feat(helmfile): Add template support for annotations

`*.yaml.gotmpl`., please read migrations.md for more details

.gitlab-ci.yml

@@ -36,17 +36,19 @@ stages:
   - "env-cleanup"
   - "env"
   - "pre-services-deploy"
-  - "migrations-pre"
+  - "010-migrations-pre"
-  - "basic-services-deploy"
+  - "030-services"
-  - "component-deploy-stage-1"
+  - "050-components"
-  - "component-deploy-stage-2"
+  - "060-components"
-  - "migrations-post"
+  - "090-migrations-post"
   - "lint"
-  - "tests"
+  - "post-prepare"
+  - "post-execute"
   - "env-stop"
   - ".post"
 
 variables:
+  RELEASE_BRANCH: "main"
   NAMESPACE:
     description: "The name of namespaces to deploy to."
     value: ""
@@ -145,6 +147,13 @@ variables:
     options:
       - "yes"
       - "no"
+  CREATE_DEFAULT_ACCOUNTS:
+    description: "Creates `default` and `default-admin` in the instance using the password defined as CI variable
+                 `DEFAULT_ACCOUNTS_PASSWORD`."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
   RUN_TESTS:
     description: "Triggers execution of E2E-tests."
     value: "no"
@@ -164,13 +173,14 @@ variables:
     description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
     value: "gitlab.opencode.de/api/v4/projects/1506"
   TESTS_TESTSET:
-    description: "Selects testset for E2E-tests"
+    description: "Selects test set for E2E-tests"
     value: "Smoke"
     options:
       - "Regression"
       - "Smoke"
   TESTS_GRACE_PERIOD:
-    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail. GRACE_PERIOD is the period in seconds that should be waited before running the tests."
+    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail.
+                  GRACE_PERIOD is the period in seconds that should be waited before running the tests."
     value: "0"
 
 .deploy-common:
@@ -273,11 +283,11 @@ policies-deploy:
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
       when: "on_success"
   variables:
-    COMPONENT: "services"
+    COMPONENT: "opendesk-services"
     ADDITIONAL_ARGS: "-l name=opendesk-otterize"
 
 migrations-pre:
-  stage: "migrations-pre"
+  stage: "010-migrations-pre"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -286,10 +296,10 @@ migrations-pre:
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
       when: "on_success"
   variables:
-    COMPONENT: "migrations-pre"
+    COMPONENT: "opendesk-migrations-pre"
 
 migrations-post:
-  stage: "migrations-post"
+  stage: "090-migrations-post"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -298,10 +308,10 @@ migrations-post:
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
       when: "on_success"
   variables:
-    COMPONENT: "migrations-post"
+    COMPONENT: "opendesk-migrations-post"
 
-services-deploy:
+services-external-deploy:
-  stage: "basic-services-deploy"
+  stage: "030-services"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -310,10 +320,22 @@ services-deploy:
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
       when: "on_success"
   variables:
-    COMPONENT: "services"
+    COMPONENT: "services-external"
+
+opendesk-services-deploy:
+  stage: "030-services"
+  extends: ".deploy-common"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
+      when: "on_success"
+  variables:
+    COMPONENT: "opendesk-services"
 
 nubus-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -325,7 +347,7 @@ nubus-deploy:
     COMPONENT: "nubus"
 
 ox-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   timeout: "30m"
   rules:
@@ -338,7 +360,7 @@ ox-deploy:
     COMPONENT: "open-xchange"
 
 xwiki-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -350,7 +372,7 @@ xwiki-deploy:
     COMPONENT: "xwiki"
 
 collabora-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -362,7 +384,7 @@ collabora-deploy:
     COMPONENT: "collabora"
 
 cryptpad-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -374,7 +396,7 @@ cryptpad-deploy:
     COMPONENT: "cryptpad"
 
 nextcloud-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -386,7 +408,7 @@ nextcloud-deploy:
     COMPONENT: "nextcloud"
 
 openproject-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -398,7 +420,7 @@ openproject-deploy:
     COMPONENT: "openproject"
 
 openproject-bootstrap-deploy:
-  stage: "component-deploy-stage-2"
+  stage: "060-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -407,10 +429,10 @@ openproject-bootstrap-deploy:
           ($DEPLOY_ALL_COMPONENTS != "no" || ($DEPLOY_OPENPROJECT != "no" && $DEPLOY_NEXTCLOUD != "no"))
       when: "on_success"
   variables:
-    COMPONENT: "openproject-bootstrap"
+    COMPONENT: "opendesk-openproject-bootstrap"
 
 jitsi-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -422,7 +444,7 @@ jitsi-deploy:
     COMPONENT: "jitsi"
 
 element-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -433,20 +455,62 @@ element-deploy:
   variables:
     COMPONENT: "element"
 
-.ums-default-password: &ums-default-password
+fetch-administrator-credentials:
-  - |
+  extends: ".deploy-common"
-    DEFAULT_ADMINISTRATOR_PASSWORD=$(
+  environment:
+    name: "${NAMESPACE}"
+  stage: "post-prepare"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api"
+          && $NAMESPACE =~ /.+/
+          && ($CREATE_DEFAULT_ACCOUNTS == "yes" || $RUN_TESTS == "yes")
+      when: "on_success"
+  script:
+    - |
+      echo "DEFAULT_ADMINISTRATOR_PASSWORD=$(
        kubectl \
          -n ${NAMESPACE} \
          get secret ums-nubus-credentials \
          -o jsonpath='{.data.administrator_password}' | base64 -d \
-    )
+      )" >> .env
+  artifacts:
+    reports:
+      dotenv: ".env"
 
-run-tests:
+import-default-accounts:
-  extends: ".deploy-common"
+  stage: "post-execute"
+  extends: ".environments"
+  dependencies:
+    - "fetch-administrator-credentials"
+  environment:
+    name: "${NAMESPACE}"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $CREATE_DEFAULT_ACCOUNTS == "yes"
+      when: "on_success"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0"
+  script:
+    - "echo \"Starting default account import for ${DOMAIN}\""
+    - "cd /app"
+    - |
+      ./user_import_udm_rest_api.py \
+        --import_domain ${DOMAIN} \
+        --udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
+        --set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
+        --import_filename ./template.ods \
+        --admin_enable_fileshare True \
+        --admin_enable_knowledgemanagement True \
+        --admin_enable_projectmanagement True \
+        --create_admin_accounts True
+
+run-tests:
+  stage: "post-execute"
+  extends: ".deploy-common"
+  dependencies:
+    - "fetch-administrator-credentials"
   environment:
     name: "${NAMESPACE}"
-  stage: "tests"
   rules:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
@@ -457,7 +521,6 @@ run-tests:
           - "de"
           - "en"
   script:
-    - *ums-default-password
     - |
       curl --request POST \
       --header "Content-Type: application/json" \
@@ -489,7 +552,7 @@ avscan-prepare:
   rules:
     - if: >
           $JOB_AVSCAN_ENABLED != 'false' &&
-          $CI_COMMIT_BRANCH == 'main' &&
+          $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
           $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "always"
     - when: "never"
@@ -539,7 +602,7 @@ avscan-start:
   rules:
     - if: >
         $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == 'main' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
         $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "always"
     - when: "never"
@@ -549,8 +612,8 @@ avscan-start:
         job: "avscan-prepare"
     strategy: "depend"
 
-# Declare .environments which is in environments repository. In case it is not available
+# Declare .environments which is in `opendesk-env` repository. In case it is not available
-# 'cache' is used because job must contain at least one key, so cache is just a dummy key.
+# 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
 .environments:
   cache: {}
 
@@ -585,7 +648,7 @@ generate-release-version:
   rules:
     - if: >
         $JOB_RELEASE_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
         $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "on_success"
 
@@ -593,7 +656,7 @@ release:
   rules:
     - if: >
         $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
         $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "on_success"
   script:
@@ -609,7 +672,7 @@ release:
       fi
     - |
       echo -e "\n[INFO] Writing data to helm value file..."
-      cat <<EOF >helmfile/environments/default/global.generated.yaml
+      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
       # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
       # SPDX-License-Identifier: Apache-2.0
       ---
@@ -621,7 +684,7 @@ release:
     - |
       cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
       {
-        "branches": ["main"],
+        "branches": ["${RELEASE_BRANCH}"],
         "plugins": [
           "@semantic-release/gitlab",
           "@semantic-release/release-notes-generator",
@@ -631,7 +694,7 @@ release:
               "charts/**/Chart.yaml",
               "CHANGELOG.md",
               "charts/**/README.md",
-              "helmfile/environments/default/global.generated.yaml",
+              "helmfile/environments/default/global.generated.yaml.gotmpl",
               ".kyverno/kyverno-test.yaml",
               "docs"
             ],

.gitlab/common/common.yml

@@ -2,10 +2,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.5.2\
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.5.3\
-    @sha256:8445978facabf1526cdb4434e7da8b9c8b9b930337c247ea811b1a53765817e3"
+    @sha256:1296e8590b59f02311881307bb14c58b72bafc92a58e7e7e7212508abf902b00"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.7\
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.8\
-    @sha256:632ea46d4ff70d39a627404576ea3b14a1cf96d04ea0701cbea6b771765d1769"
+    @sha256:59e714cad38e873cf8a9a132af76ad868b46a51ed12d0bd45477f328c0136991"
 
 .common:
   cache: {}

.gitlab/generate/generate-docs.yml

@@ -13,7 +13,7 @@ generate-docs:
   extends: ".generate-common"
   image: "${OPENDESK_CI_CLI_IMAGE}"
   rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $RELEASE_BRANCH"
       when: "on_success"
   script:
     - "node /app/src/index.js generate-docs -d ${CI_PROJECT_DIR}"

.renovate/config.yaml

@@ -35,12 +35,12 @@ repositories:
     dependencyDashboard: true
     # Include package files only within these defined paths
     includePaths:
-      - "helmfile/environments/default/images.yaml"
+      - "helmfile/environments/default/images.yaml.gotmpl"
-      - "helmfile/environments/default/charts.yaml"
+      - "helmfile/environments/default/charts.yaml.gotmpl"
     customManagers:
       - customType: "regex"
         fileMatch:
-          - "helmfile/environments/default/images.yaml"
+          - "helmfile/environments/default/images.yaml.gotmpl"
         datasourceTemplate: "docker"
         matchStrings:
           # yamllint disable rule:line-length rule:quoted-strings
@@ -48,7 +48,7 @@ repositories:
           # yamllint enable rule:line-length rule:quoted-strings
       - customType: "regex"
         fileMatch:
-          - "helmfile/environments/default/charts.yaml"
+          - "helmfile/environments/default/charts.yaml.gotmpl"
         datasourceTemplate: "docker"
         matchStrings:
           # yamllint disable rule:line-length rule:quoted-strings

README.md

@@ -27,17 +27,17 @@ openDesk is a Kubernetes based, open-source and cloud-native digital workplace s
 
 openDesk currently features the following functional main components:
 
-| Function             | Functional Component        | Component<br/>Version                                                                 | Upstream Documentation                                                                                                               |
+| Function             | Functional Component        | Component<br/>Version                                                                                | Upstream Documentation                                                                                                                |
-| -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
+| -------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
-| Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                         |
+| Chat & collaboration | Element ft. Nordeck widgets | [1.11.87](https://github.com/element-hq/element-desktop/releases/tag/v1.11.87)                       | [For the most recent release](https://element.io/user-guide)                                                                          |
-| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                         |
+| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                                     | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | [29.0.9](https://nextcloud.com/de/changelog/#29-0-9)                                  | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                         |
+| File management      | Nextcloud                   | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8)                                                 | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                           |
-| Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
-| Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                    |
+| Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)                       | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
-| Portal & IAM         | Nubus                       | [1.0](https://www.univention.de/produkte/nubus/)                                      | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                            |
+| Portal & IAM         | Nubus                       | [1.4.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | [15.0.2](https://www.openproject.org/docs/release-notes/15-0-2/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                          |
+| Project management   | OpenProject                 | [15.0.2](https://www.openproject.org/docs/release-notes/15-0-2/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
-| Videoconferencing    | Jitsi                       | [2.0.9779](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9779) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                           |
+| Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
-| Weboffice            | Collabora                   | [24.04.7.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)       |
+| Weboffice            | Collabora                   | [24.04.9.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
 
 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
@@ -87,8 +87,8 @@ of this project.
 
 Please find a list of the artifacts related to the release either in the source code archive attached to the release or
 in the files from the release's git-tag:
-- `./helmfile/environments/default/images.yaml`
+- `./helmfile/environments/default/images.yaml.gotmpl`
-- `./helmfile/environments/default/charts.yaml`
+- `./helmfile/environments/default/charts.yaml.gotmpl`
 
 Find more information in our [Workflow documentation](./docs/workflow.md).
 

dev/charts-local.py

@@ -23,7 +23,7 @@ options = p.parse_args()
 script_path = os.path.dirname(os.path.realpath(__file__))
 # some static definitions
 log_path = script_path+'/../logs'
-charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml'
+charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml.gotmpl'
 base_repo_path = script_path+'/..'
 base_helmfile = base_repo_path+'/helmfile_generic.yaml.gotmpl'
 helmfile_backup_extension = '.bak'
@@ -43,8 +43,8 @@ consoleHandler.setFormatter(logFormatter)
 rootLogger.addHandler(consoleHandler)
 
 logging.debug(f"Working with relative paths from script location: {script_path}")
-logging.debug(f"Log directory: {log_path}")
+logging.debug(f"Log directory:      {log_path}")
-logging.debug(f"charts.yaml  : {charts_yaml}")
+logging.debug(f"charts.yaml.gotmpl: {charts_yaml}")
 
 
 def create_or_switch_branch_base_repo():

docs/components.md

@@ -27,28 +27,28 @@ openDesk consists of a variety of open-source projects. Here is a list with the
 Components of type `Eval` are used for development and evaluation purposes only,
 they need to be replaced in production deployments.
 
-| Component                   | Description                    | Type       |
+| Component            | Description                    | Type       |
-|-----------------------------|--------------------------------|------------|
+| -------------------- | ------------------------------ | ---------- |
-| Certificates                | TLS certificates               | Eval       |
+| Certificates         | TLS certificates               | Eval       |
-| ClamAV (Distributed)        | Antivirus engine               | Eval       |
+| ClamAV (Distributed) | Antivirus engine               | Eval       |
-| ClamAV (Simple)             | Antivirus engine               | Eval       |
+| ClamAV (Simple)      | Antivirus engine               | Eval       |
-| Collabora                   | Weboffice                      | Functional |
+| Collabora            | Weboffice                      | Functional |
-| CryptPad                    | Weboffice                      | Functional |
+| CryptPad             | Weboffice                      | Functional |
-| dkimpy-milter               | DKIM milter for Postfix        | Eval       |
+| dkimpy-milter        | DKIM milter for Postfix        | Eval       |
-| Element                     | Secure communications platform | Functional |
+| Element              | Secure communications platform | Functional |
-| Jitsi                       | Videoconferencing              | Functional |
+| Jitsi                | Videoconferencing              | Functional |
-| MariaDB                     | Database                       | Eval       |
+| MariaDB              | Database                       | Eval       |
-| Memcached                   | Cache Database                 | Eval       |
+| Memcached            | Cache Database                 | Eval       |
-| MinIO                       | Object Storage                 | Eval       |
+| MinIO                | Object Storage                 | Eval       |
-| Nextcloud                   | File share                     | Functional |
+| Nextcloud            | File share                     | Functional |
-| Nubus (UMS)                 | Identity Management & Portal   | Functional |
+| Nubus (UMS)          | Identity Management & Portal   | Functional |
-| OpenProject                 | Project management             | Functional |
+| OpenProject          | Project management             | Functional |
-| OX Appsuite                 | Groupware                      | Functional |
+| OX App Suite         | Groupware                      | Functional |
-| OX Dovecot                  | Mail backend (IMAP)            | Functional |
+| OX Dovecot           | Mail backend (IMAP)            | Functional |
-| Postfix                     | MTA                            | Eval       |
+| Postfix              | MTA                            | Eval       |
-| PostgreSQL                  | Database                       | Eval       |
+| PostgreSQL           | Database                       | Eval       |
-| Redis                       | Cache Database                 | Eval       |
+| Redis                | Cache Database                 | Eval       |
-| XWiki                       | Knowledge Management           | Functional |
+| XWiki                | Knowledge Management           | Functional |
 
 # Component integration
 

docs/debugging.md

@@ -35,7 +35,7 @@ environments, you should use them thoughtfully and carefully if needed.
 
 # Enable debugging
 
-Check the openDesk [`debug.yaml`](../helmfile/environments/default/debug.yaml) and set for your deployment
+Check the openDesk [`debug.yaml.gotmpl`](../helmfile/environments/default/debug.yaml.gotmpl) and set for your deployment
 ```
 debug:
   enable: true
@@ -201,3 +201,6 @@ kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"dat
 ```
 
 2. Restart the Keycloak Pod(s).
+
+> **Note**<br>
+> As the `ums-keycloak-extensions-handler` is performing frequent (one per second) requests to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.

docs/development.md

@@ -12,7 +12,7 @@ However, contributions are possible using the [CLA](https://gitlab.opencode.de/b
 <!-- TOC -->
 * [Overview](#overview)
 * [Default branch, `develop` and other branches](#default-branch-develop-and-other-branches)
-* [External artifacts - `charts.yaml` and `images.yaml`](#external-artifacts---chartsyaml-and-imagesyaml)
+* [External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`](#external-artifacts---chartsyamlgotmpl-and-imagesyamlgotmpl)
   * [Linting](#linting)
     * [Disable linting selectively](#disable-linting-selectively)
   * [Renovate](#renovate)
@@ -29,29 +29,29 @@ developing the openDesk platform.
 
 ```mermaid
 flowchart TD
- J[helmfile.yaml\nor a helmfile outside of this repository]-->A
+ J[helmfile.yaml.gotmpl\nor a helmfile outside of this repository]-->A
  J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor any an environment values file]
- A[./helmfile_generic.yaml]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml\nReferences the relevant app Helm\ncharts using details from 'charts.yaml']
+ A[./helmfile_generic.yaml.gotmpl]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml.gotmpl\nReferences the relevant app Helm\ncharts using details from 'charts.yaml.gotmpl']
- B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml`]
+ B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml.gotmpl`]
  A-->D[./helmfile/environments/default/*\nwith just some examples below]
- D-->F[charts.yaml]
+ D-->F[charts.yaml.gotmpl]
- D-->G[images.yaml]
+ D-->G[images.yaml.gotmpl]
  D-->H[global.*]
- D-->I[secrets.yaml\nreplicas.yaml\nresources.yaml\n...]
+ D-->I[secrets.yaml.gotmpl\nreplicas.yaml.gotmpl\nresources.yaml.gotmpl\n...]
  A-->|overwrite defaults with your\ndeployment/environment specific values|E[./helmfile/environments/default/values.yaml.gotmpl]
 ```
 
-The `helmfile.yaml` file in the root folder is the foundation
+The `helmfile.yaml.gotmpl` file in the root folder is the foundation
-for the entire deployment. It references the `helmfile_generic.yaml`
+for the entire deployment. It references the `helmfile_generic.yaml.gotmpl`
-file, which includes app-specific `helmfile.yaml` files and
+file, which includes app-specific `helmfile.yaml.gotmpl` files and
 global values files located in `./environments/default`.
 
-`helmfile.yaml` also refers to three predefined environments: `dev`,
+`helmfile.yaml.gotmpl` also refers to three predefined environments: `dev`,
 `test`, and `prod`.
 
-The `helmfile_generic.yaml` file is designed to be referenced from
+The `helmfile_generic.yaml.gotmpl` file is designed to be referenced from
 external repositories, where custom environments may be defined. An
-example is demonstrated in the `helmfile.yaml` file.
+example is demonstrated in the `helmfile.yaml.gotmpl` file.
 
 Before you investigate any app-specific configuration, it is recommended that you review the contents of `./helmfile/environments/default` to understand what configuration details are set there, as the app deployments reference them.
 
@@ -68,9 +68,9 @@ Of course, the merge request will target the `develop` branch, be in status `dra
 
 If you do not plan to merge from the branch you have pushed, please close the auto-created MR.
 
-# External artifacts - `charts.yaml` and `images.yaml`
+# External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`
 
-The `charts.yaml` and `images.yaml` files are the central place to reference external artifacts used for the deployment.
+The `charts.yaml.gotmpl` and `images.yaml.gotmpl` files are the central place to reference external artifacts used for the deployment.
 
 Besides the deployment automation itself, some tools work with the contents of the files:
 
@@ -142,7 +142,7 @@ The mirror script takes the information on what artifacts to mirror from the ann
 - `# upstreamRegistry` *required*: To identify the source registry
 - `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public, the access credentials have to be specified as ENV variables containing the value of this key in their name, so you want to specify that key all uppercase:
   - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
-  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORT`
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORD`
 - `# upstreamRepository` *required*: To identify the source repository
 - `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set, the mirror for the component will be activated. Only tags that match the given regular expression are being mirrored. **Note:** You must use single quotes for this attribute's value if you use backslash leading regex notation like `\d`.
 - `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing group

docs/enhanced-configuration.md

@@ -13,4 +13,5 @@ The following enhanced configuration use cases are described in separate documen
 - [Federation with external identity provider](./enhanced-configuration/idp-federation.md)
 - [Matrix federation](./enhanced-configuration/matrix-federation.md)
 - [Groupware migration from M365 to openDesk](./enhanced-configuration/groupware-migration.md)
-- [Self-signed certificate and custom Certificate Authority (CA)](enhanced-configuration/self-signed-certificates.md)
+- [Self-signed certificate and custom Certificate Authority (CA)](./enhanced-configuration/self-signed-certificates.md)
+- [GitOps deployments using Argo CD](./enhanced-configuration/gitops.md)

docs/enhanced-configuration/gitops.md

@@ -0,0 +1,55 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>GitOps Deployment</h1>
+
+<!-- TOC -->
+* [Considerations](#considerations)
+* [ArgoCD](#argocd)
+  * [Option 1: Use YAML manifests](#option-1-use-yaml-manifests)
+  * [Option 2: Helmfile plugin](#option-2-helmfile-plugin)
+<!-- TOC -->
+
+The recommended deployment method for openDesk is via Helmfile. This can be done "by hand", via CI/CD (Gitlab) or using
+the [GitOps](https://about.gitlab.com/topics/gitops/) approach with tools like [Argo CD](https://argoproj.github.io/cd/).
+
+This documentation will use Argo CD to explain how to deploy openDesk GitOps-style.
+
+# Considerations
+
+- openDesk consists of multiple applications which have to be deployed in order.
+- During upgrades, migrations have to run before and after applications.
+
+# ArgoCD
+
+We are continuously improving our Argo CD support, please share you experience with Argo CD deployments e.g. by [creating
+at ticket](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues).
+
+There are two options to deploy openDesk via Argo CD described in the following sections.
+
+## Option 1: Use YAML manifests
+
+This option requires a preprocessing step before using Argo CD. This step requires you to compile the Helmfile based
+deployment into Kubernetes YAML manifest, to do so you need to execute the helmfile binary:
+
+```shell
+helmfile template > opendesk.yaml
+```
+
+References:
+- [Helmfile CLI documentation](https://helmfile.readthedocs.io/en/latest/#cli-reference)
+- [Generate K8s YAML Manifests for openDesk](https://gitlab.opencode.de/bmi/opendesk/deployment/options/generate-k8s-yaml-manifests)
+
+Afterwards, you can use the resulting manifests within an standard Argo CD workflow.
+
+## Option 2: Helmfile plugin
+
+It is possible to deploy openDesk via Argo CD with community developed
+[Helmfile plugin](https://github.com/travisghansen/argo-cd-helmfile).
+
+You can find an example for this approach in the
+[Argo CD Deployments](https://gitlab.opencode.de/bmi/opendesk/deployment/options/argocd-deploy) repository.
+It contains an example Helm chart (`opendesk-parent`) to create Argo CD Applications via a Helm chart (`opendesk`)
+according to `app of apps pattern` and is using sync waves to follow dependencies.

docs/enhanced-configuration/groupware-migration.md

@@ -6,7 +6,6 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Migration from M365 with audriga migration service and master authentication</h1>
 
 <!-- TOC -->
-* [Context](#context)
 * [Prerequisites](#prerequisites)
   * [Prepare M365 tenant for access](#prepare-m365-tenant-for-access)
   * [Provisioning user accounts in openDesk](#provisioning-user-accounts-in-opendesk)
@@ -75,18 +74,18 @@ With openDesk 1.0 Enterprise, you can set openDesk's email components (OX AppSui
 
 ```
 secrets:
-  oxAppsuite:
+  oxAppSuite:
     adminPassword: "your_temporary_master_password"
 functional:
   migration:
-    oxAppsuite:
+    oxAppSuite:
       enabled: true
 ```
 
 1. You must specify the master password referenced in the document's following sections.
 2. You need to enable the actual master authentication mode.
 
-Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppsuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppsuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
+Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppSuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppSuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
 
 > **Note**<br>
 > For the changes to take effect, it is sufficient to deploy the `open-xchange` component.

docs/enhanced-configuration/idp-federation.md

@@ -7,6 +7,7 @@ SPDX-License-Identifier: Apache-2.0
 
 <!-- TOC -->
 * [Context](#context)
+* [References](#references)
 * [Prerequisites](#prerequisites)
   * [User accounts](#user-accounts)
   * [External IdP with OIDC](#external-idp-with-oidc)
@@ -24,6 +25,15 @@ Most organizations already have an Identity and Access Management (IAM) system w
 
 This document shows how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk single sign-on based on your organization's login.
 
+# References
+
+We would like to list successful IdP federation scenarios, so we are also happy about input from the community:
+
+| External IdP                                                        | last openDesk version tested |
+| ------------------------------------------------------------------- | ---------------------------- |
+| [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0                       |
+| [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                       |
+
 # Prerequisites
 
 ## User accounts

docs/enhanced-configuration/self-signed-certificates.md

@@ -39,7 +39,7 @@ access openDesk.
     ```
 
 1. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
-wildcard certificate or a certificate with [all required subdomains](../../helmfile/environments/default/global.yaml)
+wildcard certificate or a certificate with [all required subdomains](../../helmfile/environments/default/global.yaml.gotmpl)
 set as SANs (Subject Alternative Name).
 
 1. Create a Kubernetes secret with name `opendesk-certificates-ca-tls` of type `kubernetes.io/tls` containing the custom

docs/external-services.md

@@ -18,59 +18,59 @@ This document will cover the additional configuration for external services like
 When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.
 
-| Component   | Name               | Type       | Parameter | Key                                      | Default                    |
+| Component    | Name               | Type       | Parameter | Key                                      | Default                    |
-|-------------|--------------------|------------|-----------|------------------------------------------|----------------------------|
+| ------------ | ------------------ | ---------- | --------- | ---------------------------------------- | -------------------------- |
-| Element     | Synapse            | PostgreSQL |           |                                          |                            |
+| Element      | Synapse            | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.synapse.name` | `matrix` |
+|              |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
-|             |                    |            | Host      | `databases.synapse.host` | `postgresql` |
+|              |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
-|             |                    |            | Port      | `databases.synapse.port` | `5432` |
+|              |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
-|             |                    |            | Username  | `databases.synapse.username` | `matrix_user` |
+|              |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
-|             |                    |            | Password  | `databases.synapse.password` |                            |
+|              |                    |            | Password  | `databases.synapse.password`             |                            |
-| Keycloak    | Keycloak           | PostgreSQL |           |                                          |                            |
+| Keycloak     | Keycloak           | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloak.name` | `keycloak` |
+|              |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
-|             |                    |            | Host      | `databases.keycloak.host` | `postgresql` |
+|              |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloak.port` | `5432` |
+|              |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
-|             |                    |            | Username  | `databases.keycloak.username` | `keycloak_user` |
+|              |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
-|             |                    |            | Password  | `databases.keycloak.password` |                            |
+|              |                    |            | Password  | `databases.keycloak.password`            |                            |
-|             | Keycloak Extension | PostgreSQL |           |                                          |                            |
+|              | Keycloak Extension | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloakExtension.name` | `keycloak_extensions` |
+|              |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
-|             |                    |            | Host      | `databases.keycloakExtension.host` | `postgresql` |
+|              |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloakExtension.port` | `5432` |
+|              |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
-|             |                    |            | Username  | `databases.keycloakExtension.username` | `keycloak_extensions_user` |
+|              |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
-|             |                    |            | Password  | `databases.keycloakExtension.password` |                            |
+|              |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
-| UMS         | Notifications API  | PostgreSQL |           |                                          |                            |
+| UMS          | Notifications API  | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsNotificationsApi.name` | `notificationsapi` |
+|              |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
-|             |                    |            | Host      | `databases.umsNotificationsApi.host` | `postgresql` |
+|              |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
-|             |                    |            | Port      | `databases.umsNotificationsApi.port` | `5432` |
+|              |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
-|             |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user` |
+|              |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
-|             |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
+|              |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
-|             | Self Service       | PostgreSQL |           |                                          |                            |
+|              | Self Service       | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsSelfservice.name` | `selfservice` |
+|              |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
-|             |                    |            | Host      | `databases.umsSelfservice.host` | `postgresql` |
+|              |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
-|             |                    |            | Port      | `databases.umsSelfservice.port` | `5432` |
+|              |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
-|             |                    |            | Username  | `databases.umsSelfservice.username` | `selfservice_user` |
+|              |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
-|             |                    |            | Password  | `databases.umsSelfservice.password` |                            |
+|              |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
-| Nextcloud   | Nextcloud          | MariaDB    |           |                                          |                            |
+| Nextcloud    | Nextcloud          | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.nextcloud.name` | `nextcloud` |
+|              |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
-|             |                    |            | Host      | `databases.nextcloud.host` | `mariadb` |
+|              |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
-|             |                    |            | Username  | `databases.nextcloud.username` | `nextcloud_user` |
+|              |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
-|             |                    |            | Password  | `databases.nextcloud.password` |                            |
+|              |                    |            | Password  | `databases.nextcloud.password`           |                            |
-| OpenProject | OpenProject        | PostgreSQL |           |                                          |                            |
+| OpenProject  | OpenProject        | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.openproject.name` | `openproject` |
+|              |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
-|             |                    |            | Host      | `databases.openproject.host` | `postgresql` |
+|              |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
-|             |                    |            | Port      | `databases.openproject.port` | `5432` |
+|              |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
-|             |                    |            | Username  | `databases.openproject.username` | `openproject_user` |
+|              |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
-|             |                    |            | Password  | `databases.openproject.password` |                            |
+|              |                    |            | Password  | `databases.openproject.password`         |                            |
-| OX Appsuite | OX Appsuite        | MariaDB    |           |                                          |                            |
+| OX App Suite | OX App Suite       | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.oxAppsuite.name` | `CONFIGDB` |
+|              |                    |            | Name      | `databases.oxAppSuite.name`              | `CONFIGDB`                 |
-|             |                    |            | Host      | `databases.oxAppsuite.host` | `mariadb` |
+|              |                    |            | Host      | `databases.oxAppSuite.host`              | `mariadb`                  |
-|             |                    |            | Username  | `databases.oxAppsuite.username` | `root` |
+|              |                    |            | Username  | `databases.oxAppSuite.username`          | `root`                     |
-|             |                    |            | Password  | `databases.oxAppsuite.password` |                            |
+|              |                    |            | Password  | `databases.oxAppSuite.password`          |                            |
-| XWiki       | XWiki              | MariaDB    |           |                                          |                            |
+| XWiki        | XWiki              | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.xwiki.name` | `xwiki` |
+|              |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
-|             |                    |            | Host      | `databases.xwiki.host` | `mariadb` |
+|              |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
-|             |                    |            | Username  | `databases.xwiki.username` | `xwiki_user` |
+|              |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
-|             |                    |            | Password  | `databases.xwiki.password` |                            |
+|              |                    |            | Password  | `databases.xwiki.password`               |                            |
 
 # Object storage
 

docs/getting-started.md

@@ -78,15 +78,15 @@ All subdomains can be customized. For example, _Nextcloud_ can be changed to `fi
 
 ```yaml
 global:
-  hosts:
+  hosts:
-    nextcloud: "files"
+    nextcloud: "files"
 ```
 
 The domain has to be set either via `dev` environment
 
 ```yaml
 global:
-  domain: "domain.tld"
+  domain: "domain.tld"
 ```
 
 or via environment variable
@@ -97,7 +97,7 @@ export DOMAIN=domain.tld
 
 ### Apps
 
-All available apps and their default value are in `helmfile/environments/default/workplace.yaml`.
+All available apps and their default value are in `helmfile/environments/default/opendesk_main.gotmpl`.
 
 | Component            | Name                        | Default | Description                    |
 | -------------------- | --------------------------- | ------- | ------------------------------ |
@@ -106,8 +106,10 @@ All available apps and their default value are in `helmfile/environments/default
 | ClamAV (Simple)      | `clamavSimple.enabled`      | `true`  | Antivirus engine               |
 | Collabora            | `collabora.enabled`         | `true`  | Weboffice                      |
 | CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
+| dkimpy               | `dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
 | Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
 | Element              | `element.enabled`           | `true`  | Secure communications platform |
+| Home                 | `home.enabled`              | `true`  | Base domain portal redirect    |
 | Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
 | MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
 | Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
@@ -115,7 +117,7 @@ All available apps and their default value are in `helmfile/environments/default
 | Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
 | Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
 | OpenProject          | `openproject.enabled`       | `true`  | Project management             |
-| OX Appsuite          | `oxAppsuite.enabled`        | `true`  | Groupware                      |
+| OX App Suite         | `oxAppSuite.enabled`        | `true`  | Groupware                      |
 | Postfix              | `postfix.enabled`           | `true`  | MTA                            |
 | PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
 | Redis                | `redis.enabled`             | `true`  | Cache Database                 |
@@ -125,7 +127,7 @@ Exemplary, Jitsi can be disabled like:
 
 ```yaml
 jitsi:
-  enabled: false
+  enabled: false
 ```
 
 ## Private registries
@@ -145,7 +147,7 @@ prefer the use of a private image registry, you can configure such for
 
 ```yaml
 global:
-  imageRegistry: "my_private_registry.domain.tld"
+  imageRegistry: "my_private_registry.domain.tld"
 ```
 
 alternatively, you can use an environment variable:
@@ -158,16 +160,16 @@ or control repository override fine-granular per registry:
 
 ```yaml
 repositories:
-  image:
+  image:
-    dockerHub: "my_private_registry.domain.tld/docker.io/"
+    dockerHub: "my_private_registry.domain.tld/docker.io/"
-    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
+    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
 ```
 
 If authentication is required, you can reference `imagePullSecrets` as follows:
 
 ```yaml
 global:
-  imagePullSecrets:
+  imagePullSecrets:
     - "external-registry"
 ```
 
@@ -182,8 +184,8 @@ used:
 
 ```yaml
 cluster:
-  service:
+  service:
-    type: "NodePort"
+    type: "NodePort"
 ```
 
 ### Networking
@@ -192,16 +194,16 @@ If your cluster has not the default `cluster.local` domain configured, you need
 
 ```yaml
 cluster:
-  networking:
+  networking:
-    domain: "acme.internal"
+    domain: "acme.internal"
 ```
 
 If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via the following:
 
 ```yaml
 cluster:
-  networking:
+  networking:
-    cidr:
+    cidr:
       - "127.0.0.0/8"
 ```
 
@@ -210,8 +212,8 @@ explicitly configure the related IPs or IP ranges:
 
 ```yaml
 cluster:
-  networking:
+  networking:
-    incomingCIDR:
+    incomingCIDR:
       - "172.16.0.0/12"
 ```
 
@@ -223,7 +225,7 @@ setting the following attribute to the name of the currently only supported ingr
 
 ```yaml
 ingress:
-  ingressClassName: "name-of-my-nginx-ingress"
+  ingressClassName: "name-of-my-nginx-ingress"
 ```
 
 ### Container runtime
@@ -233,30 +235,32 @@ Some apps require specific configurations for the container runtime. You can set
 
 ```yaml
 cluster:
-  container:
+  container:
-    engine: "containerd"
+    engine: "containerd"
 ```
 
 ### Volumes
-
+The **StorageClass** must be set by:
-When your cluster has a `ReadWriteMany` volume provisioner, you can benefit from the distribution or scaling of apps. By
-default, only `ReadWriteOnce` is enabled. To enable `ReadWriteMany` you can set:
-
-```yaml
-cluster:
-  persistence:
-    readWriteMany: true
-```
-
-The **StorageClass** can be set by:
 
 ```yaml
 persistence:
-  storageClassNames:
+  storageClassNames:
-    RWX: "my-read-write-many-class"
+    RWX: "my-read-write-many-class"
-    RWO: "my-read-write-once-class"
+    RWO: "my-read-write-once-class"
 ```
 
+`RWX` is optional and requires that your cluster has a `ReadWriteMany` volume provisioner. If you can make use
+of it it benefits the distribution or scaling of apps. By default, only `ReadWriteOnce` is enabled.
+To enable `ReadWriteMany` you have to set:
+
+```yaml
+cluster:
+  persistence:
+    readWriteMany: true
+```
+
+
+
 ## Connectivity
 
 ### Ports
@@ -267,22 +271,22 @@ persistence:
 
 To use the openDesk functionality with its web-based user interface, you need to expose the following ports publicly:
 
-| Component          | Description             |  Port | Type |
+| Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
-| openDesk           | Kubernetes Ingress      |    80 |  TCP |
+| openDesk           | Kubernetes Ingress      |    80 |  TCP |
-| openDesk           | Kubernetes Ingress      |   443 |  TCP |
+| openDesk           | Kubernetes Ingress      |   443 |  TCP |
-| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
+| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
 
 #### Mail clients
 
 To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need public exposure:
 
-| Component          | Description             |  Port | Type |
+| Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
-| Dovecot            | IMAPS                   |   993 |  TCP |
+| Dovecot            | IMAPS                   |   993 |  TCP |
-|                    | POP3S                   |   995 |  TCP |
+|                    | POP3S                   |   995 |  TCP |
-| Postfix            | SMTP                    |    25 |  TCP |
+| Postfix            | SMTP                    |    25 |  TCP |
-|                    | SMTPS                   |   587 |  TCP |
+|                    | SMTPS                   |   587 |  TCP |
 
 ### Mail/SMTP configuration
 
@@ -291,9 +295,9 @@ the whole subdomain.
 
 ```yaml
 smtp:
-  host: "mail.open.desk"
+  host: "mail.open.desk"
-  username: "openDesk"
+  username: "openDesk"
-  password: "secret"
+  password: "secret"
 ```
 
 Enabling DKIM signing of emails helps to reduce spam and increases trust.
@@ -301,12 +305,12 @@ openDesk ships dkimpy-milter as Postfix milter for signing emails.
 
 ```yaml
 dkimpy:
-  enable: true
+  enable: true
-  dkim:
+  dkim:
-    key:
+    key:
-      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
+      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
-    selector: "default"
+    selector: "default"
-    useED25519: true # when false, RSA is used
+    useED25519: true # when false, RSA is used
 ```
 
 ### TURN configuration
@@ -316,14 +320,14 @@ these options:
 
 ```yaml
 turn:
-  transport: "udp" # or tcp
+  transport: "udp" # or tcp
-  credentials: "secret"
+  credentials: "secret"
-  server:
+  server:
-    host: "turn.open.desk"
+    host: "turn.open.desk"
-    port: "3478"
+    port: "3478"
-  tls:
+  tls:
-    host: "turns.open.desk"
+    host: "turns.open.desk"
-    port: "5349"
+    port: "5349"
 ```
 
 ### Certificate issuer
@@ -334,7 +338,7 @@ turn off `Certificate` resource creation by:
 
 ```yaml
 certificates:
-  enabled: false
+  enabled: false
 ```
 
 If you want to leverage the `cert-manager.io` to handle certificates, like `Let's encrypt`, you need to provide the
@@ -342,15 +346,15 @@ configured cluster issuer:
 
 ```yaml
 certificate:
-  issuerRef:
+  issuerRef:
-    name: "letsencrypt-prod"
+    name: "letsencrypt-prod"
 ```
 
 Additionally, it is possible to request wildcard certificates by:
 
 ```yaml
 certificate:
-  wildcard: true
+  wildcard: true
 ```
 
 ## Password seed
@@ -415,22 +419,38 @@ If you change the subdomain of `nubus`, you must replace `portal` with the speci
 openDesk deploys with the standard user account `Administrator`, which password you get retrieved as follows:
 
 ```shell
-# Replace with your namespace
+# Set your namespace
-NAMESPACE=your-namespace
+NAMESPACE=<your_namespace>
 
 # Get password for IAM "Administrator" account
 kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.administrator_password}' | base64 -d
 ```
 
-In openDesk Community Edition, you get two more default accounts:
+Using the aforementioned account, you can either create new accounts manually or make use of the
-- `default.admin`: `kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.admin_password}' | base64 -d`
+[openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import/)
-- `default.user`: `kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.user_password}' | base64 -d`
+script or container.
+
+For example you get a `default` and `default-admin` account by running the following snippet, after settings the
+appropriate values in the first three lines.
+
+```shell
+ADMINISTRATOR_PASSWORD=<your_administrator_password_see_above>
+DOMAIN=<your_domain>
+DEFAULT_USERS_PASSWORD=<password_for_the_created_default_accounts>
+docker run --rm registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0 \
+  ./user_import_udm_rest_api.py \
+    --import_domain ${DOMAIN} \
+    --udm_api_password ${ADMINISTRATOR_PASSWORD} \
+    --set_default_password ${DEFAULT_USERS_PASSWORD} \
+    --import_filename template.ods \
+    --create_admin_accounts True
+```
 
 ## Using from external repository
 
-Referring to `./helmfile_generic.yaml` from an external
+Referring to `./helmfile_generic.yaml.gotmpl` from an external
-directory or repository is possible. The `helmfile.yaml` that refers to
+directory or repository is possible. The `helmfile.yaml.gotmpl` that refers to
-`./helmfile_generic.yaml` may define custom environments. These custom
+`./helmfile_generic.yaml.gotmpl` may define custom environments. These custom
 environments may overwrite specific configuration values. These
 configuration values are:
 
@@ -456,7 +476,7 @@ NAMESPACE=your-namespace
 
 # Uninstall all Helm charts
 for OPENDESK_RELEASE in $(helm ls -n ${NAMESPACE} -aq); do
-  helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
+  helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
 done
 
 # Delete leftover resources

docs/migrations.md

@@ -9,6 +9,16 @@ SPDX-License-Identifier: Apache-2.0
 * [Disclaimer](#disclaimer)
 * [openDesk supported upgrade path](#opendesk-supported-upgrade-path)
 * [Releases upgrade details](#releases-upgrade-details)
+  * [From v1.0.0](#from-v100)
+    * [Pre-upgrade: Manual checks/steps](#pre-upgrade-manual-checkssteps)
+      * [Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
+      * [Helmfile Cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
+      * [Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
+      * [Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names](#helmfile-cleanup-streamlining-openxchange-and-oxappsuite-attribute-names)
+      * [Helmfile feature update: Dicts to define `customization.release`](#helmfile-feature-update-dicts-to-define-customizationrelease)
+      * [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
+      * [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
+      * [External requirements: Redis 7.4](#external-requirements-redis-74)
   * [From v0.9.0](#from-v090)
     * [Pre-upgrade: Manual steps](#pre-upgrade-manual-steps)
       * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
@@ -54,11 +64,170 @@ Explanation of the table's columns:
 | Coming from   | Mandatory (minimum) release | Automatic migration                                                                                                                                           | Manual activities             |
 | ------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
 | v0.9.0        | v1.x.x                      | [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_2.py) | See [From v0.9.0](#from-v090) |
-| v0.8.1        | v0.9.0                      | Initializes migration system                                                                                                                                  | See [From v0.8.1](#from-v081)     |
+| v0.8.1        | v0.9.0                      | Initializes migration system                                                                                                                                  | See [From v0.8.1](#from-v081) |
 | not supported | v0.8.1                      | First release that supporting updates                                                                                                                         |                               |
 
 # Releases upgrade details
 
+## From v1.0.0
+
+### Pre-upgrade: Manual checks/steps
+
+#### Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`
+
+In v1.0.0 the files in [`/helmfile/environments/default`](../helmfile/environments/default/) had mixed extensions,
+we have streamlined them to consistently use `*.yaml.gotmpl`.
+
+This change requires manual action likely in two situations:
+
+1. You are referencing our upstream files from the aforementioned directory, e.g. in your Argo CD deployment. Please update your references to use the filenames with the new extension.
+2. You have custom files containing configuration information that are named just `*.yaml`: Please rename them to `*.yaml.gotmpl`.
+
+#### Helmfile Cleanup: Prefixing certain app directories with `opendesk-`
+
+To make it more obvious that some elements from below the [`apps`](../helmfile/apps/) directory are completely
+provided by openDesk, we have prefixed these app directories with `opendesk-`.
+
+Affected are the following directories, here listed directly with the new prefix:
+
+- [`./helmfile/apps/opendesk-migrations-pre`](../helmfile/apps/opendesk-migrations-pre)
+- [`./helmfile/apps/opendesk-migrations-post`](../helmfile/apps/opendesk-migrations-post)
+- [`./helmfile/apps/opendesk-openproject-bootstrap`](../helmfile/apps/opendesk-openproject-bootstrap)
+
+The described changes most likely require manual action in the following situation:
+
+- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+
+#### Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services
+
+In v1.0.0 there was a directory `/helmfile/apps/services` that was intended to contain all the services an operator had to provide externally for production deployments.
+
+As some services that are actually part of openDesk snuck in there, so we had to split the directory into two separate ones:
+
+- [`./helmfile/apps/opendesk-services`](../helmfile/apps/opendesk-services)
+- [`./helmfile/apps/services-external`](../helmfile/apps/services-external)
+
+The described changes most likely require manual action in the following situation:
+
+- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+
+#### Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names
+
+We have updated some attribute names around Open-Xchange / OX App Suite to be consistent within our Helmfile
+deployment and to aligning with the actual brand names as well as with our rule of thumb for brand based
+attribute names[^1].
+
+In case you are using any of the customizations below (`WAS`), please update as shown (`NOW`):
+
+```
+WAS: oxAppsuite: ...
+NOW: oxAppSuite: ...
+```
+
+```
+WAS: cache.oxAppsuite: ...
+NOW: cache.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuite: ...
+NOW: charts.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuiteBootstrap: ...
+NOW: charts.oxAppSuiteBootstrap: ...
+```
+
+```
+WAS: customization.release.openXchange: ...
+NOW: customization.release.openxchange: ...
+```
+
+```
+WAS: customization.release.opendeskOpenXchangeBootstrap: ...
+NOW: customization.release.opendeskOpenxchangeBootstrap: ...
+```
+
+```
+WAS: databases.oxAppsuite: ...
+NOW: databases.oxAppSuite: ...
+```
+
+```
+WAS: ingress.parameters.openXchangeAppSuite: ...
+NOW: ingress.parameters.oxAppSuite: ...
+```
+
+```
+WAS: ingress.bodyTimeout.openXchangeAppSuite: ...
+NOW: ingress.bodyTimeout.oxAppSuite: ...
+```
+
+```
+WAS: migration.oxAppsuite: ...
+NOW: migration.oxAppSuite: ...
+```
+
+```
+WAS: secrets.oxAppsuite: ...
+NOW: secrets.oxAppSuite: ...
+```
+
+#### Helmfile feature update: Dicts to define `customization.release`
+
+If you make use of the `customization.release` option, you have to switch to a dictionary based definition of customization files e.g. from
+
+```yaml
+customization:
+  release:
+    collaboraOnline: "./my_custom_templating.yaml.gotmpl"
+```
+
+to
+
+```yaml
+customization:
+  release:
+    collaboraOnline:
+      file1: "./my_custom_templating.yaml.gotmpl"
+```
+
+You can freely choose the `file1` dictionary key used in the example above, but it should start with a letter.
+
+#### openDesk defaults (new): Enforce login
+
+Users accessing the openDesk portal are now automatically redirected to the login screen as a default.
+
+In case you want to keep the previous behavior you need to set the following `functional` flag:
+
+```yaml
+functional:
+  portal:
+    enforceLogin: false
+```
+
+#### openDesk defaults (changed): Jitsi room history enabled
+
+The default to store the Jitsi room history in the local storage of a user's browser has changed.
+
+It is now enabled and therefore stored by default.
+
+To preserve the 1.0.0 behavior of not storing the room history you have to explicitly configure it:
+
+```yaml
+functional:
+  dataProtection:
+    jitsiRoomHistory:
+      enabled: false
+```
+
+#### External requirements: Redis 7.4
+
+The update from openDesk 1.0.0 contains Redis 7.4.1, like the other openDesk bundled services the bundled Redis is as well not meant to be used in production.
+
+Please ensure for the Redis you are using that it is updated to at least 7.4 to support the requirement of OX App Suite.
+
 ## From v0.9.0
 
 ### Pre-upgrade: Manual steps
@@ -306,8 +475,11 @@ The status of the upgrade migrations is tracked in the ConfigMap `migrations-sta
 
 When a new upgrade migration is required, ensure to address the following list:
 
-- Update the generated release version file [`global.generated.yaml`](../helmfile/environments/default/global.generated.yaml) at least on the patch level to test the upgrade in your feature branch and trigger it in the `develop` branch after the feature branch was merged. During the release process, the value is overwritten by the release's version number.
+- Update the generated release version file [`global.generated.yaml.gotmpl`](../helmfile/environments/default/global.generated.yaml.gotmpl) at least on the patch level to test the upgrade in your feature branch and trigger it in the `develop` branch after the feature branch was merged. During the release process, the value is overwritten by the release's version number.
 - You have to implement the migration logic as a runner script in the [`opendesk-migrations`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations) image. Please find more instructions in the linked repository.
 - You most likely have to update the [`opendesk-migrations` Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations) within the `rules` section of the [`role.yaml`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/templates/role.yaml) to provide the permissions required for the execution of your migration's logic.
 - You must set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
-- Update the [`charts.yaml`](../helmfile/environments/default/charts.yaml) and [`images.yaml`](../helmfile/environments/default/images.yaml) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
+- Update the [`charts.yaml.gotmpl`](../helmfile/environments/default/charts.yaml.gotmpl) and [`images.yaml.gotmpl`](../helmfile/environments/default/images.yaml.gotmpl) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
+
+[^1]: We do not follow a brand name's specific spelling when it comes to upper and lower case and only use new word
+uppercase when names consist of multiple, space divided words.

docs/monitoring.md

@@ -30,7 +30,7 @@ repository or Prometheus operator.
 # Defaults
 
 All configurable options and their defaults can be found in
-[`monitoring.yaml`](../helmfile/environments/default/monitoring.yaml).
+[`monitoring.yaml.gotmpl`](../helmfile/environments/default/monitoring.yaml.gotmpl).
 
 # Metrics
 
@@ -46,7 +46,10 @@ prometheus:
 
 # Alerts
 
-Some Helm charts provide a default set of prometheusRules for alerting; enable it by:
+openDesk ships with a set of Prometheus alerting rules that are specific to the operation of openDesk.
+Some of these are created by our partners while others are defined in [opendesk-alerts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts).
+
+All alert rules are deployed as [PrometheusRule](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PrometheusRule) and can be enabled like this:
 
 ```yaml
 prometheus:

docs/scaling.md

@@ -10,13 +10,13 @@ This document covers the ability to scale applications.
 # Horizontal scalability
 
 We are working on generating this document automatically based on the file
-[`replicas.yaml`](../helmfile/environments/default/replicas.yaml) that contains necessary annotations.
+[`replicas.yaml.gotmpl`](../helmfile/environments/default/replicas.yaml.gotmpl) that contains necessary annotations.
 In the meantime, this file can be used to check the components scaling support/capabilities.
 
 # Upstream information
 
 While scaling services horizontally is the ideal solution, information about vertical scaling is helpful
-when defining the application's resources, see [`resources.yaml`](../helmfile/environments/default/resources.yaml) for references.
+when defining the application's resources, see [`resources.yaml.gotmpl`](../helmfile/environments/default/resources.yaml.gotmpl) for references.
 
 Please find below links to the application's upstream resources about scaling:
 

docs/workflow.md

@@ -235,7 +235,7 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
 1. Linting
    - Blocking
      - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
-     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in [development.md](./development.md).
+     - openDesk specific: Especially `images.yaml.gotmpl` and `charts.yaml.gotmpl`, find more details in [development.md](./development.md).
    - Non-Blocking
      - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
      - Formal: Yaml

helmfile.yaml.gotmpl

@@ -22,7 +22,7 @@ helmfiles:
 #
 #   Use this format from a remote repository
 #
-#   - path: "git::https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git@helmfile_generic.yaml?ref=v0.7.1"
+#   - path: "git::https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git@helmfile_generic.yaml.gotmpl?ref=v0.7.1"
 #     values:
 #       - {{ toYaml .Values | nindent 8 }}
 # */}}

helmfile/apps/collabora/helmfile-child.yaml.gotmpl

@@ -18,10 +18,12 @@ releases:
     version: "{{ .Values.charts.collabora.version }}"
     values:
       - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.collaboraOnline | default "additionalValues: false" }}
+      {{ range .Values.customization.release.collaboraOnline }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.collabora.enabled }}
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "collabora"
 ...

helmfile/apps/collabora/values.yaml.gotmpl

@@ -22,14 +22,6 @@ collabora:
 
 fullnameOverride: "collabora"
 
-grafana:
-  dashboards:
-    enabled: {{ .Values.monitoring.grafana.dashboards.enabled }}
-    labels:
-      {{ .Values.monitoring.grafana.dashboards.labels | toYaml | nindent 6 }}
-    annotations:
-      {{ .Values.monitoring.grafana.dashboards.annotations | toYaml | nindent 6 }}
-
 image:
   repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
   tag: {{ .Values.images.collabora.tag | quote }}
@@ -78,6 +70,9 @@ ingress:
       acl admin_url path_beg /cool/adminws/
       acl admin_url path_beg /browser/dist/admin/admin.html
       http-request deny if admin_url
+   {{- with .Values.annotations.collabora.ingress }}
+   {{ . | toYaml | nindent 4 }}
+   {{- end }}
   enabled: {{ .Values.ingress.enabled }}
   className: {{ .Values.ingress.ingressClassName | quote }}
   hosts:
@@ -90,7 +85,8 @@ ingress:
       hosts:
         - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.collabora.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   fsGroup: 100

helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl

@@ -18,10 +18,12 @@ releases:
     version: "{{ .Values.charts.cryptpad.version }}"
     values:
       - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.cryptpad | default "additionalValues: false" }}
+      {{ range .Values.customization.release.cryptpad }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.cryptpad.enabled }}
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "cryptpad"
 ...

helmfile/apps/cryptpad/values.yaml.gotmpl

@@ -39,6 +39,9 @@ ingress:
   enabled: {{ .Values.ingress.enabled }}
   annotations:
     nginx.org/websocket-services: "cryptpad"
+   {{- with .Values.annotations.cryptpad.ingress }}
+   {{ . | toYaml | nindent 4 }}
+   {{- end }}
   className: {{ .Values.ingress.ingressClassName | quote }}
   hosts:
     - host: "{{ .Values.global.hosts.cryptpad }}.{{ .Values.global.domain }}"
@@ -53,7 +56,8 @@ ingress:
 persistence:
   enabled: false
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.jitsiKeycloakAdapter.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   fsGroup: 4001

helmfile/apps/element/helmfile-child.yaml.gotmpl

@@ -32,7 +32,6 @@ repositories:
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
     url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
-
   - name: "synapse-create-account-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapseCreateAccount.verify }}
@@ -79,13 +78,54 @@ repositories:
     oci: true
     url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
 
+  # openDesk Enterprise Repositories
+
+  # openDesk Element
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
+  - name: "synapse-admin-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseAdmin.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
+  - name: "synapse-adminbot-web-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseAdminbotWeb.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
+  - name: "synapse-groupsync-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseGroupsync.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
+  - name: "synapse-pipe-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapsePipe.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
+
 releases:
+  # During upgrade 1.0.0 -> 1.1.0 the chart 'opendesk-element' has been moved to 'opendesk-element-web'
   - name: "opendesk-element"
     chart: "element-repo/{{ .Values.charts.element.name }}"
     version: "{{ .Values.charts.element.version }}"
+    installed: false
+
+  - name: "opendesk-element-web"
+    chart: "element-repo/{{ .Values.charts.elementWeb.name }}"
+    version: "{{ .Values.charts.elementWeb.version }}"
     values:
       - "values-element.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskElement | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskElement }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
@@ -94,7 +134,9 @@ releases:
     version: "{{ .Values.charts.elementWellKnown.version }}"
     values:
       - "values-well-known.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskWellKnown | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskWellKnown }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
@@ -103,7 +145,9 @@ releases:
     version: "{{ .Values.charts.synapseWeb.version }}"
     values:
       - "values-synapse-web.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskSynapseWeb | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskSynapseWeb }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
@@ -112,7 +156,9 @@ releases:
     version: "{{ .Values.charts.synapse.version }}"
     values:
       - "values-synapse.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskSynapse | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskSynapse }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
@@ -172,7 +218,78 @@ releases:
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
+  # openDesk Enterprise Releases
+  - name: "opendesk-synapse-admin"
+    chart: "synapse-admin-repo/{{ .Values.charts.synapseAdmin.name }}"
+    version: "{{ .Values.charts.synapseAdmin.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdmin }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-pipe"
+    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
+    version: "{{ .Values.charts.synapsePipe.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdminbotPipe }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-web"
+    chart: "synapse-adminbot-web-repo/{{ .Values.charts.synapseAdminbotWeb.name }}"
+    version: "{{ .Values.charts.synapseAdminbotWeb.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdminbotWeb }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-auditbot-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-auditbot-pipe"
+    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
+    version: "{{ .Values.charts.synapsePipe.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAuditbotPipe }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-groupsync"
+    chart: "synapse-groupsync-repo/{{ .Values.charts.synapseGroupsync.name }}"
+    version: "{{ .Values.charts.synapseGroupsync.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseGroupsync }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementGroupsync.enabled }}
+    timeout: 900
+
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "element"
 ...

helmfile/apps/element/values-element.yaml.gotmpl

@@ -136,8 +136,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.element.ingress | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.element.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -148,6 +151,14 @@ replicaCount: {{ .Values.replicas.element }}
 resources:
   {{ .Values.resources.element | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.element.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.element.serviceAccount | toYaml | nindent 4 }}
+
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 

helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl

@@ -54,4 +54,7 @@ resources:
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 
+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...

helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl

@@ -54,4 +54,7 @@ theme:
 resources:
   {{ .Values.resources.matrixNeoChoiceWidget | toYaml | nindent 2 }}
 
+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...

helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl

@@ -59,4 +59,7 @@ resources:
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 
+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...

helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl

@@ -42,7 +42,8 @@ image:
   repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
   tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.matrixUserVerificationService.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -53,4 +54,12 @@ replicaCount: {{ .Values.replicas.matrixUserVerificationService }}
 resources:
   {{ .Values.resources.matrixUserVerificationService | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.matrixUserVerificationService.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.matrixUserVerificationService.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/element/values-synapse-web.yaml.gotmpl

@@ -44,6 +44,9 @@ ingress:
     nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.element }}"
     nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}s"
     nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}s"
+    {{- with .Values.annotations.synapseWeb.ingress }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   host: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
   enabled: {{ .Values.ingress.enabled }}
   ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -51,7 +54,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.synapseWeb.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -62,4 +66,12 @@ replicaCount: {{ .Values.replicas.synapseWeb }}
 resources:
   {{ .Values.resources.synapseWeb | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.synapseWeb.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.synapseWeb.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/element/values-synapse.yaml.gotmpl

@@ -27,9 +27,26 @@ configuration:
 
   database:
     host: {{ .Values.databases.synapse.host | quote }}
+    port: {{ .Values.databases.synapse.port }}
     name: {{ .Values.databases.synapse.name | quote }}
     user: {{ .Values.databases.synapse.username | quote }}
-    password: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    password:
+      value: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    requireAuth: {{ .Values.databases.synapse.requireAuth }}
+    channelBinding: {{ .Values.databases.synapse.channelBinding | quote }}
+    connectTimeout: {{ .Values.databases.synapse.connectTimeout }}
+    clientEncoding: {{ .Values.databases.synapse.clientEncoding | quote }}
+    keepalives: {{ .Values.databases.synapse.keepalives }}
+    keepalivesIdle: {{ .Values.databases.synapse.keepalivesIdle }}
+    keepalivesInterval: {{ .Values.databases.synapse.keepalivesInterval }}
+    keepalivesCount: {{ .Values.databases.synapse.keepalivesCount }}
+    replication: {{ .Values.databases.synapse.replication }}
+    gssencmode: {{ .Values.databases.synapse.gssencmode | quote }}
+    sslmode: {{ .Values.databases.synapse.sslmode | quote }}
+    sslcompression: {{ .Values.databases.synapse.sslcompression }}
+    sslMinProtocolVersion: {{ .Values.databases.synapse.sslMinProtocolVersion | quote }}
+    connectionPoolMin: {{ .Values.databases.synapse.connectionPoolMin }}
+    connectionPoolMax: {{ .Values.databases.synapse.connectionPoolMax }}
 
   homeserver:
     serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
@@ -43,8 +60,8 @@ configuration:
               regex: "@.*"
         url: null
         sender_localpart: intercom-service
-      - as_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+      - as_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
-        hs_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
         id: ox-appsuite
         namespaces:
           users:
@@ -144,6 +161,8 @@ federation:
     tls:
       enabled: {{ .Values.ingress.tls.enabled }}
       secretName: {{ .Values.ingress.tls.secretName | quote }}
+    annotations:
+      {{ .Values.annotations.synapse.ingress | toYaml | nindent 6 }}
 
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -162,7 +181,8 @@ persistence:
   size: {{ .Values.persistence.size.synapse | quote }}
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.synapse.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -177,6 +197,14 @@ replicaCount: {{ .Values.replicas.synapse }}
 resources:
   {{ .Values.resources.synapse | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.synapse.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.synapse.serviceAccount | toYaml | nindent 4 }}
+
 tls:
   secretName: {{ if .Values.global.matrixDomain }}"opendesk-certificates-synapse-tls"{{ else }}"opendesk-certificates-tls"{{ end }}
 ...

helmfile/apps/element/values-well-known.yaml.gotmpl

@@ -44,8 +44,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.elementWellKnown.ingress | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementWellKnown.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -56,4 +59,11 @@ replicaCount: {{ .Values.replicas.wellKnown }}
 resources:
   {{ .Values.resources.wellKnown | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementWellKnown.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementWellKnown.serviceAccount | toYaml | nindent 4 }}
 ...

helmfile/apps/jitsi/helmfile-child.yaml.gotmpl

@@ -18,11 +18,13 @@ releases:
     version: "{{ .Values.charts.jitsi.version }}"
     values:
       - "values-jitsi.yaml.gotmpl"
-      - {{ .Values.customization.release.jitsi | default "additionalValues: false" }}
+      {{ range .Values.customization.release.jitsi }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.jitsi.enabled }}
     timeout: 900
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "jitsi"
 ...

helmfile/apps/jitsi/values-jitsi.yaml.gotmpl

@@ -75,6 +75,10 @@ jitsi:
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     ingress:
       enabled: {{ .Values.ingress.enabled }}
+      annotations:
+        {{- with .Values.annotations.jitsi.ingress }}
+        {{ . | toYaml | nindent 8 }}
+        {{- end }}
       ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
       hosts:
         - host: "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
@@ -102,6 +106,8 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.jitsi.pod | toYaml | nindent 6 }}
   prosody:
     image:
       repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
@@ -151,6 +157,8 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.prosody | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.prosody.pod | toYaml | nindent 6 }}
   jicofo:
     replicaCount: {{ .Values.replicas.jicofo }}
     image:
@@ -174,6 +182,8 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.jicofo.pod | toYaml | nindent 6 }}
   jvb:
     replicaCount: {{ .Values.replicas.jvb }}
     # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
@@ -202,6 +212,8 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jvb | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.jvb.pod | toYaml | nindent 6 }}
   jibri:
     replicaCount: {{ .Values.replicas.jibri }}
     image:
@@ -218,10 +230,16 @@ jitsi:
       # Chart does not allow to template more
       capabilities:
         add: ["SYS_ADMIN"]
+    podAnnotations:
+      {{ .Values.annotations.jibri.pod | toYaml | nindent 6 }}
   imagePullSecrets:
   {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
   {{- end }}
+  serviceAccount:
+    annotations:
+      {{ .Values.annotations.jitsi.serviceAccount | toYaml | nindent 6 }}
+
 
 patchJVB:
   configuration:
@@ -248,10 +266,15 @@ patchJVB:
     repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
     tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.cryptpad.pod | toYaml | nindent 2 }}
 
 replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}
 
 resources:
   {{ .Values.resources.jitsiKeycloakAdapter | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.jitsiPatchJVB.serviceAccount | toYaml | nindent 4 }}
 ...

helmfile/apps/migrations-post/values.yaml.gotmpl

@@ -1,10 +0,0 @@
-{{/*
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-podAnnotations: {}
-
-migrations:
-  stage: "POST"
-...

helmfile/apps/migrations-pre/values.yaml.gotmpl

@@ -1,10 +0,0 @@
-{{/*
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-podAnnotations: {}
-
-migrations:
-  stage: "PRE"
-...

helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl

@@ -25,7 +25,9 @@ releases:
     version: "{{ .Values.charts.nextcloudManagement.version }}"
     values:
       - "values-nextcloud-mgmt.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskNextcloudManagement | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskNextcloudManagement }}
+      - {{ . }}
+      {{ end }}
     waitForJobs: true
     wait: true
     installed: {{ .Values.nextcloud.enabled }}
@@ -35,12 +37,14 @@ releases:
     version: "{{ .Values.charts.nextcloud.version }}"
     values:
       - "values-nextcloud.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskNextcloud | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskNextcloud }}
+      - {{ . }}
+      {{ end }}
     needs:
       - "opendesk-nextcloud-management"
     installed: {{ .Values.nextcloud.enabled }}
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "nextcloud"
 ...

helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl

@@ -13,40 +13,57 @@ global:
 
 additionalAnnotations:
   intents.otterize.com/service-name: "opendesk-nextcloud-php"
+  {{- with .Values.annotations.nextcloudManagement.all }}
+  {{ . | toYaml | nindent 2}}
+  {{- end }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.nextcloudManagement.serviceAccount | toYaml | nindent 4 }}
 
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
 
 configuration:
   administrator:
+    # The admin user is (currently) required to bootstrap the OpenProject <> Nextcloud integration.
+    enabled: true
     username:
       value: "nextcloud"
     password:
       value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
   antivirus:
+    {{- if .Values.antivirus.icap.host }}
+    host: {{ .Values.antivirus.icap.host | quote }}
+    port: {{ .Values.antivirus.icap.port | quote }}
+    {{- else }}
     {{- if .Values.clamavDistributed.enabled }}
     host: "clamav-icap"
     {{- else if .Values.clamavSimple.enabled }}
     host: "clamav-simple"
     {{- end }}
+    port: 1344
+    {{- end }}
   cache:
     auth:
       enabled: true
       username:
-        value: "default"
+        value: {{ .Values.cache.nextcloud.username }}
       password:
         value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
     host: {{ .Values.cache.nextcloud.host | quote }}
     port: {{ .Values.cache.nextcloud.port | quote }}
+    tls: {{ .Values.cache.nextcloud.tls }}
   collabora:
     # internalWopiUrl: ""
     wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
   database:
     host: {{ .Values.databases.nextcloud.host | quote }}
     port: {{ .Values.databases.nextcloud.port | quote }}
+    name: {{ .Values.databases.nextcloud.name | quote }}
     auth:
       username:
-        value: "nextcloud_user"
+        value: {{ .Values.databases.nextcloud.username | quote }}
       password:
         value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
   ldap:
@@ -89,6 +106,7 @@ configuration:
     defaultExternalExpireEnabled: {{ .Values.functional.filestore.sharing.external.expiry.activeByDefault }}
     defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
     defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
+    sendPasswordMail: {{ .Values.functional.filestore.sharing.external.sendPasswordMail | quote }}
   smtp:
     auth:
       enabled: false
@@ -131,6 +149,7 @@ podSecurityContext:
 
 debug:
   loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
+  bootstrap: {{ .Values.debug.enabled }}
 
 {{- if .Values.certificate.selfSigned }}
 extraEnvVars:

helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl

@@ -11,6 +11,7 @@ global:
 exporter:
   enabled: true
   configuration:
+    server: "http://opendesk-nextcloud-aio"
     token:
       value: {{ .Values.secrets.nextcloud.metricsToken | quote }}
   containerSecurityContext:
@@ -50,22 +51,32 @@ exporter:
 aio:
   additionalAnnotations:
     intents.otterize.com/service-name: "opendesk-nextcloud"
+    {{- with .Values.annotations.nextcloud.all }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
+
+  serviceAccount:
+    annotations:
+      {{ .Values.annotations.nextcloud.serviceAccount | toYaml | nindent 6 }}
+
   configuration:
     cache:
       auth:
         enabled: true
         username:
-          value: "default"
+          value: {{ .Values.cache.nextcloud.username }}
         password:
           value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
       host: {{ .Values.cache.nextcloud.host | quote }}
       port: {{ .Values.cache.nextcloud.port | quote }}
+      tls: {{ .Values.cache.nextcloud.tls }}
     database:
       host: {{ .Values.databases.nextcloud.host | quote }}
       port: {{ .Values.databases.nextcloud.port | quote }}
+      name: {{ .Values.databases.nextcloud.name | quote }}
       auth:
         username:
-          value: "nextcloud_user"
+          value: {{ .Values.databases.nextcloud.username | quote }}
         password:
           value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
     trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
@@ -120,11 +131,15 @@ aio:
       nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.nextcloud }}"
       nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}s"
       nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}s"
+      {{- with .Values.annotations.nextcloud.ingress }}
+        {{ . | toYaml | nindent 8 }}
+      {{- end }}
     ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
     host: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
     tls:
       secretName: {{ .Values.ingress.tls.secretName | quote }}
-  podAnnotations: {}
+  podAnnotations:
+    {{ .Values.annotations.nextcloud.podAnnotations | toYaml | nindent 6 }}
   podSecurityContext:
     fsGroup: 101
   prometheus:

helmfile/apps/nubus/helmfile-child.yaml.gotmpl

@@ -28,6 +28,14 @@ repositories:
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
     url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+  # NGINX S3 Gateway Chart
+  - name: "nginx-s3-gateway-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.nginxS3Gateway.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
 
 releases:
   # Univention Management Stack Umbrella Chart
@@ -38,7 +46,9 @@ releases:
       - "values-nubus.yaml.gotmpl"
       - "values-opendesk-customization.yaml.gotmpl"
       - "values-opendesk-images.yaml.gotmpl"
-      - {{ .Values.customization.release.ums | default "additionalValues: false" }}
+      {{ range .Values.customization.release.ums }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.nubus.enabled }}
     timeout: 900
   # Intercom-Service
@@ -47,7 +57,9 @@ releases:
     version: "{{ .Values.charts.intercomService.version }}"
     values:
       - "values-intercom-service.yaml.gotmpl"
-      - {{ .Values.customization.release.intercomService | default "additionalValues: false" }}
+      {{ range .Values.customization.release.intercomService }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.nubus.enabled }}
 
   # openDesk Keycloak Bootstrap Chart
@@ -56,13 +68,27 @@ releases:
     version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
     values:
       - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskKeycloakBootstrap | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskKeycloakBootstrap }}
+      - {{ . }}
+      {{ end }}
     needs:
       - "ums"
     installed: {{ .Values.nubus.enabled }}
     timeout: 900
 
+  # NGINX S3 Gateway (when cluster minio is not used)
+  - name: "nubus"
+    chart: "nginx-s3-gateway-repo/{{ .Values.charts.nginxS3Gateway.name }}"
+    version: "{{ .Values.charts.nginxS3Gateway.version }}"
+    values:
+      - "values-nginx-s3-gateway.yaml.gotmpl"
+      {{ range .Values.customization.release.nginxS3Gateway }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ not .Values.minio.enabled }}
+    timeout: 900
+
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "nubus"
 ...

helmfile/apps/nubus/values-intercom-service.yaml.gotmpl

@@ -32,10 +32,15 @@ extraVolumeMounts:
   - name: "trusted-cert-secret-volume"
     mountPath: "/etc/ssl/certs/ca-certificates.crt"
     subPath: "ca-certificates.crt"
+{{- end }}
+
 extraEnvVars:
+  - name: "REDIS_USER"
+    value: {{ .Values.cache.intercomService.username }}
+  {{- if .Values.certificate.selfSigned }}
   - name: "NODE_EXTRA_CA_CERTS"
     value: "/etc/ssl/certs/ca-certificates.crt"
-{{- end }}
+  {{- end }}
 
 global:
   domain: {{ .Values.global.domain | quote }}

helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl

@@ -0,0 +1,39 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nginxS3Gateway.registry | quote }}
+  repository: {{ .Values.images.nginxS3Gateway.repository | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  tag: {{ .Values.images.nginxS3Gateway.tag | quote }}
+
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+  host: "{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: "/portal-assets/icons/$2/$3"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+  path: "/univention/(portal|selfservice)/icons/(logos|entries)/(.*)$"
+  tls:
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+configuration:
+  bucket: {{ .Values.objectstores.nubus.bucket | quote }}
+  endpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+  port: 443
+  region: {{ .Values.objectstores.nubus.region | quote }}
+  style: "path"
+  credentials:
+    accessKey:
+      value: {{ .Values.objectstores.nubus.username | quote }}
+    secretKey:
+      value: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+
+resources:
+  {{ .Values.resources.nginxS3Gateway | toYaml | nindent 2 }}
+
+replicaCount: {{ .Values.replicas.nginxS3Gateway }}
+...

helmfile/apps/nubus/values-nubus.yaml.gotmpl

@@ -8,6 +8,9 @@ global:
   ldap:
     baseDn: {{ .Values.ldap.baseDn | quote }}
     domainName: {{ .Values.global.domain | quote }}
+    auth:
+      cnAdmin:
+        password: {{ .Values.secrets.nubus.ldapSecret | quote }}
   domain: {{ .Values.global.domain | quote }}
   subDomains:
     portal: {{ .Values.global.hosts.nubus | quote }}
@@ -23,36 +26,6 @@ global:
       host: "minio"
       port: "9000"
       protocol: "http"
-  credentialOverride:
-    ldapServer:
-      adminPassword: {{ .Values.secrets.nubus.ldapSecret | quote}}
-    defaultUsers:
-      defaultAdminPassword: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote}}
-      defaultUserPassword: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote}}
-      defaultAdministratorPassword: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote}}
-    portalConsumer:
-      minio:
-        accessKey: {{ .Values.objectstores.nubus.username | quote }}
-        secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
-      provisioningApi:
-        password: {{ .Values.secrets.nubus.portalConsumer.provisioningApiPassword | quote}}
-    provisioning:
-      api:
-        adminPassword: {{ .Values.secrets.nubus.provisioning.api.adminPassword | quote}}
-        natsPassword: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
-        prefillPassword: {{ .Values.secrets.nubus.provisioning.api.prefillPassword | quote}}
-        udmTransformerPassword: {{ .Values.secrets.nubus.provisioning.api.udmTransformerPassword | quote}}
-      dispatcher:
-        natsPassword: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
-      nats:
-        adminPassword: {{ .Values.secrets.nats.natsAdminPassword | quote}}
-      prefill:
-        natsPassword: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
-      udmTransformer:
-        natsPassword: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
-    selfserviceConsumer:
-      provisioningApi:
-        password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}
 
   # -- Extensions to load. Add entries to load additional extensions into Nubus.
   extensions:
@@ -144,6 +117,10 @@ global:
             groups: __DELETE_KEY__
 
 ingress:
+  # temporary fix
+  {{- if not .Values.minio.enabled }}
+  enabled: false
+  {{- end }}
   certManager:
     enabled: false
   tls:
@@ -193,9 +170,10 @@ keycloak:
   keycloak:
     auth:
       username: "kcadmin"
-      credentialSecret:
+      existingSecret:
         name: "ums-opendesk-keycloak-credentials"
-        key: "admin_password"
+        keyMapping:
+          adminPassword: "admin_password"
   postgresql:
     connection:
       host: {{ .Values.databases.keycloak.host | quote }}
@@ -203,9 +181,10 @@ keycloak:
     auth:
       username: {{ .Values.databases.keycloak.username | quote }}
       database: {{ .Values.databases.keycloak.name | quote }}
-      credentialSecret:
+      existingSecret:
         name: "ums-keycloak-postgresql-opendesk-credentials"
-        key: "keycloakDatabasePassword"
+        keyMapping:
+          password: keycloakDatabasePassword
   config:
     exposeAdminConsole: {{ .Values.debug.enabled }}
     logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
@@ -253,7 +232,8 @@ nubusNotificationsApi:
     auth:
       username: {{ .Values.databases.umsNotificationsApi.username | quote }}
       database: {{ .Values.databases.umsNotificationsApi.name | quote }}
-      existingSecret: "ums-notifications-api-postgresql-opendesk-credentials"
+      existingSecret:
+        name: "ums-notifications-api-postgresql-opendesk-credentials"
   ingress:
     certManager:
       enabled: false
@@ -273,9 +253,10 @@ nubusKeycloakExtensions:
   keycloak:
     auth:
       username: "kcadmin"
-      credentialSecret:
+      existingSecret:
         name: "ums-opendesk-keycloak-credentials"
-        key: "admin_password"
+        keyMapping:
+          adminPassword: "admin_password"
   proxy:
     ingress:
       paths:
@@ -297,7 +278,6 @@ nubusKeycloakExtensions:
         enabled: {{ .Values.ingress.tls.enabled }}
         secretName: {{ .Values.ingress.tls.secretName | quote }}
 
-
   postgresql:
     connection:
       host: {{ .Values.databases.keycloakExtension.host | quote }}
@@ -305,9 +285,10 @@ nubusKeycloakExtensions:
     auth:
       database: {{ .Values.databases.keycloakExtension.name | quote }}
       username: {{ .Values.databases.keycloakExtension.username | quote }}
-      credentialSecret:
+      existingSecret:
         name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
-        key: "umcKeycloakExtensionsDatabasePassword"
+        keyMapping:
+          password: "umcKeycloakExtensionsDatabasePassword"
   smtp:
     connection:
       host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
@@ -317,9 +298,10 @@ nubusKeycloakExtensions:
     auth:
       enabled: false
       username: ""
-      credentialSecret:
+      existingSecret:
         name: "ums-keycloak-extensions-smtp-opendesk-credentials"
-        key: "umcKeycloakExtensionsSmtpPassword"
+        keyMapping:
+          password: "umcKeycloakExtensionsSmtpPassword"
   handler:
     appConfig:
       logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
@@ -333,15 +315,28 @@ nubusPortalConsumer:
   enabled: true
   portalConsumer:
     logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
-    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
     objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
   provisioningApi:
     auth:
       username: "portal-consumer"
+      password: {{ .Values.secrets.nubus.portalConsumer.provisioningApiPassword | quote }}
+      # TODO: Workaround for a small bug introduced during the secrets refactoring.
+      # The fix will be part of a future Nubus release and the two lines can then be deleted.
+      existingSecret:
+        name: "ums-portal-consumer-credentials"
+  objectStorage:
+    auth:
+      accessKey: {{ .Values.objectstores.nubus.username | quote }}
+      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
 
 nubusPortalServer:
+  objectStorage:
+    auth:
+      accessKey: {{ .Values.objectstores.nubus.username | quote }}
+      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
   portalServer:
-    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
     objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
     objectStorageCredentialSecret:
       name: "ums-portal-server-minio-opendesk-credentials"
@@ -367,6 +362,43 @@ nubusUdmRestApi:
 
 nubusProvisioning:
   enabled: true
+  ldap:
+    auth:
+      password: {{ .Values.secrets.nubus.ldapSecret | quote }}
+  nats:
+    auth:
+      adminPassword: {{ .Values.secrets.nats.natsAdminPassword | quote }}
+  api:
+    auth:
+      adminPassword: {{ .Values.secrets.nubus.provisioning.api.adminPassword | quote }}
+      prefillPassword: {{ .Values.secrets.nubus.provisioning.api.prefillPassword | quote}}
+      udmTransformerPassword: {{ .Values.secrets.nubus.provisioning.api.udmTransformerPassword | quote}}
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
+
+  dispatcher:
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
+
+  prefill:
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
+
+  udmTransformer:
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
+
+  registerConsumers:
+    createUsers:
+      oxConsumer:
+        existingSecret:
+          name: ums-provisioning-ox-credentials
+          keyMapping:
+            password: "ox-connector.json"
 
 nubusUdmListener:
   enabled: true
@@ -376,6 +408,9 @@ nubusSelfServiceListener:
 
 nubusSelfServiceConsumer:
   enabled: true
+  provisioningApi:
+    auth:
+      password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}
 
 # Nubus services
 nubusStackDataUms:
@@ -395,8 +430,10 @@ nubusStackDataUms:
     smtpStartTls: false
     ldapBase: {{ .Values.ldap.baseDn }}
   templateContext:
-    # creates the default.user and default.admin
+    initialPasswordDefaultAdmin: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote }}
-    loadDevData: true
+    initialPasswordDefaultUser: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote }}
+    initialPasswordAdministrator: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote }}
+    portalEnforceLogin: {{ .Values.functional.portal.enforceLogin }}
     portalHeaderLogo: {{ toYaml .Values.theme.imagery.logoHeaderSvgB64 | quote }}
     portalTiles: {{ toYaml .Values.theme.imagery.portalTiles | nindent 6 }}
     portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }}
@@ -461,18 +498,20 @@ nubusUmcServer:
     auth:
       username: {{ .Values.databases.umsSelfservice.username | quote }}
       database: {{ .Values.databases.umsSelfservice.name | quote }}
-      credentialSecret:
+      existingSecret:
         name: "ums-umc-server-postgresql-opendesk-credentials"
-        key: "umcServerDatabasePassword"
+        keyMapping:
+          password: "umcServerDatabasePassword"
   memcached:
     bundled: false
     server: {{ .Values.cache.umsSelfservice.host | quote }}
     auth:
-      credentialSecret:
+      existingSecret:
         name: "ums-umc-server-memcached-opendesk-credentials"
-        key: "umcServerMemcachedPassword"
+        keyMapping:
+          memcached-password: "umcServerMemcachedPassword"
   smtp:
-    credentialSecret:
+    existingSecret:
       name: "ums-umc-server-smtp-credentials-custom"
   ingress:
     certManager:
@@ -497,9 +536,8 @@ nubusKeycloakBootstrap:
   keycloak:
     auth:
       username: "kcadmin"
-      credentialSecret:
+      existingSecret:
         name: "ums-opendesk-keycloak-credentials"
-        key: "admin_password"
   bootstrap:
     ldapMappers:
       - ldapAndUserModelAttributeName: "opendeskProjectmanagementAdmin"
@@ -510,7 +548,7 @@ nubusKeycloakBootstrap:
   ldap:
     auth:
       bindDn: {{ printf "uid=ldapsearch_keycloak,cn=users,%s" .Values.ldap.baseDn }}
-      credentialSecret:
+      existingSecret:
         name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
 
 # Credential secrets for accessing customer supplied services
@@ -555,3 +593,6 @@ extraSecrets:
   - name: "ums-umc-server-smtp-credentials-custom"
     stringData:
       password: ""
+  - name: "ums-provisioning-ox-credentials"
+    stringData:
+      ox-connector.json: "{ \"name\": \"ox-connector\", \"realms_topics\": [{\"realm\": \"udm\", \"topic\": \"oxmail/oxcontext\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/accessprofile\"}, {\"realm\": \"udm\", \"topic\": \"users/user\"}, {\"realm\": \"udm\", \"topic\": \"oxresources/oxresources\"}, {\"realm\": \"udm\", \"topic\": \"groups/group\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/functional_account\"}], \"request_prefill\": true, \"password\": \"{{ .Values.secrets.oxConnector.provisioningApiPassword }}\" }"

helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl

@@ -5,6 +5,8 @@ SPDX-License-Identifier: Apache-2.0
 ---
 keycloak:
   enabled: true
+  ingress:
+    enabled: false
   containerSecurityContext:
     allowPrivilegeEscalation: false
     capabilities:
@@ -238,6 +240,7 @@ nubusUmcServer:
         Ihr {domainname} Passwort-Service
 
 nubusKeycloakExtensions:
+  enabled: true
   handler:
     imagePullSecrets:
       {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}

helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl

@@ -15,22 +15,22 @@ repositories:
   # Open-Xchange
   - name: "open-xchange-repo"
     keyring: "../../files/gpg-pubkeys/open-xchange-com.gpg"
-    verify: {{ .Values.charts.openXchangeAppSuite.verify }}
+    verify: {{ .Values.charts.oxAppSuite.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
 
   # openDesk Open-Xchange Bootstrap
   # Source:
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap
   - name: "open-xchange-bootstrap-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.openXchangeAppSuiteBootstrap.verify }}
+    verify: {{ .Values.charts.oxAppSuiteBootstrap.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/{{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
 
   # OX Connector
   - name: "ox-connector-repo"
@@ -45,27 +45,33 @@ releases:
     version: "{{ .Values.charts.dovecot.version }}"
     values:
       - "values-dovecot.yaml.gotmpl"
-      - {{ .Values.customization.release.dovecot | default "additionalValues: false" }}
+      {{ range .Values.customization.release.dovecot }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.dovecot.enabled }}
     timeout: 900
 
   - name: "open-xchange"
-    chart: "open-xchange-repo/{{ .Values.charts.openXchangeAppSuite.name }}"
+    chart: "open-xchange-repo/{{ .Values.charts.oxAppSuite.name }}"
-    version: "{{ .Values.charts.openXchangeAppSuite.version }}"
+    version: "{{ .Values.charts.oxAppSuite.version }}"
     values:
       - "values-openxchange.yaml.gotmpl"
       - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
-      - {{ .Values.customization.release.openXchange | default "additionalValues: false" }}
+      {{ range .Values.customization.release.openxchange }}
-    installed: {{ .Values.oxAppsuite.enabled }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
     timeout: 900
 
   - name: "opendesk-open-xchange-bootstrap"
-    chart: "open-xchange-bootstrap-repo/{{ .Values.charts.openXchangeAppSuiteBootstrap.name }}"
+    chart: "open-xchange-bootstrap-repo/{{ .Values.charts.oxAppSuiteBootstrap.name }}"
-    version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
+    version: "{{ .Values.charts.oxAppSuiteBootstrap.version }}"
     values:
       - "values-openxchange-bootstrap.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskOpenXchangeBootstrap | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskOpenxchangeBootstrap }}
-    installed: {{ .Values.oxAppsuite.enabled }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
     timeout: 900
 
   - name: "ox-connector"
@@ -73,12 +79,14 @@ releases:
     version: "{{ .Values.charts.oxConnector.version }}"
     values:
       - "values-oxconnector.yaml.gotmpl"
-      - {{ .Values.customization.release.oxConnector | default "additionalValues: false" }}
+      {{ range .Values.customization.release.oxConnector }}
-    installed: {{ .Values.oxAppsuite.enabled }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
     needs:
       - "open-xchange"
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "open-xchange"
 ...

helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl

@@ -17,8 +17,8 @@ dovecot:
   mailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
   password: {{ .Values.secrets.dovecot.doveadm | quote }}
   migration:
-    enabled: {{ .Values.functional.migration.oxAppsuite.enabled }}
+    enabled: {{ .Values.functional.migration.oxAppSuite.enabled }}
-    masterPassword: {{ .Values.secrets.oxAppsuite.migrationsMasterPassword | quote }}
+    masterPassword: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
   ldap:
     enabled: true
     host: {{ .Values.ldap.host | quote }}

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -7,16 +7,16 @@ SPDX-License-Identifier: Apache-2.0
 global:
   hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
   appsuite:
-    cookieHashSalt: {{ .Values.secrets.oxAppsuite.cookieHashSalt }}
+    cookieHashSalt: {{ .Values.secrets.oxAppSuite.cookieHashSalt }}
-    shareCryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey }}
+    shareCryptKey: {{ .Values.secrets.oxAppSuite.shareCryptKey }}
-    sessiondEncryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey }}
+    sessiondEncryptionKey: {{ .Values.secrets.oxAppSuite.sessiondEncryptionKey }}
   mysql:
-    host: {{ .Values.databases.oxAppsuite.host | quote }}
+    host: {{ .Values.databases.oxAppSuite.host | quote }}
-    database: {{ .Values.databases.oxAppsuite.name | quote }}
+    database: {{ .Values.databases.oxAppSuite.name | quote }}
     auth:
-      user: {{ .Values.databases.oxAppsuite.username | quote }}
+      user: {{ .Values.databases.oxAppSuite.username | quote }}
-      password: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
+      password: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
-      rootPassword: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
+      rootPassword: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
 
 nextcloud-integration-ui:
   image:
@@ -105,9 +105,9 @@ appsuite:
     routes:
       http-api-routes-appsuite-api:
         annotations:
-          nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.openXchangeAppSuite }}"
+          nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.oxAppSuite }}"
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openXchangeAppSuite }}"
+          nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.oxAppSuite }}"
-          nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openXchangeAppSuite }}"
+          nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.oxAppSuite }}"
       trailslash:
         enabled: false
   core-mw:
@@ -119,13 +119,13 @@ appsuite:
         oidcLogin: true
         oidcPath: "/oidc"
     masterAdmin: "admin"
-    masterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+    masterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
     hzGroupName: "hzgroup"
-    hzGroupPassword: {{ .Values.secrets.oxAppsuite.hzGroupPassword | quote }}
+    hzGroupPassword: {{ .Values.secrets.oxAppSuite.hzGroupPassword | quote }}
     basicAuthLogin: "oxlogin"
-    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
+    basicAuthPassword: {{ .Values.secrets.oxAppSuite.basicAuthPassword | quote }}
     jolokiaLogin: "jolokia"
-    jolokiaPassword: {{ .Values.secrets.oxAppsuite.jolokiaPassword | quote }}
+    jolokiaPassword: {{ .Values.secrets.oxAppSuite.jolokiaPassword | quote }}
     hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
     podAnnotations: {}
     serviceAccount:
@@ -174,7 +174,7 @@ appsuite:
           chown open-xchange:open-xchange /opt/open-xchange/guard-files
     packages:
       status:
-        {{- if .Values.functional.migration.oxAppsuite.enabled }}
+        {{- if .Values.functional.migration.oxAppSuite.enabled }}
         open-xchange-authentication-masterpassword: "enabled"
         open-xchange-authentication-ldap: "disabled"
         open-xchange-authentication-oauth: "disabled"
@@ -301,7 +301,7 @@ appsuite:
     {{- if .Values.certificate.selfSigned }}
     extraEnv:
     - name: "JAVA_OPTS_APPEND"
-      value: {{ printf "%s %s=%s" "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks -Djavax.net.ssl.trustStoreType=jks" "-Djavax.net.ssl.trustStorePassword" (.Values.secrets.certificates.password | quote) | quote }}
+      value: {{ printf "%s %s=%s" "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks -Djavax.net.ssl.trustStoreType=jks" "-Djavax.net.ssl.trustStorePassword" .Values.secrets.certificates.password | quote }}
     extraVolumes:
       - name: "trusted-cert-secret-volume"
         secret:
@@ -316,13 +316,13 @@ appsuite:
         mountPath: "/etc/ssl/certs/"
     {{- end }}
     secretProperties:
-      com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
+      com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppSuite.cookieHashSalt | quote }}
-      com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
+      com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppSuite.sessiondEncryptionKey | quote }}
-      com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
+      com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppSuite.shareCryptKey | quote }}
-      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
     propertiesFiles:
       /opt/open-xchange/etc/masterpassword-authentication.properties:
-        com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppsuite.migrationsMasterPassword | quote }}
+        com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
       /opt/open-xchange/etc/AdminDaemon.properties:
         MASTER_ACCOUNT_OVERRIDE: "true"
       /opt/open-xchange/etc/AdminUser.properties:
@@ -336,12 +336,17 @@ appsuite:
         bindOnly: "false"
       /opt/open-xchange/etc/antivirus.properties:
         com.openexchange.antivirus.enabled: "true"
+        {{- if .Values.antivirus.icap.host }}
+        com.openexchange.antivirus.server: {{ .Values.antivirus.icap.host | quote }}
+        com.openexchange.antivirus.port: {{ .Values.antivirus.icap.port | quote }}
+        {{- else }}
         {{- if .Values.clamavDistributed.enabled }}
         com.openexchange.antivirus.server: "clamav-icap"
         {{- else if .Values.clamavSimple.enabled }}
         com.openexchange.antivirus.server: "clamav-simple"
         {{- end }}
         com.openexchange.antivirus.port: "1344"
+        {{- end }}
         com.openexchange.antivirus.maxFileSize: "1024"
     uiSettings:
       io.ox.nextcloud//server: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/fs/"
@@ -387,16 +392,17 @@ appsuite:
       # MC+base64(20 random bytes)
       # RC+base64(20 random bytes)
       oxguardpass: |
-        {{ .Values.secrets.oxAppsuite.oxguardMC }}
+        {{ .Values.secrets.oxAppSuite.oxguardMC }}
-        {{ .Values.secrets.oxAppsuite.oxguardRC }}
+        {{ .Values.secrets.oxAppSuite.oxguardRC }}
     redis: &redisConfiguration
       enabled: true
       mode: "standalone"
       hosts:
-        - "redis-master:6379"
+        - {{ printf "%s:%v" .Values.cache.oxAppSuite.host .Values.cache.oxAppSuite.port | quote }}
       auth:
         enabled: true
-        password: {{ .Values.secrets.redis.password | quote }}
+        username: {{ .Values.cache.oxAppSuite.username | quote }}
+        password: {{ .Values.cache.oxAppSuite.password | default .Values.secrets.redis.password | quote }}
     image:
       registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
@@ -495,9 +501,9 @@ appsuite:
 
   core-documentconverter:
     adminUser: "admin"
-    adminPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+    adminPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
     basicAuthLogin: "oxlogin"
-    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
+    basicAuthPassword: {{ .Values.secrets.oxAppSuite.basicAuthPassword | quote }}
     enabled: true
     documentConverter:
       cache:
@@ -582,9 +588,9 @@ appsuite:
   core-imageconverter:
     enabled: true
     adminUser: "admin"
-    adminPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+    adminPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
     basicAuthLogin: "oxlogin"
-    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
+    basicAuthPassword: {{ .Values.secrets.oxAppSuite.basicAuthPassword | quote }}
     image:
       registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeImageConverter.registry | quote }}
       repository: {{ .Values.images.openxchangeImageConverter.repository | quote }}

helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl

@@ -50,7 +50,7 @@ oxConnector:
   oxLocalTimezone: "Europe/Berlin"
   oxLanguage: "de_DE"
   oxMasterAdmin: "admin"
-  oxMasterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+  oxMasterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
   oxSmtpServer: "smtp://127.0.0.1:587"
   oxSoapServer: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
 

helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl

@@ -21,11 +21,13 @@ releases:
     values:
       - "values.yaml.gotmpl"
       - "../../shared/migrations.yaml.gotmpl"
-      - {{ .Values.customization.release.migrationsPost | default "additionalValues: false" }}
+      {{ range .Values.customization.release.migrationsPost }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.migrations.enabled }}
     timeout: 900
 
 commonLabels:
-  deploy-stage: "component-0"
+  deployStage: "090-migrations-post"
-  component: "opendesk-migrations"
+  component: "migrations-post"
 ...

helmfile/apps/opendesk-migrations-post/values.yaml.gotmpl

@@ -0,0 +1,15 @@
+{{/*
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+podAnnotations:
+  {{ .Values.annotations.migrationsPost.pod | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.migrationsPost.serviceAccount | toYaml | nindent 4 }}
+
+migrations:
+  stage: "POST"
+...

helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl

@@ -21,11 +21,13 @@ releases:
     values:
       - "values.yaml.gotmpl"
       - "../../shared/migrations.yaml.gotmpl"
-      - {{ .Values.customization.release.migrationsPre | default "additionalValues: false" }}
+      {{ range .Values.customization.release.migrationsPre }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.migrations.enabled }}
     timeout: 900
 
 commonLabels:
-  deploy-stage: "component-0"
+  deployStage: "010-migrations-pre"
-  component: "opendesk-migrations"
+  component: "migrations-pre"
 ...

helmfile/apps/opendesk-migrations-pre/values.yaml.gotmpl

@@ -0,0 +1,15 @@
+{{/*
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+podAnnotations:
+  {{ .Values.annotations.migrationsPre.pod | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.migrationsPre.serviceAccount | toYaml | nindent 4 }}
+
+migrations:
+  stage: "PRE"
+...

helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl

@@ -20,11 +20,13 @@ releases:
     waitForJobs: true
     values:
       - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskOpenprojectBootstrap | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskOpenprojectBootstrap }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.openproject.enabled }}
     timeout: 900
 
 commonLabels:
-  deploy-stage: "component-2"
+  deployStage: "060-components"
   component: "opendesk-openproject-bootstrap"
 ...

helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl

@@ -72,4 +72,10 @@ podSecurityContext:
   fsGroup: 1000
   fsGroupChangePolicy: "OnRootMismatch"
 
+additionalAnnotations:
+  {{ .Values.annotations.openprojectBootstrap.all | toYaml | nindent 2 }}
+
+podAnnotations:
+  {{ .Values.annotations.openprojectBootstrap.pod | toYaml | nindent 2 }}
+
 ...

helmfile/apps/opendesk-services/helmfile-child.yaml.gotmpl

@@ -0,0 +1,111 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # openDesk Otterize
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-otterize
+  - name: "otterize-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.otterize.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
+
+  # openDesk Home
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
+  - name: "home-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.home.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
+
+  # openDesk Certificates
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
+  - name: "certificates-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.certificates.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
+
+    # openDesk Alerts
+  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts
+  - name: "opendesk-alerts-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.opendeskAlerts.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"
+
+    # openDesk Grafana Dashboards
+    # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards
+  - name: "dashboards-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.opendeskDashboards.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"
+
+releases:
+  - name: "opendesk-otterize"
+    chart: "otterize-repo/{{ .Values.charts.otterize.name }}"
+    version: "{{ .Values.charts.otterize.version }}"
+    values:
+      - "values-otterize.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskOtterize }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.security.otterizeIntents.enabled }}
+    timeout: 900
+
+  - name: "opendesk-home"
+    chart: "home-repo/{{ .Values.charts.home.name }}"
+    version: "{{ .Values.charts.home.version }}"
+    values:
+      - "values-home.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskHome }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.home.enabled }}
+
+  - name: "opendesk-certificates"
+    chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
+    version: "{{ .Values.charts.certificates.version }}"
+    values:
+      - "values-certificates.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskCertificates }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.certificates.enabled }}
+    timeout: 900
+
+  - name: "opendesk-alerts"
+    chart: "opendesk-alerts-repo/{{ .Values.charts.opendeskAlerts.name }}"
+    version: "{{ .Values.charts.opendeskAlerts.version }}"
+    values:
+      - "values-opendesk-alerts.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskAlerts}}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
+    timeout: 900
+
+  - name: "opendesk-dashboards"
+    chart: "dashboards-repo/{{ .Values.charts.opendeskDashboards.name }}"
+    version: "{{ .Values.charts.opendeskDashboards.version }}"
+    values:
+      - "values-dashboards.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskDashboards | default "additionalValues: false" }}
+    installed: {{ .Values.monitoring.grafana.dashboards.enabled }}
+    timeout: 900
+
+commonLabels:
+  deployStage: "030-opendesk-services"
+  component: "opendesk-services"
+...

helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl

@@ -39,7 +39,7 @@ global:
     {{- if .Values.openproject.enabled }}
     openproject: {{ .Values.global.hosts.openproject }}
     {{- end }}
-    {{- if .Values.oxAppsuite.enabled }}
+    {{- if .Values.oxAppSuite.enabled }}
     openxchange: {{ .Values.global.hosts.openxchange }}
     {{- end }}
     {{- if .Values.nubus.enabled }}
@@ -52,6 +52,7 @@ global:
 
 issuerRef:
   name: {{ .Values.certificate.issuerRef.name | quote }}
+  kind: {{ .Values.certificate.issuerRef.kind | quote }}
 
 cleanup:
   keepRessourceOnDelete: {{ .Values.debug.cleanup.keepRessourceOnDelete }}

helmfile/apps/opendesk-services/values-dashboards.yaml.gotmpl

@@ -0,0 +1,54 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+additionalAnnotations:
+  {{ .Values.monitoring.grafana.dashboards.annotations | toYaml | nindent 2 }}
+additionalLabels:
+  {{ .Values.monitoring.grafana.dashboards.labels | toYaml | nindent 2 }}
+
+config:
+  apps:
+    collabora:
+      enable: {{ .Values.collabora.enabled }}
+      selectors:
+        namespace: {{ .Values.collabora.namespace | quote }}
+    matrixElement:
+      enable: {{ .Values.element.enabled }}
+      selectors:
+        namespace: {{ .Values.element.namespace | quote }}
+    diagrams:
+      enable: {{ .Values.cryptpad.enabled }}
+      selectors:
+        namespace: {{ .Values.cryptpad.namespace | quote }}
+    nextcloud:
+      enable: {{ .Values.nextcloud.enabled }}
+      selectors:
+        namespace: {{ .Values.nextcloud.namespace | quote }}
+    openxchange:
+      enable: {{ .Values.oxAppSuite.enabled }}
+      selectors:
+        namespace: {{ .Values.oxAppSuite.namespace | quote }}
+    xwiki:
+      enable: {{ .Values.xwiki.enabled }}
+      selectors:
+        namespace: {{ .Values.xwiki.namespace | quote }}
+    nubus:
+      enable: {{ .Values.nubus.enabled }}
+      selectors:
+        namespace: {{ .Values.nubus.namespace | quote }}
+    openproject:
+      enable: {{ .Values.openproject.enabled }}
+      selectors:
+        namespace: {{ .Values.openproject.namespace | quote }}
+    jitsi:
+      enable: {{ .Values.jitsi.enabled }}
+      selectors:
+        namespace: {{ .Values.jitsi.namespace | quote }}
+    collabora:
+      enable: {{ .Values.collabora.enabled }}
+      selectors:
+        namespace: {{ .Values.collabora.namespace | quote }}
+...

helmfile/apps/opendesk-services/values-opendesk-alerts.yaml.gotmpl

@@ -0,0 +1,52 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+additionalAnnotations:
+  {{ .Values.monitoring.prometheus.prometheusRules.annotations | toYaml | nindent 2 }}
+additionalLabels:
+  {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 2 }}
+
+config:
+  collabora:
+    enable: {{ .Values.collabora.enabled }}
+    selectors:
+      namespace: {{ .Values.collabora.namespace | quote }}
+  matrix:
+    enable: {{ .Values.element.enabled }}
+    selectors:
+      namespace: {{ .Values.element.namespace | quote }}
+  diagrams:
+    enable: {{ .Values.cryptpad.enabled }}
+    selectors:
+      namespace: {{ .Values.cryptpad.namespace | quote }}
+  nextcloud:
+    enable: {{ .Values.nextcloud.enabled }}
+    selectors:
+      namespace: {{ .Values.nextcloud.namespace | quote }}
+  openXChange:
+    enable: {{ .Values.oxAppSuite.enabled }}
+    selectors:
+      namespace: {{ .Values.oxAppSuite.namespace | quote }}
+  xwiki:
+    enable: {{ .Values.xwiki.enabled }}
+    selectors:
+      namespace: {{ .Values.xwiki.namespace | quote }}
+  nubus:
+    enable: {{ .Values.nubus.enabled }}
+    selectors:
+      namespace: {{ .Values.nubus.namespace | quote }}
+  openProject:
+    enable: {{ .Values.openproject.enabled }}
+    selectors:
+      namespace: {{ .Values.openproject.namespace | quote }}
+  jitsi:
+    enable: {{ .Values.jitsi.enabled }}
+    selectors:
+      namespace: {{ .Values.jitsi.namespace | quote }}
+  collabora:
+    enable: {{ .Values.collabora.enabled }}
+    selectors:
+      namespace: {{ .Values.collabora.namespace | quote }}
+

helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl

@@ -29,7 +29,7 @@ apps:
   openproject:
     enabled: {{ .Values.openproject.enabled }}
   oxAppsuite:
-    enabled: {{ .Values.oxAppsuite.enabled }}
+    enabled: {{ .Values.oxAppSuite.enabled }}
   postfix:
     enabled: {{ .Values.postfix.enabled }}
   postgresql:

helmfile/apps/openproject/helmfile-child.yaml.gotmpl

@@ -20,11 +20,13 @@ releases:
     waitForJobs: true
     values:
       - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.openproject | default "additionalValues: false" }}
+      {{ range .Values.customization.release.openproject }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.openproject.enabled }}
     timeout: 1800
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "openproject"
 ...

helmfile/apps/openproject/values.yaml.gotmpl

@@ -40,7 +40,8 @@ dbInit:
 environment:
 # For more details and more options see
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
-  OPENPROJECT_LOG__LEVEL: {{ if .Values.debug.enabled }}"debug"{{ else }}"warn"{{ end }}
+  OPENPROJECT_APP__TITLE: "Projects | {{ .Values.theme.texts.productName }}"
+  OPENPROJECT_LOG__LEVEL: {{ if .Values.debug.enabled }}"debug"{{ else }}"info"{{ end }}
   OPENPROJECT_LOGIN__REQUIRED: "true"
   OPENPROJECT_USER__DEFAULT__TIMEZONE: "Europe/Berlin"
   OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
@@ -84,9 +85,6 @@ environment:
   OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.nubus .Values.global.domain | quote }}
   OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
   OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
-  {{- if .Values.enterprise.openproject.token }}
-  OPENPROJECT_ENTERPRISE__TOKEN: {{ .Values.enterprise.openproject.token | quote }}
-  {{- end }}
   {{- if .Values.certificate.selfSigned }}
   SSL_CERT_FILE: "/etc/ssl/certs/ca-certificates.crt"
   {{- end }}
@@ -120,7 +118,8 @@ memcached:
 persistence:
   enabled: false
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.openproject.pod | toYaml | nindent 2 }}
 
 postgresql:
   bundled: false
@@ -166,6 +165,10 @@ openproject:
       admin: "openproject_admin"
   useTmpVolumes: true
 
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.openproject.serviceAccount | toYaml | nindent 4 }}
+
 ingress:
   annotations:
     nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.openproject }}"
@@ -174,6 +177,9 @@ ingress:
     nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.openproject }}"
     nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openproject }}s"
     nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openproject }}s"
+    {{- with .Values.annotations.openproject.ingress }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   host: "{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
   enabled: {{ .Values.ingress.enabled }}
   ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -192,8 +198,8 @@ s3:
   enabled: true
   directUploads: {{ .Values.objectstores.openproject.directUploads }}
   enableSignatureV4Streaming: {{ .Values.objectstores.openproject.enableSignatureV4Streaming }}
-  endpoint: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+  endpoint: {{ printf "https://%s" (.Values.objectstores.openproject.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
-  host: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+  host: {{ printf "https://%s" (.Values.objectstores.openproject.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
   pathStyle: {{ .Values.objectstores.openproject.pathStyle }}
   region: {{ .Values.objectstores.openproject.region | quote }}
   bucketName: {{ .Values.objectstores.openproject.bucket | quote }}

helmfile/apps/services-external/helmfile-child.yaml.gotmpl

@@ -2,36 +2,6 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
-  # openDesk Otterize
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-otterize
-  - name: "otterize-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.otterize.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
-
-  # openDesk Home
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
-  - name: "home-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.home.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
-
-  # openDesk Certificates
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
-  - name: "certificates-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.certificates.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
-
   # openDesk PostgreSQL
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postgresql
   - name: "postgresql-repo"
@@ -113,39 +83,27 @@ repositories:
     oci: true
     url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
 
+  # openDesk Enterprise Repositories
+
+  # Cassandra
+  # Source: https://github.com/bitnami/charts/
+  - name: "cassandra-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.cassandra.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"
+
 releases:
-  - name: "opendesk-otterize"
-    chart: "otterize-repo/{{ .Values.charts.otterize.name }}"
-    version: "{{ .Values.charts.otterize.version }}"
-    values:
-      - "values-otterize.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskOtterize | default "additionalValues: false" }}
-    installed: {{ .Values.security.otterizeIntents.enabled }}
-    timeout: 900
-
-  - name: "opendesk-home"
-    chart: "home-repo/{{ .Values.charts.home.name }}"
-    version: "{{ .Values.charts.home.version }}"
-    values:
-      - "values-home.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskHome | default "additionalValues: false" }}
-    installed: {{ .Values.home.enabled }}
-
-  - name: "opendesk-certificates"
-    chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
-    version: "{{ .Values.charts.certificates.version }}"
-    values:
-      - "values-certificates.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskCertificates | default "additionalValues: false" }}
-    installed: {{ .Values.certificates.enabled }}
-    timeout: 900
-
   - name: "redis"
     chart: "redis-repo/{{ .Values.charts.redis.name }}"
     version: "{{ .Values.charts.redis.version }}"
     values:
       - "values-redis.yaml.gotmpl"
-      - {{ .Values.customization.release.redis | default "additionalValues: false" }}
+      {{ range .Values.customization.release.redis }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.redis.enabled }}
     timeout: 900
 
@@ -154,7 +112,9 @@ releases:
     version: "{{ .Values.charts.memcached.version }}"
     values:
       - "values-memcached.yaml.gotmpl"
-      - {{ .Values.customization.release.memcached | default "additionalValues: false" }}
+      {{ range .Values.customization.release.memcached }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.memcached.enabled }}
     timeout: 900
 
@@ -163,7 +123,9 @@ releases:
     version: "{{ .Values.charts.postgresql.version }}"
     values:
       - "values-postgresql.yaml.gotmpl"
-      - {{ .Values.customization.release.postgresql | default "additionalValues: false" }}
+      {{ range .Values.customization.release.postgresql }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.postgresql.enabled }}
     timeout: 900
 
@@ -172,7 +134,9 @@ releases:
     version: "{{ .Values.charts.mariadb.version }}"
     values:
       - "values-mariadb.yaml.gotmpl"
-      - {{ .Values.customization.release.mariadb | default "additionalValues: false" }}
+      {{ range .Values.customization.release.mariadb }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.mariadb.enabled }}
     timeout: 900
 
@@ -181,7 +145,9 @@ releases:
     version: "{{ .Values.charts.postfix.version }}"
     values:
       - "values-postfix.yaml.gotmpl"
-      - {{ .Values.customization.release.postfix | default "additionalValues: false" }}
+      {{ range .Values.customization.release.postfix }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.postfix.enabled }}
     timeout: 900
 
@@ -190,7 +156,9 @@ releases:
     version: "{{ .Values.charts.dkimpy.version }}"
     values:
       - "values-dkimpy.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskDkimpyMilter | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskDkimpyMilter }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.dkimpy.enabled }}
     timeout: 900
 
@@ -199,7 +167,9 @@ releases:
     version: "{{ .Values.charts.clamav.version }}"
     values:
       - "values-clamav-distributed.yaml.gotmpl"
-      - {{ .Values.customization.release.clamav | default "additionalValues: false" }}
+      {{ range .Values.customization.release.clamav }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.clamavDistributed.enabled }}
     timeout: 900
 
@@ -208,7 +178,9 @@ releases:
     version: "{{ .Values.charts.clamavSimple.version }}"
     values:
       - "values-clamav-simple.yaml.gotmpl"
-      - {{ .Values.customization.release.clamavSimple | default "additionalValues: false" }}
+      {{ range .Values.customization.release.clamavSimple }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.clamavSimple.enabled }}
     timeout: 900
 
@@ -217,11 +189,24 @@ releases:
     version: "{{ .Values.charts.minio.version }}"
     values:
       - "values-minio.yaml.gotmpl"
-      - {{ .Values.customization.release.minio | default "additionalValues: false" }}
+      {{ range .Values.customization.release.minio }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.minio.enabled }}
     timeout: 900
 
+  # openDesk Enterprise Releases
+  - name: "cassandra"
+    chart: "cassandra-repo/{{ .Values.charts.cassandra.name }}"
+    version: "{{ .Values.charts.cassandra.version }}"
+    values:
+      {{ range .Values.customization.release.cassandra }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.cassandra.enabled }}
+    timeout: 900
+
 commonLabels:
-  deploy-stage: "services"
+  deployStage: "030-services-external"
-  component: "services"
+  component: "services-external"
 ...

helmfile/apps/services-external/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/services-external/values-mariadb.yaml.gotmpl

@@ -42,25 +42,25 @@ job:
     - username: {{ .Values.databases.nextcloud.username | quote }}
       password: {{ .Values.secrets.mariadb.nextcloudUser | quote}}
       connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
+    # OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
     # users for the moment.
     - username: "openxchange_user"
     # - username: {{ .Values.databases.xwiki.username | quote }}
       password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
-      connectionLimit: {{ .Values.databases.oxAppsuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+      connectionLimit: {{ .Values.databases.oxAppSuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
     - username: "xwiki_user"
-    # - username: {{ .Values.databases.oxAppsuite.username | quote }}
+    # - username: {{ .Values.databases.oxAppSuite.username | quote }}
       password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
       connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
   databases:
     - name: {{ .Values.databases.nextcloud.name | quote }}
       user: {{ .Values.databases.nextcloud.username | quote }}
-    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
+    # OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
     # users for the moment.
     - name: "openxchange"
       user: "openxchange_user"
-    # - name: {{ .Values.databases.oxAppsuite.name | quote }}
+    # - name: {{ .Values.databases.oxAppSuite.name | quote }}
-    #   user: {{ .Values.databases.oxAppsuite.username | quote }}
+    #   user: {{ .Values.databases.oxAppSuite.username | quote }}
     - name: "xwiki"
       user: "xwiki_user"
     # - name: {{ .Values.databases.xwiki.name | quote }}

helmfile/apps/services-external/values-postfix.yaml.gotmpl

@@ -68,11 +68,15 @@ postfix:
   smtpdTLSCertFile: "/etc/tls/tls.crt"
   smtpdKeyFile: "/etc/tls/tls.key"
   smtpdSASLPath: "inet:dovecot:3659"
+  {{- if .Values.antivirus.milter.host }}
+  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
+  {{- else }}
   {{- if .Values.clamavDistributed.enabled }}
   smtpdMilters: "inet:clamav-milter:7357"
   {{- else if .Values.clamavSimple.enabled }}
   smtpdMilters: "inet:clamav-simple:7357"
   {{- end }}
+  {{- end }}
   virtualMailboxDomains: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
   virtualTransport: "lmtps:dovecot:24"
 

helmfile/apps/xwiki/helmfile-child.yaml.gotmpl

@@ -19,11 +19,13 @@ releases:
     wait: true
     values:
       - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.xwiki | default "additionalValues: false" }}
+      {{ range .Values.customization.release.xwiki }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.xwiki.enabled }}
     timeout: 1800
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "xwiki"
 ...

helmfile/apps/xwiki/values.yaml.gotmpl

@@ -23,7 +23,7 @@ externalDB:
   password: {{ .Values.databases.xwiki.password | default .Values.secrets.mariadb.rootPassword | quote }}
   database: {{ .Values.databases.xwiki.name | quote }}
   user: {{ .Values.databases.xwiki.username | quote }}
-  host: {{ .Values.databases.xwiki.host | quote }}
+  host: {{ printf "%s:%d" .Values.databases.xwiki.host .Values.databases.xwiki.port | quote }}
   customKeyRef:
     enabled: false
 
@@ -57,8 +57,10 @@ customConfigs:
     xwiki.authentication.ldap.photo_attribute: "jpegPhoto"
     ## Enable the synchronization of the LDAP profile picture
     xwiki.authentication.ldap.update_photo: 1
-    ## Password of default user
+    {{ if .Values.debug.enabled }}
+    ## Password of "superadmin" user, disables account if not password is set
     xwiki.superadminpassword: {{ .Values.secrets.xwiki.superadminpassword | quote }}
+    {{ end }}
     ## LDAP Server configuration
     xwiki.authentication.ldap.server: {{ .Values.ldap.host | quote }}
     xwiki.authentication.ldap.port: 389

helmfile/bases/environments.yaml

@@ -4,21 +4,17 @@
 environments:
   default:
     values:
-      - "../../environments/default/*.gotmpl"
+      - "../../environments/default/*.yaml.gotmpl"
-      - "../../environments/default/*.yaml"
   dev:
     values:
-      - "../../environments/default/*.gotmpl"
+      - "../../environments/default/*.yaml.gotmpl"
-      - "../../environments/default/*.yaml"
       - "../../environments/dev/*.yaml.gotmpl"
   test:
     values:
-      - "../../environments/default/*.gotmpl"
+      - "../../environments/default/*.yaml.gotmpl"
-      - "../../environments/default/*.yaml"
       - "../../environments/test/*.yaml.gotmpl"
   prod:
     values:
-      - "../../environments/default/*.gotmpl"
+      - "../../environments/default/*.yaml.gotmpl"
-      - "../../environments/default/*.yaml"
       - "../../environments/prod/*.yaml.gotmpl"
 ...

helmfile/environments/default/annotations.yaml

@@ -0,0 +1,73 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+annotations:
+  collabora:
+    ingress: ~
+    pod: ~
+  cryptpad:
+    ingress: ~
+    pod: ~
+  element:
+    ingress: ~
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  elementWellKnown:
+    ingress: ~
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  jicofo:
+    pod: ~
+  jitsi:
+    ingress: ~
+    pod: ~
+    serviceAccount: ~
+  jitsiKeycloakAdapter:
+    pod: ~
+  jitsiPatchJVB:
+    serviceAccount: ~
+  jvb:
+    pod: ~
+  prosody:
+    pod: ~
+  matrixUserVerificationService:
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  migrationsPre:
+    pod: ~
+    serviceAccount: ~
+  migrationsPost:
+    pod: ~
+    serviceAccount: ~
+  nextcloudManagement:
+    all: ~
+    serviceAccount: ~
+  nextcloud:
+    all: ~
+    ingress: ~
+    serviceAccount: ~
+  openproject:
+    ingress: ~
+    pod: ~
+    serviceAccount: ~
+  openprojectBootstrap:
+    all: ~
+    pod: ~
+  synapse:
+    ingress: ~
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  synapseWeb:
+    ingress: ~
+    pod: ~
+    service: ~
+    serviceAccount: ~
+  # XWiki has no annotation support.
+  # xwiki:
+  #   pod: ~
+
+...

helmfile/environments/default/antivirus.yaml.gotmpl

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+antivirus:
+  icap:
+    host: ~
+    port: 1344
+  milter:
+    host: ~
+    port: 7357
+...

helmfile/environments/default/cache.yaml.gotmpl

@@ -5,14 +5,22 @@ cache:
   intercomService:
     host: "redis-headless"
     port: 6379
+    username: "default"
     password: ""
   nextcloud:
     host: "redis-headless"
     port: 6379
+    username: "default"
     password: ""
+    tls: false
   openproject:
     host: "memcached"
     port: 11211
+  oxAppSuite:
+    host: "redis-headless"
+    port: 6379
+    username: "default"
+    password: ""
   umsSelfservice:
     host: "memcached"
     port: 11211

helmfile/environments/default/certificate.yaml.gotmpl

@@ -5,6 +5,7 @@
 certificate:
   issuerRef:
     name: "letsencrypt-prod"
+    kind: "ClusterIssuer"
   wildcard: false
   selfSigned: false
 ...

helmfile/environments/default/charts.yaml.gotmpl

@@ -6,6 +6,13 @@
 # yamllint disable rule:line-length
 ---
 charts:
+  cassandra:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
+    verify: true
   certificates:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -46,7 +53,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/collabora/charts-mirror"
     name: "collabora-online"
-    version: "1.1.21"
+    version: "1.1.26"
     verify: true
   cryptpad:
     # providerCategory: "Supplier"
@@ -90,7 +97,17 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-element"
-    version: "3.4.1"
+    version: "5.0.1"
+    verify: true
+  elementWeb:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
+    name: "opendesk-element-web"
+    version: "5.0.1"
     verify: true
   elementWellKnown:
     # providerCategory: "Platform"
@@ -100,7 +117,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-well-known"
-    version: "3.4.1"
+    version: "5.0.1"
     verify: true
   home:
     # providerCategory: "Platform"
@@ -132,7 +149,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
     name: "opendesk-jitsi"
-    version: "2.1.0"
+    version: "2.1.1"
     verify: true
   mariadb:
     # providerCategory: "Platform"
@@ -152,7 +169,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
     name: "matrix-neoboard-widget"
-    version: "3.5.0"
+    version: "3.5.1"
     verify: true
   matrixNeochoiseWidget:
     # providerCategory: "Platform"
@@ -162,7 +179,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
     name: "matrix-neochoice-widget"
-    version: "3.5.0"
+    version: "3.5.1"
     verify: true
   matrixNeodatefixBot:
     # providerCategory: "Platform"
@@ -172,7 +189,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
     name: "matrix-neodatefix-bot"
-    version: "3.5.0"
+    version: "3.5.1"
     verify: true
   matrixNeodatefixWidget:
     # providerCategory: "Platform"
@@ -182,7 +199,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
     name: "matrix-neodatefix-widget"
-    version: "3.5.0"
+    version: "3.5.1"
     verify: true
   matrixUserVerificationService:
     # providerCategory: "Platform"
@@ -192,7 +209,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-matrix-user-verification-service"
-    version: "3.4.0"
+    version: "5.0.1"
     verify: true
   memcached:
     # providerCategory: "Community"
@@ -232,7 +249,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud"
-    version: "3.4.1"
+    version: "3.6.2"
     verify: true
   nextcloudManagement:
     # providerCategory: "Platform"
@@ -242,7 +259,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud-management"
-    version: "3.4.1"
+    version: "3.6.2"
     verify: true
   nginx:
     # providerCategory: "Community"
@@ -254,6 +271,16 @@ charts:
     name: "nginx"
     version: "15.9.3"
     verify: true
+  nginxS3Gateway:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # packageName=bmi/opendesk/components/platform-development/charts/nginx-s3-gateway/nginx-s3-gateway
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/nginx-s3-gateway"
+    name: "nginx-s3-gateway"
+    version: "1.0.1"
+    verify: true
   nubus:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -264,7 +291,27 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "nubus"
-    version: "0.64.2"
+    version: "1.4.0"
+    verify: true
+  opendeskAlerts:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-alerts"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-alerts"
+    name: "opendesk-alerts"
+    version: "1.1.0"
+    verify: true
+  opendeskDashboards:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegiostry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-dashboards"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-dashboards"
+    name: "opendesk-dashboards"
+    version: "1.1.0"
     verify: true
   opendeskKeycloakBootstrap:
     # providerCategory: "Platform"
@@ -286,7 +333,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
     name: "openproject"
-    version: "8.3.2"
+    version: "9.0.1"
     verify: true
   openprojectBootstrap:
     # providerCategory: "Platform"
@@ -298,7 +345,17 @@ charts:
     name: "opendesk-openproject-bootstrap"
     version: "2.1.1"
     verify: true
-  openXchangeAppSuite:
+  otterize:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize/opendesk-otterize"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize"
+    name: "opendesk-otterize"
+    version: "2.1.0"
+    verify: true
+  oxAppSuite:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
@@ -310,7 +367,7 @@ charts:
     name: "appsuite-public-sector"
     version: "2.12.85"
     verify: false
-  openXchangeAppSuiteBootstrap:
+  oxAppSuiteBootstrap:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
     # upstreamRegistry: "https://registry.opencode.de"
@@ -320,16 +377,6 @@ charts:
     name: "opendesk-open-xchange-bootstrap"
     version: "2.1.2"
     verify: true
-  otterize:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize/opendesk-otterize"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize"
-    name: "opendesk-otterize"
-    version: "2.1.0"
-    verify: true
   oxConnector:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -380,7 +427,21 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse"
-    version: "3.4.1"
+    version: "5.0.1"
+    verify: true
+  synapseAdmin:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
+    verify: true
+  synapseAdminbotWeb:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
     verify: true
   synapseCreateAccount:
     # providerCategory: "Platform"
@@ -390,7 +451,21 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse-create-account"
-    version: "3.4.1"
+    version: "5.0.1"
+    verify: true
+  synapseGroupsync:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
+    verify: true
+  synapsePipe:
+    # Component is required for openDesk Enterprise only.
+    registry: ""
+    repository: ""
+    name: ""
+    version: ""
     verify: true
   synapseWeb:
     # providerCategory: "Platform"
@@ -400,7 +475,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse-web"
-    version: "3.4.1"
+    version: "5.0.1"
     verify: true
   xwiki:
     # providerCategory: "Supplier"

helmfile/environments/default/customization.yaml

@@ -1,57 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
----
-# This variable allows customization of helmfile releases by loading custom values file.
-# Example:
-# customization:
-#   release:
-#     collaboraOnline: /path/to/additional/file.yaml
-customization:
-  release:
-    # collabora
-    collaboraOnline: ~
-    # cryptpad
-    cryptpad: ~
-    # element
-    opendeskElement: ~
-    opendeskWellKnown: ~
-    opendeskSynapseWeb: ~
-    opendeskSynapse: ~
-    # jitsi
-    jitsi: ~
-    # migrations-post
-    migrationsPost: ~
-    # migrations-pre
-    migrationsPre: ~
-    # nextcloud
-    opendeskNextcloudManagement: ~
-    opendeskNextcloud: ~
-    # nubus
-    ums: ~
-    intercomService: ~
-    opendeskKeycloakBootstrap: ~
-    # open-xchange
-    dovecot: ~
-    openXchange: ~
-    opendeskOpenXchangeBootstrap: ~
-    oxConnector: ~
-    # openproject
-    openproject: ~
-    # openproject-bootstrap
-    opendeskOpenprojectBootstrap: ~
-    # services
-    opendeskOtterize: ~
-    opendeskHome: ~
-    opendeskCertificates: ~
-    redis: ~
-    memcached: ~
-    postgresql: ~
-    mariadb: ~
-    postfix: ~
-    opendeskDkimpyMilter: ~
-    clamav: ~
-    clamavSimple: ~
-    minio: ~
-    # xwiki
-    xwiki: ~
-...

helmfile/environments/default/customization.yaml.gotmpl

@@ -0,0 +1,78 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# This variable allows customization of helmfile releases by loading custom values file.
+#
+# **Warning**: Customizations are a very powerful tool to apply individual changes to your
+# openDesk installation. As there are no limits set for what you use it, openDesk cannot
+# support the configurations you are about to create using the customization-option. If you
+# have the demand for a specific configuration, try to get it into the openDesk standard
+# by creating a ticket at https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues
+#
+# Example:
+# customization:
+#   release:
+#     collaboraOnline:
+#       myCustomConfig: "/path/to/additional/file.yaml.gotmpl"
+customization:
+  release:
+    # collabora
+    collaboraOnline: {}
+    # cryptpad
+    cryptpad: {}
+    # element
+    opendeskElement: {}
+    opendeskWellKnown: {}
+    opendeskSynapseWeb: {}
+    opendeskSynapse: {}
+    # jitsi
+    jitsi: {}
+    # migrations-post
+    migrationsPost: {}
+    # migrations-pre
+    migrationsPre: {}
+    # nextcloud
+    opendeskNextcloudManagement: {}
+    opendeskNextcloud: {}
+    # nubus
+    ums: {}
+    intercomService: {}
+    opendeskKeycloakBootstrap: {}
+    nginxS3Gateway: {}
+    # open-xchange
+    dovecot: {}
+    openxchange: {}
+    opendeskOpenxchangeBootstrap: {}
+    oxConnector: {}
+    # openproject
+    openproject: {}
+    # openproject-bootstrap
+    opendeskOpenprojectBootstrap: {}
+    # services
+    opendeskOtterize: {}
+    opendeskHome: {}
+    opendeskCertificates: {}
+    opendeskAlerts: {}
+    opendeskDashboards: {}
+    redis: {}
+    memcached: {}
+    postgresql: {}
+    mariadb: {}
+    postfix: {}
+    opendeskDkimpyMilter: {}
+    clamav: {}
+    clamavSimple: {}
+    minio: {}
+    # xwiki
+    xwiki: {}
+
+    # openDesk Enterprise Components
+    cassandra: {}
+    opendeskSynapseAdmin: {}
+    opendeskSynapseAdminbotBootstrap: {}
+    opendeskSynapseAdminbotPipe: {}
+    opendeskSynapseAdminbotWeb: {}
+    opendeskSynapseAuditbotBootstrap: {}
+    opendeskSynapseAuditbotPipe: {}
+    opendeskSynapseGroupsync: {}
+...

helmfile/environments/default/database.yaml.gotmpl

@@ -32,7 +32,7 @@ databases:
     username: "openproject_user"
     password: ""
     connectionLimit: ~
-  oxAppsuite:
+  oxAppSuite:
     name: "configdb"
     host: "mariadb"
     port: 3306
@@ -45,6 +45,21 @@ databases:
     port: 5432
     username: "matrix_user"
     password: ""
+    requireAuth: []
+    channelBinding: "prefer"
+    connectTimeout: 10
+    clientEncoding: "auto"
+    keepalives: 1
+    keepalivesIdle: 10
+    keepalivesInterval: 10
+    keepalivesCount: 3
+    replication: false
+    gssencmode: "prefer"
+    sslmode: "prefer"
+    sslcompression: 0
+    sslMinProtocolVersion: "TLSv1.2"
+    connectionPoolMin: "3"
+    connectionPoolMax: "5"
     connectionLimit: ~
   umsGuardianManagementApi:
     name: "guardianmanagementapi"

helmfile/environments/default/debug.yaml.gotmpl

@@ -14,6 +14,5 @@ debug:
   # should activate debug output in all components and even allow e.g. successfully executed jobs
   # to stay available. This is going to be implemented on a case by case basis when we actually
   # need debugging in a component.
-  # Use: `{{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}`
   enabled: false
 ...

helmfile/environments/default/enterprise.yaml

@@ -1,9 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
-# The variables set in this file are required to upgrade components to their "Enterprise" product variant.
----
-enterprise:
-  openproject:
-    # Enterprise token must match the deployment's OpenProject host name.
-    token: ""
-...

helmfile/environments/default/functional.yaml.gotmpl

@@ -45,6 +45,8 @@ functional:
         enabled: false
         # Enforces passwords to be used on external shares.
         enforcePasswords: false
+        # Let Nextcloud send the password set for the share by mail to the recipient of the share.
+        sendPasswordMail: true
         # Expiry settings for the external shares.
         expiry:
           # If true the check box for the expiry date is enabled by default.
@@ -81,10 +83,14 @@ functional:
       # Ref.: https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#presence
       enabled: false
     jitsiRoomHistory:
-      # Enable to allow the room history to be stored in the user's browser local storage.
+      # Disable to avoid the room history to be stored in the user's browser local storage.
-      # Ref.:
+      # Ref.: https://github.com/jitsi/docker-jitsi-meet/issues/898
-      enabled: false
+      enabled: true
 
+  portal:
+    # Configure if the a re-direct to the login dialogue is enforced, or if the portal is shown and the user as to actively
+    # trigger the login flow, e.g. but clicking on the "Login" portal tile.
+    enforceLogin: true
   chat:
     matrix:
       profile:
@@ -99,10 +105,10 @@ functional:
         useImmutableIdentifierForLocalpart: false
 
   migration:
-    oxAppsuite:
+    oxAppSuite:
       # Note: Only available in openDesk Enterprise.
       # Turn on temporary for migration purposes only. Will enable master password auth in OX AppSuite and Dovecot using
-      # `secrets.oxAppsuite.migrationsMasterPassword`.
+      # `secrets.oxAppSuite.migrationsMasterPassword`.
       enabled: false
 
 ...

helmfile/environments/default/images.yaml.gotmpl

@@ -20,7 +20,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "24.04.7.2.1@sha256:5b00478f2c6c7372b2a67e68783d9b1a91265679bbd4afdc1416e50720d50ce6"
+    tag: "24.04.9.2.1@sha256:749917bf9146d8507b3a63d422a30ebe4f499700421c30527e32f322a015c73d"
   cryptpad:
     # providerCategory: "Supplier"
     # providerResponsible: "XWiki"
@@ -53,7 +53,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/supplier/nordeck/images/opendesk-element-web"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images/opendesk-element-web"
-    tag: "1.11.2@sha256:faf57be74ff715e0f7c833a977f9f7b974ed3230d5d4e30733be7ed01b295a4c"
+    tag: "1.11.3@sha256:cd0693af163acccfe31bc6d505cc1f17918e7475c7b77d63f94a802a3071b2b3"
   freshclam:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -89,7 +89,7 @@ images:
     # upstreamMirrorStartFrom: ["8922"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jibri"
-    tag: "stable-9779@sha256:7a0dfa397e7c6c03eb1dc2b49d94f0dc2d6fc44fe85761f67a45ea0e34056b3e"
+    tag: "stable-9823@sha256:dd7a330cb14d95b7661167d7b4e1a8f2e988952ba4ea24baa0a96e09bebd40b1"
   jicofo:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -99,7 +99,7 @@ images:
     # upstreamMirrorStartFrom: ["8922"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jicofo"
-    tag: "stable-9779@sha256:6b00d53a899e01058a99fa71a3238442e18c43bc62d4212b6647b4f7aa67aae1"
+    tag: "stable-9823@sha256:551aa2adf078f8872474481a9bda7b7526fc5cae2853ce0be2aa1f6d91bf2ecc"
   jitsi:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -109,7 +109,7 @@ images:
     # upstreamMirrorStartFrom: ["8922"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/web"
-    tag: "stable-9779@sha256:77f9cb45bb8c1053002b1ce8987ac26aa1d3724e79b23b0403ca0e92469b7d14"
+    tag: "stable-9823@sha256:d37d0d34715a0089437c5c030251010e068926f93395d46753e1767d0ee16247"
   jitsiKeycloakAdapter:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -127,7 +127,7 @@ images:
     # upstreamRepository: "bitnami/kubectl"
     registry: "registry-1.docker.io"
     repository: "bitnami/kubectl"
-    tag: "1.30.2@sha256:3ec696e5ce1b79f78eb0eac1fed4ef20fa6584662cdf3c7ad933b0b03b9ce3f6"
+    tag: "1.31.3@sha256:e90b9642d3daeabcfe73cf9aadcbbc624d1de7f88185095307c785f1c266bdb9"
   jvb:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -137,7 +137,7 @@ images:
     # upstreamMirrorStartFrom: ["8922"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jvb"
-    tag: "stable-9779@sha256:126719d4bd6fc3a85b61e786936a561a41527223b7b6a9c6204df41b1af48a50"
+    tag: "stable-9823@sha256:e6e43071ce26628c816bea46a259c7462c8d5edbbd2ed66f983b1e0f2d9a6cb2"
   mariadb:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -155,7 +155,7 @@ images:
     # upstreamMirrorStartFrom: ["1", "4", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-neoboard-widget"
-    tag: "1.20.0@sha256:e72bca018af1c0087587f6bcd1748c820ff520c8cf2a042b9b58354cdc878345"
+    tag: "2.0.0@sha256:dea11481404c2368d0089543d977fb26af51753073e9e5cb73e389bde82c4004"
   matrixNeoChoiceWidget:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -165,7 +165,7 @@ images:
     # upstreamMirrorStartFrom: ["1", "4", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-poll-widget"
-    tag: "1.4.0@sha256:216cb88aaa47449a15af9a531d60eee593cb1923c4e8fcc67c119982972911e5"
+    tag: "1.5.0@sha256:29f332c5b79774201cc4fe2724e13017b6f4acc492211bc1cbfd6b4aa78b05fd"
   matrixNeoDateFixBot:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -175,7 +175,7 @@ images:
     # upstreamMirrorStartFrom: ["2", "7", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-meetings-bot"
-    tag: "2.8.0@sha256:db1d99c13a9facfd08a7da1d0a9c7c05715bad47110e93649ad6b389e462b42c"
+    tag: "2.8.1@sha256:d23b08e3b6f322ffdc67029a35bd110cefb98de7a2a023b7f52fb7729886078b"
   matrixNeoDateFixWidget:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -185,7 +185,7 @@ images:
     # upstreamMirrorStartFrom: ["1", "6", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/matrix-meetings-widget"
-    tag: "1.6.1@sha256:70bebd9293a977124a5da955e1a520381129d476d6414a083093c1b48a55dadd"
+    tag: "1.7.0@sha256:a3547f064dff6b469bb3ed931acd4edba9654699e1af59a9180987bbbfd8104b"
   matrixUserVerificationService:
     # providerCategory: "Supplier"
     # providerResponsible: "Element"
@@ -235,7 +235,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.2.5@sha256:1ad3d78f790f39826a855ac49324b24395ffe93ccb3ff50e2b9ea1da02b46bda"
+    tag: "2.3.4@sha256:46c596818861486ee621cf8a454c2539a4e230e58b1aebb5735022de849de8e6"
   nextcloudExporter:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -244,6 +244,14 @@ images:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-exporter"
     tag: "1.0.1@sha256:63e63c7420e37d3989fa0ffdbcf18a07b2a603ab9b2a849c2e7e44342dd82af0"
+  nginxS3Gateway:
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "nginxinc/nginx-s3-gateway"
+    registry: "registry-1.docker.io"
+    repository: "nginxinc/nginx-s3-gateway"
+    tag: "unprivileged-oss-20241111@sha256:20d6b6ec5fc987b18c3e345de33674374a8335c593d6d0841ac64eb49ae2dea4"
   nubusDataLoader:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -253,7 +261,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "41", "5"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/data-loader"
-    tag: "0.73.0@sha256:9babbdd0879aed7da928bf5034bf5f311511a8d07c242d2b10d067cc5dc0fd41"
+    tag: "0.80.0@sha256:61a8ed924c27578f40022ec7cb8d34337d0bdc890e46a09fee57a5428cd33037"
   nubusGuardianAuthorizationApi:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -313,7 +321,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "1", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-bootstrap"
-    tag: "0.3.0@sha256:2911e8d5409f4e302b5c8c073cc6bf3f3622582e6eef43c63672ac4551712750"
+    tag: "0.7.1@sha256:1675e1615732914f01f832af7347c5913af51b447f7e5ca4bdd38557d798c52e"
   nubusKeycloakExtensionHandler:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -343,7 +351,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "8", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-notifier"
-    tag: "0.25.2@sha256:9e29c7fb5c609d7e597f27e0384c4f932e6962cdf64012154d7b7c076755d86c"
+    tag: "0.26.5@sha256:2849bcea1c0d532d83d7d5ccd6036592af53ae6fee2ef5822eae7147ec0e094c"
   nubusLdapServer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -353,7 +361,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "8", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server"
-    tag: "0.25.2@sha256:2b9d53f93a93d0f3a659c81c0e44596da8941bd83c8e1f7301a24e46ca06dba2"
+    tag: "0.27.0@sha256:c8b2b4e6987deb37095a7dbfcc4e622a503e003dc9b667558edc2f9c2f58a072"
   nubusLdapServerDhInitContainer:
     # providerCategory: 'Community'
     # providerResponsible: 'Univention'
@@ -395,7 +403,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "9", "4"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/notifications-api"
-    tag: "0.42.2@sha256:ff744b2d5388bfc413a4d25108f37ba086d2a08cb14ceb02d17e93de003a1078"
+    tag: "0.48.0@sha256:0d633fbe27c153e306b2887e597da138072e3b74218df27fbd27901daed31987"
   nubusOpendeskExtension:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -403,7 +411,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-    tag: "1.7.5@sha256:cc38d339abea18dc3644b7764d7be13798956161d1c87e34b26b5d8b7a11edc6"
+    tag: "1.8.2-trossner-nubus1-3@sha256:d8d7d851233e1360968417844c73b1b3822b4e8876194fd4dc3088112c66530a"
   nubusOpenPolicyAgent:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -433,7 +441,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "27", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-consumer"
-    tag: "0.42.2@sha256:5afee47e4d3d5f8bf51ffca66578a98318f49ee41e8f4b306cb75826b66a1804"
+    tag: "0.48.0@sha256:949b4e47b0f0f2cf8197c080eba709481e09d776a6293669404bceb749ac4a70"
   nubusPortalExtension:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -443,7 +451,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "28", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-extension"
-    tag: "0.38.0@sha256:aa6ec6b99810e05655d98fa1192bc2eabb855335f7a04aa4cd96ed5b5645d736"
+    tag: "0.44.3@sha256:734efc0adda680526dde09387db964612f9e0ab020382580984488cc993c68f0"
   nubusPortalFrontend:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -451,7 +459,7 @@ images:
     # upstreamRepository: "nubus/images/portal-frontend"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus-portal-update"
-    tag: "1.8.1@sha256:dd2c8e16b57d5b2a97f465b15e108231782e3ee2df1cc07cee0388459bf40e1c"
+    tag: "1.10.5@sha256:75461683a2233c2e5c99499791ceb576b717c68baa28eef2c307e7052aaaf754"
   nubusPortalServer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -461,7 +469,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "9", "4"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-server"
-    tag: "0.42.2@sha256:00b45c354c421ad6bc0ee046444cc0a2caf633787c770cad60e7c06c4307a248"
+    tag: "0.48.0@sha256:33860975dac733c1412a7ca0372324a15dc5cd60d73061666744bcab6de5f7c6"
   nubusProvisioningDispatcher:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -471,7 +479,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-dispatcher"
-    tag: "0.44.0@sha256:b7b9ee59c008bd8850bcfb6cb009ae47e6be43ed117116928374c721711b09ca"
+    tag: "0.45.1@sha256:0ba7867e68a3b76a9d094462d17c347839551f46548671c11688a22cc3315e6b"
   nubusProvisioningEventsAndConsumerApi:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -481,7 +489,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-events-and-consumer-api"
-    tag: "0.44.0@sha256:b87218dcd2db7539b786ff479cde9620939274d4365721531dc6075b6fcc19ea"
+    tag: "0.45.1@sha256:9f9d38002da6a9a6f6dc6d08f73055c6636cf63c3c348d7c8830ea8dc20a7766"
   nubusProvisioningPrefill:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -491,7 +499,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-prefill"
-    tag: "0.44.0@sha256:86201a277164ceb9a8df3fd4c7fc28b0185cadf7962a937d88d9feb576e77da2"
+    tag: "0.45.1@sha256:c38bb5c8591fb2fca74cbab742c897f194582c55151cae41bc029cbf64992f6a"
   nubusProvisioningUdmListener:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -501,7 +509,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-listener"
-    tag: "0.44.0@sha256:03c8f03ca0fab92ecd3234d1f3fad3293629feae0123134641dad243f3ca328c"
+    tag: "0.45.1@sha256:09a837ceca9a5f1f5812f8ae242a9427959db9cfa50563a62f6daba9b92ce63d"
   nubusProvisioningUdmTransformer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -511,7 +519,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "14", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-transformer"
-    tag: "0.44.0@sha256:1aca5eaa575ab0ee7b9fa128de30050b748a182b53b7bcdc6293b58187f5416a"
+    tag: "0.45.1@sha256:5fe7addb286230e185a9d688fdf0a4fa4a2602254412d50df340fde76d8adeba"
   nubusSelfServiceConsumer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -521,7 +529,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "3", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-invitation"
-    tag: "0.11.3@sha256:cd51246ae9436426bd7ee12bc85466cafc18a43ba05ab3ede35dfcf3a012656f"
+    tag: "0.12.2@sha256:99ec299e5a57a24f5dc9b437d6a66ae4afbbb23b66b09f7239acac0fd1399d03"
   nubusUdmRestApi:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -531,7 +539,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "9", "3"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/udm-rest-api"
-    tag: "0.25.1@sha256:0078b16ecf5539e6f3c7e6d5a7ddb57937d3d2d143754fbd6d439a3a8741abe8"
+    tag: "0.26.1@sha256:7b5e2fd05ebdd388a9f4af7fb254f95fe120ea6e038e0436070e581b2c0b4abd"
   nubusUmcGateway:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -541,7 +549,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "7", "3"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-gateway"
-    tag: "0.34.1@sha256:ab4ffccc182bae115dc8f264c051f1c23102b1416ac00709d95285218829ce39"
+    tag: "0.35.4@sha256:940b71bda766deb1325b2728845b669a61b511c3339976def588ec3488c69f77"
   nubusUmcServer:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -551,7 +559,7 @@ images:
     # upstreamMirrorStartFrom: ["0", "7", "3"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-server"
-    tag: "0.34.1@sha256:4addb518b7b622f0e82dbdde30bbb8d8da6cc197528268d2ad856635f3bbe64a"
+    tag: "0.35.4@sha256:5f6bed0b01df14eb5a8457a9109c1d87eb49c682ef818dc07c73009f7e7a0bdc"
   nubusUmcServerProxy:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -587,7 +595,7 @@ images:
     # upstreamMirrorStartFrom: ["13", "1", "1"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "15.0.2@sha256:b476947e8cbd5e0ed15aaa38ee49a76920015dbcb530b3dd11b32a95f9119c08"
+    tag: "15.0.3@sha256:286cc75712446b832b42e0fa6610dfb01996c491f22db98ba77b1137b2611cd4"
   openprojectBootstrap:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -611,7 +619,7 @@ images:
     # upstreamRepository: "alpine/k8s"
     registry: "registry-1.docker.io"
     repository: "alpine/k8s"
-    tag: "1.26.8@sha256:acde24d2a8ebaafda76f464591a5ddc7d0acd08bb38b12560961c1b1c4fc85ec"
+    tag: "1.31.3@sha256:77812543abe5649b286d5f0dc17a7dbaa4056433225f6f695150f329cb4b6803"
   openxchangeCoreGuidedtours:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -757,16 +765,15 @@ images:
     # upstreamMirrorStartFrom: ["8922"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/prosody"
-    tag: "stable-9779@sha256:5864f3f72d3605a52a1b90ec845a4a1837a851d7774dcbfdc9490beb4bdda18a"
+    tag: "stable-9823@sha256:1c52b4ca8397545d54067c67a54c50473d83242c75f001fbf20ee628dfc80b7b"
   redis:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
     # upstreamRegistry: "https://registry-1.docker.io"
     # upstreamRepository: "bitnami/redis"
-    # WE ARE STUCK WITH <7.4 because of https://redis.com/blog/redis-adopts-dual-source-available-licensing/
     registry: "registry-1.docker.io"
     repository: "bitnami/redis"
-    tag: "7.2.3-debian-11-r2@sha256:9ac3bbf7740969d32689e360ddcfa5f672538c47f6f6cf296173c3078de0edf2"
+    tag: "7.4.1-debian-12-r2@sha256:3cfa11e8fef45c006a101ed7cfaae2cdaed7a5167c8ada2a3f76a1de54488cd0"
   synapse:
     # providerCategory: "Supplier"
     # providerResponsible: "Element"
@@ -776,7 +783,7 @@ images:
     # upstreamMirrorStartFrom: ["1", "91", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse"
-    tag: "v1.115.0@sha256:abf4a5b5b2030f7deb555a8ec7b945607db9e98b057eb06364e66ba8308bdd40"
+    tag: "v1.120.2@sha256:daee887fa4ca6370e297439bb33a61896ff3413c9454540446a94e461f097d33"
   synapseCreateUser:
     # providerCategory: "Community"
     # providerResponsible: "Nordeck"
@@ -784,7 +791,7 @@ images:
     # upstreamRepository: "alpine/k8s"
     registry: "registry-1.docker.io"
     repository: "alpine/k8s"
-    tag: "1.30.0@sha256:d7a11b7032550e992667fd7725b039dcd639270fbceec368d7e66e3d9e41ee15"
+    tag: "1.31.3@sha256:77812543abe5649b286d5f0dc17a7dbaa4056433225f6f695150f329cb4b6803"
   synapseGuestModule:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"

helmfile/environments/default/ingress.yaml.gotmpl

@@ -13,13 +13,13 @@ ingress:
       element: "100M"
       nextcloud: "100M"
       openproject: "100M"
-      openXchangeAppSuite: "100M"
+      oxAppSuite: "100M"
       xwiki: "100M"
     bodyTimeout:
       collabora: 600
       element: 60
       nextcloud: 600
       openproject: 60
-      openXchangeAppSuite: 60
+      oxAppSuite: 60
       xwiki: 60
 ...

helmfile/environments/default/monitoring.yaml.gotmpl

@@ -13,6 +13,7 @@ monitoring:
         release: "kube-prometheus-stack"
     prometheusRules:
       enabled: false
+      annotations: {}
       labels:
         release: "kube-prometheus-stack"