fix(nubus): Set preview image for KC 26.2.2 for internal testing

README.md

@@ -37,7 +37,7 @@ openDesk currently features the following functional main components:
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89)                                                | [For the most recent release](https://element.io/user-guide)                                                                          |
 | Collaborative notes  | Notes (aka Docs)            | [2.4.0](https://github.com/suitenumerique/docs/releases/tag/v2.4.0)                                                           | Online documentation/welcome document available in installed application                                                              |
 | Diagram editor       | CryptPad ft. diagrams.net   | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                                                        | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | [30.0.6](https://nextcloud.com/de/changelog/#30-0-6)                                                                          | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
+| File management      | Nextcloud                   | [30.0.10](https://nextcloud.com/de/changelog/#30-0-10)                                                                          | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
 | Groupware            | OX App Suite                | [8.37](https://documentation.open-xchange.com/appsuite/releases/8.37/)                                                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
 | Knowledge management | XWiki                       | [16.10.5](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.5/)                                              | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
 | Portal & IAM         | Nubus                       | [1.9.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html#version-1-9-1-2025-05-07) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |

docs/enhanced-configuration/idp-federation.md

@@ -22,7 +22,7 @@ SPDX-License-Identifier: Apache-2.0
 
 Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on (SSO) to internal or external web applications.
 
-This document explains how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk SSO based on your organization's login.
+This document helps in setting up your organization's IdP and openDesk to enable IdP federation.
 
 # References
 
@@ -33,7 +33,7 @@ We would like to list successful IdP federation scenarios:
 | [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0, v1.2.0           |
 | [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                   |
 
->If you have successfully federated using another External IdP, please let us know so we can update the list above.
+> If you have successfully federated using another External IdP, please let us know so we can update the list above.
 
 # Prerequisites
 
@@ -70,6 +70,23 @@ This document focuses on the OIDC federation between an external IdP and the ope
 
 # Example configuration
 
+The following section explains how to configure the IdP federation manually in an example upstream IdP and in openDesk.
+
+With openDesk 1.4.0 IdP federation has to be enabled as part of the deployment using the `functional.authentication.ssoFederation` section, see [`functional.yaml.gotmpl`](../../helmfile/environments/default/functional.yaml.gotmpl) for reference.
+
+You can use the description below to configure and test the federation that can be exported and used as part of the deployment afterwards, e.g. with the following commands from within the Keycloak Pod:
+
+```shell
+# Set the variables according to your deployment first, below are just example values.
+export FEDERATION_IDP_ALIAS=sso-federation-idp
+export NAMESPACE=example_namespace
+export CLUSTER_NETWORKING_DOMAIN=svc.cluster.local
+# Authenticate with Keycloak
+/opt/keycloak/bin/kcadm.sh config credentials --server http://ums-keycloak.${NAMESPACE}.${CLUSTER_NETWORKING_DOMAIN}:8080 --realm master --user ${KEYCLOAK_ADMIN} --password ${KEYCLOAK_ADMIN_PASSWORD}
+# Request details of IdP configuration
+/opt/keycloak/bin/kcadm.sh get identity-provider/instances/${FEDERATION_IDP_ALIAS} -r opendesk
+```
+
 ## Versions
 
 The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3. As external IdP, we also used an openDesk deployment of the same version, but created a separate realm for proper configuration separation.

docs/migrations.md

@@ -11,6 +11,7 @@ SPDX-License-Identifier: Apache-2.0
 * [Manual checks/actions](#manual-checksactions)
   * [v1.4.0+](#v140)
     * [Pre-upgrade to v1.4.0+](#pre-upgrade-to-v140)
+      * [Helmfile new feature: `functional.authentication.ssoFederation`](#helmfile-new-feature-functionalauthenticationssofederation)
       * [Helmfile cleanup: `global.additionalMailDomains` as list](#helmfile-cleanup-globaladditionalmaildomains-as-list)
   * [v1.2.0+](#v120)
     * [Pre-upgrade to v1.2.0+](#pre-upgrade-to-v120)
@@ -104,6 +105,12 @@ If you would like more details about the automated migrations, please read secti
 
 ### Pre-upgrade to v1.4.0+
 
+#### Helmfile new feature: `functional.authentication.ssoFederation`
+
+**Target group:** Deployments that make use of IdP federation as described in [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
+
+Please ensure to configure your IdP federation config details as part of `functional.authentication.ssoFederation`. You can find more details in the "Example configuration" section of [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
+
 #### Helmfile cleanup: `global.additionalMailDomains` as list
 
 **Target group:** Installations that have set `global.additionalMailDomains`.

docs/requirements.md

@@ -29,7 +29,7 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
 - K8s cluster >= v1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
 - Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases)
-- [Helm](https://helm.sh/) >= v3.17.3
+- [Helm](https://helm.sh/) >= v3.17.3 && < 3.18.x[^3]
 - [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= v1.0.0
 - [HelmDiff](https://github.com/databus23/helm-diff) >= v3.11.0
 - Volume provisioner supporting RWO (read-write-once)[^1]
@@ -140,3 +140,5 @@ Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare
 [^1]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail.
 
 [^2]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
+
+[^3]: Due to a [bug in Helm 3.18.x](https://github.com/helm/helm/issues/30890), fixed versions are likely to be supported again.

helmfile/apps/nubus/values-nubus.yaml.gotmpl

@@ -182,7 +182,8 @@ keycloak:
   commonAnnotations:
     {{ .Values.annotations.nubusKeycloak.common | toYaml | nindent 4 }}
   image:
-    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloak.registry | quote }}
+#    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloak.registry | quote }}
+    registry: {{ .Values.images.nubusKeycloak.registry | quote }}
     repository: {{ .Values.images.nubusKeycloak.repository }}
     tag: {{ .Values.images.nubusKeycloak.tag }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -200,9 +201,9 @@ keycloak:
     login:
       messages:
         de:
-          loginTitle: "Anmeldung bei opendesk"
+          loginTitle: "Anmeldung bei {{ .Values.theme.texts.productName }}"
         en:
-          loginTitle: "Sign in to opendesk"
+          loginTitle: "Sign in to {{ .Values.theme.texts.productName }}"
   podAnnotations:
     intents.otterize.com/service-name: "ums-keycloak"
     {{- with .Values.annotations.nubusKeycloak.pod }}

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -291,7 +291,12 @@ appsuite:
         open-xchange-documents-backend: "disabled"
         open-xchange-documents-monitoring: "disabled"
         open-xchange-documents-templates: "disabled"
+        # Required for the central contacts integration
+        open-xchange-oauth-provider: "enabled"
+        # Needed to set com.openexchange.hostname
+        open-xchange-hostname-config-cascade: "enabled"
     properties:
+      com.openexchange.hostname: {{ printf "%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
       com.openexchange.UIWebPath: "/appsuite/"
       com.openexchange.showAdmin: "false"
       # PDF Export
@@ -323,6 +328,15 @@ appsuite:
       com.openexchange.oidc.userLookupNamePart: "full"
       com.openexchange.oidc.enablePasswordGrant: "true"
       com.openexchange.oidc.passwordGrantUserNamePart: "local-part"
+      # OAUTH
+      com.openexchange.oauth.provider.enabled: "true"
+      com.openexchange.oauth.provider.allowedIssuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+      com.openexchange.oauth.provider.contextLookupClaim: "context"
+      com.openexchange.oauth.provider.contextLookupNamePart: "full"
+      com.openexchange.oauth.provider.jwt.jwksUri: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
+      com.openexchange.oauth.provider.mode: "expect_jwt"
+      com.openexchange.oauth.provider.userLookupNamePart: "full"
+      com.openexchange.oauth.provider.userLookupClaim: "opendesk_username"
       # MAIL
       com.openexchange.mail.authType: "xoauth2"
       com.openexchange.mail.loginSource: "mail"

helmfile/apps/open-xchange/values-postfix.yaml.gotmpl

@@ -55,6 +55,10 @@ postfix:
   {{- if .Values.apps.dkimpy.enabled }}
   dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
   {{- end }}
+
+  minTLSVersion: "TLSv1.3"
+  smtpdTLSMandatoryCiphers: "high"
+
   rspamdHost: ""
   relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
   allowRelayNets: false

helmfile/apps/services-external/values-postfix.yaml.gotmpl

@@ -65,8 +65,14 @@ postfix:
   {{- end }}
   rspamdHost: ""
   relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
+
+  # Warning: This setting allows unauthenticated mail relay from relayNets!
   relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
   allowRelayNets: true
+
+  minTLSVersion: "TLSv1.3"
+  smtpdTLSMandatoryCiphers: "high"
+
   smtpSASLAuthEnable: "yes"
   smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
   smtpTLSSecurityLevel: "encrypt"

helmfile/environments/default/images.yaml.gotmpl

@@ -320,7 +320,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.5.0@sha256:9457bc2116620e52dcd1f5f12f042090aa4cca2a3e4d5f64b7c84c232ca6bb63"
+    tag: "2.6.0@sha256:47b9d01b70f72a717ce89a80bf36a2c01653c6a7335dd3287f7cab1555aa8864"
   nextcloudExporter:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -418,9 +418,9 @@ images:
     # upstreamRepository: "nubus/images/keycloak"
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
     # upstreamMirrorStartFrom: ["0", "0", "1"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak"
-    tag: "0.0.1@sha256:ce2397ac38920750b81a8a6065f7ed8a551641c6562a551963a2857fe6822beb"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/images/keycloak"
+    tag: "0.2.0-post-jbremer-keycloakupdate26-2-2"
   nubusKeycloakBootstrap:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"