Video Conference**: Enabled
|
||||
- **Knowledge Management Admin**: Disabled
|
||||
- **Project Management Admin**: Disabled
|
||||
- **File Sharing Admin**: Disabled
|
||||
|
||||
### *openDesk Administrator*
|
||||
|
||||
The *openDesk Administrator* template sets the primary group to *Domain Admins* and initially sets the following permissions:
|
||||
|
||||
- **Groupware**: Disabled
|
||||
- **Chat**: Disabled
|
||||
- **Knowledge Management**: Disabled
|
||||
- **Project Management**: Disabled
|
||||
- **File Sharing**: Disabled
|
||||
- **Video Conference**: Disabled
|
||||
- **Knowledge Management Admin**: Disabled
|
||||
- **Project Management Admin**: Disabled
|
||||
- **File Sharing Admin**: Disabled
|
||||
|
||||
## Managing permissions
|
||||
|
||||
*Administrators* can manage permissions of *Users* using the [administration portal](https://docs.opendesk.eu/administration/).
|
||||
|
||||
By using roles and permissions, openDesk ensures that users have the appropriate level of access, enhancing both security and efficiency.
|
||||
|
||||
## Hierarchies and delegation
|
||||
|
||||
The IAM allows the nesting of groups, in that case a group has no or not only users as members but other groups.
|
||||
|
||||
## Audit/Logging
|
||||
|
||||
Univention is about to provide an audit logging which brings the idea of the [UCS based directory logger](https://docs.software-univention.de/manual/5.0/en/domain-ldap/ldap-directory.html#audit-proof-logging-of-ldap-changes) to Nubus. openDesk will offer this feature as soon as it is made available in Nubus.
|
||||
|
||||
## Reporting
|
||||
|
||||
The IAM webinterface supports the export of reports for users and groups, which are the essential objects when it comes to permissions. These data exports can be subject to custom data analysis.
|
||||
|
||||
## Delegation
|
||||
|
||||
Currently the temporary assignment of roles is not supported. Role membership must be managed at the time of granting / revoking the membership.
|
||||
|
||||
## Regular review
|
||||
|
||||
While the overall role and permission setup must be checked by the customer including the respective custom roles, the openDesk team is challenging and improving the role and permission management on a regular basis, e.g. to address the need for a distinct "support" role.
|
||||
|
||||
# Applications
|
||||
|
||||
As managing all the application permissions within the IAM would require a superset of permissions to be available in the IAM causing a high level of administrative complexity, the permissions are usually managed within an application itself and mapped to roles/groups that are managed in the IAM.
|
||||
|
||||
## Roles/groups
|
||||
|
||||
For each IAM group it can be configured for which openDesk application the group should be visible. Like with users this is done in the "openDesk" tab of the [group administration](https://docs.opendesk.eu/administration/gruppen/).
|
||||
|
||||
> **Note**<br>
|
||||
> Currently the openDesk applications do not support nested groups. As a result only direct group memberships of users are processed in the application.<br>
|
||||
> The plan is to enable the openDesk applications to either support nested groups or to actively provision users into an application while resolving the nested group memberships for the application.
|
||||
|
||||
Within an application each available group can get a set of application specific permissions assigned.
|
||||
@@ -26,7 +26,7 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
|
||||
- Domain and DNS Service
|
||||
- Ingress controller (Ingress NGINX)
|
||||
- [Helm](https://helm.sh/) >= v3.9.0
|
||||
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc5**
|
||||
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc8**
|
||||
- [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
|
||||
- Volume provisioner supporting RWO (read-write-once)
|
||||
- Certificate handling with [cert-manager](https://cert-manager.io/)
|
||||
@@ -48,7 +48,8 @@ Any self-hosted or managed K8s cluster >= 1.24 listed in
|
||||
|
||||
The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/kubespray) based clusters.
|
||||
|
||||
> **Note:** The deployment is not tested against OpenShift.
|
||||
> **Note**<br>
|
||||
> The deployment is not tested against OpenShift.
|
||||
|
||||
# Ingress controller
|
||||
|
||||
|
||||
@@ -1,8 +1,7 @@
|
||||
<!--
|
||||
SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
-->
|
||||
|
||||
<h1>Kubernetes Security Context</h1>
|
||||
|
||||
<!-- TOC -->
|
||||
@@ -63,7 +62,7 @@ containerSecurityContext:
|
||||
## privileged
|
||||
|
||||
|
||||
Privileged Pods disable most security mechanisms and must be disallowed.
|
||||
Privileged Pods eliminate most security mechanisms and must be disallowed.
|
||||
|
||||
```yaml
|
||||
containerSecurityContext:
|
||||
@@ -93,7 +92,7 @@ containerSecurityContext:
|
||||
## seccompProfile
|
||||
|
||||
|
||||
Seccomp profile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
|
||||
The seccompProfile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
|
||||
|
||||
```yaml
|
||||
containerSecurityContext:
|
||||
@@ -113,7 +112,7 @@ containerSecurityContext:
|
||||
## readOnlyRootFilesystem
|
||||
|
||||
|
||||
Containers should have an immutable file systems, so that attackers could not modify application code or download malicious code.
|
||||
Containers should have an immutable file systems, so that attackers can not modify application code or download malicious code.
|
||||
|
||||
```yaml
|
||||
containerSecurityContext:
|
||||
@@ -133,10 +132,10 @@ containerSecurityContext:
|
||||
# Status quo
|
||||
|
||||
|
||||
openDesk aims to achieve that all security relevant settings are explicitly templated and comply with security recommendations.
|
||||
openDesk aims to ensure that all security relevant settings are explicitly templated and comply with security recommendations.
|
||||
|
||||
|
||||
The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are also properly templated by the given Helm charts.
|
||||
The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are properly templated by the Helm charts.
|
||||
|
||||
|
||||
This list gives you an overview of templated security settings and if they comply with security standards:
|
||||
@@ -144,11 +143,11 @@ This list gives you an overview of templated security settings and if they compl
|
||||
|
||||
- **yes**: Value is set to `true`
|
||||
- **no**: Value is set to `false`
|
||||
- **n/a**: No explicitly templated in openDesk and default is used.
|
||||
- **n/a**: Not explicitly templated in openDesk; default is used.
|
||||
|
||||
| process | status | allowPrivilegeEscalation | privileged | readOnlyRootFilesystem | runAsNonRoot | runAsUser | runAsGroup | seccompProfile | capabilities |
|
||||
| ------- | ------ | ------------------------ | ---------- | ---------------------- | ------------ | --------- | ---------- | -------------- | ------------ |
|
||||
| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT","MKNOD"] |
|
||||
| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","FOWNER","SYS_CHROOT"] |
|
||||
| **cryptpad**/cryptpad | :x: | no | no | no | yes | 4001 | 4001 | yes | yes |
|
||||
| **element**/matrix-neoboard-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
|
||||
| **element**/matrix-neochoice-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
|
||||
@@ -164,14 +163,41 @@ This list gives you an overview of templated security settings and if they compl
|
||||
| **jitsi**/jitsi | :white_check_mark: | no | no | yes | yes | 1993 | 1993 | yes | yes |
|
||||
| **jitsi**/jitsi/jitsi/jibri | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no ["SYS_ADMIN"] |
|
||||
| **jitsi**/jitsi/jitsi/jicofo | :x: | no | no | no | no | 0 | 0 | yes | no |
|
||||
| **jitsi**/jitsi/jitsi/jigasi | :x: | no | no | no | no | 0 | 0 | yes | no |
|
||||
| **jitsi**/jitsi/jitsi/jvb | :x: | no | no | no | no | 0 | 0 | yes | no |
|
||||
| **jitsi**/jitsi/jitsi/prosody | :x: | no | no | no | no | 0 | 0 | yes | no |
|
||||
| **jitsi**/jitsi/jitsi/web | :x: | no | no | no | no | 0 | 0 | yes | no |
|
||||
| **jitsi**/jitsi/patchJVB | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 65532 | 65532 | yes | yes |
|
||||
| **nextcloud**/opendesk-nextcloud/apache2 | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
|
||||
| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 101 | 101 | yes | yes |
|
||||
| **nextcloud**/opendesk-nextcloud/aio | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
|
||||
| **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
|
||||
| **nextcloud**/opendesk-nextcloud/php | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
|
||||
| **notes**/impress/backend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **notes**/impress/frontend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **notes**/impress/yProvider | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **nubus**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/intercom-service/provisioning | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
|
||||
| **nubus**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/keycloak | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusGuardian/authorizationApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusGuardian/managementApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusGuardian/managementUi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusGuardian/openPolicyAgent | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusKeycloakBootstrap | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusKeycloakExtensions/handler | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
|
||||
| **nubus**/ums/nubusKeycloakExtensions/proxy | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
|
||||
| **nubus**/ums/nubusLdapNotifier | :x: | no | n/a | yes | yes | 101 | 102 | yes | yes |
|
||||
| **nubus**/ums/nubusNotificationsApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusPortalConsumer | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
|
||||
| **nubus**/ums/nubusPortalFrontend | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusPortalServer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusProvisioning | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusProvisioning/nats | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusSelfServiceConsumer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusStackDataUms | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusUdmListener | :x: | no | n/a | yes | yes | 102 | 65534 | yes | yes |
|
||||
| **nubus**/ums/nubusUdmRestApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusUmcGateway | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **nubus**/ums/nubusUmcServer | :x: | no | n/a | yes | no | 0 | 0 | yes | yes |
|
||||
| **open-xchange**/dovecot | :x: | no | n/a | yes | n/a | n/a | n/a | yes | no ["CHOWN","DAC_OVERRIDE","KILL","NET_BIND_SERVICE","SETGID","SETUID","SYS_CHROOT"] |
|
||||
| **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
|
||||
| **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
@@ -183,34 +209,26 @@ This list gives you an overview of templated security settings and if they compl
|
||||
| **open-xchange**/open-xchange/appsuite/guard-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **open-xchange**/open-xchange/nextcloud-integration-ui | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
|
||||
| **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **open-xchange**/opendesk-open-xchange-bootstrap | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **opendesk-migrations-post**/opendesk-migrations-post | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **opendesk-migrations-pre**/opendesk-migrations-pre | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **opendesk-openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **opendesk-services**/opendesk-static-files | :x: | no | n/a | yes | yes | 101 | 101 | yes | yes |
|
||||
| **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **open-xchange**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
|
||||
| **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
|
||||
| **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **services**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **services**/minio | :x: | no | no | no | yes | 1000 | 0 | yes | yes |
|
||||
| **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
|
||||
| **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **univention-management-stack**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
|
||||
| **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
|
||||
| **univention-management-stack**/ums/keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **univention-management-stack**/ums/keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
|
||||
| **univention-management-stack**/ums/ldap-notifier | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
|
||||
| **univention-management-stack**/ums/portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
|
||||
| **univention-management-stack**/ums/selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
|
||||
| **univention-management-stack**/ums/stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
|
||||
| **univention-management-stack**/ums/stack-gateway | :x: | no | no | no | yes | 1001 | 0 | yes | yes |
|
||||
| **univention-management-stack**/ums/umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
|
||||
| **univention-management-stack**/ums/umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
|
||||
| **services-external**/cassandra | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **services-external**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
|
||||
| **services-external**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services-external**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services-external**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services-external**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services-external**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
|
||||
| **services-external**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **services-external**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **services-external**/minio | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **services-external**/opendesk-dkimpy-milter | :x: | yes | no | yes | yes | 1000 | 1000 | yes | no |
|
||||
| **services-external**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
|
||||
| **services-external**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **services-external**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
|
||||
| **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |
|
||||
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
|
||||
|
||||
# Collabora Controller - Enterprise Only
|
||||
# Source: https://github.com/CollaboraOnline/online
|
||||
@@ -20,7 +20,7 @@ repositories:
|
||||
username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "collabora-online"
|
||||
@@ -28,18 +28,24 @@ releases:
|
||||
version: "{{ .Values.charts.collabora.version }}"
|
||||
values:
|
||||
- "values.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.collaboraOnline }}
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "values-enterprise.yaml.gotmpl"
|
||||
{{- end }}
|
||||
{{- range .Values.customization.release.collaboraOnline }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.collabora.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.collabora.enabled }}
|
||||
- name: "collabora-controller"
|
||||
chart: "collabora-controller-repo/{{ .Values.charts.collaboraController.name }}"
|
||||
version: "{{ .Values.charts.collaboraController.version }}"
|
||||
values:
|
||||
{{ range .Values.customization.release.collaboraController }}
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "values-coco-enterprise.yaml.gotmpl"
|
||||
{{- end }}
|
||||
{{- range .Values.customization.release.collaboraController }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.collaboraController.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.collaboraController.enabled }}
|
||||
|
||||
commonLabels:
|
||||
deployStage: "050-components"
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
63
helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
Normal file
63
helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
Normal file
@@ -0,0 +1,63 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
controller:
|
||||
enableHashmapParallelization: true
|
||||
ingressUrl: "https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
|
||||
namespacedRole: true
|
||||
# CoolController uses `app.kubernetes.io/name` label to find deployment resource
|
||||
# openDesk uses `fullnameOverride` in Collabora Deployment that updates `metadata.name` not the `app.kubernetes.io/name`
|
||||
# Therefore we use the default of `collabora-online` for the `resourceName`
|
||||
resourceName: "collabora-online"
|
||||
statsInterval: 2000
|
||||
watchNamespace: {{ (.Values.apps.collabora.namespace | default .Release.Namespace | quote) }}
|
||||
|
||||
documentMigrator:
|
||||
enabled: true
|
||||
coolMemoryUtilization: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
coolMemoryLimit: {{ .Values.resources.collabora.limits.memory }}
|
||||
|
||||
leaderElection:
|
||||
enabled: {{ if gt .Values.replicas.collaboraController 1 }}true{{ else }}false{{ end }}
|
||||
|
||||
image:
|
||||
repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collaboraController.registry }}/{{ .Values.images.collaboraController.repository }}"
|
||||
tag: {{ .Values.images.collaboraController.tag | quote }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
|
||||
ingress:
|
||||
enabled: {{ .Values.ingress.enabled }}
|
||||
className: {{ .Values.ingress.ingressClassName | quote }}
|
||||
hosts:
|
||||
- host: "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
|
||||
paths:
|
||||
- path: "/controller"
|
||||
pathType: "Prefix"
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsGroup: 2000
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions:
|
||||
|
||||
replicaCount: {{ .Values.replicas.collaboraController }}
|
||||
|
||||
resources:
|
||||
{{ .Values.resources.collaboraController | toYaml | nindent 2 }}
|
||||
|
||||
...
|
||||
15
helmfile/apps/collabora/values-enterprise.yaml.gotmpl
Normal file
15
helmfile/apps/collabora/values-enterprise.yaml.gotmpl
Normal file
@@ -0,0 +1,15 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
image:
|
||||
repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
|
||||
autoscaling:
|
||||
enabled: {{ .Values.apps.collaboraController.enabled }}
|
||||
minReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.maxReplicas }}
|
||||
targetMemoryUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
targetCPUUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetCPUUtilizationPercentage }}
|
||||
scaleDownDisabled: {{ .Values.enterpriseFeatures.collabora.autoscaling.scaleDownDisabled }}
|
||||
...
|
||||
@@ -27,7 +27,7 @@ collabora:
|
||||
{{- else }}
|
||||
--o:logging.anonymize.anonymize_user_data=true
|
||||
{{- end }}
|
||||
{{- if .Values.collaboraController.enabled }}
|
||||
{{- if .Values.apps.collaboraController.enabled }}
|
||||
--o:indirection_endpoint.url=https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/routeToken
|
||||
--o:monitors.monitor[0]=wss://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/ws
|
||||
--o:monitors.monitor[0][@retryInterval]=5
|
||||
@@ -49,7 +49,7 @@ imagePullSecrets:
|
||||
|
||||
ingress:
|
||||
annotations:
|
||||
{{- if .Values.collaboraController.enabled }}
|
||||
{{- if .Values.apps.collaboraController.enabled }}
|
||||
nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_RouteToken"
|
||||
{{- else }}
|
||||
nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "cryptpad"
|
||||
@@ -18,10 +18,10 @@ releases:
|
||||
version: "{{ .Values.charts.cryptpad.version }}"
|
||||
values:
|
||||
- "values.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.cryptpad }}
|
||||
{{- range .Values.customization.release.cryptpad }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.cryptpad.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.cryptpad.enabled }}
|
||||
|
||||
commonLabels:
|
||||
deployStage: "050-components"
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -10,35 +10,35 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
|
||||
- name: "element-well-known-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.elementWellKnown.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
|
||||
- name: "synapse-web-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.synapseWeb.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
|
||||
- name: "synapse-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.synapse.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
|
||||
- name: "synapse-create-account-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.synapseCreateAccount.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
|
||||
|
||||
# openDesk Matrix Widgets
|
||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
|
||||
@@ -48,35 +48,35 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
|
||||
- name: "matrix-neoboard-widget-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
|
||||
- name: "matrix-neochoice-widget-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
|
||||
- name: "matrix-neodatefix-widget-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
|
||||
- name: "matrix-neodatefix-bot-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
|
||||
|
||||
# openDesk Enterprise Repositories
|
||||
|
||||
@@ -88,28 +88,28 @@ repositories:
|
||||
username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
|
||||
- name: "synapse-adminbot-web-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.synapseAdminbotWeb.verify }}
|
||||
username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
|
||||
- name: "synapse-groupsync-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.synapseGroupsync.verify }}
|
||||
username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
|
||||
- name: "synapse-pipe-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.synapsePipe.verify }}
|
||||
username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "opendesk-element"
|
||||
@@ -117,10 +117,10 @@ releases:
|
||||
version: "{{ .Values.charts.element.version }}"
|
||||
values:
|
||||
- "values-element.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskElement }}
|
||||
{{- range .Values.customization.release.opendeskElement }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.element.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-well-known"
|
||||
@@ -128,10 +128,10 @@ releases:
|
||||
version: "{{ .Values.charts.elementWellKnown.version }}"
|
||||
values:
|
||||
- "values-well-known.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskWellKnown }}
|
||||
{{- range .Values.customization.release.opendeskWellKnown }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.element.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-synapse-web"
|
||||
@@ -139,10 +139,10 @@ releases:
|
||||
version: "{{ .Values.charts.synapseWeb.version }}"
|
||||
values:
|
||||
- "values-synapse-web.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskSynapseWeb }}
|
||||
{{- range .Values.customization.release.opendeskSynapseWeb }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.element.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-synapse"
|
||||
@@ -150,10 +150,10 @@ releases:
|
||||
version: "{{ .Values.charts.synapse.version }}"
|
||||
values:
|
||||
- "values-synapse.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskSynapse }}
|
||||
{{- range .Values.customization.release.opendeskSynapse }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.element.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-matrix-user-verification-service-bootstrap"
|
||||
@@ -161,7 +161,7 @@ releases:
|
||||
version: "{{ .Values.charts.synapseCreateAccount.version }}"
|
||||
values:
|
||||
- "values-matrix-user-verification-service-bootstrap.yaml.gotmpl"
|
||||
installed: {{ .Values.element.enabled }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-matrix-user-verification-service"
|
||||
@@ -169,7 +169,7 @@ releases:
|
||||
version: "{{ .Values.charts.matrixUserVerificationService.version }}"
|
||||
values:
|
||||
- "values-matrix-user-verification-service.yaml.gotmpl"
|
||||
installed: {{ .Values.element.enabled }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "matrix-neoboard-widget"
|
||||
@@ -177,7 +177,7 @@ releases:
|
||||
version: "{{ .Values.charts.matrixNeoboardWidget.version }}"
|
||||
values:
|
||||
- "values-matrix-neoboard-widget.yaml.gotmpl"
|
||||
installed: {{ .Values.element.enabled }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "matrix-neochoice-widget"
|
||||
@@ -185,7 +185,7 @@ releases:
|
||||
version: "{{ .Values.charts.matrixNeochoiseWidget.version }}"
|
||||
values:
|
||||
- "values-matrix-neochoice-widget.yaml.gotmpl"
|
||||
installed: {{ .Values.element.enabled }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "matrix-neodatefix-widget"
|
||||
@@ -193,7 +193,7 @@ releases:
|
||||
version: "{{ .Values.charts.matrixNeodatefixWidget.version }}"
|
||||
values:
|
||||
- "values-matrix-neodatefix-widget.yaml.gotmpl"
|
||||
installed: {{ .Values.element.enabled }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "matrix-neodatefix-bot-bootstrap"
|
||||
@@ -201,7 +201,7 @@ releases:
|
||||
version: "{{ .Values.charts.synapseCreateAccount.version }}"
|
||||
values:
|
||||
- "values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl"
|
||||
installed: {{ .Values.element.enabled }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "matrix-neodatefix-bot"
|
||||
@@ -209,7 +209,7 @@ releases:
|
||||
version: "{{ .Values.charts.matrixNeodatefixBot.version }}"
|
||||
values:
|
||||
- "values-matrix-neodatefix-bot.yaml.gotmpl"
|
||||
installed: {{ .Values.element.enabled }}
|
||||
installed: {{ .Values.apps.element.enabled }}
|
||||
timeout: 900
|
||||
|
||||
# openDesk Enterprise Releases
|
||||
@@ -217,70 +217,77 @@ releases:
|
||||
chart: "synapse-admin-repo/{{ .Values.charts.synapseAdmin.name }}"
|
||||
version: "{{ .Values.charts.synapseAdmin.version }}"
|
||||
values:
|
||||
{{ range .Values.customization.release.opendeskSynapseAdmin }}
|
||||
- "values-synapse-admin.yaml.gotmpl"
|
||||
{{- range .Values.customization.release.opendeskSynapseAdmin }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.elementAdmin.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.elementAdmin.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-synapse-adminbot-bootstrap"
|
||||
chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
|
||||
version: "{{ .Values.charts.synapseCreateAccount.version }}"
|
||||
values:
|
||||
{{ range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
|
||||
- "values-synapse-adminbot-bootstrap.yaml.gotmpl"
|
||||
{{- range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.elementAdmin.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.elementAdmin.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-synapse-adminbot-pipe"
|
||||
chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
|
||||
version: "{{ .Values.charts.synapsePipe.version }}"
|
||||
values:
|
||||
{{ range .Values.customization.release.opendeskSynapseAdminbotPipe }}
|
||||
- "values-synapse-adminbot-pipe.yaml.gotmpl"
|
||||
{{- range .Values.customization.release.opendeskSynapseAdminbotPipe }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.elementAdmin.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.elementAdmin.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-synapse-adminbot-web"
|
||||
chart: "synapse-adminbot-web-repo/{{ .Values.charts.synapseAdminbotWeb.name }}"
|
||||
version: "{{ .Values.charts.synapseAdminbotWeb.version }}"
|
||||
values:
|
||||
{{ range .Values.customization.release.opendeskSynapseAdminbotWeb }}
|
||||
- "values-synapse-adminbot-web.yaml.gotmpl"
|
||||
{{- range .Values.customization.release.opendeskSynapseAdminbotWeb }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.elementAdmin.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.elementAdmin.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-synapse-auditbot-bootstrap"
|
||||
chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
|
||||
version: "{{ .Values.charts.synapseCreateAccount.version }}"
|
||||
values:
|
||||
{{ range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
|
||||
- "values-synapse-auditbot-bootstrap.yaml.gotmpl"
|
||||
{{- range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.elementAdmin.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.elementAdmin.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-synapse-auditbot-pipe"
|
||||
chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
|
||||
version: "{{ .Values.charts.synapsePipe.version }}"
|
||||
values:
|
||||
{{ range .Values.customization.release.opendeskSynapseAuditbotPipe }}
|
||||
- "values-synapse-auditbot-pipe.yaml.gotmpl"
|
||||
{{- range .Values.customization.release.opendeskSynapseAuditbotPipe }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.elementAdmin.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.elementAdmin.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-synapse-groupsync"
|
||||
chart: "synapse-groupsync-repo/{{ .Values.charts.synapseGroupsync.name }}"
|
||||
version: "{{ .Values.charts.synapseGroupsync.version }}"
|
||||
values:
|
||||
{{ range .Values.customization.release.opendeskSynapseGroupsync }}
|
||||
- "values-synapse-groupsync.yaml.gotmpl"
|
||||
{{- range .Values.customization.release.opendeskSynapseGroupsync }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.elementGroupsync.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.elementGroupsync.enabled }}
|
||||
timeout: 900
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -98,7 +98,7 @@ configuration:
|
||||
- org.matrix.msc2762.receive.event:net.nordeck.meetings.sub_meetings.send_message
|
||||
- org.matrix.msc3973.user_directory_search
|
||||
|
||||
welcomeUserId: "@meetings-bot:{{ .Values.global.domain }}"
|
||||
welcomeUserId: "@meetings-bot:{{ .Values.global.matrixDomain | default .Values.global.domain }}"
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
@@ -81,8 +81,8 @@ liveness sample:
|
||||
enabled: true
|
||||
|
||||
persistence:
|
||||
size: {{ .Values.persistence.size.matrixNeoDateFixBot | quote }}
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.storages.matrixNeoDateFixBot.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.matrixNeoDateFixBot.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
|
||||
88
helmfile/apps/element/values-synapse-admin.yaml.gotmpl
Normal file
88
helmfile/apps/element/values-synapse-admin.yaml.gotmpl
Normal file
@@ -0,0 +1,88 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
hosts:
|
||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
configuration:
|
||||
adminBot:
|
||||
backupPhrase: {{ .Values.secrets.matrixAdminBot.backupPassphrase | quote }}
|
||||
#name: "adminbot"
|
||||
#secretName: "matrix-adminbot-account"
|
||||
#secretKey: "access_token"
|
||||
auditBot:
|
||||
backupPhrase: {{ .Values.secrets.matrixAuditBot.backupPassphrase | quote }}
|
||||
#name: "auditbot"
|
||||
database:
|
||||
host: {{ .Values.databases.synapse.host | quote }}
|
||||
port: {{ .Values.databases.synapse.port }}
|
||||
name: {{ .Values.databases.synapse.name | quote }}
|
||||
user: {{ .Values.databases.synapse.username | quote }}
|
||||
password:
|
||||
value: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
|
||||
requireAuth: {{ .Values.databases.synapse.requireAuth }}
|
||||
channelBinding: {{ .Values.databases.synapse.channelBinding | quote }}
|
||||
connectTimeout: {{ .Values.databases.synapse.connectTimeout }}
|
||||
clientEncoding: {{ .Values.databases.synapse.clientEncoding | quote }}
|
||||
keepalives: {{ .Values.databases.synapse.keepalives }}
|
||||
keepalivesIdle: {{ .Values.databases.synapse.keepalivesIdle }}
|
||||
keepalivesInterval: {{ .Values.databases.synapse.keepalivesInterval }}
|
||||
keepalivesCount: {{ .Values.databases.synapse.keepalivesCount }}
|
||||
replication: {{ .Values.databases.synapse.replication }}
|
||||
gssencmode: {{ .Values.databases.synapse.gssencmode | quote }}
|
||||
sslmode: {{ .Values.databases.synapse.sslmode | quote }}
|
||||
sslcompression: {{ .Values.databases.synapse.sslcompression }}
|
||||
sslMinProtocolVersion: {{ .Values.databases.synapse.sslMinProtocolVersion | quote }}
|
||||
connectionPoolMin: {{ .Values.databases.synapse.connectionPoolMin }}
|
||||
connectionPoolMax: {{ .Values.databases.synapse.connectionPoolMax }}
|
||||
# Settings regarding homeserver.
|
||||
homeserver:
|
||||
# -- URL of synapse deployment. As default the url of synapse will be used.
|
||||
#baseUrl: ""
|
||||
homeserver:
|
||||
serverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
|
||||
ldap:
|
||||
base: {{ .Values.ldap.baseDn | quote }}
|
||||
bind_dn: "uid=ldapsearch_element,cn=users,dc=swp-ldap,dc=internal"
|
||||
bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
|
||||
filter: "(memberOf=cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,dc=swp-ldap,dc=internal)"
|
||||
uri: {{ printf "ldap://%s:389" .Values.ldap.host | quote }}
|
||||
cron:
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSyncAdmins.registry | quote }}
|
||||
repository: {{ .Values.images.elementSyncAdmins.repository | quote }}
|
||||
tag: {{ .Values.images.elementSyncAdmins.tag | quote }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
#fullnameOverride: "opendesk-synapse-admin"
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSynapseAdmin.registry | quote }}
|
||||
repository: {{ .Values.images.elementSynapseAdmin.repository | quote }}
|
||||
tag: {{ .Values.images.elementSynapseAdmin.tag | quote }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
ingress:
|
||||
enabled: {{ .Values.ingress.enabled }}
|
||||
tls:
|
||||
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||
{{- if .Values.certificate.selfSigned }}
|
||||
extraEnvVars:
|
||||
- name: "NODE_EXTRA_CA_CERTS"
|
||||
value: "/etc/ssl/certs/ca-certificates.crt"
|
||||
extraVolumes:
|
||||
- name: "trusted-cert-secret-volume"
|
||||
secret:
|
||||
secretName: "opendesk-certificates-ca-tls"
|
||||
items:
|
||||
- key: "ca.crt"
|
||||
path: "ca-certificates.crt"
|
||||
extraVolumeMounts:
|
||||
- name: "trusted-cert-secret-volume"
|
||||
mountPath: "/etc/ssl/certs/ca-certificates.crt"
|
||||
subPath: "ca-certificates.crt"
|
||||
{{- end }}
|
||||
...
|
||||
@@ -0,0 +1,33 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
hosts:
|
||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
configuration:
|
||||
username: "adminbot"
|
||||
pod: "opendesk-synapse-0"
|
||||
secretName: "matrix-adminbot-account"
|
||||
password: {{ .Values.secrets.matrixAdminBot.password | quote }}
|
||||
pipeConfig:
|
||||
enabled: true
|
||||
type: "admin"
|
||||
secretName: "matrix-adminbot-config"
|
||||
asToken: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
|
||||
hsToken: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
|
||||
serviceUrl: "http://opendesk-synapse-web:8008"
|
||||
backupPassphrase: {{ .Values.secrets.matrixAdminBot.backupPassphrase | quote }}
|
||||
homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
|
||||
url: {{ .Values.images.synapseCreateUser.repository | quote }}
|
||||
tag: {{ .Values.images.synapseCreateUser.tag | quote }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
fullnameOverride: "matrix-adminbot-bootstrap"
|
||||
...
|
||||
@@ -0,0 +1,22 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
hosts:
|
||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
configuration:
|
||||
secretName: "matrix-adminbot-config"
|
||||
#serviceName: "opendesk-synapse-adminbot-pipe"
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
|
||||
url: {{ .Values.images.elementPipe.repository | quote }}
|
||||
tag: {{ .Values.images.elementPipe.tag | quote }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
fullnameOverride: "opendesk-synapse-adminbot-pipe"
|
||||
...
|
||||
@@ -0,0 +1,26 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
hosts:
|
||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
configuration:
|
||||
homeserver:
|
||||
serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
|
||||
#fullnameOverride: "opendesk-synapse-adminbot-web"
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementAdminBot.registry | quote }}
|
||||
repository: {{ .Values.images.elementAdminBot.repository | quote }}
|
||||
tag: {{ .Values.images.elementAdminBot.tag | quote }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
ingress:
|
||||
enabled: {{ .Values.ingress.enabled }}
|
||||
tls:
|
||||
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||
...
|
||||
@@ -0,0 +1,33 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
hosts:
|
||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
configuration:
|
||||
username: "auditbot"
|
||||
pod: "opendesk-synapse-0"
|
||||
secretName: "matrix-auditbot-account"
|
||||
password: {{ .Values.secrets.matrixAuditBot.password | quote }}
|
||||
pipeConfig:
|
||||
enabled: true
|
||||
type: "admin"
|
||||
secretName: "matrix-auditbot-config"
|
||||
asToken: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
|
||||
hsToken: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
|
||||
serviceUrl: "http://opendesk-synapse-web:8008"
|
||||
backupPassphrase: {{ .Values.secrets.matrixAuditBot.backupPassphrase | quote }}
|
||||
homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
|
||||
url: {{ .Values.images.synapseCreateUser.repository | quote }}
|
||||
tag: {{ .Values.images.synapseCreateUser.tag | quote }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
fullnameOverride: "matrix-auditbot-bootstrap"
|
||||
...
|
||||
@@ -0,0 +1,22 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
hosts:
|
||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
configuration:
|
||||
secretName: "matrix-auditbot-config"
|
||||
#serviceName: "opendesk-synapse-auditbot-pipe"
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
|
||||
url: {{ .Values.images.elementPipe.repository | quote }}
|
||||
tag: {{ .Values.images.elementPipe.tag | quote }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
fullnameOverride: "opendesk-synapse-auditbot-pipe"
|
||||
...
|
||||
56
helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl
Normal file
56
helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl
Normal file
@@ -0,0 +1,56 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
hosts:
|
||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
configuration:
|
||||
asToken: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
|
||||
dryRun: false
|
||||
hsToken: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
|
||||
id: "gps"
|
||||
homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
|
||||
registrationSharedSecret: {{ .Values.secrets.synapse.registrationSharedSecret | quote }}
|
||||
runOnce: false
|
||||
username: "groupsyncbot"
|
||||
ldap:
|
||||
attributes:
|
||||
name: "description"
|
||||
uid: "uid"
|
||||
base: {{ .Values.ldap.baseDn | quote }}
|
||||
bind_dn: "uid=ldapsearch_element,cn=users,dc=swp-ldap,dc=internal"
|
||||
bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
|
||||
check_interval_seconds: 60
|
||||
type: mapped-ldap
|
||||
uri: "ldap://ums-ldap-server:389"
|
||||
spaces:
|
||||
- groups:
|
||||
- externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,dc=swp-ldap,dc=internal"
|
||||
powerLevel: 50
|
||||
- externalId: "cn=managed-by-attribute-Livecollaboration,cn=groups,dc=swp-ldap,dc=internal"
|
||||
id: "c3122e32-4e05-4bf8-8a5d-66679076ed36"
|
||||
name: "openDesk"
|
||||
subspaces:
|
||||
- groups:
|
||||
- externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,dc=swp-ldap,dc=internal"
|
||||
powerLevel: 50
|
||||
id: "e7889d96-5baa-4e21-be6e-12c66b2e9565"
|
||||
name: "openDesk Element Admins"
|
||||
provisionerDefaultRooms:
|
||||
- id: "c3122e32-4e05-4bf8-8a5d-66679076ed36"
|
||||
properties:
|
||||
name: "openDesk"
|
||||
# Name of group sync service (default opendesk-synapse-groupsync)
|
||||
groupSyncService: "opendesk-synapse-groupsync"
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementGroupsync.registry | quote }}
|
||||
url: {{ .Values.images.elementGroupsync.repository | quote }}
|
||||
tag: {{ .Values.images.elementGroupsync.tag | quote }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
...
|
||||
@@ -69,6 +69,60 @@ configuration:
|
||||
regex: "@.*"
|
||||
url: null
|
||||
sender_localpart: ox-appsuite
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
{{- if .Values.apps.elementAdmin.enabled }}
|
||||
- as_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
|
||||
hs_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
|
||||
id: "element-adminbot-pipe"
|
||||
namespaces:
|
||||
rooms:
|
||||
- exclusive: false
|
||||
regex: "!.*:{{ .Values.global.domain }}"
|
||||
users:
|
||||
- exclusive: false
|
||||
regex: "@.*:.*"
|
||||
- exclusive: true
|
||||
regex: "@adminbot:{{ .Values.global.domain }}"
|
||||
de.sorunome.msc2409.push_ephemeral: true
|
||||
org.matrix.msc3202: true
|
||||
url: "http://opendesk-synapse-adminbot-pipe:9995"
|
||||
rate_limited: false
|
||||
sender_localpart: "adminbot-sendernotinuse"
|
||||
- as_token: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
|
||||
hs_token: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
|
||||
id: "element-auditbot-pipe"
|
||||
namespaces:
|
||||
rooms:
|
||||
- exclusive: false
|
||||
regex: "!.*:{{ .Values.global.domain }}"
|
||||
users:
|
||||
- exclusive: false
|
||||
regex: "@.*:.*"
|
||||
- exclusive: true
|
||||
regex: "@auditbot:{{ .Values.global.domain }}"
|
||||
de.sorunome.msc2409.push_ephemeral: true
|
||||
org.matrix.msc3202: true
|
||||
url: "http://opendesk-synapse-auditbot-pipe:9995"
|
||||
rate_limited: false
|
||||
sender_localpart: "auditbot-sendernotinuse"
|
||||
{{- end }}
|
||||
{{- if .Values.apps.elementGroupsync.enabled }}
|
||||
- as_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
|
||||
hs_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
|
||||
id: "gps"
|
||||
namespaces:
|
||||
rooms:
|
||||
- exclusive: false
|
||||
regex: "!.*:{{ .Values.global.domain }}"
|
||||
users:
|
||||
- exclusive: false
|
||||
regex: '@.*:{{ .Values.global.domain }}'
|
||||
url: "http://opendesk-synapse-groupsync:10010"
|
||||
rate_limited: false
|
||||
sender_localpart: "groupsyncbot"
|
||||
{{- end }}
|
||||
registrationSharedSecret: {{ .Values.secrets.synapse.registrationSharedSecret | quote }}
|
||||
{{- end }}
|
||||
|
||||
presence:
|
||||
enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
|
||||
@@ -78,7 +132,7 @@ configuration:
|
||||
|
||||
smtp:
|
||||
senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
|
||||
host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
port: 25
|
||||
tls: false
|
||||
starttls: false
|
||||
@@ -176,8 +230,8 @@ image:
|
||||
tag: {{ .Values.images.synapse.tag | quote }}
|
||||
|
||||
persistence:
|
||||
size: {{ .Values.persistence.size.synapse | quote }}
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.storages.synapse.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.synapse.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "jitsi"
|
||||
@@ -18,10 +18,10 @@ releases:
|
||||
version: "{{ .Values.charts.jitsi.version }}"
|
||||
values:
|
||||
- "values-jitsi.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.jitsi }}
|
||||
{{- range .Values.customization.release.jitsi }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.jitsi.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.jitsi.enabled }}
|
||||
timeout: 900
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -85,7 +85,7 @@ jitsi:
|
||||
- secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||
hosts:
|
||||
- "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
|
||||
extraConfigJs:
|
||||
extraConfig:
|
||||
doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
|
||||
extraEnvs:
|
||||
TURN_ENABLE: "1"
|
||||
@@ -138,8 +138,8 @@ jitsi:
|
||||
resources:
|
||||
{{ .Values.resources.prosody | toYaml | nindent 6 }}
|
||||
persistence:
|
||||
size: {{ .Values.persistence.size.prosody | quote }}
|
||||
storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.storages.prosody.size | quote }}
|
||||
storageClassName: {{ coalesce .Values.persistence.storages.prosody.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {}
|
||||
@@ -175,6 +175,35 @@ jitsi:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
|
||||
jigasi:
|
||||
replicaCount: {{ .Values.replicas.jigasi }}
|
||||
enabled: {{ .Values.sip.jigasi.enabled }}
|
||||
image:
|
||||
repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jigasi.registry }}/{{ .Values.images.jigasi.repository }}"
|
||||
tag: {{ .Values.images.jigasi.tag | quote }}
|
||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
extraEnvs:
|
||||
JIGASI_SIP_PASSWORD: {{ .Values.sip.jigasi.password | quote }}
|
||||
JIGASI_SIP_PORT: {{ .Values.sip.jigasi.port | quote }}
|
||||
JIGASI_SIP_SERVER: {{ .Values.sip.jigasi.server | quote }}
|
||||
JIGASI_SIP_TRANSPORT: {{ .Values.sip.jigasi.transport | quote }}
|
||||
JIGASI_SIP_URI: {{ .Values.sip.jigasi.uri | quote }}
|
||||
xmpp:
|
||||
password: {{ .Values.secrets.jitsi.jigasiXmppPassword | quote }}
|
||||
resources:
|
||||
{{ .Values.resources.jigasi | toYaml | nindent 6 }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities: {}
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.jigasi | toYaml | nindent 8 }}
|
||||
jvb:
|
||||
replicaCount: {{ .Values.replicas.jvb }}
|
||||
# The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
|
||||
|
||||
@@ -10,14 +10,14 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
|
||||
- name: "nextcloud-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.nextcloud.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "opendesk-nextcloud-management"
|
||||
@@ -25,24 +25,30 @@ releases:
|
||||
version: "{{ .Values.charts.nextcloudManagement.version }}"
|
||||
values:
|
||||
- "values-nextcloud-mgmt.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskNextcloudManagement }}
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "values-nextcloud-mgmt-enterprise.yaml.gotmpl"
|
||||
{{- end }}
|
||||
{{- range .Values.customization.release.opendeskNextcloudManagement }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
waitForJobs: true
|
||||
wait: true
|
||||
installed: {{ .Values.nextcloud.enabled }}
|
||||
installed: {{ .Values.apps.nextcloud.enabled }}
|
||||
timeout: 900
|
||||
- name: "opendesk-nextcloud"
|
||||
chart: "nextcloud-repo/{{ .Values.charts.nextcloud.name }}"
|
||||
version: "{{ .Values.charts.nextcloud.version }}"
|
||||
values:
|
||||
- "values-nextcloud.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskNextcloud }}
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "values-nextcloud-enterprise.yaml.gotmpl"
|
||||
{{- end }}
|
||||
{{- range .Values.customization.release.opendeskNextcloud }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
needs:
|
||||
- "opendesk-nextcloud-management"
|
||||
installed: {{ .Values.nextcloud.enabled }}
|
||||
installed: {{ .Values.apps.nextcloud.enabled }}
|
||||
|
||||
commonLabels:
|
||||
deployStage: "050-components"
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
aio:
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
|
||||
...
|
||||
@@ -0,0 +1,12 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
|
||||
configuration:
|
||||
enterprise:
|
||||
subscriptionKey: {{ if .Values.enterpriseKeys.nextcloud.subscriptionKey }}{{ .Values.enterpriseKeys.nextcloud.subscriptionKey | quote }}{{ end }}
|
||||
subscriptionData: {{ if .Values.enterpriseKeys.nextcloud.subscriptionData}}{{ .Values.enterpriseKeys.nextcloud.subscriptionData | quote }}{{ end }}
|
||||
...
|
||||
@@ -25,18 +25,20 @@ configuration:
|
||||
value: "nextcloud"
|
||||
password:
|
||||
value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
|
||||
|
||||
antivirus:
|
||||
{{- if .Values.antivirus.icap.host }}
|
||||
host: {{ .Values.antivirus.icap.host | quote }}
|
||||
port: {{ .Values.antivirus.icap.port | quote }}
|
||||
{{- else }}
|
||||
{{- if .Values.clamavDistributed.enabled }}
|
||||
{{- if .Values.apps.clamavDistributed.enabled }}
|
||||
host: "clamav-icap"
|
||||
{{- else if .Values.clamavSimple.enabled }}
|
||||
{{- else if .Values.apps.clamavSimple.enabled }}
|
||||
host: "clamav-simple"
|
||||
{{- end }}
|
||||
port: 1344
|
||||
{{- end }}
|
||||
|
||||
cache:
|
||||
auth:
|
||||
enabled: true
|
||||
@@ -47,10 +49,36 @@ configuration:
|
||||
host: {{ .Values.cache.nextcloud.host | quote }}
|
||||
port: {{ .Values.cache.nextcloud.port | quote }}
|
||||
tls: {{ .Values.cache.nextcloud.tls }}
|
||||
|
||||
feature:
|
||||
apps:
|
||||
contacts:
|
||||
enabled: false
|
||||
cryptpad:
|
||||
enabled: {{ .Values.apps.cryptpad.enabled }}
|
||||
filesZip:
|
||||
enabled: true
|
||||
groupfolders:
|
||||
enabled: true
|
||||
integrationOpenproject:
|
||||
enabled: {{ .Values.apps.openproject.enabled }}
|
||||
spreed:
|
||||
enabled: true
|
||||
circles:
|
||||
enabled: false
|
||||
|
||||
collabora:
|
||||
# internalWopiUrl: ""
|
||||
wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
|
||||
|
||||
database:
|
||||
{{ if eq .Values.databases.nextcloud.type "mariadb" }}
|
||||
type: "mysql"
|
||||
{{ else if eq .Values.databases.nextcloud.type "postgresql" }}
|
||||
type: "pgsql"
|
||||
{{ else }}
|
||||
{{ .Values.databases.nextcloud.type | quote }}
|
||||
{{ end }}
|
||||
host: {{ .Values.databases.nextcloud.host | quote }}
|
||||
port: {{ .Values.databases.nextcloud.port | quote }}
|
||||
name: {{ .Values.databases.nextcloud.name | quote }}
|
||||
@@ -58,12 +86,20 @@ configuration:
|
||||
username:
|
||||
value: {{ .Values.databases.nextcloud.username | quote }}
|
||||
password:
|
||||
{{- if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
|
||||
value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
|
||||
{{- else if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
|
||||
value: {{ .Values.databases.nextcloud.password | default .Values.secrets.postgresql.nextcloudUser | quote }}
|
||||
{{- else }}
|
||||
value: {{ .Values.databases.nextcloud.password | quote }}
|
||||
{{- end }}
|
||||
|
||||
ldap:
|
||||
host: {{ .Values.ldap.host | quote }}
|
||||
password:
|
||||
value: {{ .Values.secrets.nubus.ldapSearch.nextcloud | quote }}
|
||||
adminGroupName: "managed-by-attribute-FileshareAdmin"
|
||||
|
||||
objectstore:
|
||||
auth:
|
||||
accessKey:
|
||||
@@ -77,16 +113,19 @@ configuration:
|
||||
port: {{ .Values.objectstores.nextcloud.port | quote }}
|
||||
pathStyle: {{ .Values.objectstores.nextcloud.pathStyle | quote }}
|
||||
useSSL: {{ .Values.objectstores.nextcloud.useSSL | quote }}
|
||||
|
||||
oidc:
|
||||
username:
|
||||
value: "opendesk-nextcloud"
|
||||
password:
|
||||
value: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
|
||||
|
||||
opendeskIntegration:
|
||||
username:
|
||||
value: "opendesk_username"
|
||||
password:
|
||||
value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
|
||||
|
||||
sharing:
|
||||
allowLinks: {{ .Values.functional.filestore.sharing.external.enabled }}
|
||||
allowMailNotification: {{ .Values.functional.filestore.sharing.external.enabled }}
|
||||
@@ -100,6 +139,7 @@ configuration:
|
||||
defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
|
||||
defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
|
||||
sendPasswordMail: {{ .Values.functional.filestore.sharing.external.sendPasswordMail | quote }}
|
||||
|
||||
smtp:
|
||||
auth:
|
||||
enabled: false
|
||||
@@ -107,12 +147,13 @@ configuration:
|
||||
value: ""
|
||||
password:
|
||||
value: ""
|
||||
host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
port: 25
|
||||
fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
|
||||
mailDomain: "{{ .Values.global.domain }}"
|
||||
security: ""
|
||||
skipVerifyPeer: true
|
||||
|
||||
quota:
|
||||
default: "{{ .Values.functional.filestore.quota.default }} GB"
|
||||
retentionObligation:
|
||||
|
||||
@@ -63,6 +63,13 @@ aio:
|
||||
port: {{ .Values.cache.nextcloud.port | quote }}
|
||||
tls: {{ .Values.cache.nextcloud.tls }}
|
||||
database:
|
||||
{{ if eq .Values.databases.nextcloud.type "mariadb" }}
|
||||
type: "mysql"
|
||||
{{ else if eq .Values.databases.nextcloud.type "postgresql" }}
|
||||
type: "pgsql"
|
||||
{{ else }}
|
||||
{{ .Values.databases.nextcloud.type | quote }}
|
||||
{{ end }}
|
||||
host: {{ .Values.databases.nextcloud.host | quote }}
|
||||
port: {{ .Values.databases.nextcloud.port | quote }}
|
||||
name: {{ .Values.databases.nextcloud.name | quote }}
|
||||
@@ -70,7 +77,13 @@ aio:
|
||||
username:
|
||||
value: {{ .Values.databases.nextcloud.username | quote }}
|
||||
password:
|
||||
{{- if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
|
||||
value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
|
||||
{{- else if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
|
||||
value: {{ .Values.databases.nextcloud.password | default .Values.secrets.postgresql.nextcloudUser | quote }}
|
||||
{{- else }}
|
||||
value: {{ .Values.databases.nextcloud.password | quote }}
|
||||
{{- end }}
|
||||
trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "impress"
|
||||
@@ -19,10 +19,10 @@ releases:
|
||||
wait: true
|
||||
values:
|
||||
- "values.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.notes }}
|
||||
{{- range .Values.customization.release.notes }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.notes.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.notes.enabled }}
|
||||
timeout: 1800
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url:
|
||||
"{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
|
||||
"{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
|
||||
# Intercom Service
|
||||
# Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
|
||||
- name: "intercom-service-repo"
|
||||
@@ -19,7 +19,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
|
||||
# openDesk Keycloak Bootstrap Chart
|
||||
- name: "opendesk-keycloak-bootstrap-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
@@ -27,7 +27,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
|
||||
# NGINX S3 Gateway Chart
|
||||
- name: "nginx-s3-gateway-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
@@ -35,7 +35,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
|
||||
|
||||
releases:
|
||||
# Univention Management Stack Umbrella Chart
|
||||
@@ -44,10 +44,10 @@ releases:
|
||||
version: "{{ .Values.charts.nubus.version }}"
|
||||
values:
|
||||
- "values-nubus.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.ums }}
|
||||
{{- range .Values.customization.release.ums }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.nubus.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.nubus.enabled }}
|
||||
timeout: 900
|
||||
# Intercom-Service
|
||||
- name: "intercom-service"
|
||||
@@ -55,10 +55,10 @@ releases:
|
||||
version: "{{ .Values.charts.intercomService.version }}"
|
||||
values:
|
||||
- "values-intercom-service.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.intercomService }}
|
||||
{{- range .Values.customization.release.intercomService }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.nubus.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.nubus.enabled }}
|
||||
|
||||
# openDesk Keycloak Bootstrap Chart
|
||||
- name: "opendesk-keycloak-bootstrap"
|
||||
@@ -66,12 +66,12 @@ releases:
|
||||
version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
|
||||
values:
|
||||
- "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskKeycloakBootstrap }}
|
||||
{{- range .Values.customization.release.opendeskKeycloakBootstrap }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
needs:
|
||||
- "ums"
|
||||
installed: {{ .Values.nubus.enabled }}
|
||||
installed: {{ .Values.apps.nubus.enabled }}
|
||||
timeout: 900
|
||||
|
||||
# NGINX S3 Gateway (when cluster minio is not used)
|
||||
@@ -80,10 +80,10 @@ releases:
|
||||
version: "{{ .Values.charts.nginxS3Gateway.version }}"
|
||||
values:
|
||||
- "values-nginx-s3-gateway.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.nginxS3Gateway }}
|
||||
{{- range .Values.customization.release.nginxS3Gateway }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ not .Values.minio.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ not .Values.apps.minio.enabled }}
|
||||
timeout: 900
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -17,7 +17,7 @@ global:
|
||||
cnAdmin:
|
||||
password: {{ .Values.secrets.nubus.ldapSecret | quote }}
|
||||
nubusDeployment: true
|
||||
nubusMasterPassword: {{ env "MASTER_PASSWORD" | default "sovereign-workplace" | quote }}
|
||||
nubusMasterPassword: {{ .Values.secrets.nubus.masterpassword | quote }}
|
||||
objectStorage:
|
||||
bucket: {{ .Values.objectstores.nubus.bucket | quote }}
|
||||
connection:
|
||||
@@ -119,7 +119,7 @@ global:
|
||||
|
||||
ingress:
|
||||
# temporary fix
|
||||
{{- if not .Values.minio.enabled }}
|
||||
{{- if not .Values.apps.minio.enabled }}
|
||||
enabled: false
|
||||
{{- end }}
|
||||
certManager:
|
||||
@@ -377,6 +377,7 @@ nubusGuardian:
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
|
||||
nubusNotificationsApi:
|
||||
enabled: false
|
||||
additionalAnnotations:
|
||||
intents.otterize.com/service-name: "ums-notifications-api"
|
||||
containerSecurityContext:
|
||||
@@ -524,7 +525,7 @@ nubusKeycloakExtensions:
|
||||
password: "umcKeycloakExtensionsDatabasePassword"
|
||||
smtp:
|
||||
connection:
|
||||
host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
port: 25
|
||||
ssl: false
|
||||
starttls: false
|
||||
@@ -581,8 +582,8 @@ nubusPortalConsumer:
|
||||
accessKey: {{ .Values.objectstores.nubus.username | quote }}
|
||||
secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
|
||||
persistence:
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.size.nubus.portalConsumer | quote }}
|
||||
size: {{ .Values.persistence.storages.nubusPortalConsumer.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.nubusPortalConsumer.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
podAnnotations:
|
||||
intents.otterize.com/service-name: "ums-portal-consumer"
|
||||
provisioningApi:
|
||||
@@ -736,6 +737,7 @@ nubusUdmRestApi:
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
ingress:
|
||||
enabled: {{ .Values.functional.externalServices.nubus.udmRestApi.enabled }}
|
||||
certManager:
|
||||
enabled: false
|
||||
tls:
|
||||
@@ -797,60 +799,6 @@ nubusLdapServer:
|
||||
repository: {{ .Values.images.nubusLdapServerDhInitContainer.repository }}
|
||||
tag: {{ .Values.images.nubusLdapServerDhInitContainer.tag }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
|
||||
extraVolumes:
|
||||
- name: "migration-scripts"
|
||||
secret:
|
||||
secretName: "ums-ldap-server-migration"
|
||||
defaultMode: 0555
|
||||
extraVolumeMounts:
|
||||
- name: "migration-scripts"
|
||||
mountPath: "/entrypoint.d/30-purge.sh"
|
||||
subPath: "30-purge.sh"
|
||||
- name: "migration-scripts"
|
||||
mountPath: "/entrypoint.d/95-slapadd-24-ldiff.sh"
|
||||
subPath: "95-slapadd-24-ldif.sh"
|
||||
extraSecrets:
|
||||
- name: "ums-ldap-server-migration"
|
||||
stringData:
|
||||
30-purge.sh: |
|
||||
#!/usr/bin/env bash
|
||||
me=$(basename "$0")
|
||||
echo "- Running ${me}"
|
||||
if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
|
||||
echo "- Cleaning up /var/lib/univention-ldap."
|
||||
cd /var/lib/univention-ldap
|
||||
rm -rf internal
|
||||
rm -rf ldap
|
||||
ls -l
|
||||
else
|
||||
echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
|
||||
fi
|
||||
95-slapadd-24-ldif.sh: |
|
||||
#!/usr/bin/env bash
|
||||
me=$(basename "$0")
|
||||
echo "- Running ${me}"
|
||||
ls -l /var/lib/univention-ldap
|
||||
if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
|
||||
echo "- slapadd-ing /var/lib/univention-ldap/ldap-24-export.ldif"
|
||||
ls -l /var/lib/univention-ldap/
|
||||
rm -rf /var/lib/univention-ldap/ldap
|
||||
rm -rf /var/lib/univention-ldap/internal
|
||||
echo "- deleted /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
|
||||
ls -l /var/lib/univention-ldap/
|
||||
mkdir /var/lib/univention-ldap/ldap
|
||||
mkdir /var/lib/univention-ldap/internal
|
||||
echo "- created /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
|
||||
ls -l /var/lib/univention-ldap/
|
||||
/usr/sbin/slapadd -v -l /var/lib/univention-ldap/ldap-24-export.ldif
|
||||
echo "- slapadd executed"
|
||||
ls -l /var/lib/univention-ldap/
|
||||
mv /var/lib/univention-ldap/ldap-24-export.ldif /var/lib/univention-ldap/ldap-24-export.ldif-imported
|
||||
echo "- import file renamed"
|
||||
ls -l /var/lib/univention-ldap/
|
||||
else
|
||||
echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
|
||||
fi
|
||||
initResources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
|
||||
ldapServer:
|
||||
image:
|
||||
@@ -863,10 +811,10 @@ nubusLdapServer:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServerLeaderElector.registry | quote }}
|
||||
repository: {{ .Values.images.nubusLdapServerLeaderElector.repository }}
|
||||
tag: {{ .Values.images.nubusLdapServerLeaderElector.tag }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
persistence:
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.size.nubus.ldapServerData | quote }}
|
||||
size: {{ .Values.persistence.storages.nubusLdapServerData.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.nubusLdapServerData.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
replicaCountPrimary: {{ .Values.replicas.umsLdapServerPrimary }}
|
||||
replicaCountSecondary: {{ .Values.replicas.umsLdapServerSecondary }}
|
||||
replicaCountProxy: {{ .Values.replicas.umsLdapServerProxy }}
|
||||
@@ -968,7 +916,8 @@ nubusProvisioning:
|
||||
tag: {{ .Values.images.nubusNatsBox.tag }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
persistence:
|
||||
size: {{ .Values.persistence.size.nubus.provisioningNats }}
|
||||
size: {{ .Values.persistence.storages.nubusProvisioningNats.size }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.nubusProvisioningNats.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
reloader:
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsReloader.registry | quote }}
|
||||
@@ -1148,7 +1097,7 @@ nubusStackDataUms:
|
||||
umcMemcachedUsername: ""
|
||||
externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
|
||||
umcHtmlTitle: "Portal - {{ .Values.theme.texts.productName }}"
|
||||
smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
smtpPort: 25
|
||||
smtpUser: ""
|
||||
smtpStartTls: false
|
||||
@@ -1171,7 +1120,7 @@ nubusStackDataUms:
|
||||
portalTitleEN: "Portal - {{ .Values.theme.texts.productName }}"
|
||||
oxDefaultContext: "1"
|
||||
componentEnabled:
|
||||
notes: {{ .Values.notes.enabled }}
|
||||
notes: {{ .Values.apps.notes.enabled }}
|
||||
ldapSearchUsers:
|
||||
{{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
|
||||
- username: {{ printf "ldapsearch_%s" $username | quote }}
|
||||
@@ -1204,7 +1153,7 @@ nubusStackDataUms:
|
||||
portaltileGroupNotes:
|
||||
- 'cn=managed-by-attribute-Notes,cn=groups,{{ .Values.ldap.baseDn }}'
|
||||
systemInformation:
|
||||
releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
|
||||
releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}{{ if eq (env "OPENDESK_ENTERPRISE") "true" }}-ee{{ end }}"
|
||||
{{- if .Values.functional.admin.portal.deploymentTimestamp.enabled }}
|
||||
deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
|
||||
{{- else }}
|
||||
|
||||
@@ -21,16 +21,63 @@ cleanup:
|
||||
keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
|
||||
|
||||
config:
|
||||
clientAccessRestrictions:
|
||||
matrix:
|
||||
client: "opendesk-matrix"
|
||||
scope: "opendesk-matrix-scope"
|
||||
role: "opendesk-matrix-access-control"
|
||||
group: "managed-by-attribute-Livecollaboration"
|
||||
jitsi:
|
||||
client: "opendesk-jitsi"
|
||||
scope: "opendesk-jitsi-scope"
|
||||
role: "opendesk-jitsi-access-control"
|
||||
group: "managed-by-attribute-Videoconference"
|
||||
xwiki:
|
||||
client: "opendesk-xwiki"
|
||||
scope: "opendesk-xwiki-scope"
|
||||
role: "opendesk-xwiki-access-control"
|
||||
group: "managed-by-attribute-Knowledgemanagement"
|
||||
openproject:
|
||||
client: "opendesk-openproject"
|
||||
scope: "opendesk-openproject-scope"
|
||||
role: "opendesk-openproject-access-control"
|
||||
group: "managed-by-attribute-Projectmanagement"
|
||||
nextcloud:
|
||||
client: "opendesk-nextcloud"
|
||||
scope: "opendesk-nextcloud-scope"
|
||||
role: "opendesk-nextcloud-access-control"
|
||||
group: "managed-by-attribute-Fileshare"
|
||||
oxAppSuite:
|
||||
client: "opendesk-oxappsuite"
|
||||
scope: "opendesk-oxappsuite-scope"
|
||||
role: "opendesk-oxappsuite-access-control"
|
||||
group: "managed-by-attribute-Groupware"
|
||||
dovecot:
|
||||
client: "opendesk-dovecot"
|
||||
scope: "opendesk-dovecot-scope"
|
||||
role: "opendesk-dovecot-access-control"
|
||||
group: "managed-by-attribute-Groupware"
|
||||
{{- if .Values.apps.notes.enabled }}
|
||||
notes:
|
||||
client: "opendesk-notes"
|
||||
scope: "opendesk-notes-scope"
|
||||
role: "opendesk-notes-access-control"
|
||||
group: "managed-by-attribute-Notes"
|
||||
{{- end }}
|
||||
|
||||
componentEnabled:
|
||||
notes: {{ .Values.notes.enabled }}
|
||||
notes: {{ .Values.apps.notes.enabled }}
|
||||
custom:
|
||||
clientScopes:
|
||||
{{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
|
||||
clients:
|
||||
{{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
|
||||
managed:
|
||||
clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
|
||||
clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
|
||||
clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list',
|
||||
'offline_access', 'roles', 'address', 'phone' ]
|
||||
clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}',
|
||||
'${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}',
|
||||
'${client_security-admin-console}' ]
|
||||
keycloak:
|
||||
adminUser: "kcadmin"
|
||||
adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
|
||||
@@ -40,6 +87,15 @@ config:
|
||||
internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
|
||||
twoFactorSettings:
|
||||
additionalGroups: {{ .Values.functional.authentication.twoFactor.groups }}
|
||||
precreateGroups: [ 'Domain Admins', 'Domain Users', '2fa-users', 'IAM API - Full Access',
|
||||
'managed-by-attribute-Fileshare', 'managed-by-attribute-FileshareAdmin',
|
||||
'managed-by-attribute-Knowledgemanagement', 'managed-by-attribute-KnowledgemanagementAdmin',
|
||||
'managed-by-attribute-Livecollaboration', 'managed-by-attribute-LivecollaborationAdmin',
|
||||
'managed-by-attribute-Projectmanagement', 'managed-by-attribute-ProjectmanagementAdmin',
|
||||
'managed-by-attribute-Videoconference',
|
||||
'managed-by-attribute-Groupware',
|
||||
'managed-by-attribute-Notes' ]
|
||||
|
||||
opendesk:
|
||||
# We use client specific scopes as we bind them to Keycloak role membership which itself is linked
|
||||
# to LDAP group membership to ensure a user cannot access an application without the required
|
||||
@@ -375,7 +431,7 @@ config:
|
||||
access.token.claim: true
|
||||
claim.name: "opendesk_username"
|
||||
jsonType.label: "String"
|
||||
{{ if .Values.notes.enabled }}
|
||||
{{ if .Values.apps.notes.enabled }}
|
||||
- name: "opendesk-notes-scope"
|
||||
description: "Scope for the claims required by openDesk's Notes instance."
|
||||
protocol: "openid-connect"
|
||||
@@ -466,7 +522,7 @@ config:
|
||||
jsonType.label: "String"
|
||||
defaultClientScopes:
|
||||
- "offline_access"
|
||||
{{ if .Values.notes.enabled }}
|
||||
{{ if .Values.apps.notes.enabled }}
|
||||
- name: "opendesk-notes"
|
||||
clientId: "opendesk-notes"
|
||||
protocol: "openid-connect"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
repositories:
|
||||
@@ -7,19 +7,31 @@ repositories:
|
||||
- name: "dovecot-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.dovecot.verify }}
|
||||
oci: true
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
username: {{ env "ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
|
||||
{{- else }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
|
||||
{{- end }}
|
||||
|
||||
# Open-Xchange
|
||||
- name: "open-xchange-repo"
|
||||
keyring: "../../files/gpg-pubkeys/open-xchange-com.gpg"
|
||||
verify: {{ .Values.charts.oxAppSuite.verify }}
|
||||
oci: true
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
username: {{ env "ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
|
||||
{{- else }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
|
||||
{{- end }}
|
||||
|
||||
# openDesk Open-Xchange Bootstrap
|
||||
# Source:
|
||||
@@ -30,14 +42,14 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
|
||||
|
||||
# OX Connector
|
||||
- name: "ox-connector-repo"
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "dovecot"
|
||||
@@ -45,10 +57,13 @@ releases:
|
||||
version: "{{ .Values.charts.dovecot.version }}"
|
||||
values:
|
||||
- "values-dovecot.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.dovecot }}
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "values-dovecot-enterprise.yaml.gotmpl"
|
||||
{{- end }}
|
||||
{{- range .Values.customization.release.dovecot }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.dovecot.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.dovecot.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "open-xchange"
|
||||
@@ -56,11 +71,14 @@ releases:
|
||||
version: "{{ .Values.charts.oxAppSuite.version }}"
|
||||
values:
|
||||
- "values-openxchange.yaml.gotmpl"
|
||||
- "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.openxchange }}
|
||||
- "values-openxchange-contact-picker.yaml.gotmpl"
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "values-openxchange-enterprise.yaml.gotmpl"
|
||||
{{- end }}
|
||||
{{- range .Values.customization.release.openxchange }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.oxAppSuite.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.oxAppSuite.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-open-xchange-bootstrap"
|
||||
@@ -68,10 +86,10 @@ releases:
|
||||
version: "{{ .Values.charts.oxAppSuiteBootstrap.version }}"
|
||||
values:
|
||||
- "values-openxchange-bootstrap.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskOpenxchangeBootstrap }}
|
||||
{{- range .Values.customization.release.opendeskOpenxchangeBootstrap }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.oxAppSuite.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.oxAppSuite.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "ox-connector"
|
||||
@@ -79,10 +97,10 @@ releases:
|
||||
version: "{{ .Values.charts.oxConnector.version }}"
|
||||
values:
|
||||
- "values-oxconnector.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.oxConnector }}
|
||||
{{- range .Values.customization.release.oxConnector }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.oxAppSuite.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.oxAppSuite.enabled }}
|
||||
needs:
|
||||
- "open-xchange"
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.dovecot.registry | quote }}
|
||||
repository: {{ .Values.images.dovecot.repository | quote }}
|
||||
tag: {{ .Values.images.dovecot.tag | quote }}
|
||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
|
||||
imageInitCassandra:
|
||||
registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandra.registry | quote }}
|
||||
repository: {{ .Values.images.cassandra.repository | quote }}
|
||||
tag: {{ .Values.images.cassandra.tag | quote }}
|
||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
|
||||
|
||||
dovecot:
|
||||
dictmap:
|
||||
enabled: true
|
||||
host: {{ .Values.databases.dovecotDictmap.host | quote }}
|
||||
port: {{ .Values.databases.dovecotDictmap.port }}
|
||||
username: {{ .Values.databases.dovecotDictmap.username | quote }}
|
||||
password: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
|
||||
keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
|
||||
sharedMailboxes:
|
||||
enabled: false
|
||||
host: {{ .Values.databases.dovecotACL.host | quote }}
|
||||
port: {{ .Values.databases.dovecotACL.port }}
|
||||
username: {{ .Values.databases.dovecotACL.username | quote }}
|
||||
password: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
|
||||
keyspace: {{ .Values.databases.dovecotACL.name | quote }}
|
||||
objectStorage:
|
||||
encryption:
|
||||
privateKey:
|
||||
value: {{ env "DOVECOT_CRYPT_PRIVATE_KEY" | quote }}
|
||||
publicKey:
|
||||
value: {{ env "DOVECOT_CRYPT_PUBLIC_KEY" | quote }}
|
||||
fqdn: {{ .Values.objectstores.dovecot.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
|
||||
username: {{ .Values.objectstores.dovecot.username | quote }}
|
||||
password: {{ .Values.secrets.minio.dovecotUser | quote }}
|
||||
...
|
||||
@@ -1,5 +1,5 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
@@ -34,11 +34,10 @@ dovecot:
|
||||
introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
|
||||
usernameAttribute: "opendesk_username"
|
||||
loginTrustedNetworks: {{ join " " .Values.cluster.networking.cidr | quote }}
|
||||
|
||||
submission:
|
||||
enabled: true
|
||||
ssl: "no"
|
||||
host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
|
||||
host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
|
||||
|
||||
certificate:
|
||||
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||
@@ -92,15 +91,15 @@ podSecurityContext:
|
||||
|
||||
persistence:
|
||||
{{- if .Values.cluster.persistence.readWriteMany.enabled }}
|
||||
storageClassName: {{ .Values.persistence.storageClassNames.RWX | quote }}
|
||||
storageClassName: {{ coalesce .Values.persistence.storages.dovecot.storageClassName .Values.persistence.storageClassNames.RWX | quote }}
|
||||
accessModes:
|
||||
- "ReadWriteMany"
|
||||
{{- else }}
|
||||
storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
storageClassName: {{ coalesce .Values.persistence.storages.dovecot.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
{{- end }}
|
||||
size: {{ .Values.persistence.size.dovecot | quote }}
|
||||
size: {{ .Values.persistence.storages.dovecot.size | quote }}
|
||||
|
||||
resources:
|
||||
{{ .Values.resources.dovecot | toYaml | nindent 2 }}
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
appsuite:
|
||||
plugins-ui:
|
||||
enabled: false
|
||||
core-mw:
|
||||
global:
|
||||
extras:
|
||||
monitoring:
|
||||
enabled: true
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
|
||||
update:
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
|
||||
...
|
||||
@@ -340,9 +340,9 @@ appsuite:
|
||||
com.openexchange.antivirus.server: {{ .Values.antivirus.icap.host | quote }}
|
||||
com.openexchange.antivirus.port: {{ .Values.antivirus.icap.port | quote }}
|
||||
{{- else }}
|
||||
{{- if .Values.clamavDistributed.enabled }}
|
||||
{{- if .Values.apps.clamavDistributed.enabled }}
|
||||
com.openexchange.antivirus.server: "clamav-icap"
|
||||
{{- else if .Values.clamavSimple.enabled }}
|
||||
{{- else if .Values.apps.clamavSimple.enabled }}
|
||||
com.openexchange.antivirus.server: "clamav-simple"
|
||||
{{- end }}
|
||||
com.openexchange.antivirus.port: "1344"
|
||||
|
||||
@@ -23,9 +23,8 @@ image:
|
||||
repository: {{ .Values.images.oxConnector.repository | quote }}
|
||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
tag: {{ .Values.images.oxConnector.tag | quote }}
|
||||
|
||||
waitForDependency:
|
||||
registry: {{ .Values.global.imageRegistry | default .Values.images.nubusWaitForDependency.registry | quote }}
|
||||
registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
|
||||
repository: {{ .Values.images.nubusWaitForDependency.repository }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
pullSecrets:
|
||||
@@ -67,7 +66,8 @@ resourcesWaitForDependency:
|
||||
{{ .Values.resources.oxConnector | toYaml | nindent 2 }}
|
||||
|
||||
persistence:
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.storages.oxConnector.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.oxConnector.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
|
||||
@@ -4,27 +4,27 @@
|
||||
repositories:
|
||||
# openDesk Migrations
|
||||
# Source:
|
||||
- name: "openproject-migrations-repo"
|
||||
- name: "opendesk-migrations-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.migrations.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "opendesk-migrations-post"
|
||||
chart: "openproject-migrations-repo/{{ .Values.charts.migrations.name }}"
|
||||
chart: "opendesk-migrations-repo/{{ .Values.charts.migrations.name }}"
|
||||
version: "{{ .Values.charts.migrations.version }}"
|
||||
wait: true
|
||||
waitForJobs: true
|
||||
values:
|
||||
- "values.yaml.gotmpl"
|
||||
- "../../shared/migrations.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.migrationsPost }}
|
||||
{{- range .Values.customization.release.migrationsPost }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.migrations.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.migrations.enabled }}
|
||||
timeout: 900
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "opendesk-migrations-pre"
|
||||
@@ -21,10 +21,10 @@ releases:
|
||||
values:
|
||||
- "values.yaml.gotmpl"
|
||||
- "../../shared/migrations.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.migrationsPre }}
|
||||
{{- range .Values.customization.release.migrationsPre }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.migrations.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.migrations.enabled }}
|
||||
timeout: 900
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "opendesk-openproject-bootstrap"
|
||||
@@ -20,10 +20,10 @@ releases:
|
||||
waitForJobs: true
|
||||
values:
|
||||
- "values.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskOpenprojectBootstrap }}
|
||||
{{- range .Values.customization.release.opendeskOpenprojectBootstrap }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.openproject.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.openproject.enabled }}
|
||||
timeout: 900
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
|
||||
|
||||
# openDesk Home
|
||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
|
||||
@@ -20,7 +20,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
|
||||
|
||||
# openDesk Certificates
|
||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
|
||||
@@ -30,7 +30,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
|
||||
|
||||
# openDesk Alerts
|
||||
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts
|
||||
@@ -40,7 +40,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"
|
||||
|
||||
# openDesk Grafana Dashboards
|
||||
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards
|
||||
@@ -50,7 +50,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"
|
||||
|
||||
# openDesk Static Files
|
||||
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-static-files
|
||||
@@ -60,7 +60,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskStaticFiles.registry }}/{{ .Values.charts.opendeskStaticFiles.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskStaticFiles.registry }}/{{ .Values.charts.opendeskStaticFiles.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "opendesk-otterize"
|
||||
@@ -68,9 +68,9 @@ releases:
|
||||
version: "{{ .Values.charts.otterize.version }}"
|
||||
values:
|
||||
- "values-otterize.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskOtterize }}
|
||||
{{- range .Values.customization.release.opendeskOtterize }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.security.otterizeIntents.enabled }}
|
||||
timeout: 900
|
||||
|
||||
@@ -79,20 +79,20 @@ releases:
|
||||
version: "{{ .Values.charts.home.version }}"
|
||||
values:
|
||||
- "values-home.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskHome }}
|
||||
{{- range .Values.customization.release.opendeskHome }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.home.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.home.enabled }}
|
||||
|
||||
- name: "opendesk-certificates"
|
||||
chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
|
||||
version: "{{ .Values.charts.certificates.version }}"
|
||||
values:
|
||||
- "values-certificates.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskCertificates }}
|
||||
{{- range .Values.customization.release.opendeskCertificates }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.certificates.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.certificates.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-alerts"
|
||||
@@ -100,9 +100,9 @@ releases:
|
||||
version: "{{ .Values.charts.opendeskAlerts.version }}"
|
||||
values:
|
||||
- "values-opendesk-alerts.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskAlerts}}
|
||||
{{- range .Values.customization.release.opendeskAlerts }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
|
||||
timeout: 900
|
||||
|
||||
@@ -111,7 +111,9 @@ releases:
|
||||
version: "{{ .Values.charts.opendeskDashboards.version }}"
|
||||
values:
|
||||
- "values-opendesk-dashboards.yaml.gotmpl"
|
||||
- {{ .Values.customization.release.opendeskDashboards | default "additionalValues: false" }}
|
||||
{{- range .Values.customization.release.opendeskDashboards }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.monitoring.grafana.dashboards.enabled }}
|
||||
timeout: 900
|
||||
|
||||
@@ -120,8 +122,10 @@ releases:
|
||||
version: "{{ .Values.charts.opendeskStaticFiles.version }}"
|
||||
values:
|
||||
- "values-opendesk-static-files.yaml.gotmpl"
|
||||
- {{ .Values.customization.release.opendeskStaticFiles | default "additionalValues: false" }}
|
||||
installed: {{ .Values.staticFiles.enabled }}
|
||||
{{- range .Values.customization.release.opendeskStaticFiles }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.staticFiles.enabled }}
|
||||
timeout: 900
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -7,13 +7,13 @@ SPDX-License-Identifier: Apache-2.0
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
hosts:
|
||||
{{- if .Values.collabora.enabled }}
|
||||
{{- if .Values.apps.collabora.enabled }}
|
||||
collabora: {{ .Values.global.hosts.collabora }}
|
||||
{{- end }}
|
||||
{{- if .Values.cryptpad.enabled }}
|
||||
{{- if .Values.apps.cryptpad.enabled }}
|
||||
cryptpad: {{ .Values.global.hosts.cryptpad }}
|
||||
{{- end }}
|
||||
{{- if .Values.element.enabled }}
|
||||
{{- if .Values.apps.element.enabled }}
|
||||
element: {{ .Values.global.hosts.element }}
|
||||
matrixNeoBoardWidget: {{ .Values.global.hosts.matrixNeoBoardWidget }}
|
||||
matrixNeoChoiceWidget: {{ .Values.global.hosts.matrixNeoChoiceWidget }}
|
||||
@@ -23,30 +23,30 @@ global:
|
||||
synapseFederation: {{ .Values.global.hosts.synapseFederation }}
|
||||
whiteboard: {{ .Values.global.hosts.whiteboard }}
|
||||
{{- end }}
|
||||
{{- if .Values.nubus.enabled }}
|
||||
{{- if .Values.apps.nubus.enabled }}
|
||||
intercomService: {{ .Values.global.hosts.intercomService }}
|
||||
{{- end }}
|
||||
{{- if .Values.jitsi.enabled }}
|
||||
{{- if .Values.apps.jitsi.enabled }}
|
||||
jitsi: {{ .Values.global.hosts.jitsi }}
|
||||
{{- end }}
|
||||
{{- if .Values.minio.enabled }}
|
||||
{{- if .Values.apps.minio.enabled }}
|
||||
minioApi: {{ .Values.global.hosts.minioApi }}
|
||||
minioConsole: {{ .Values.global.hosts.minioConsole }}
|
||||
{{- end }}
|
||||
{{- if .Values.nextcloud.enabled }}
|
||||
{{- if .Values.apps.nextcloud.enabled }}
|
||||
nextcloud: {{ .Values.global.hosts.nextcloud }}
|
||||
{{- end }}
|
||||
{{- if .Values.openproject.enabled }}
|
||||
{{- if .Values.apps.openproject.enabled }}
|
||||
openproject: {{ .Values.global.hosts.openproject }}
|
||||
{{- end }}
|
||||
{{- if .Values.oxAppSuite.enabled }}
|
||||
{{- if .Values.apps.oxAppSuite.enabled }}
|
||||
openxchange: {{ .Values.global.hosts.openxchange }}
|
||||
{{- end }}
|
||||
{{- if .Values.nubus.enabled }}
|
||||
{{- if .Values.apps.nubus.enabled }}
|
||||
keycloak: {{ .Values.global.hosts.keycloak }}
|
||||
nubus: {{ .Values.global.hosts.nubus }}
|
||||
{{- end }}
|
||||
{{- if .Values.xwiki.enabled }}
|
||||
{{- if .Values.apps.xwiki.enabled }}
|
||||
xwiki: {{ .Values.global.hosts.xwiki }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
@@ -10,43 +10,43 @@ additionalLabels:
|
||||
|
||||
config:
|
||||
collabora:
|
||||
enable: {{ .Values.collabora.enabled }}
|
||||
enable: {{ .Values.apps.collabora.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.collabora.namespace | quote }}
|
||||
namespace: {{ .Values.apps.collabora.namespace | quote }}
|
||||
matrix:
|
||||
enable: {{ .Values.element.enabled }}
|
||||
enable: {{ .Values.apps.element.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.element.namespace | quote }}
|
||||
namespace: {{ .Values.apps.element.namespace | quote }}
|
||||
diagrams:
|
||||
enable: {{ .Values.cryptpad.enabled }}
|
||||
enable: {{ .Values.apps.cryptpad.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.cryptpad.namespace | quote }}
|
||||
namespace: {{ .Values.apps.cryptpad.namespace | quote }}
|
||||
nextcloud:
|
||||
enable: {{ .Values.nextcloud.enabled }}
|
||||
enable: {{ .Values.apps.nextcloud.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.nextcloud.namespace | quote }}
|
||||
namespace: {{ .Values.apps.nextcloud.namespace | quote }}
|
||||
openXChange:
|
||||
enable: {{ .Values.oxAppSuite.enabled }}
|
||||
enable: {{ .Values.apps.oxAppSuite.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.oxAppSuite.namespace | quote }}
|
||||
namespace: {{ .Values.apps.oxAppSuite.namespace | quote }}
|
||||
xwiki:
|
||||
enable: {{ .Values.xwiki.enabled }}
|
||||
enable: {{ .Values.apps.xwiki.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.xwiki.namespace | quote }}
|
||||
namespace: {{ .Values.apps.xwiki.namespace | quote }}
|
||||
nubus:
|
||||
enable: {{ .Values.nubus.enabled }}
|
||||
enable: {{ .Values.apps.nubus.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.nubus.namespace | quote }}
|
||||
namespace: {{ .Values.apps.nubus.namespace | quote }}
|
||||
openProject:
|
||||
enable: {{ .Values.openproject.enabled }}
|
||||
enable: {{ .Values.apps.openproject.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.openproject.namespace | quote }}
|
||||
namespace: {{ .Values.apps.openproject.namespace | quote }}
|
||||
jitsi:
|
||||
enable: {{ .Values.jitsi.enabled }}
|
||||
enable: {{ .Values.apps.jitsi.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.jitsi.namespace | quote }}
|
||||
namespace: {{ .Values.apps.jitsi.namespace | quote }}
|
||||
collabora:
|
||||
enable: {{ .Values.collabora.enabled }}
|
||||
enable: {{ .Values.apps.collabora.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.collabora.namespace | quote }}
|
||||
namespace: {{ .Values.apps.collabora.namespace | quote }}
|
||||
|
||||
|
||||
@@ -12,43 +12,43 @@ additionalLabels:
|
||||
config:
|
||||
apps:
|
||||
collabora:
|
||||
enable: {{ .Values.collabora.enabled }}
|
||||
enable: {{ .Values.apps.collabora.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.collabora.namespace | quote }}
|
||||
namespace: {{ .Values.apps.collabora.namespace | quote }}
|
||||
matrixElement:
|
||||
enable: {{ .Values.element.enabled }}
|
||||
enable: {{ .Values.apps.element.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.element.namespace | quote }}
|
||||
namespace: {{ .Values.apps.element.namespace | quote }}
|
||||
diagrams:
|
||||
enable: {{ .Values.cryptpad.enabled }}
|
||||
enable: {{ .Values.apps.cryptpad.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.cryptpad.namespace | quote }}
|
||||
namespace: {{ .Values.apps.cryptpad.namespace | quote }}
|
||||
nextcloud:
|
||||
enable: {{ .Values.nextcloud.enabled }}
|
||||
enable: {{ .Values.apps.nextcloud.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.nextcloud.namespace | quote }}
|
||||
namespace: {{ .Values.apps.nextcloud.namespace | quote }}
|
||||
openxchange:
|
||||
enable: {{ .Values.oxAppSuite.enabled }}
|
||||
enable: {{ .Values.apps.oxAppSuite.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.oxAppSuite.namespace | quote }}
|
||||
namespace: {{ .Values.apps.oxAppSuite.namespace | quote }}
|
||||
xwiki:
|
||||
enable: {{ .Values.xwiki.enabled }}
|
||||
enable: {{ .Values.apps.xwiki.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.xwiki.namespace | quote }}
|
||||
namespace: {{ .Values.apps.xwiki.namespace | quote }}
|
||||
nubus:
|
||||
enable: {{ .Values.nubus.enabled }}
|
||||
enable: {{ .Values.apps.nubus.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.nubus.namespace | quote }}
|
||||
namespace: {{ .Values.apps.nubus.namespace | quote }}
|
||||
openproject:
|
||||
enable: {{ .Values.openproject.enabled }}
|
||||
enable: {{ .Values.apps.openproject.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.openproject.namespace | quote }}
|
||||
namespace: {{ .Values.apps.openproject.namespace | quote }}
|
||||
jitsi:
|
||||
enable: {{ .Values.jitsi.enabled }}
|
||||
enable: {{ .Values.apps.jitsi.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.jitsi.namespace | quote }}
|
||||
namespace: {{ .Values.apps.jitsi.namespace | quote }}
|
||||
collabora:
|
||||
enable: {{ .Values.collabora.enabled }}
|
||||
enable: {{ .Values.apps.collabora.enabled }}
|
||||
selectors:
|
||||
namespace: {{ .Values.collabora.namespace | quote }}
|
||||
namespace: {{ .Values.apps.collabora.namespace | quote }}
|
||||
...
|
||||
|
||||
@@ -10,47 +10,47 @@ global:
|
||||
|
||||
apps:
|
||||
clamavDistributed:
|
||||
enabled: {{ .Values.clamavDistributed.enabled }}
|
||||
enabled: {{ .Values.apps.clamavDistributed.enabled }}
|
||||
clamavSimple:
|
||||
enabled: {{ .Values.clamavSimple.enabled }}
|
||||
enabled: {{ .Values.apps.clamavSimple.enabled }}
|
||||
collabora:
|
||||
enabled: {{ .Values.collabora.enabled }}
|
||||
enabled: {{ .Values.apps.collabora.enabled }}
|
||||
cryptpad:
|
||||
enabled: {{ .Values.cryptpad.enabled }}
|
||||
enabled: {{ .Values.apps.cryptpad.enabled }}
|
||||
dkimpy:
|
||||
enabled: {{ .Values.dkimpy.enabled }}
|
||||
enabled: {{ .Values.apps.dkimpy.enabled }}
|
||||
dovecot:
|
||||
enabled: {{ .Values.dovecot.enabled }}
|
||||
enabled: {{ .Values.apps.dovecot.enabled }}
|
||||
element:
|
||||
enabled: {{ .Values.element.enabled }}
|
||||
enabled: {{ .Values.apps.element.enabled }}
|
||||
jitsi:
|
||||
enabled: {{ .Values.jitsi.enabled }}
|
||||
enabled: {{ .Values.apps.jitsi.enabled }}
|
||||
mariadb:
|
||||
enabled: {{ .Values.mariadb.enabled }}
|
||||
enabled: {{ .Values.apps.mariadb.enabled }}
|
||||
memcached:
|
||||
enabled: {{ .Values.memcached.enabled }}
|
||||
enabled: {{ .Values.apps.memcached.enabled }}
|
||||
migrations:
|
||||
enabled: {{ .Values.migrations.enabled }}
|
||||
enabled: {{ .Values.apps.migrations.enabled }}
|
||||
minio:
|
||||
enabled: {{ .Values.minio.enabled }}
|
||||
enabled: {{ .Values.apps.minio.enabled }}
|
||||
nextcloud:
|
||||
enabled: {{ .Values.nextcloud.enabled }}
|
||||
enabled: {{ .Values.apps.nextcloud.enabled }}
|
||||
notes:
|
||||
enabled: {{ .Values.notes.enabled }}
|
||||
enabled: {{ .Values.apps.notes.enabled }}
|
||||
nubus:
|
||||
enabled: {{ .Values.nubus.enabled }}
|
||||
enabled: {{ .Values.apps.nubus.enabled }}
|
||||
openproject:
|
||||
enabled: {{ .Values.openproject.enabled }}
|
||||
enabled: {{ .Values.apps.openproject.enabled }}
|
||||
oxAppsuite:
|
||||
enabled: {{ .Values.oxAppSuite.enabled }}
|
||||
enabled: {{ .Values.apps.oxAppSuite.enabled }}
|
||||
postfix:
|
||||
enabled: {{ .Values.postfix.enabled }}
|
||||
enabled: {{ .Values.apps.postfix.enabled }}
|
||||
postgresql:
|
||||
enabled: {{ .Values.postgresql.enabled }}
|
||||
enabled: {{ .Values.apps.postgresql.enabled }}
|
||||
redis:
|
||||
enabled: {{ .Values.redis.enabled }}
|
||||
enabled: {{ .Values.apps.redis.enabled }}
|
||||
xwiki:
|
||||
enabled: {{ .Values.xwiki.enabled }}
|
||||
enabled: {{ .Values.apps.xwiki.enabled }}
|
||||
|
||||
ingressController:
|
||||
{{ .Values.security.ingressController | toYaml | nindent 2 }}
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "openproject"
|
||||
@@ -20,10 +20,10 @@ releases:
|
||||
waitForJobs: true
|
||||
values:
|
||||
- "values.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.openproject }}
|
||||
{{- range .Values.customization.release.openproject }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.openproject.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.openproject.enabled }}
|
||||
timeout: 1800
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -38,6 +38,9 @@ dbInit:
|
||||
{{ .Values.resources.openprojectDbInit | toYaml | nindent 4 }}
|
||||
|
||||
environment:
|
||||
{{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.openproject.token }}
|
||||
OPENPROJECT_ENTERPRISE__TOKEN: {{ .Values.enterpriseKeys.openproject.token | quote }}
|
||||
{{- end }}
|
||||
# For more details and more options see
|
||||
# https://www.openproject.org/docs/installation-and-operations/configuration/environment/
|
||||
OPENPROJECT_APP__TITLE: "Projekte - {{ .Values.theme.texts.productName }}"
|
||||
@@ -77,7 +80,7 @@ environment:
|
||||
OPENPROJECT_SMTP__PASSWORD: ""
|
||||
OPENPROJECT_SMTP__PORT: 25
|
||||
OPENPROJECT_SMTP__SSL: "false" # (default=false)
|
||||
OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
OPENPROJECT_SMTP__AUTHENTICATION: "none"
|
||||
OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "false"
|
||||
OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "none"
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
|
||||
|
||||
# openDesk MariaDB
|
||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
|
||||
@@ -20,7 +20,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
|
||||
|
||||
# openDesk dkimpy-milter
|
||||
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter
|
||||
@@ -30,7 +30,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"
|
||||
|
||||
# openDesk Postfix
|
||||
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
|
||||
@@ -40,7 +40,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
|
||||
|
||||
# openDesk ClamAV
|
||||
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
|
||||
@@ -50,14 +50,14 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
|
||||
- name: "clamav-simple-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.clamavSimple.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
|
||||
|
||||
# VMWare Bitnami
|
||||
# Source: https://github.com/bitnami/charts/
|
||||
@@ -67,21 +67,21 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
|
||||
- name: "redis-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.redis.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
|
||||
- name: "minio-repo"
|
||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||
verify: {{ .Values.charts.minio.verify }}
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
|
||||
|
||||
# openDesk Enterprise
|
||||
# Cassandra
|
||||
@@ -92,7 +92,7 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "redis"
|
||||
@@ -100,10 +100,10 @@ releases:
|
||||
version: "{{ .Values.charts.redis.version }}"
|
||||
values:
|
||||
- "values-redis.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.redis }}
|
||||
{{- range .Values.customization.release.redis }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.redis.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.redis.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "memcached"
|
||||
@@ -111,10 +111,10 @@ releases:
|
||||
version: "{{ .Values.charts.memcached.version }}"
|
||||
values:
|
||||
- "values-memcached.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.memcached }}
|
||||
{{- range .Values.customization.release.memcached }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.memcached.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.memcached.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "postgresql"
|
||||
@@ -122,10 +122,10 @@ releases:
|
||||
version: "{{ .Values.charts.postgresql.version }}"
|
||||
values:
|
||||
- "values-postgresql.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.postgresql }}
|
||||
{{- range .Values.customization.release.postgresql }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.postgresql.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.postgresql.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "mariadb"
|
||||
@@ -133,10 +133,10 @@ releases:
|
||||
version: "{{ .Values.charts.mariadb.version }}"
|
||||
values:
|
||||
- "values-mariadb.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.mariadb }}
|
||||
{{- range .Values.customization.release.mariadb }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.mariadb.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.mariadb.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "postfix"
|
||||
@@ -144,10 +144,10 @@ releases:
|
||||
version: "{{ .Values.charts.postfix.version }}"
|
||||
values:
|
||||
- "values-postfix.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.postfix }}
|
||||
{{- range .Values.customization.release.postfix }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.postfix.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.postfix.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "opendesk-dkimpy-milter"
|
||||
@@ -155,10 +155,10 @@ releases:
|
||||
version: "{{ .Values.charts.dkimpy.version }}"
|
||||
values:
|
||||
- "values-dkimpy.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.opendeskDkimpyMilter }}
|
||||
{{- range .Values.customization.release.opendeskDkimpyMilter }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.dkimpy.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.dkimpy.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "clamav"
|
||||
@@ -166,10 +166,10 @@ releases:
|
||||
version: "{{ .Values.charts.clamav.version }}"
|
||||
values:
|
||||
- "values-clamav-distributed.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.clamav }}
|
||||
{{- range .Values.customization.release.clamav }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.clamavDistributed.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.clamavDistributed.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "clamav-simple"
|
||||
@@ -177,10 +177,10 @@ releases:
|
||||
version: "{{ .Values.charts.clamavSimple.version }}"
|
||||
values:
|
||||
- "values-clamav-simple.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.clamavSimple }}
|
||||
{{- range .Values.customization.release.clamavSimple }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.clamavSimple.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.clamavSimple.enabled }}
|
||||
timeout: 900
|
||||
|
||||
- name: "minio"
|
||||
@@ -188,10 +188,10 @@ releases:
|
||||
version: "{{ .Values.charts.minio.version }}"
|
||||
values:
|
||||
- "values-minio.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.minio }}
|
||||
{{- range .Values.customization.release.minio }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.minio.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.minio.enabled }}
|
||||
timeout: 900
|
||||
|
||||
# openDesk Enterprise Releases
|
||||
@@ -199,10 +199,11 @@ releases:
|
||||
chart: "cassandra-repo/{{ .Values.charts.cassandra.name }}"
|
||||
version: "{{ .Values.charts.cassandra.version }}"
|
||||
values:
|
||||
{{ range .Values.customization.release.cassandra }}
|
||||
- "values-cassandra.yaml.gotmpl"
|
||||
{{- range .Values.customization.release.cassandra }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.cassandra.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.cassandra.enabled }}
|
||||
timeout: 900
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
102
helmfile/apps/services-external/values-cassandra.yaml.gotmpl
Normal file
102
helmfile/apps/services-external/values-cassandra.yaml.gotmpl
Normal file
@@ -0,0 +1,102 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.cassandra | toYaml | nindent 4 }}
|
||||
|
||||
dbUser:
|
||||
user: "root"
|
||||
password: {{ .Values.secrets.cassandra.rootPassword | quote }}
|
||||
|
||||
global:
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandra.registry | quote }}
|
||||
repository: {{ .Values.images.cassandra.repository | quote }}
|
||||
tag: {{ .Values.images.cassandra.tag | quote }}
|
||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
|
||||
initDB:
|
||||
initUserData.cql: >
|
||||
CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
|
||||
CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.username | quote }};
|
||||
ALTER ROLE {{ .Values.databases.dovecotDictmap.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotDictmapUser "''" | squote }} AND LOGIN = true;
|
||||
GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotDictmap.name | quote }} TO {{ .Values.databases.dovecotDictmap.username | quote }};
|
||||
CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotACL.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
|
||||
CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotACL.username | quote }};
|
||||
ALTER ROLE {{ .Values.databases.dovecotACL.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotACLUser "''" | squote }} AND LOGIN = true;
|
||||
GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotACL.name | quote }} TO {{ .Values.databases.dovecotACL.username | quote }};
|
||||
|
||||
# Will print a warning if unset but is automatically calculated:
|
||||
jvm:
|
||||
maxHeapSize: ""
|
||||
newHeapSize: ""
|
||||
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 30
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
|
||||
metrics:
|
||||
enabled: false
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandraExporter.registry | quote }}
|
||||
repository: {{ .Values.images.cassandraExporter.repository | quote }}
|
||||
tag: {{ .Values.images.cassandraExporter.tag | quote }}
|
||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
|
||||
persistence:
|
||||
commitLogsize: {{ .Values.persistence.storages.cassandra.commitLogsize | quote }}
|
||||
size: {{ .Values.persistence.storages.cassandra.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.cassandra.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: "Always"
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 30
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
|
||||
replicaCount: {{ .Values.replicas.cassandra }}
|
||||
|
||||
resources:
|
||||
{{ .Values.resources.cassandra | toYaml | nindent 2 }}
|
||||
|
||||
startupProbe:
|
||||
enabled: false
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
successThreshold: 1
|
||||
failureThreshold: 60
|
||||
...
|
||||
@@ -152,6 +152,6 @@ milter:
|
||||
{{ .Values.resources.milter | toYaml | nindent 4 }}
|
||||
|
||||
persistence:
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWX | quote }}
|
||||
size: {{ .Values.persistence.size.clamav | quote }}
|
||||
size: {{ .Values.persistence.storages.clamav.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.clamav.storageClassName .Values.persistence.storageClassNames.RWX | quote }}
|
||||
...
|
||||
|
||||
@@ -37,8 +37,8 @@ image:
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
|
||||
persistence:
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.size.clamav | quote }}
|
||||
size: {{ .Values.persistence.storages.clamav.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.clamav.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
|
||||
@@ -39,40 +39,40 @@ job:
|
||||
retries: 10
|
||||
wait: 30
|
||||
users:
|
||||
- username: "openxchange_user"
|
||||
password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
|
||||
connectionLimit: {{ .Values.databases.oxAppSuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
{{ if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
|
||||
- username: {{ .Values.databases.nextcloud.username | quote }}
|
||||
password: {{ .Values.secrets.mariadb.nextcloudUser | quote}}
|
||||
connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
# OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
|
||||
# users for the moment.
|
||||
- username: "openxchange_user"
|
||||
# - username: {{ .Values.databases.xwiki.username | quote }}
|
||||
password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
|
||||
connectionLimit: {{ .Values.databases.oxAppSuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
{{ end }}
|
||||
{{ if eq .Values.databases.xwiki.type "mariadb" }}
|
||||
- username: "xwiki_user"
|
||||
# - username: {{ .Values.databases.oxAppSuite.username | quote }}
|
||||
password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
|
||||
connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
{{ end }}
|
||||
databases:
|
||||
# OX uses root user and auto automanages the database, we add a dummy user and create a dummy/empty database.
|
||||
- name: "openxchange_dummy"
|
||||
user: "openxchange_user"
|
||||
{{ if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
|
||||
- name: {{ .Values.databases.nextcloud.name | quote }}
|
||||
user: {{ .Values.databases.nextcloud.username | quote }}
|
||||
# OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
|
||||
# users for the moment.
|
||||
- name: "openxchange"
|
||||
user: "openxchange_user"
|
||||
# - name: {{ .Values.databases.oxAppSuite.name | quote }}
|
||||
# user: {{ .Values.databases.oxAppSuite.username | quote }}
|
||||
- name: "xwiki"
|
||||
{{ end }}
|
||||
{{ if eq .Values.databases.xwiki.type "mariadb" }}
|
||||
# XWiki uses root user to create new subwiki databases, we add a dummy user.
|
||||
- name: {{ .Values.databases.xwiki.name | quote }}
|
||||
user: "xwiki_user"
|
||||
# - name: {{ .Values.databases.xwiki.name | quote }}
|
||||
# user: {{ .Values.databases.xwiki.username | quote }}
|
||||
{{ end }}
|
||||
|
||||
mariadb:
|
||||
rootPassword:
|
||||
value: {{ .Values.secrets.mariadb.rootPassword | quote }}
|
||||
|
||||
persistence:
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.size.mariadb | quote }}
|
||||
size: {{ .Values.persistence.storages.mariadb.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.mariadb.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
podAnnotations:
|
||||
argocd.argoproj.io/hook: "PostSync"
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
@@ -90,8 +90,8 @@ podSecurityContext:
|
||||
fsGroup: 1001
|
||||
|
||||
persistence:
|
||||
storageClass: "{{ .Values.persistence.storageClassNames.RWO }}"
|
||||
size: "{{ .Values.persistence.size.minio }}"
|
||||
size: {{ .Values.persistence.storages.minio.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.minio.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
provisioning:
|
||||
enabled: true
|
||||
@@ -116,6 +116,11 @@ provisioning:
|
||||
- name: {{ .Values.objectstores.nubus.bucket | quote }}
|
||||
versioning: "Suspended"
|
||||
withLock: false
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- name: {{ .Values.objectstores.dovecot.bucket | quote }}
|
||||
versioning: "Suspended"
|
||||
withLock: false
|
||||
{{- end }}
|
||||
policies:
|
||||
- name: "migrations-bucket-policy"
|
||||
statements:
|
||||
@@ -177,6 +182,20 @@ provisioning:
|
||||
effect: "Allow"
|
||||
actions:
|
||||
- "s3:*"
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- name: "dovecot-bucket-policy"
|
||||
statements:
|
||||
- resources:
|
||||
- "arn:aws:s3:::dovecot"
|
||||
effect: "Allow"
|
||||
actions:
|
||||
- "s3:*"
|
||||
- resources:
|
||||
- "arn:aws:s3:::dovecot/*"
|
||||
effect: "Allow"
|
||||
actions:
|
||||
- "s3:*"
|
||||
{{- end }}
|
||||
users:
|
||||
- username: {{ .Values.objectstores.migrations.username | quote }}
|
||||
password: {{ .Values.secrets.minio.migrationsUser | quote }}
|
||||
@@ -208,6 +227,14 @@ provisioning:
|
||||
policies:
|
||||
- "ums-bucket-policy"
|
||||
setPolicies: true
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- username: {{ .Values.objectstores.dovecot.username | quote }}
|
||||
password: {{ .Values.secrets.minio.dovecotUser | quote }}
|
||||
disabled: false
|
||||
policies:
|
||||
- "dovecot-bucket-policy"
|
||||
setPolicies: true
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ .Values.resources.minio | toYaml | nindent 4 }}
|
||||
|
||||
|
||||
@@ -34,8 +34,8 @@ image:
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
|
||||
persistence:
|
||||
size: {{ .Values.persistence.size.postfix | quote }}
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.storages.postfix.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.postfix.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
@@ -52,7 +52,7 @@ postfix:
|
||||
- fileName: "sasl_passwd.map"
|
||||
content:
|
||||
- {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
|
||||
{{- if .Values.dkimpy.enabled }}
|
||||
{{- if .Values.apps.dkimpy.enabled }}
|
||||
dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
|
||||
{{- end }}
|
||||
rspamdHost: ""
|
||||
@@ -71,9 +71,9 @@ postfix:
|
||||
{{- if .Values.antivirus.milter.host }}
|
||||
smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
|
||||
{{- else }}
|
||||
{{- if .Values.clamavDistributed.enabled }}
|
||||
{{- if .Values.apps.clamavDistributed.enabled }}
|
||||
smtpdMilters: "inet:clamav-milter:7357"
|
||||
{{- else if .Values.clamavSimple.enabled }}
|
||||
{{- else if .Values.apps.clamavSimple.enabled }}
|
||||
smtpdMilters: "inet:clamav-simple:7357"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -69,6 +69,16 @@ job:
|
||||
- username: {{ .Values.databases.umsSelfservice.username | quote }}
|
||||
password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
|
||||
connectionLimit: {{ .Values.databases.umsSelfservice.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
{{ if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
|
||||
- username: {{ .Values.databases.nextcloud.username | quote }}
|
||||
password: {{ .Values.secrets.postgresql.nextcloudUser | quote }}
|
||||
connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
{{ end }}
|
||||
{{ if eq .Values.databases.xwiki.type "postgresql" }}
|
||||
- username: {{ .Values.databases.xwiki.username | quote }}
|
||||
password: {{ .Values.secrets.postgresql.xwikiUser | quote }}
|
||||
connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
|
||||
{{ end }}
|
||||
databases:
|
||||
- name: {{ .Values.databases.keycloak.name | quote }}
|
||||
user: {{ .Values.databases.keycloak.username | quote }}
|
||||
@@ -87,10 +97,19 @@ job:
|
||||
user: {{ .Values.databases.umsNotificationsApi.username | quote }}
|
||||
- name: {{ .Values.databases.umsSelfservice.name | quote }}
|
||||
user: {{ .Values.databases.umsSelfservice.username | quote }}
|
||||
{{ if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
|
||||
- name: {{ .Values.databases.nextcloud.name | quote }}
|
||||
user: {{ .Values.databases.nextcloud.username | quote }}
|
||||
{{ end }}
|
||||
{{ if eq .Values.databases.xwiki.type "postgresql" }}
|
||||
- name: {{ .Values.databases.xwiki.name | quote }}
|
||||
user: {{ .Values.databases.xwiki.username | quote }}
|
||||
additionalParams: "ENCODING 'UNICODE' template=template0"
|
||||
{{ end }}
|
||||
|
||||
persistence:
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.size.postgresql | quote }}
|
||||
size: {{ .Values.persistence.storages.postgresql.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.postgresql.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
podAnnotations:
|
||||
argocd.argoproj.io/hook: "PostSync"
|
||||
|
||||
@@ -12,7 +12,7 @@ auth:
|
||||
global:
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.redis.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
image:
|
||||
registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.redis.registry | quote }}
|
||||
@@ -37,7 +37,7 @@ master:
|
||||
{{ .Values.seLinuxOptions.redis | toYaml | nindent 6 }}
|
||||
count: {{ .Values.replicas.redis }}
|
||||
persistence:
|
||||
size: {{ .Values.persistence.size.redis | quote }}
|
||||
size: {{ .Values.persistence.storages.redis.size | quote }}
|
||||
podAnnotations: {}
|
||||
resources:
|
||||
{{ .Values.resources.redis | toYaml | nindent 4 }}
|
||||
|
||||
@@ -10,8 +10,8 @@ repositories:
|
||||
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||
oci: true
|
||||
url: "{{ .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
|
||||
|
||||
url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
|
||||
|
||||
releases:
|
||||
- name: "xwiki"
|
||||
chart: "xwiki-repo/{{ .Values.charts.xwiki.name }}"
|
||||
@@ -19,10 +19,10 @@ releases:
|
||||
wait: true
|
||||
values:
|
||||
- "values.yaml.gotmpl"
|
||||
{{ range .Values.customization.release.xwiki }}
|
||||
{{- range .Values.customization.release.xwiki }}
|
||||
- {{ . }}
|
||||
{{ end }}
|
||||
installed: {{ .Values.xwiki.enabled }}
|
||||
{{- end }}
|
||||
installed: {{ .Values.apps.xwiki.enabled }}
|
||||
timeout: 1800
|
||||
|
||||
commonLabels:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
bases:
|
||||
- "../../bases/environments.yaml"
|
||||
- "../../bases/environments.yaml.gotmpl"
|
||||
---
|
||||
helmfiles:
|
||||
- path: "./helmfile-child.yaml.gotmpl"
|
||||
|
||||
@@ -5,21 +5,34 @@ SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
image:
|
||||
name: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.xwiki.registry }}/{{ .Values.images.xwiki.repository }}"
|
||||
tag: {{ .Values.images.xwiki.tag | quote }}
|
||||
{{- if eq .Values.databases.xwiki.type "mariadb" }}
|
||||
name: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.xwikiMariadb.registry }}/{{ .Values.images.xwikiMariadb.repository }}"
|
||||
tag: {{ .Values.images.xwikiMariadb.tag | quote }}
|
||||
{{- else if eq .Values.databases.xwiki.type "postgresql" }}
|
||||
name: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.xwikiPostgres.registry }}/{{ .Values.images.xwikiPostgres.repository }}"
|
||||
tag: {{ .Values.images.xwikiPostgres.tag | quote }}
|
||||
{{- else }}
|
||||
{{- fail "Unsupported value for .Values.databases.xwiki.type, supported values are 'mariadb' or 'postgresql'" }}
|
||||
{{- end }}
|
||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
|
||||
imagePullSecrets: {{ .Values.global.imagePullSecrets }}
|
||||
|
||||
{{- if .Values.certificate.selfSigned }}
|
||||
javaOpts:
|
||||
{{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense .Values.enterpriseKeys.xwiki.proApplicationslicense }}
|
||||
- "-Dlicenses={{ .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense }},{{ .Values.enterpriseKeys.xwiki.proApplicationslicense }}"
|
||||
{{- end }}
|
||||
{{- if .Values.certificate.selfSigned }}
|
||||
- "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks"
|
||||
- "-Djavax.net.ssl.trustStoreType=jks"
|
||||
- {{ printf "%s=%s" "-Djavax.net.ssl.trustStorePassword" .Values.secrets.certificates.password | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
externalDB:
|
||||
{{- if eq .Values.databases.xwiki.type "mariadb" }}
|
||||
password: {{ .Values.databases.xwiki.password | default .Values.secrets.mariadb.rootPassword | quote }}
|
||||
{{- else }}
|
||||
password: {{ .Values.databases.xwiki.password | default .Values.secrets.postgresql.xwikiUser | quote }}
|
||||
{{- end }}
|
||||
database: {{ .Values.databases.xwiki.name | quote }}
|
||||
user: {{ .Values.databases.xwiki.username | quote }}
|
||||
host: {{ printf "%s:%d" .Values.databases.xwiki.host .Values.databases.xwiki.port | quote }}
|
||||
@@ -73,6 +86,9 @@ customConfigs:
|
||||
xwiki.authentication.ldap.fields_mapping: "last_name=sn,first_name=givenName,email=mailPrimaryAddress"
|
||||
|
||||
xwiki.properties:
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
distribution.defaultUI: "com.xwiki.projects.swp:xwiki-swp-flavor-enterprise-main"
|
||||
{{- end }}
|
||||
wikiInitializer.initialRequest.xwiki.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/distribution/"
|
||||
wikiInitializer.initialRequest.xwiki.contextPath: "/"
|
||||
wikiInitializer.initialRequest.xwiki.remoteAddress: "{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
|
||||
@@ -133,8 +149,8 @@ mysql:
|
||||
enabled: false
|
||||
|
||||
persistence:
|
||||
size: {{ .Values.persistence.size.xwiki | quote }}
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.storages.xwiki.size | quote }}
|
||||
storageClass: {{ coalesce .Values.persistence.storages.xwiki.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
@@ -149,7 +165,7 @@ properties:
|
||||
"property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.ldap_group_mapping": "xwiki:XWiki.XWikiAdminGroup=cn=managed-by-attribute-KnowledgemanagementAdmin,cn=groups,dc=swp-ldap,dc=internal"
|
||||
## SMTP settings
|
||||
"property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
|
||||
"property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
"property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
|
||||
"property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.port": 25
|
||||
"property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.properties": "mail.smtp.starttls.enable=false"
|
||||
## Link LDAP users and users authenticated through OIDC
|
||||
|
||||
@@ -5,16 +5,28 @@ environments:
|
||||
default:
|
||||
values:
|
||||
- "../../environments/default/*.yaml.gotmpl"
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
|
||||
{{- end }}
|
||||
dev:
|
||||
values:
|
||||
- "../../environments/default/*.yaml.gotmpl"
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
|
||||
{{- end }}
|
||||
- "../../environments/dev/*.yaml.gotmpl"
|
||||
test:
|
||||
values:
|
||||
- "../../environments/default/*.yaml.gotmpl"
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
|
||||
{{- end }}
|
||||
- "../../environments/test/*.yaml.gotmpl"
|
||||
prod:
|
||||
values:
|
||||
- "../../environments/default/*.yaml.gotmpl"
|
||||
{{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
|
||||
- "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
|
||||
{{- end }}
|
||||
- "../../environments/prod/*.yaml.gotmpl"
|
||||
...
|
||||
@@ -0,0 +1,17 @@
|
||||
# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
charts:
|
||||
dovecot:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/product-development/charts/opendesk-dovecot-pro"
|
||||
name: "dovecot"
|
||||
version: "1.0.0"
|
||||
verify: true
|
||||
oxAppSuite:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/charts-mirror"
|
||||
name: "appsuite-public-sector-pro-chart"
|
||||
version: "1.10.114"
|
||||
verify: false
|
||||
...
|
||||
@@ -0,0 +1,21 @@
|
||||
# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
images:
|
||||
collabora:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/supplier/collabora/images/collabora-online-for-opendesk"
|
||||
tag: "24.04.9.4.2@sha256:7c38f2568855ec33c11296d65384766230ea3097a245a60b9e8b0b62cb9cc17f"
|
||||
dovecot:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/dovecot-pro"
|
||||
tag: "3.0.1-rev3@sha256:b87f16562dd486c0f97e8147a797af16a54f25f1ac64826f4f53bd8177ec9a33"
|
||||
nextcloud:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/supplier/nextcloud/images/opendesk-nextcloud"
|
||||
tag: "1.0.7@sha256:3c0afeb7fb41e3ffa32ab3d3b96b41f5afd7a2b066a27b4478a64e06d2f0bd06"
|
||||
openxchangeCoreMW:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/core-mw"
|
||||
tag: "8.30.63@sha256:181fcb31f500f88573e6b735587b52df906199337fa62aeee1e64aacdc64f548"
|
||||
...
|
||||
@@ -0,0 +1,15 @@
|
||||
# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
objectstores:
|
||||
dovecot:
|
||||
bucket: "dovecot"
|
||||
endpoint: ""
|
||||
region: "eu-west-1"
|
||||
secretKey: ""
|
||||
username: "dovecot_user"
|
||||
storageClass: "STANDARD"
|
||||
useSSL: true
|
||||
pathStyle: true
|
||||
port: 443
|
||||
...
|
||||
@@ -0,0 +1,13 @@
|
||||
# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
resources:
|
||||
collabora:
|
||||
# When using CollaboraController for autoscaling, `targetMemoryUtilizationPercentage` and
|
||||
# `targetCPUUtilizationPercentage` defined at `enterpriseFeatures.collabora.autoscaling`
|
||||
# are checked against the values defined below under `requests`, so please ensure you set these
|
||||
# appropriately to avoid unnecessary scaling.
|
||||
requests:
|
||||
cpu: 3
|
||||
memory: "3Gi"
|
||||
...
|
||||
@@ -7,11 +7,14 @@
|
||||
---
|
||||
charts:
|
||||
cassandra:
|
||||
# Component is required for openDesk Enterprise only.
|
||||
registry: ""
|
||||
repository: ""
|
||||
name: ""
|
||||
version: ""
|
||||
# providerCategory: "Community"
|
||||
# providerResponsible: "openDesk"
|
||||
# upstreamRegistry: "https://registry-1.docker.io"
|
||||
# upstreamRepository: "bitnamicharts/cassandra"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/external/charts/bitnami-charts"
|
||||
name: "cassandra"
|
||||
version: "12.0.4"
|
||||
verify: true
|
||||
certificates:
|
||||
# providerCategory: "Platform"
|
||||
@@ -56,12 +59,14 @@ charts:
|
||||
version: "1.1.21"
|
||||
verify: true
|
||||
collaboraController:
|
||||
# Component is required for openDesk Enterprise only.
|
||||
registry: ""
|
||||
repository: ""
|
||||
name: ""
|
||||
version: ""
|
||||
verify: true
|
||||
# Enterprise Component
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Collabora"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/supplier/collabora/charts-mirror"
|
||||
name: "cool-controller"
|
||||
version: "1.1.1"
|
||||
verify: false
|
||||
cryptpad:
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "XWiki"
|
||||
@@ -104,17 +109,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-element"
|
||||
version: "6.0.0"
|
||||
verify: true
|
||||
elementWeb:
|
||||
# providerCategory: "Platform"
|
||||
# providerResponsible: "openDesk"
|
||||
# upstreamRegistry: "https://registry.opencode.de"
|
||||
# upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-element-web"
|
||||
version: "6.0.0"
|
||||
version: "6.0.2"
|
||||
verify: true
|
||||
elementWellKnown:
|
||||
# providerCategory: "Platform"
|
||||
@@ -124,7 +119,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-well-known"
|
||||
version: "6.0.0"
|
||||
version: "6.0.2"
|
||||
verify: true
|
||||
home:
|
||||
# providerCategory: "Platform"
|
||||
@@ -216,7 +211,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-matrix-user-verification-service"
|
||||
version: "6.0.1"
|
||||
version: "6.0.2"
|
||||
verify: true
|
||||
memcached:
|
||||
# providerCategory: "Community"
|
||||
@@ -232,7 +227,7 @@ charts:
|
||||
# providerCategory: "Platform"
|
||||
# providerResponsible: "openDesk"
|
||||
# upstreamRegistry: "https://registry.opencode.de"
|
||||
# upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-migrations"
|
||||
# upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
|
||||
name: "opendesk-migrations"
|
||||
@@ -256,7 +251,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
|
||||
name: "opendesk-nextcloud"
|
||||
version: "3.6.2"
|
||||
version: "3.7.1"
|
||||
verify: true
|
||||
nextcloudManagement:
|
||||
# providerCategory: "Platform"
|
||||
@@ -266,7 +261,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
|
||||
name: "opendesk-nextcloud-management"
|
||||
version: "3.6.2"
|
||||
version: "3.7.1"
|
||||
verify: true
|
||||
nginx:
|
||||
# providerCategory: "Community"
|
||||
@@ -338,7 +333,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
|
||||
name: "opendesk-keycloak-bootstrap"
|
||||
version: "2.2.0"
|
||||
version: "2.2.3"
|
||||
verify: true
|
||||
opendeskStaticFiles:
|
||||
# providerCategory: "Platform"
|
||||
@@ -348,7 +343,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-static-files"
|
||||
name: "opendesk-static-files"
|
||||
version: "4.0.0"
|
||||
version: "4.0.1"
|
||||
verify: true
|
||||
openproject:
|
||||
# providerCategory: "Supplier"
|
||||
@@ -360,7 +355,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
|
||||
name: "openproject"
|
||||
version: "9.2.0"
|
||||
version: "9.5.0"
|
||||
verify: true
|
||||
openprojectBootstrap:
|
||||
# providerCategory: "Platform"
|
||||
@@ -434,7 +429,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-postgresql"
|
||||
name: "postgresql"
|
||||
version: "2.1.1"
|
||||
version: "2.1.2"
|
||||
verify: true
|
||||
redis:
|
||||
# providerCategory: "Community"
|
||||
@@ -447,28 +442,32 @@ charts:
|
||||
version: "18.6.1"
|
||||
verify: true
|
||||
synapse:
|
||||
# providerCategory: "Platform"
|
||||
# providerResponsible: "openDesk"
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Element"
|
||||
# upstreamRegistry: "https://registry.opencode.de"
|
||||
# upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-synapse"
|
||||
version: "6.0.1"
|
||||
version: "6.0.2"
|
||||
verify: true
|
||||
synapseAdmin:
|
||||
# Component is required for openDesk Enterprise only.
|
||||
registry: ""
|
||||
repository: ""
|
||||
name: ""
|
||||
version: ""
|
||||
# Enterprise Component
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Element"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-synapse-admin"
|
||||
version: "5.0.1"
|
||||
verify: true
|
||||
synapseAdminbotWeb:
|
||||
# Component is required for openDesk Enterprise only.
|
||||
registry: ""
|
||||
repository: ""
|
||||
name: ""
|
||||
version: ""
|
||||
# Enterprise Component
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Element"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-synapse-adminbot-web"
|
||||
version: "5.0.1"
|
||||
verify: true
|
||||
synapseCreateAccount:
|
||||
# providerCategory: "Platform"
|
||||
@@ -478,21 +477,25 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-synapse-create-account"
|
||||
version: "6.0.0"
|
||||
version: "6.0.2"
|
||||
verify: true
|
||||
synapseGroupsync:
|
||||
# Component is required for openDesk Enterprise only.
|
||||
registry: ""
|
||||
repository: ""
|
||||
name: ""
|
||||
version: ""
|
||||
# Enterprise Component
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Element"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-synapse-groupsync"
|
||||
version: "5.0.1"
|
||||
verify: true
|
||||
synapsePipe:
|
||||
# Component is required for openDesk Enterprise only.
|
||||
registry: ""
|
||||
repository: ""
|
||||
name: ""
|
||||
version: ""
|
||||
# Enterprise Component
|
||||
# providerCategory: "Supplier"
|
||||
# providerResponsible: "Element"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-synapse-pipe"
|
||||
version: "5.0.1"
|
||||
verify: true
|
||||
synapseWeb:
|
||||
# providerCategory: "Platform"
|
||||
@@ -502,7 +505,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
|
||||
name: "opendesk-synapse-web"
|
||||
version: "6.0.0"
|
||||
version: "6.0.2"
|
||||
verify: true
|
||||
xwiki:
|
||||
# providerCategory: "Supplier"
|
||||
@@ -514,6 +517,6 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
|
||||
name: "xwiki"
|
||||
version: "1.4.0"
|
||||
version: "1.4.1"
|
||||
verify: false
|
||||
...
|
||||
|
||||
@@ -1,10 +1,29 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
#
|
||||
# See `external-services.md` for more details on the database configuration
|
||||
---
|
||||
databases:
|
||||
defaults:
|
||||
userConnectionLimit: 100
|
||||
dovecotDictmap:
|
||||
type: "cassandra"
|
||||
name: "dovecot_dictmap"
|
||||
host: "cassandra"
|
||||
port: 9042
|
||||
username: "dovecot_dictmap_user"
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
dovecotACL:
|
||||
type: "cassandra"
|
||||
name: "dovecot_acl"
|
||||
host: "cassandra"
|
||||
port: 9042
|
||||
username: "dovecot_acl_user"
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
keycloak:
|
||||
type: "postgresql"
|
||||
name: "keycloak"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
@@ -12,6 +31,7 @@ databases:
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
keycloakExtension:
|
||||
type: "postgresql"
|
||||
name: "keycloak_extensions"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
@@ -19,6 +39,8 @@ databases:
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
nextcloud:
|
||||
# Nextcloud itself also supports `postgresql` or `oci`
|
||||
type: "mariadb"
|
||||
name: "nextcloud"
|
||||
host: "mariadb"
|
||||
port: 3306
|
||||
@@ -26,6 +48,7 @@ databases:
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
notes:
|
||||
type: "postgresql"
|
||||
name: "notes"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
@@ -33,6 +56,7 @@ databases:
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
openproject:
|
||||
type: "postgresql"
|
||||
name: "openproject"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
@@ -40,6 +64,7 @@ databases:
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
oxAppSuite:
|
||||
type: "mariadb"
|
||||
name: "configdb"
|
||||
host: "mariadb"
|
||||
port: 3306
|
||||
@@ -47,6 +72,7 @@ databases:
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
synapse:
|
||||
type: "postgresql"
|
||||
name: "matrix"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
@@ -69,6 +95,7 @@ databases:
|
||||
connectionPoolMax: "5"
|
||||
connectionLimit: ~
|
||||
umsGuardianManagementApi:
|
||||
type: "postgresql"
|
||||
name: "guardianmanagementapi"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
@@ -76,6 +103,7 @@ databases:
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
umsNotificationsApi:
|
||||
type: "postgresql"
|
||||
name: "notificationsapi"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
@@ -83,6 +111,7 @@ databases:
|
||||
password: ""
|
||||
connectionLimit: ~
|
||||
umsSelfservice:
|
||||
type: "postgresql"
|
||||
name: "selfservice"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
@@ -90,6 +119,8 @@ databases:
|
||||
password: ""
|
||||
connectionLimit: 10
|
||||
xwiki:
|
||||
# XWiki itself also supports `postgresql`
|
||||
type: "mariadb"
|
||||
name: "xwiki"
|
||||
host: "mariadb"
|
||||
port: 3306
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
enterpriseFeatures:
|
||||
collabora:
|
||||
# Collabora autoscaling can be configured here. To enable autoscaling enable the Collabora
|
||||
# Controller, see `opendesk_main.yaml.gotmpl` for reference.
|
||||
autoscaling:
|
||||
minReplicas: 1
|
||||
maxReplicas: 4
|
||||
scaleDownDisabled: false
|
||||
targetMemoryUtilizationPercentage: 99
|
||||
targetCPUUtilizationPercentage: 99
|
||||
|
||||
...
|
||||
20
helmfile/environments/default/enterprise_keys.yaml.gotmpl
Normal file
20
helmfile/environments/default/enterprise_keys.yaml.gotmpl
Normal file
@@ -0,0 +1,20 @@
|
||||
# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
# The variables set in this file are required to upgrade components to their "Enterprise" product variant.
|
||||
---
|
||||
enterpriseKeys:
|
||||
openproject:
|
||||
# Enterprise token must match the deployment's OpenProject host name.
|
||||
token: ~
|
||||
xwiki:
|
||||
# Per instance their must be a unique set of keys.
|
||||
opendeskEnterpriseLicense: ""
|
||||
proApplicationslicense: ""
|
||||
nextcloud:
|
||||
# Subscription key can be used for all customer owned instances, the number of users
|
||||
# from all instances and is limited by the number of users the key was bought for.
|
||||
subscriptionKey: ""
|
||||
# Subscription data is required for air gapped installations.
|
||||
subscriptionData: ""
|
||||
|
||||
...
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user