fix(nubus): OX Connector kyverno errors

fix(nextcloud): Update Chart to 3.6.1 and Image to 2.3.3 (including rollback to 29.0.8). Introducing setting for functional.filestore.sharing.external.sendPasswordMail
fix(helmfile): Streamline commonLabels.deployStage.
2025-12-06 07:21:36 +01:00 · 2024-12-02 13:12:24 +00:00 · 2024-12-02 12:07:05 +01:00 · 2024-11-29 12:20:15 +01:00 · 2024-11-29 06:24:38 +01:00 · 2024-11-28 15:07:25 +01:00
49 changed files with 732 additions and 352 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -36,17 +36,18 @@ stages:
  - "env-cleanup"
  - "env"
  - "pre-services-deploy"
-  - "migrations-pre"
-  - "basic-services-deploy"
-  - "component-deploy-stage-1"
-  - "component-deploy-stage-2"
-  - "migrations-post"
+  - "010-migrations-pre"
+  - "030-services"
+  - "050-components"
+  - "060-components"
+  - "090-migrations-post"
  - "lint"
  - "tests"
  - "env-stop"
  - ".post"

 variables:
+  RELEASE_BRANCH: "main"
  NAMESPACE:
    description: "The name of namespaces to deploy to."
    value: ""
@@ -277,7 +278,7 @@ policies-deploy:
    ADDITIONAL_ARGS: "-l name=opendesk-otterize"

 migrations-pre:
-  stage: "migrations-pre"
+  stage: "010-migrations-pre"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -289,7 +290,7 @@ migrations-pre:
    COMPONENT: "migrations-pre"

 migrations-post:
-  stage: "migrations-post"
+  stage: "090-migrations-post"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -301,7 +302,7 @@ migrations-post:
    COMPONENT: "migrations-post"

 services-deploy:
-  stage: "basic-services-deploy"
+  stage: "030-services"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -313,7 +314,7 @@ services-deploy:
    COMPONENT: "services"

 nubus-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -325,7 +326,7 @@ nubus-deploy:
    COMPONENT: "nubus"

 ox-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  timeout: "30m"
  rules:
@@ -338,7 +339,7 @@ ox-deploy:
    COMPONENT: "open-xchange"

 xwiki-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -350,7 +351,7 @@ xwiki-deploy:
    COMPONENT: "xwiki"

 collabora-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -362,7 +363,7 @@ collabora-deploy:
    COMPONENT: "collabora"

 cryptpad-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -374,7 +375,7 @@ cryptpad-deploy:
    COMPONENT: "cryptpad"

 nextcloud-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -386,7 +387,7 @@ nextcloud-deploy:
    COMPONENT: "nextcloud"

 openproject-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -398,7 +399,7 @@ openproject-deploy:
    COMPONENT: "openproject"

 openproject-bootstrap-deploy:
-  stage: "component-deploy-stage-2"
+  stage: "060-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -410,7 +411,7 @@ openproject-bootstrap-deploy:
    COMPONENT: "openproject-bootstrap"

 jitsi-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -422,7 +423,7 @@ jitsi-deploy:
    COMPONENT: "jitsi"

 element-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
  extends: ".deploy-common"
  rules:
    - if: >
@@ -489,7 +490,7 @@ avscan-prepare:
  rules:
    - if: >
          $JOB_AVSCAN_ENABLED != 'false' &&
-          $CI_COMMIT_BRANCH == 'main' &&
+          $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
          $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "always"
    - when: "never"
@@ -539,7 +540,7 @@ avscan-start:
  rules:
    - if: >
        $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == 'main' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "always"
    - when: "never"
@@ -585,7 +586,7 @@ generate-release-version:
  rules:
    - if: >
        $JOB_RELEASE_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "on_success"

@@ -593,7 +594,7 @@ release:
  rules:
    - if: >
        $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "on_success"
  script:
@@ -621,7 +622,7 @@ release:
    - |
      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
      {
-        "branches": ["main"],
+        "branches": ["${RELEASE_BRANCH}"],
        "plugins": [
          "@semantic-release/gitlab",
          "@semantic-release/release-notes-generator",
--- a/.gitlab/generate/generate-docs.yml
+++ b/.gitlab/generate/generate-docs.yml
@@ -13,7 +13,7 @@ generate-docs:
  extends: ".generate-common"
  image: "${OPENDESK_CI_CLI_IMAGE}"
  rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $RELEASE_BRANCH"
      when: "on_success"
  script:
    - "node /app/src/index.js generate-docs -d ${CI_PROJECT_DIR}"
--- a/README.md
+++ b/README.md
@@ -31,12 +31,12 @@ openDesk currently features the following functional main components:
 | -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                         |
 | Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                         |
-| File management      | Nextcloud                   | [29.0.9](https://nextcloud.com/de/changelog/#29-0-9)                                  | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                         |
+| File management      | Nextcloud                   | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8)                                  | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                         |
 | Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
 | Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                    |
 | Portal & IAM         | Nubus                       | [1.0](https://www.univention.de/produkte/nubus/)                                      | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                            |
 | Project management   | OpenProject                 | [15.0.2](https://www.openproject.org/docs/release-notes/15-0-2/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                          |
-| Videoconferencing    | Jitsi                       | [2.0.9779](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9779) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                           |
+| Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                           |
 | Weboffice            | Collabora                   | [24.04.7.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)       |

 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
--- a/docs/components.md
+++ b/docs/components.md
@@ -27,28 +27,28 @@ openDesk consists of a variety of open-source projects. Here is a list with the
 Components of type `Eval` are used for development and evaluation purposes only,
 they need to be replaced in production deployments.

-| Component                   | Description                    | Type       |
-|-----------------------------|--------------------------------|------------|
-| Certificates                | TLS certificates               | Eval       |
-| ClamAV (Distributed)        | Antivirus engine               | Eval       |
-| ClamAV (Simple)             | Antivirus engine               | Eval       |
-| Collabora                   | Weboffice                      | Functional |
-| CryptPad                    | Weboffice                      | Functional |
-| dkimpy-milter               | DKIM milter for Postfix        | Eval       |
-| Element                     | Secure communications platform | Functional |
-| Jitsi                       | Videoconferencing              | Functional |
-| MariaDB                     | Database                       | Eval       |
-| Memcached                   | Cache Database                 | Eval       |
-| MinIO                       | Object Storage                 | Eval       |
-| Nextcloud                   | File share                     | Functional |
-| Nubus (UMS)                 | Identity Management & Portal   | Functional |
-| OpenProject                 | Project management             | Functional |
-| OX Appsuite                 | Groupware                      | Functional |
-| OX Dovecot                  | Mail backend (IMAP)            | Functional |
-| Postfix                     | MTA                            | Eval       |
-| PostgreSQL                  | Database                       | Eval       |
-| Redis                       | Cache Database                 | Eval       |
-| XWiki                       | Knowledge Management           | Functional |
+| Component            | Description                    | Type       |
+| -------------------- | ------------------------------ | ---------- |
+| Certificates         | TLS certificates               | Eval       |
+| ClamAV (Distributed) | Antivirus engine               | Eval       |
+| ClamAV (Simple)      | Antivirus engine               | Eval       |
+| Collabora            | Weboffice                      | Functional |
+| CryptPad             | Weboffice                      | Functional |
+| dkimpy-milter        | DKIM milter for Postfix        | Eval       |
+| Element              | Secure communications platform | Functional |
+| Jitsi                | Videoconferencing              | Functional |
+| MariaDB              | Database                       | Eval       |
+| Memcached            | Cache Database                 | Eval       |
+| MinIO                | Object Storage                 | Eval       |
+| Nextcloud            | File share                     | Functional |
+| Nubus (UMS)          | Identity Management & Portal   | Functional |
+| OpenProject          | Project management             | Functional |
+| OX App Suite         | Groupware                      | Functional |
+| OX Dovecot           | Mail backend (IMAP)            | Functional |
+| Postfix              | MTA                            | Eval       |
+| PostgreSQL           | Database                       | Eval       |
+| Redis                | Cache Database                 | Eval       |
+| XWiki                | Knowledge Management           | Functional |

 # Component integration

--- a/docs/enhanced-configuration/groupware-migration.md
+++ b/docs/enhanced-configuration/groupware-migration.md
@@ -6,7 +6,6 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Migration from M365 with audriga migration service and master authentication</h1>

 <!-- TOC -->
-* [Context](#context)
 * [Prerequisites](#prerequisites)
  * [Prepare M365 tenant for access](#prepare-m365-tenant-for-access)
  * [Provisioning user accounts in openDesk](#provisioning-user-accounts-in-opendesk)
@@ -75,18 +74,18 @@ With openDesk 1.0 Enterprise, you can set openDesk's email components (OX AppSui

 ```
 secrets:
-  oxAppsuite:
+  oxAppSuite:
    adminPassword: "your_temporary_master_password"
 functional:
  migration:
-    oxAppsuite:
+    oxAppSuite:
      enabled: true
 ```

 1. You must specify the master password referenced in the document's following sections.
 2. You need to enable the actual master authentication mode.

-Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppsuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppsuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
+Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppSuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppSuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.

 > **Note**<br>
 > For the changes to take effect, it is sufficient to deploy the `open-xchange` component.
--- a/docs/external-services.md
+++ b/docs/external-services.md
@@ -18,59 +18,59 @@ This document will cover the additional configuration for external services like
 When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.

-| Component   | Name               | Type       | Parameter | Key                                      | Default                    |
-|-------------|--------------------|------------|-----------|------------------------------------------|----------------------------|
-| Element     | Synapse            | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.synapse.name` | `matrix` |
-|             |                    |            | Host      | `databases.synapse.host` | `postgresql` |
-|             |                    |            | Port      | `databases.synapse.port` | `5432` |
-|             |                    |            | Username  | `databases.synapse.username` | `matrix_user` |
-|             |                    |            | Password  | `databases.synapse.password` |                            |
-| Keycloak    | Keycloak           | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloak.name` | `keycloak` |
-|             |                    |            | Host      | `databases.keycloak.host` | `postgresql` |
-|             |                    |            | Port      | `databases.keycloak.port` | `5432` |
-|             |                    |            | Username  | `databases.keycloak.username` | `keycloak_user` |
-|             |                    |            | Password  | `databases.keycloak.password` |                            |
-|             | Keycloak Extension | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloakExtension.name` | `keycloak_extensions` |
-|             |                    |            | Host      | `databases.keycloakExtension.host` | `postgresql` |
-|             |                    |            | Port      | `databases.keycloakExtension.port` | `5432` |
-|             |                    |            | Username  | `databases.keycloakExtension.username` | `keycloak_extensions_user` |
-|             |                    |            | Password  | `databases.keycloakExtension.password` |                            |
-| UMS         | Notifications API  | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsNotificationsApi.name` | `notificationsapi` |
-|             |                    |            | Host      | `databases.umsNotificationsApi.host` | `postgresql` |
-|             |                    |            | Port      | `databases.umsNotificationsApi.port` | `5432` |
-|             |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user` |
-|             |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
-|             | Self Service       | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsSelfservice.name` | `selfservice` |
-|             |                    |            | Host      | `databases.umsSelfservice.host` | `postgresql` |
-|             |                    |            | Port      | `databases.umsSelfservice.port` | `5432` |
-|             |                    |            | Username  | `databases.umsSelfservice.username` | `selfservice_user` |
-|             |                    |            | Password  | `databases.umsSelfservice.password` |                            |
-| Nextcloud   | Nextcloud          | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.nextcloud.name` | `nextcloud` |
-|             |                    |            | Host      | `databases.nextcloud.host` | `mariadb` |
-|             |                    |            | Username  | `databases.nextcloud.username` | `nextcloud_user` |
-|             |                    |            | Password  | `databases.nextcloud.password` |                            |
-| OpenProject | OpenProject        | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.openproject.name` | `openproject` |
-|             |                    |            | Host      | `databases.openproject.host` | `postgresql` |
-|             |                    |            | Port      | `databases.openproject.port` | `5432` |
-|             |                    |            | Username  | `databases.openproject.username` | `openproject_user` |
-|             |                    |            | Password  | `databases.openproject.password` |                            |
-| OX Appsuite | OX Appsuite        | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.oxAppsuite.name` | `CONFIGDB` |
-|             |                    |            | Host      | `databases.oxAppsuite.host` | `mariadb` |
-|             |                    |            | Username  | `databases.oxAppsuite.username` | `root` |
-|             |                    |            | Password  | `databases.oxAppsuite.password` |                            |
-| XWiki       | XWiki              | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.xwiki.name` | `xwiki` |
-|             |                    |            | Host      | `databases.xwiki.host` | `mariadb` |
-|             |                    |            | Username  | `databases.xwiki.username` | `xwiki_user` |
-|             |                    |            | Password  | `databases.xwiki.password` |                            |
+| Component    | Name               | Type       | Parameter | Key                                      | Default                    |
+| ------------ | ------------------ | ---------- | --------- | ---------------------------------------- | -------------------------- |
+| Element      | Synapse            | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
+|              |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
+|              |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
+|              |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
+|              |                    |            | Password  | `databases.synapse.password`             |                            |
+| Keycloak     | Keycloak           | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
+|              |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
+|              |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
+|              |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
+|              |                    |            | Password  | `databases.keycloak.password`            |                            |
+|              | Keycloak Extension | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
+|              |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
+|              |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
+|              |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
+|              |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
+| UMS          | Notifications API  | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
+|              |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
+|              |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
+|              |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
+|              |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
+|              | Self Service       | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
+|              |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
+|              |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
+|              |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
+|              |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
+| Nextcloud    | Nextcloud          | MariaDB    |           |                                          |                            |
+|              |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
+|              |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
+|              |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
+|              |                    |            | Password  | `databases.nextcloud.password`           |                            |
+| OpenProject  | OpenProject        | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
+|              |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
+|              |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
+|              |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
+|              |                    |            | Password  | `databases.openproject.password`         |                            |
+| OX App Suite | OX App Suite       | MariaDB    |           |                                          |                            |
+|              |                    |            | Name      | `databases.oxAppSuite.name`              | `CONFIGDB`                 |
+|              |                    |            | Host      | `databases.oxAppSuite.host`              | `mariadb`                  |
+|              |                    |            | Username  | `databases.oxAppSuite.username`          | `root`                     |
+|              |                    |            | Password  | `databases.oxAppSuite.password`          |                            |
+| XWiki        | XWiki              | MariaDB    |           |                                          |                            |
+|              |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
+|              |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
+|              |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
+|              |                    |            | Password  | `databases.xwiki.password`               |                            |

 # Object storage

--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -78,15 +78,15 @@ All subdomains can be customized. For example, _Nextcloud_ can be changed to `fi

 ```yaml
 global:
-  hosts:
-    nextcloud: "files"
+  hosts:
+    nextcloud: "files"
 ```

 The domain has to be set either via `dev` environment

 ```yaml
 global:
-  domain: "domain.tld"
+  domain: "domain.tld"
 ```

 or via environment variable
@@ -97,7 +97,7 @@ export DOMAIN=domain.tld

 ### Apps

-All available apps and their default value are in `helmfile/environments/default/workplace.yaml`.
+All available apps and their default value are in `helmfile/environments/default/opendesk_main.gotmpl`.

 | Component            | Name                        | Default | Description                    |
 | -------------------- | --------------------------- | ------- | ------------------------------ |
@@ -106,8 +106,10 @@ All available apps and their default value are in `helmfile/environments/default
 | ClamAV (Simple)      | `clamavSimple.enabled`      | `true`  | Antivirus engine               |
 | Collabora            | `collabora.enabled`         | `true`  | Weboffice                      |
 | CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
+| dkimpy               | `dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
 | Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
 | Element              | `element.enabled`           | `true`  | Secure communications platform |
+| Home                 | `home.enabled`              | `true`  | Base domain portal redirect    |
 | Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
 | MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
 | Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
@@ -115,7 +117,7 @@ All available apps and their default value are in `helmfile/environments/default
 | Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
 | Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
 | OpenProject          | `openproject.enabled`       | `true`  | Project management             |
-| OX Appsuite          | `oxAppsuite.enabled`        | `true`  | Groupware                      |
+| OX App Suite         | `oxAppSuite.enabled`        | `true`  | Groupware                      |
 | Postfix              | `postfix.enabled`           | `true`  | MTA                            |
 | PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
 | Redis                | `redis.enabled`             | `true`  | Cache Database                 |
@@ -125,7 +127,7 @@ Exemplary, Jitsi can be disabled like:

 ```yaml
 jitsi:
-  enabled: false
+  enabled: false
 ```

 ## Private registries
@@ -145,7 +147,7 @@ prefer the use of a private image registry, you can configure such for

 ```yaml
 global:
-  imageRegistry: "my_private_registry.domain.tld"
+  imageRegistry: "my_private_registry.domain.tld"
 ```

 alternatively, you can use an environment variable:
@@ -158,16 +160,16 @@ or control repository override fine-granular per registry:

 ```yaml
 repositories:
-  image:
-    dockerHub: "my_private_registry.domain.tld/docker.io/"
-    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
+  image:
+    dockerHub: "my_private_registry.domain.tld/docker.io/"
+    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
 ```

 If authentication is required, you can reference `imagePullSecrets` as follows:

 ```yaml
 global:
-  imagePullSecrets:
+  imagePullSecrets:
    - "external-registry"
 ```

@@ -182,8 +184,8 @@ used:

 ```yaml
 cluster:
-  service:
-    type: "NodePort"
+  service:
+    type: "NodePort"
 ```

 ### Networking
@@ -192,16 +194,16 @@ If your cluster has not the default `cluster.local` domain configured, you need

 ```yaml
 cluster:
-  networking:
-    domain: "acme.internal"
+  networking:
+    domain: "acme.internal"
 ```

 If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via the following:

 ```yaml
 cluster:
-  networking:
-    cidr:
+  networking:
+    cidr:
      - "127.0.0.0/8"
 ```

@@ -210,8 +212,8 @@ explicitly configure the related IPs or IP ranges:

 ```yaml
 cluster:
-  networking:
-    incomingCIDR:
+  networking:
+    incomingCIDR:
      - "172.16.0.0/12"
 ```

@@ -223,7 +225,7 @@ setting the following attribute to the name of the currently only supported ingr

 ```yaml
 ingress:
-  ingressClassName: "name-of-my-nginx-ingress"
+  ingressClassName: "name-of-my-nginx-ingress"
 ```

 ### Container runtime
@@ -233,8 +235,8 @@ Some apps require specific configurations for the container runtime. You can set

 ```yaml
 cluster:
-  container:
-    engine: "containerd"
+  container:
+    engine: "containerd"
 ```

 ### Volumes
@@ -244,17 +246,17 @@ default, only `ReadWriteOnce` is enabled. To enable `ReadWriteMany` you can set:

 ```yaml
 cluster:
-  persistence:
-    readWriteMany: true
+  persistence:
+    readWriteMany: true
 ```

 The **StorageClass** can be set by:

 ```yaml
 persistence:
-  storageClassNames:
-    RWX: "my-read-write-many-class"
-    RWO: "my-read-write-once-class"
+  storageClassNames:
+    RWX: "my-read-write-many-class"
+    RWO: "my-read-write-once-class"
 ```

 ## Connectivity
@@ -267,22 +269,22 @@ persistence:

 To use the openDesk functionality with its web-based user interface, you need to expose the following ports publicly:

-| Component          | Description             |  Port | Type |
+| Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
-| openDesk           | Kubernetes Ingress      |    80 |  TCP |
-| openDesk           | Kubernetes Ingress      |   443 |  TCP |
-| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
+| openDesk           | Kubernetes Ingress      |    80 |  TCP |
+| openDesk           | Kubernetes Ingress      |   443 |  TCP |
+| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |

 #### Mail clients

 To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need public exposure:

-| Component          | Description             |  Port | Type |
+| Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
-| Dovecot            | IMAPS                   |   993 |  TCP |
-|                    | POP3S                   |   995 |  TCP |
-| Postfix            | SMTP                    |    25 |  TCP |
-|                    | SMTPS                   |   587 |  TCP |
+| Dovecot            | IMAPS                   |   993 |  TCP |
+|                    | POP3S                   |   995 |  TCP |
+| Postfix            | SMTP                    |    25 |  TCP |
+|                    | SMTPS                   |   587 |  TCP |

 ### Mail/SMTP configuration

@@ -291,9 +293,9 @@ the whole subdomain.

 ```yaml
 smtp:
-  host: "mail.open.desk"
-  username: "openDesk"
-  password: "secret"
+  host: "mail.open.desk"
+  username: "openDesk"
+  password: "secret"
 ```

 Enabling DKIM signing of emails helps to reduce spam and increases trust.
@@ -301,12 +303,12 @@ openDesk ships dkimpy-milter as Postfix milter for signing emails.

 ```yaml
 dkimpy:
-  enable: true
-  dkim:
-    key:
-      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
-    selector: "default"
-    useED25519: true # when false, RSA is used
+  enable: true
+  dkim:
+    key:
+      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
+    selector: "default"
+    useED25519: true # when false, RSA is used
 ```

 ### TURN configuration
@@ -316,14 +318,14 @@ these options:

 ```yaml
 turn:
-  transport: "udp" # or tcp
-  credentials: "secret"
-  server:
-    host: "turn.open.desk"
-    port: "3478"
-  tls:
-    host: "turns.open.desk"
-    port: "5349"
+  transport: "udp" # or tcp
+  credentials: "secret"
+  server:
+    host: "turn.open.desk"
+    port: "3478"
+  tls:
+    host: "turns.open.desk"
+    port: "5349"
 ```

 ### Certificate issuer
@@ -334,7 +336,7 @@ turn off `Certificate` resource creation by:

 ```yaml
 certificates:
-  enabled: false
+  enabled: false
 ```

 If you want to leverage the `cert-manager.io` to handle certificates, like `Let's encrypt`, you need to provide the
@@ -342,15 +344,15 @@ configured cluster issuer:

 ```yaml
 certificate:
-  issuerRef:
-    name: "letsencrypt-prod"
+  issuerRef:
+    name: "letsencrypt-prod"
 ```

 Additionally, it is possible to request wildcard certificates by:

 ```yaml
 certificate:
-  wildcard: true
+  wildcard: true
 ```

 ## Password seed
@@ -456,7 +458,7 @@ NAMESPACE=your-namespace

 # Uninstall all Helm charts
 for OPENDESK_RELEASE in $(helm ls -n ${NAMESPACE} -aq); do
-  helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
+  helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
 done

 # Delete leftover resources
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -9,6 +9,11 @@ SPDX-License-Identifier: Apache-2.0
 * [Disclaimer](#disclaimer)
 * [openDesk supported upgrade path](#opendesk-supported-upgrade-path)
 * [Releases upgrade details](#releases-upgrade-details)
+  * [From v1.0.0](#from-v100)
+    * [Pre-upgrade: Manual checks/steps](#pre-upgrade-manual-checkssteps)
+      * [Streamlining `openxchange` and `oxAppSuite` attribute names.](#streamlining-openxchange-and-oxappsuite-attribute-names)
+      * [Dicts to define `customization.release`](#dicts-to-define-customizationrelease)
+      * [Redis 7.4](#redis-74)
  * [From v0.9.0](#from-v090)
    * [Pre-upgrade: Manual steps](#pre-upgrade-manual-steps)
      * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
@@ -54,11 +59,105 @@ Explanation of the table's columns:
 | Coming from   | Mandatory (minimum) release | Automatic migration                                                                                                                                           | Manual activities             |
 | ------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
 | v0.9.0        | v1.x.x                      | [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_2.py) | See [From v0.9.0](#from-v090) |
-| v0.8.1        | v0.9.0                      | Initializes migration system                                                                                                                                  | See [From v0.8.1](#from-v081)     |
+| v0.8.1        | v0.9.0                      | Initializes migration system                                                                                                                                  | See [From v0.8.1](#from-v081) |
 | not supported | v0.8.1                      | First release that supporting updates                                                                                                                         |                               |

 # Releases upgrade details

+## From v1.0.0
+
+### Pre-upgrade: Manual checks/steps
+
+#### Streamlining `openxchange` and `oxAppSuite` attribute names.
+
+We have updated some attribute names around Open-Xchange / OX App Suite to be consistent within our Helmfile
+deployment and to aligning with the actual brand names as well as with our rule of thumb for brand based
+attribute names[^1].
+
+In case you are using any of the customizations below (`WAS`), please update as shown (`NOW`):
+
+```
+WAS: oxAppsuite: ...
+NOW: oxAppSuite: ...
+```
+
+```
+WAS: cache.oxAppsuite: ...
+NOW: cache.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuite: ...
+NOW: charts.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuiteBootstrap: ...
+NOW: charts.oxAppSuiteBootstrap: ...
+```
+
+```
+WAS: customization.release.openXchange: ...
+NOW: customization.release.openxchange: ...
+```
+
+```
+WAS: customization.release.opendeskOpenXchangeBootstrap: ...
+NOW: customization.release.opendeskOpenxchangeBootstrap: ...
+```
+
+```
+WAS: databases.oxAppsuite: ...
+NOW: databases.oxAppSuite: ...
+```
+
+```
+WAS: ingress.parameters.openXchangeAppSuite: ...
+NOW: ingress.parameters.oxAppSuite: ...
+```
+
+```
+WAS: ingress.bodyTimeout.openXchangeAppSuite: ...
+NOW: ingress.bodyTimeout.oxAppSuite: ...
+```
+
+```
+WAS: migration.oxAppsuite: ...
+NOW: migration.oxAppSuite: ...
+```
+
+```
+WAS: secrets.oxAppsuite: ...
+NOW: secrets.oxAppSuite: ...
+```
+
+#### Dicts to define `customization.release`
+
+If you make use of the `customization.release` option, you have to switch to a dictionary based definition of customization files e.g. from
+
+```
+customization:
+  release:
+    collaboraOnline: "./my_custom_templating.yaml"
+```
+
+to
+
+```
+customization:
+  release:
+    collaboraOnline:
+      file1: "./my_custom_templating.yaml"
+```
+
+You can freely choose the `file1` dictionary key used in the example above, but it should start with a letter.
+
+#### Redis 7.4
+
+The update from openDesk 1.0.0 contains Redis 7.4.1, like the other openDesk bundled services the bundled Redis is as well not meant to be used in production.
+
+Please ensure for the Redis you are using that it is updated to at least 7.4 to support the requirement of OX App Suite.
+
 ## From v0.9.0

 ### Pre-upgrade: Manual steps
@@ -311,3 +410,6 @@ When a new upgrade migration is required, ensure to address the following list:
 - You most likely have to update the [`opendesk-migrations` Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations) within the `rules` section of the [`role.yaml`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/templates/role.yaml) to provide the permissions required for the execution of your migration's logic.
 - You must set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
 - Update the [`charts.yaml`](../helmfile/environments/default/charts.yaml) and [`images.yaml`](../helmfile/environments/default/images.yaml) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
+
+[^1]: We do not follow a brand name's specific spelling when it comes to upper and lower case and only use new word
+uppercase when names consist of multiple, space divided words.
--- a/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
@@ -18,10 +18,12 @@ releases:
    version: "{{ .Values.charts.collabora.version }}"
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.collaboraOnline | default "additionalValues: false" }}
+      {{ range .Values.customization.release.collaboraOnline }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.collabora.enabled }}

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "collabora"
 ...
--- a/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
@@ -18,10 +18,12 @@ releases:
    version: "{{ .Values.charts.cryptpad.version }}"
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.cryptpad | default "additionalValues: false" }}
+      {{ range .Values.customization.release.cryptpad }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.cryptpad.enabled }}

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "cryptpad"
 ...
--- a/helmfile/apps/element/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/element/helmfile-child.yaml.gotmpl
@@ -80,12 +80,20 @@ repositories:
    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"

 releases:
+  # During upgrade 1.0.0 -> 1.1.0 the chart 'opendesk-element' has been moved to 'opendesk-element-web'
  - name: "opendesk-element"
    chart: "element-repo/{{ .Values.charts.element.name }}"
    version: "{{ .Values.charts.element.version }}"
+    installed: false
+
+  - name: "opendesk-element-web"
+    chart: "element-repo/{{ .Values.charts.elementWeb.name }}"
+    version: "{{ .Values.charts.elementWeb.version }}"
    values:
      - "values-element.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskElement | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskElement }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -94,7 +102,9 @@ releases:
    version: "{{ .Values.charts.elementWellKnown.version }}"
    values:
      - "values-well-known.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskWellKnown | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskWellKnown }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -103,7 +113,9 @@ releases:
    version: "{{ .Values.charts.synapseWeb.version }}"
    values:
      - "values-synapse-web.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskSynapseWeb | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskSynapseWeb }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -112,7 +124,9 @@ releases:
    version: "{{ .Values.charts.synapse.version }}"
    values:
      - "values-synapse.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskSynapse | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskSynapse }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.element.enabled }}
    timeout: 900

@@ -173,6 +187,6 @@ releases:
    timeout: 900

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "element"
 ...
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -27,9 +27,26 @@ configuration:

  database:
    host: {{ .Values.databases.synapse.host | quote }}
+    port: {{ .Values.databases.synapse.port }}
    name: {{ .Values.databases.synapse.name | quote }}
    user: {{ .Values.databases.synapse.username | quote }}
-    password: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    password:
+      value: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    requireAuth: {{ .Values.databases.synapse.requireAuth }}
+    channelBinding: {{ .Values.databases.synapse.channelBinding | quote }}
+    connectTimeout: {{ .Values.databases.synapse.connectTimeout }}
+    clientEncoding: {{ .Values.databases.synapse.clientEncoding | quote }}
+    keepalives: {{ .Values.databases.synapse.keepalives }}
+    keepalivesIdle: {{ .Values.databases.synapse.keepalivesIdle }}
+    keepalivesInterval: {{ .Values.databases.synapse.keepalivesInterval }}
+    keepalivesCount: {{ .Values.databases.synapse.keepalivesCount }}
+    replication: {{ .Values.databases.synapse.replication }}
+    gssencmode: {{ .Values.databases.synapse.gssencmode | quote }}
+    sslmode: {{ .Values.databases.synapse.sslmode | quote }}
+    sslcompression: {{ .Values.databases.synapse.sslcompression }}
+    sslMinProtocolVersion: {{ .Values.databases.synapse.sslMinProtocolVersion | quote }}
+    connectionPoolMin: {{ .Values.databases.synapse.connectionPoolMin }}
+    connectionPoolMax: {{ .Values.databases.synapse.connectionPoolMax }}

  homeserver:
    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
@@ -43,8 +60,8 @@ configuration:
              regex: "@.*"
        url: null
        sender_localpart: intercom-service
-      - as_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
-        hs_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+      - as_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
        id: ox-appsuite
        namespaces:
          users:
--- a/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
@@ -18,11 +18,13 @@ releases:
    version: "{{ .Values.charts.jitsi.version }}"
    values:
      - "values-jitsi.yaml.gotmpl"
-      - {{ .Values.customization.release.jitsi | default "additionalValues: false" }}
+      {{ range .Values.customization.release.jitsi }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.jitsi.enabled }}
    timeout: 900

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "jitsi"
 ...
--- a/helmfile/apps/migrations-post/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/migrations-post/helmfile-child.yaml.gotmpl
@@ -21,11 +21,13 @@ releases:
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
-      - {{ .Values.customization.release.migrationsPost | default "additionalValues: false" }}
+      {{ range .Values.customization.release.migrationsPost }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.migrations.enabled }}
    timeout: 900

 commonLabels:
-  deploy-stage: "component-0"
-  component: "opendesk-migrations"
+  deployStage: "090-migrations-post"
+  component: "migrations-post"
 ...
--- a/helmfile/apps/migrations-pre/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/migrations-pre/helmfile-child.yaml.gotmpl
@@ -21,11 +21,13 @@ releases:
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
-      - {{ .Values.customization.release.migrationsPre | default "additionalValues: false" }}
+      {{ range .Values.customization.release.migrationsPre }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.migrations.enabled }}
    timeout: 900

 commonLabels:
-  deploy-stage: "component-0"
-  component: "opendesk-migrations"
+  deployStage: "010-migrations-pre"
+  component: "migrations-pre"
 ...
--- a/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
@@ -25,7 +25,9 @@ releases:
    version: "{{ .Values.charts.nextcloudManagement.version }}"
    values:
      - "values-nextcloud-mgmt.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskNextcloudManagement | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskNextcloudManagement }}
+      - {{ . }}
+      {{ end }}
    waitForJobs: true
    wait: true
    installed: {{ .Values.nextcloud.enabled }}
@@ -35,12 +37,14 @@ releases:
    version: "{{ .Values.charts.nextcloud.version }}"
    values:
      - "values-nextcloud.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskNextcloud | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskNextcloud }}
+      - {{ . }}
+      {{ end }}
    needs:
      - "opendesk-nextcloud-management"
    installed: {{ .Values.nextcloud.enabled }}

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "nextcloud"
 ...
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -19,34 +19,44 @@ cleanup:

 configuration:
  administrator:
+    # The admin user is (currently) required to bootstrap the OpenProject <> Nextcloud integration.
+    enabled: true
    username:
      value: "nextcloud"
    password:
      value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
  antivirus:
+    {{- if .Values.antivirus.icap.host }}
+    host: {{ .Values.antivirus.icap.host | quote }}
+    port: {{ .Values.antivirus.icap.port | quote }}
+    {{- else }}
    {{- if .Values.clamavDistributed.enabled }}
    host: "clamav-icap"
    {{- else if .Values.clamavSimple.enabled }}
    host: "clamav-simple"
    {{- end }}
+    port: 1344
+    {{- end }}
  cache:
    auth:
      enabled: true
      username:
-        value: "default"
+        value: {{ .Values.cache.nextcloud.username }}
      password:
        value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
    host: {{ .Values.cache.nextcloud.host | quote }}
    port: {{ .Values.cache.nextcloud.port | quote }}
+    tls: {{ .Values.cache.nextcloud.tls }}
  collabora:
    # internalWopiUrl: ""
    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
  database:
    host: {{ .Values.databases.nextcloud.host | quote }}
    port: {{ .Values.databases.nextcloud.port | quote }}
+    name: {{ .Values.databases.nextcloud.name | quote }}
    auth:
      username:
-        value: "nextcloud_user"
+        value: {{ .Values.databases.nextcloud.username | quote }}
      password:
        value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
  ldap:
@@ -89,6 +99,7 @@ configuration:
    defaultExternalExpireEnabled: {{ .Values.functional.filestore.sharing.external.expiry.activeByDefault }}
    defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
    defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
+    sendPasswordMail: {{ .Values.functional.filestore.sharing.external.sendPasswordMail | quote }}
  smtp:
    auth:
      enabled: false
@@ -131,6 +142,7 @@ podSecurityContext:

 debug:
  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
+  bootstrap: {{ .Values.debug.enabled }}

 {{- if .Values.certificate.selfSigned }}
 extraEnvVars:
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -55,17 +55,19 @@ aio:
      auth:
        enabled: true
        username:
-          value: "default"
+          value: {{ .Values.cache.nextcloud.username }}
        password:
          value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
      host: {{ .Values.cache.nextcloud.host | quote }}
      port: {{ .Values.cache.nextcloud.port | quote }}
+      tls: {{ .Values.cache.nextcloud.tls }}
    database:
      host: {{ .Values.databases.nextcloud.host | quote }}
      port: {{ .Values.databases.nextcloud.port | quote }}
+      name: {{ .Values.databases.nextcloud.name | quote }}
      auth:
        username:
-          value: "nextcloud_user"
+          value: {{ .Values.databases.nextcloud.username | quote }}
        password:
          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
    trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
--- a/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
@@ -28,6 +28,14 @@ repositories:
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+  # NGINX S3 Gateway Chart
+  - name: "nginx-s3-gateway-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.nginxS3Gateway.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"

 releases:
  # Univention Management Stack Umbrella Chart
@@ -38,7 +46,9 @@ releases:
      - "values-nubus.yaml.gotmpl"
      - "values-opendesk-customization.yaml.gotmpl"
      - "values-opendesk-images.yaml.gotmpl"
-      - {{ .Values.customization.release.ums | default "additionalValues: false" }}
+      {{ range .Values.customization.release.ums }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.nubus.enabled }}
    timeout: 900
  # Intercom-Service
@@ -47,7 +57,9 @@ releases:
    version: "{{ .Values.charts.intercomService.version }}"
    values:
      - "values-intercom-service.yaml.gotmpl"
-      - {{ .Values.customization.release.intercomService | default "additionalValues: false" }}
+      {{ range .Values.customization.release.intercomService }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.nubus.enabled }}

  # openDesk Keycloak Bootstrap Chart
@@ -56,13 +68,27 @@ releases:
    version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
    values:
      - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskKeycloakBootstrap | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskKeycloakBootstrap }}
+      - {{ . }}
+      {{ end }}
    needs:
      - "ums"
    installed: {{ .Values.nubus.enabled }}
    timeout: 900

+  # NGINX S3 Gateway (when cluster minio is not used)
+  - name: "nubus"
+    chart: "nginx-s3-gateway-repo/{{ .Values.charts.nginxS3Gateway.name }}"
+    version: "{{ .Values.charts.nginxS3Gateway.version }}"
+    values:
+      - "values-nginx-s3-gateway.yaml.gotmpl"
+      {{ range .Values.customization.release.nginxS3Gateway }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ not .Values.minio.enabled }}
+    timeout: 900
+
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "nubus"
 ...
--- a/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-intercom-service.yaml.gotmpl
@@ -32,10 +32,15 @@ extraVolumeMounts:
  - name: "trusted-cert-secret-volume"
    mountPath: "/etc/ssl/certs/ca-certificates.crt"
    subPath: "ca-certificates.crt"
+{{- end }}
+
 extraEnvVars:
+  - name: "REDIS_USER"
+    value: {{ .Values.cache.intercomService.username }}
+  {{- if .Values.certificate.selfSigned }}
  - name: "NODE_EXTRA_CA_CERTS"
    value: "/etc/ssl/certs/ca-certificates.crt"
-{{- end }}
+  {{- end }}

 global:
  domain: {{ .Values.global.domain | quote }}
--- a/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
@@ -0,0 +1,39 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nginxS3Gateway.registry | quote }}
+  repository: {{ .Values.images.nginxS3Gateway.repository | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  tag: {{ .Values.images.nginxS3Gateway.tag | quote }}
+
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+  host: "{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: "/portal-assets/icons/$2/$3"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+  path: "/univention/(portal|selfservice)/icons/(logos|entries)/(.*)$"
+  tls:
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+configuration:
+  bucket: {{ .Values.objectstores.nubus.bucket | quote }}
+  endpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+  port: 443
+  region: {{ .Values.objectstores.nubus.region | quote }}
+  style: "path"
+  credentials:
+    accessKey:
+      value: {{ .Values.objectstores.nubus.username | quote }}
+    secretKey:
+      value: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+
+resources:
+  {{ .Values.resources.nginxS3Gateway | toYaml | nindent 2 }}
+
+replicaCount: {{ .Values.replicas.nginxS3Gateway }}
+...
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -144,6 +144,10 @@ global:
            groups: __DELETE_KEY__

 ingress:
+  # temporary fix
+  {{- if not .Values.minio.enabled }}
+  enabled: false
+  {{- end }}
  certManager:
    enabled: false
  tls:
@@ -333,7 +337,7 @@ nubusPortalConsumer:
  enabled: true
  portalConsumer:
    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
-    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
  provisioningApi:
    auth:
@@ -341,7 +345,7 @@ nubusPortalConsumer:

 nubusPortalServer:
  portalServer:
-    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
    objectStorageCredentialSecret:
      name: "ums-portal-server-minio-opendesk-credentials"
--- a/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
@@ -15,22 +15,22 @@ repositories:
  # Open-Xchange
  - name: "open-xchange-repo"
    keyring: "../../files/gpg-pubkeys/open-xchange-com.gpg"
-    verify: {{ .Values.charts.openXchangeAppSuite.verify }}
+    verify: {{ .Values.charts.oxAppSuite.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"

  # openDesk Open-Xchange Bootstrap
  # Source:
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap
  - name: "open-xchange-bootstrap-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.openXchangeAppSuiteBootstrap.verify }}
+    verify: {{ .Values.charts.oxAppSuiteBootstrap.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/{{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"

  # OX Connector
  - name: "ox-connector-repo"
@@ -45,27 +45,33 @@ releases:
    version: "{{ .Values.charts.dovecot.version }}"
    values:
      - "values-dovecot.yaml.gotmpl"
-      - {{ .Values.customization.release.dovecot | default "additionalValues: false" }}
+      {{ range .Values.customization.release.dovecot }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.dovecot.enabled }}
    timeout: 900

  - name: "open-xchange"
-    chart: "open-xchange-repo/{{ .Values.charts.openXchangeAppSuite.name }}"
-    version: "{{ .Values.charts.openXchangeAppSuite.version }}"
+    chart: "open-xchange-repo/{{ .Values.charts.oxAppSuite.name }}"
+    version: "{{ .Values.charts.oxAppSuite.version }}"
    values:
      - "values-openxchange.yaml.gotmpl"
      - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
-      - {{ .Values.customization.release.openXchange | default "additionalValues: false" }}
-    installed: {{ .Values.oxAppsuite.enabled }}
+      {{ range .Values.customization.release.openxchange }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
    timeout: 900

  - name: "opendesk-open-xchange-bootstrap"
-    chart: "open-xchange-bootstrap-repo/{{ .Values.charts.openXchangeAppSuiteBootstrap.name }}"
-    version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
+    chart: "open-xchange-bootstrap-repo/{{ .Values.charts.oxAppSuiteBootstrap.name }}"
+    version: "{{ .Values.charts.oxAppSuiteBootstrap.version }}"
    values:
      - "values-openxchange-bootstrap.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskOpenXchangeBootstrap | default "additionalValues: false" }}
-    installed: {{ .Values.oxAppsuite.enabled }}
+      {{ range .Values.customization.release.opendeskOpenxchangeBootstrap }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
    timeout: 900

  - name: "ox-connector"
@@ -73,12 +79,14 @@ releases:
    version: "{{ .Values.charts.oxConnector.version }}"
    values:
      - "values-oxconnector.yaml.gotmpl"
-      - {{ .Values.customization.release.oxConnector | default "additionalValues: false" }}
-    installed: {{ .Values.oxAppsuite.enabled }}
+      {{ range .Values.customization.release.oxConnector }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
    needs:
      - "open-xchange"

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "open-xchange"
 ...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -17,8 +17,8 @@ dovecot:
  mailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  password: {{ .Values.secrets.dovecot.doveadm | quote }}
  migration:
-    enabled: {{ .Values.functional.migration.oxAppsuite.enabled }}
-    masterPassword: {{ .Values.secrets.oxAppsuite.migrationsMasterPassword | quote }}
+    enabled: {{ .Values.functional.migration.oxAppSuite.enabled }}
+    masterPassword: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
  ldap:
    enabled: true
    host: {{ .Values.ldap.host | quote }}
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -7,16 +7,16 @@ SPDX-License-Identifier: Apache-2.0
 global:
  hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
  appsuite:
-    cookieHashSalt: {{ .Values.secrets.oxAppsuite.cookieHashSalt }}
-    shareCryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey }}
-    sessiondEncryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey }}
+    cookieHashSalt: {{ .Values.secrets.oxAppSuite.cookieHashSalt }}
+    shareCryptKey: {{ .Values.secrets.oxAppSuite.shareCryptKey }}
+    sessiondEncryptionKey: {{ .Values.secrets.oxAppSuite.sessiondEncryptionKey }}
  mysql:
-    host: {{ .Values.databases.oxAppsuite.host | quote }}
-    database: {{ .Values.databases.oxAppsuite.name | quote }}
+    host: {{ .Values.databases.oxAppSuite.host | quote }}
+    database: {{ .Values.databases.oxAppSuite.name | quote }}
    auth:
-      user: {{ .Values.databases.oxAppsuite.username | quote }}
-      password: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
-      rootPassword: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
+      user: {{ .Values.databases.oxAppSuite.username | quote }}
+      password: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
+      rootPassword: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}

 nextcloud-integration-ui:
  image:
@@ -105,9 +105,9 @@ appsuite:
    routes:
      http-api-routes-appsuite-api:
        annotations:
-          nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.openXchangeAppSuite }}"
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openXchangeAppSuite }}"
-          nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.openXchangeAppSuite }}"
+          nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.oxAppSuite }}"
+          nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.oxAppSuite }}"
+          nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.oxAppSuite }}"
      trailslash:
        enabled: false
  core-mw:
@@ -119,13 +119,13 @@ appsuite:
        oidcLogin: true
        oidcPath: "/oidc"
    masterAdmin: "admin"
-    masterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+    masterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
    hzGroupName: "hzgroup"
-    hzGroupPassword: {{ .Values.secrets.oxAppsuite.hzGroupPassword | quote }}
+    hzGroupPassword: {{ .Values.secrets.oxAppSuite.hzGroupPassword | quote }}
    basicAuthLogin: "oxlogin"
-    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
+    basicAuthPassword: {{ .Values.secrets.oxAppSuite.basicAuthPassword | quote }}
    jolokiaLogin: "jolokia"
-    jolokiaPassword: {{ .Values.secrets.oxAppsuite.jolokiaPassword | quote }}
+    jolokiaPassword: {{ .Values.secrets.oxAppSuite.jolokiaPassword | quote }}
    hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
    podAnnotations: {}
    serviceAccount:
@@ -174,7 +174,7 @@ appsuite:
          chown open-xchange:open-xchange /opt/open-xchange/guard-files
    packages:
      status:
-        {{- if .Values.functional.migration.oxAppsuite.enabled }}
+        {{- if .Values.functional.migration.oxAppSuite.enabled }}
        open-xchange-authentication-masterpassword: "enabled"
        open-xchange-authentication-ldap: "disabled"
        open-xchange-authentication-oauth: "disabled"
@@ -301,7 +301,7 @@ appsuite:
    {{- if .Values.certificate.selfSigned }}
    extraEnv:
    - name: "JAVA_OPTS_APPEND"
-      value: {{ printf "%s %s=%s" "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks -Djavax.net.ssl.trustStoreType=jks" "-Djavax.net.ssl.trustStorePassword" (.Values.secrets.certificates.password | quote) | quote }}
+      value: {{ printf "%s %s=%s" "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks -Djavax.net.ssl.trustStoreType=jks" "-Djavax.net.ssl.trustStorePassword" .Values.secrets.certificates.password | quote }}
    extraVolumes:
      - name: "trusted-cert-secret-volume"
        secret:
@@ -316,13 +316,13 @@ appsuite:
        mountPath: "/etc/ssl/certs/"
    {{- end }}
    secretProperties:
-      com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
-      com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
-      com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
-      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+      com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppSuite.cookieHashSalt | quote }}
+      com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppSuite.sessiondEncryptionKey | quote }}
+      com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppSuite.shareCryptKey | quote }}
+      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
    propertiesFiles:
      /opt/open-xchange/etc/masterpassword-authentication.properties:
-        com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppsuite.migrationsMasterPassword | quote }}
+        com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
      /opt/open-xchange/etc/AdminDaemon.properties:
        MASTER_ACCOUNT_OVERRIDE: "true"
      /opt/open-xchange/etc/AdminUser.properties:
@@ -336,12 +336,17 @@ appsuite:
        bindOnly: "false"
      /opt/open-xchange/etc/antivirus.properties:
        com.openexchange.antivirus.enabled: "true"
+        {{- if .Values.antivirus.icap.host }}
+        com.openexchange.antivirus.server: {{ .Values.antivirus.icap.host | quote }}
+        com.openexchange.antivirus.port: {{ .Values.antivirus.icap.port | quote }}
+        {{- else }}
        {{- if .Values.clamavDistributed.enabled }}
        com.openexchange.antivirus.server: "clamav-icap"
        {{- else if .Values.clamavSimple.enabled }}
        com.openexchange.antivirus.server: "clamav-simple"
        {{- end }}
        com.openexchange.antivirus.port: "1344"
+        {{- end }}
        com.openexchange.antivirus.maxFileSize: "1024"
    uiSettings:
      io.ox.nextcloud//server: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/fs/"
@@ -387,16 +392,17 @@ appsuite:
      # MC+base64(20 random bytes)
      # RC+base64(20 random bytes)
      oxguardpass: |
-        {{ .Values.secrets.oxAppsuite.oxguardMC }}
-        {{ .Values.secrets.oxAppsuite.oxguardRC }}
+        {{ .Values.secrets.oxAppSuite.oxguardMC }}
+        {{ .Values.secrets.oxAppSuite.oxguardRC }}
    redis: &redisConfiguration
      enabled: true
      mode: "standalone"
      hosts:
-        - "redis-master:6379"
+        - {{ printf "%s:%v" .Values.cache.oxAppSuite.host .Values.cache.oxAppSuite.port | quote }}
      auth:
        enabled: true
-        password: {{ .Values.secrets.redis.password | quote }}
+        username: {{ .Values.cache.oxAppSuite.username | quote }}
+        password: {{ .Values.cache.oxAppSuite.password | default .Values.secrets.redis.password | quote }}
    image:
      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
      repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
@@ -495,9 +501,9 @@ appsuite:

  core-documentconverter:
    adminUser: "admin"
-    adminPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+    adminPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
    basicAuthLogin: "oxlogin"
-    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
+    basicAuthPassword: {{ .Values.secrets.oxAppSuite.basicAuthPassword | quote }}
    enabled: true
    documentConverter:
      cache:
@@ -582,9 +588,9 @@ appsuite:
  core-imageconverter:
    enabled: true
    adminUser: "admin"
-    adminPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+    adminPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
    basicAuthLogin: "oxlogin"
-    basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
+    basicAuthPassword: {{ .Values.secrets.oxAppSuite.basicAuthPassword | quote }}
    image:
      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeImageConverter.registry | quote }}
      repository: {{ .Values.images.openxchangeImageConverter.repository | quote }}
--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -50,7 +50,7 @@ oxConnector:
  oxLocalTimezone: "Europe/Berlin"
  oxLanguage: "de_DE"
  oxMasterAdmin: "admin"
-  oxMasterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
+  oxMasterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
  oxSmtpServer: "smtp://127.0.0.1:587"
  oxSoapServer: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"

@@ -78,6 +78,11 @@ probes:
    periodSeconds: 30
    failureThreshold: 3
    successThreshold: 1
+    command:
+      - /bin/sh
+      - -c
+      - |
+        exit 0

  readiness:
    enabled: true
@@ -86,6 +91,11 @@ probes:
    periodSeconds: 15
    failureThreshold: 30
    successThreshold: 1
+    command:
+      - /bin/sh
+      - -c
+      - |
+        exit 0

 replicaCount: {{ .Values.replicas.oxConnector }}

--- a/helmfile/apps/openproject-bootstrap/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject-bootstrap/helmfile-child.yaml.gotmpl
@@ -20,11 +20,13 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskOpenprojectBootstrap | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskOpenprojectBootstrap }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.openproject.enabled }}
    timeout: 900

 commonLabels:
-  deploy-stage: "component-2"
+  deployStage: "060-components"
  component: "opendesk-openproject-bootstrap"
 ...
--- a/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
@@ -20,11 +20,13 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.openproject | default "additionalValues: false" }}
+      {{ range .Values.customization.release.openproject }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.openproject.enabled }}
    timeout: 1800

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "openproject"
 ...
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -192,8 +192,8 @@ s3:
  enabled: true
  directUploads: {{ .Values.objectstores.openproject.directUploads }}
  enableSignatureV4Streaming: {{ .Values.objectstores.openproject.enableSignatureV4Streaming }}
-  endpoint: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
-  host: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+  endpoint: {{ printf "https://%s" (.Values.objectstores.openproject.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
+  host: {{ printf "https://%s" (.Values.objectstores.openproject.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
  pathStyle: {{ .Values.objectstores.openproject.pathStyle }}
  region: {{ .Values.objectstores.openproject.region | quote }}
  bucketName: {{ .Values.objectstores.openproject.bucket | quote }}
--- a/helmfile/apps/services/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/services/helmfile-child.yaml.gotmpl
@@ -119,7 +119,9 @@ releases:
    version: "{{ .Values.charts.otterize.version }}"
    values:
      - "values-otterize.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskOtterize | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskOtterize }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.security.otterizeIntents.enabled }}
    timeout: 900

@@ -128,7 +130,9 @@ releases:
    version: "{{ .Values.charts.home.version }}"
    values:
      - "values-home.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskHome | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskHome }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.home.enabled }}

  - name: "opendesk-certificates"
@@ -136,7 +140,9 @@ releases:
    version: "{{ .Values.charts.certificates.version }}"
    values:
      - "values-certificates.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskCertificates | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskCertificates }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.certificates.enabled }}
    timeout: 900

@@ -145,7 +151,9 @@ releases:
    version: "{{ .Values.charts.redis.version }}"
    values:
      - "values-redis.yaml.gotmpl"
-      - {{ .Values.customization.release.redis | default "additionalValues: false" }}
+      {{ range .Values.customization.release.redis }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.redis.enabled }}
    timeout: 900

@@ -154,7 +162,9 @@ releases:
    version: "{{ .Values.charts.memcached.version }}"
    values:
      - "values-memcached.yaml.gotmpl"
-      - {{ .Values.customization.release.memcached | default "additionalValues: false" }}
+      {{ range .Values.customization.release.memcached }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.memcached.enabled }}
    timeout: 900

@@ -163,7 +173,9 @@ releases:
    version: "{{ .Values.charts.postgresql.version }}"
    values:
      - "values-postgresql.yaml.gotmpl"
-      - {{ .Values.customization.release.postgresql | default "additionalValues: false" }}
+      {{ range .Values.customization.release.postgresql }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.postgresql.enabled }}
    timeout: 900

@@ -172,7 +184,9 @@ releases:
    version: "{{ .Values.charts.mariadb.version }}"
    values:
      - "values-mariadb.yaml.gotmpl"
-      - {{ .Values.customization.release.mariadb | default "additionalValues: false" }}
+      {{ range .Values.customization.release.mariadb }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.mariadb.enabled }}
    timeout: 900

@@ -181,7 +195,9 @@ releases:
    version: "{{ .Values.charts.postfix.version }}"
    values:
      - "values-postfix.yaml.gotmpl"
-      - {{ .Values.customization.release.postfix | default "additionalValues: false" }}
+      {{ range .Values.customization.release.postfix }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.postfix.enabled }}
    timeout: 900

@@ -190,7 +206,9 @@ releases:
    version: "{{ .Values.charts.dkimpy.version }}"
    values:
      - "values-dkimpy.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskDkimpyMilter | default "additionalValues: false" }}
+      {{ range .Values.customization.release.opendeskDkimpyMilter }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.dkimpy.enabled }}
    timeout: 900

@@ -199,7 +217,9 @@ releases:
    version: "{{ .Values.charts.clamav.version }}"
    values:
      - "values-clamav-distributed.yaml.gotmpl"
-      - {{ .Values.customization.release.clamav | default "additionalValues: false" }}
+      {{ range .Values.customization.release.clamav }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.clamavDistributed.enabled }}
    timeout: 900

@@ -208,7 +228,9 @@ releases:
    version: "{{ .Values.charts.clamavSimple.version }}"
    values:
      - "values-clamav-simple.yaml.gotmpl"
-      - {{ .Values.customization.release.clamavSimple | default "additionalValues: false" }}
+      {{ range .Values.customization.release.clamavSimple }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.clamavSimple.enabled }}
    timeout: 900

@@ -217,11 +239,13 @@ releases:
    version: "{{ .Values.charts.minio.version }}"
    values:
      - "values-minio.yaml.gotmpl"
-      - {{ .Values.customization.release.minio | default "additionalValues: false" }}
+      {{ range .Values.customization.release.minio }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.minio.enabled }}
    timeout: 900

 commonLabels:
-  deploy-stage: "services"
+  deployStage: "030-services"
  component: "services"
 ...
--- a/helmfile/apps/services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/services/values-certificates.yaml.gotmpl
@@ -39,7 +39,7 @@ global:
    {{- if .Values.openproject.enabled }}
    openproject: {{ .Values.global.hosts.openproject }}
    {{- end }}
-    {{- if .Values.oxAppsuite.enabled }}
+    {{- if .Values.oxAppSuite.enabled }}
    openxchange: {{ .Values.global.hosts.openxchange }}
    {{- end }}
    {{- if .Values.nubus.enabled }}
@@ -52,6 +52,7 @@ global:

 issuerRef:
  name: {{ .Values.certificate.issuerRef.name | quote }}
+  kind: {{ .Values.certificate.issuerRef.kind | quote }}

 cleanup:
  keepRessourceOnDelete: {{ .Values.debug.cleanup.keepRessourceOnDelete }}
--- a/helmfile/apps/services/values-mariadb.yaml.gotmpl
+++ b/helmfile/apps/services/values-mariadb.yaml.gotmpl
@@ -47,9 +47,9 @@ job:
    - username: "openxchange_user"
    # - username: {{ .Values.databases.xwiki.username | quote }}
      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
-      connectionLimit: {{ .Values.databases.oxAppsuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+      connectionLimit: {{ .Values.databases.oxAppSuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
    - username: "xwiki_user"
-    # - username: {{ .Values.databases.oxAppsuite.username | quote }}
+    # - username: {{ .Values.databases.oxAppSuite.username | quote }}
      password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
  databases:
@@ -59,8 +59,8 @@ job:
    # users for the moment.
    - name: "openxchange"
      user: "openxchange_user"
-    # - name: {{ .Values.databases.oxAppsuite.name | quote }}
-    #   user: {{ .Values.databases.oxAppsuite.username | quote }}
+    # - name: {{ .Values.databases.oxAppSuite.name | quote }}
+    #   user: {{ .Values.databases.oxAppSuite.username | quote }}
    - name: "xwiki"
      user: "xwiki_user"
    # - name: {{ .Values.databases.xwiki.name | quote }}
--- a/helmfile/apps/services/values-otterize.yaml.gotmpl
+++ b/helmfile/apps/services/values-otterize.yaml.gotmpl
@@ -29,7 +29,7 @@ apps:
  openproject:
    enabled: {{ .Values.openproject.enabled }}
  oxAppsuite:
-    enabled: {{ .Values.oxAppsuite.enabled }}
+    enabled: {{ .Values.oxAppSuite.enabled }}
  postfix:
    enabled: {{ .Values.postfix.enabled }}
  postgresql:
--- a/helmfile/apps/services/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services/values-postfix.yaml.gotmpl
@@ -68,11 +68,15 @@ postfix:
  smtpdTLSCertFile: "/etc/tls/tls.crt"
  smtpdKeyFile: "/etc/tls/tls.key"
  smtpdSASLPath: "inet:dovecot:3659"
+  {{- if .Values.antivirus.milter.host }}
+  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
+  {{- else }}
  {{- if .Values.clamavDistributed.enabled }}
  smtpdMilters: "inet:clamav-milter:7357"
  {{- else if .Values.clamavSimple.enabled }}
  smtpdMilters: "inet:clamav-simple:7357"
  {{- end }}
+  {{- end }}
  virtualMailboxDomains: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  virtualTransport: "lmtps:dovecot:24"

--- a/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
@@ -19,11 +19,13 @@ releases:
    wait: true
    values:
      - "values.yaml.gotmpl"
-      - {{ .Values.customization.release.xwiki | default "additionalValues: false" }}
+      {{ range .Values.customization.release.xwiki }}
+      - {{ . }}
+      {{ end }}
    installed: {{ .Values.xwiki.enabled }}
    timeout: 1800

 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
  component: "xwiki"
 ...
--- a/helmfile/apps/xwiki/values.yaml.gotmpl
+++ b/helmfile/apps/xwiki/values.yaml.gotmpl
@@ -23,7 +23,7 @@ externalDB:
  password: {{ .Values.databases.xwiki.password | default .Values.secrets.mariadb.rootPassword | quote }}
  database: {{ .Values.databases.xwiki.name | quote }}
  user: {{ .Values.databases.xwiki.username | quote }}
-  host: {{ .Values.databases.xwiki.host | quote }}
+  host: {{ printf "%s:%d" .Values.databases.xwiki.host .Values.databases.xwiki.port | quote }}
  customKeyRef:
    enabled: false

@@ -57,8 +57,10 @@ customConfigs:
    xwiki.authentication.ldap.photo_attribute: "jpegPhoto"
    ## Enable the synchronization of the LDAP profile picture
    xwiki.authentication.ldap.update_photo: 1
-    ## Password of default user
+    {{ if .Values.debug.enabled }}
+    ## Password of "superadmin" user, disables account if not password is set
    xwiki.superadminpassword: {{ .Values.secrets.xwiki.superadminpassword | quote }}
+    {{ end }}
    ## LDAP Server configuration
    xwiki.authentication.ldap.server: {{ .Values.ldap.host | quote }}
    xwiki.authentication.ldap.port: 389
--- a/helmfile/environments/default/antivirus.yaml
+++ b/helmfile/environments/default/antivirus.yaml
@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+antivirus:
+  icap:
+    host: ~
+    port: 1344
+  milter:
+    host: ~
+    port: 7357
+...
--- a/helmfile/environments/default/cache.yaml
+++ b/helmfile/environments/default/cache.yaml
@@ -5,14 +5,22 @@ cache:
  intercomService:
    host: "redis-headless"
    port: 6379
+    username: "default"
    password: ""
  nextcloud:
    host: "redis-headless"
    port: 6379
+    username: "default"
    password: ""
+    tls: false
  openproject:
    host: "memcached"
    port: 11211
+  oxAppSuite:
+    host: "redis-headless"
+    port: 6379
+    username: "default"
+    password: ""
  umsSelfservice:
    host: "memcached"
    port: 11211
--- a/helmfile/environments/default/certificate.yaml
+++ b/helmfile/environments/default/certificate.yaml
@@ -5,6 +5,7 @@
 certificate:
  issuerRef:
    name: "letsencrypt-prod"
+    kind: "ClusterIssuer"
  wildcard: false
  selfSigned: false
 ...
--- a/helmfile/environments/default/charts.yaml
+++ b/helmfile/environments/default/charts.yaml
@@ -90,7 +90,17 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-element"
-    version: "3.4.1"
+    version: "5.0.0"
+    verify: true
+  elementWeb:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
+    name: "opendesk-element-web"
+    version: "5.0.0"
    verify: true
  elementWellKnown:
    # providerCategory: "Platform"
@@ -100,7 +110,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-well-known"
-    version: "3.4.1"
+    version: "5.0.0"
    verify: true
  home:
    # providerCategory: "Platform"
@@ -132,7 +142,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
    name: "opendesk-jitsi"
-    version: "2.1.0"
+    version: "2.1.1"
    verify: true
  mariadb:
    # providerCategory: "Platform"
@@ -232,7 +242,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud"
-    version: "3.4.1"
+    version: "3.6.2"
    verify: true
  nextcloudManagement:
    # providerCategory: "Platform"
@@ -242,7 +252,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud-management"
-    version: "3.4.1"
+    version: "3.6.2"
    verify: true
  nginx:
    # providerCategory: "Community"
@@ -254,6 +264,16 @@ charts:
    name: "nginx"
    version: "15.9.3"
    verify: true
+  nginxS3Gateway:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # packageName=bmi/opendesk/components/platform-development/charts/nginx-s3-gateway/nginx-s3-gateway
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/nginx-s3-gateway"
+    name: "nginx-s3-gateway"
+    version: "1.0.1"
+    verify: true
  nubus:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -298,7 +318,17 @@ charts:
    name: "opendesk-openproject-bootstrap"
    version: "2.1.1"
    verify: true
-  openXchangeAppSuite:
+  otterize:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize/opendesk-otterize"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize"
+    name: "opendesk-otterize"
+    version: "2.1.0"
+    verify: true
+  oxAppSuite:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
@@ -310,7 +340,7 @@ charts:
    name: "appsuite-public-sector"
    version: "2.12.85"
    verify: false
-  openXchangeAppSuiteBootstrap:
+  oxAppSuiteBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry.opencode.de"
@@ -320,16 +350,6 @@ charts:
    name: "opendesk-open-xchange-bootstrap"
    version: "2.1.2"
    verify: true
-  otterize:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize/opendesk-otterize"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize"
-    name: "opendesk-otterize"
-    version: "2.1.0"
-    verify: true
  oxConnector:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -337,10 +357,10 @@ charts:
    # upstreamRepository: "nubus/charts/ox-connector"
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
    # upstreamMirrorStartFrom: ["0", "4", "2"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/charts"
    name: "ox-connector"
-    version: "0.14.5"
+    version: "0.14.8"
    verify: true
  postfix:
    # providerCategory: "Platform"
@@ -380,7 +400,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse"
-    version: "3.4.1"
+    version: "5.0.0"
    verify: true
  synapseCreateAccount:
    # providerCategory: "Platform"
@@ -390,7 +410,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-create-account"
-    version: "3.4.1"
+    version: "5.0.0"
    verify: true
  synapseWeb:
    # providerCategory: "Platform"
@@ -400,7 +420,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-web"
-    version: "3.4.1"
+    version: "5.0.0"
    verify: true
  xwiki:
    # providerCategory: "Supplier"
--- a/helmfile/environments/default/customization.yaml
+++ b/helmfile/environments/default/customization.yaml
@@ -2,56 +2,65 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 # This variable allows customization of helmfile releases by loading custom values file.
+#
+# **Warning**: Customizations are a very powerful tool to apply individual changes to your
+# openDesk installation. As there are no limits set for what you use it, openDesk cannot
+# support the configurations you are about to create using the customization-option. If you
+# have the demand for a specific configuration, try to get it into the openDesk standard
+# by creating a ticket at https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues
+#
 # Example:
 # customization:
 #   release:
-#     collaboraOnline: /path/to/additional/file.yaml
+#     collaboraOnline:
+#       myCustomConfig: "/path/to/additional/file.yaml"
 customization:
  release:
    # collabora
-    collaboraOnline: ~
+    collaboraOnline: {}
    # cryptpad
-    cryptpad: ~
+    cryptpad: {}
    # element
-    opendeskElement: ~
-    opendeskWellKnown: ~
-    opendeskSynapseWeb: ~
-    opendeskSynapse: ~
+    opendeskElement: {}
+    opendeskWellKnown: {}
+    opendeskSynapseWeb: {}
+    opendeskSynapse: {}
    # jitsi
-    jitsi: ~
+    jitsi: {}
    # migrations-post
-    migrationsPost: ~
+    migrationsPost: {}
    # migrations-pre
-    migrationsPre: ~
+    migrationsPre: {}
    # nextcloud
-    opendeskNextcloudManagement: ~
-    opendeskNextcloud: ~
+    opendeskNextcloudManagement: {}
+    opendeskNextcloud: {}
    # nubus
-    ums: ~
-    intercomService: ~
-    opendeskKeycloakBootstrap: ~
+    ums: {}
+    intercomService: {}
+    opendeskKeycloakBootstrap: {}
+    nginxS3Gateway: {}
    # open-xchange
-    dovecot: ~
-    openXchange: ~
-    opendeskOpenXchangeBootstrap: ~
-    oxConnector: ~
+    dovecot: {}
+    openxchange: {}
+    opendeskOpenxchangeBootstrap: {}
+    oxConnector: {}
    # openproject
-    openproject: ~
+    openproject: {}
    # openproject-bootstrap
-    opendeskOpenprojectBootstrap: ~
+    opendeskOpenprojectBootstrap: {}
    # services
-    opendeskOtterize: ~
-    opendeskHome: ~
-    opendeskCertificates: ~
-    redis: ~
-    memcached: ~
-    postgresql: ~
-    mariadb: ~
-    postfix: ~
-    opendeskDkimpyMilter: ~
-    clamav: ~
-    clamavSimple: ~
-    minio: ~
+    opendeskOtterize: {}
+    opendeskHome: {}
+    opendeskCertificates: {}
+    redis: {}
+    memcached: {}
+    postgresql: {}
+    mariadb: {}
+    postfix: {}
+    opendeskDkimpyMilter: {}
+    clamav: {}
+    clamavSimple: {}
+    minio: {}
    # xwiki
-    xwiki: ~
+    xwiki: {}
 ...
--- a/helmfile/environments/default/database.yaml
+++ b/helmfile/environments/default/database.yaml
@@ -32,7 +32,7 @@ databases:
    username: "openproject_user"
    password: ""
    connectionLimit: ~
-  oxAppsuite:
+  oxAppSuite:
    name: "configdb"
    host: "mariadb"
    port: 3306
@@ -45,6 +45,21 @@ databases:
    port: 5432
    username: "matrix_user"
    password: ""
+    requireAuth: []
+    channelBinding: "prefer"
+    connectTimeout: 10
+    clientEncoding: "auto"
+    keepalives: 1
+    keepalivesIdle: 10
+    keepalivesInterval: 10
+    keepalivesCount: 3
+    replication: false
+    gssencmode: "prefer"
+    sslmode: "prefer"
+    sslcompression: 0
+    sslMinProtocolVersion: "TLSv1.2"
+    connectionPoolMin: "3"
+    connectionPoolMax: "5"
    connectionLimit: ~
  umsGuardianManagementApi:
    name: "guardianmanagementapi"
--- a/helmfile/environments/default/functional.yaml
+++ b/helmfile/environments/default/functional.yaml
@@ -45,6 +45,8 @@ functional:
        enabled: false
        # Enforces passwords to be used on external shares.
        enforcePasswords: false
+        # Let Nextcloud send the password set for the share by mail to the recipient of the share.
+        sendPasswordMail: true
        # Expiry settings for the external shares.
        expiry:
          # If true the check box for the expiry date is enabled by default.
@@ -99,10 +101,10 @@ functional:
        useImmutableIdentifierForLocalpart: false

  migration:
-    oxAppsuite:
+    oxAppSuite:
      # Note: Only available in openDesk Enterprise.
      # Turn on temporary for migration purposes only. Will enable master password auth in OX AppSuite and Dovecot using
-      # `secrets.oxAppsuite.migrationsMasterPassword`.
+      # `secrets.oxAppSuite.migrationsMasterPassword`.
      enabled: false

 ...
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -89,7 +89,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jibri"
-    tag: "stable-9779@sha256:7a0dfa397e7c6c03eb1dc2b49d94f0dc2d6fc44fe85761f67a45ea0e34056b3e"
+    tag: "stable-9823@sha256:dd7a330cb14d95b7661167d7b4e1a8f2e988952ba4ea24baa0a96e09bebd40b1"
  jicofo:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -99,7 +99,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jicofo"
-    tag: "stable-9779@sha256:6b00d53a899e01058a99fa71a3238442e18c43bc62d4212b6647b4f7aa67aae1"
+    tag: "stable-9823@sha256:551aa2adf078f8872474481a9bda7b7526fc5cae2853ce0be2aa1f6d91bf2ecc"
  jitsi:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -109,7 +109,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/web"
-    tag: "stable-9779@sha256:77f9cb45bb8c1053002b1ce8987ac26aa1d3724e79b23b0403ca0e92469b7d14"
+    tag: "stable-9823@sha256:d37d0d34715a0089437c5c030251010e068926f93395d46753e1767d0ee16247"
  jitsiKeycloakAdapter:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -137,7 +137,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jvb"
-    tag: "stable-9779@sha256:126719d4bd6fc3a85b61e786936a561a41527223b7b6a9c6204df41b1af48a50"
+    tag: "stable-9823@sha256:e6e43071ce26628c816bea46a259c7462c8d5edbbd2ed66f983b1e0f2d9a6cb2"
  mariadb:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -235,7 +235,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.2.5@sha256:1ad3d78f790f39826a855ac49324b24395ffe93ccb3ff50e2b9ea1da02b46bda"
+    tag: "2.3.3@sha256:449ea2b0ed5031b8c08f00471f788ac248eb0cd33a60bbc6341098a4faf1fb78"
  nextcloudExporter:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -244,6 +244,14 @@ images:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-exporter"
    tag: "1.0.1@sha256:63e63c7420e37d3989fa0ffdbcf18a07b2a603ab9b2a849c2e7e44342dd82af0"
+  nginxS3Gateway:
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "nginxinc/nginx-s3-gateway"
+    registry: "registry-1.docker.io"
+    repository: "nginxinc/nginx-s3-gateway"
+    tag: "unprivileged-oss-20241111@sha256:20d6b6ec5fc987b18c3e345de33674374a8335c593d6d0841ac64eb49ae2dea4"
  nubusDataLoader:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -729,9 +737,9 @@ images:
    # upstreamRepository: "nubus/images/ox-connector-standalone"
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
    # upstreamMirrorStartFrom: ["0", "4", "2"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ox-connector-standalone"
-    tag: "0.14.5@sha256:0b7816e3c8eca1949d3adc8c19d64394a862cbe478a3c51c6d18e546f02aea3d"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/images/ox-connector-standalone"
+    tag: "0.14.8@sha256:2f726c34747d8cd1c4152c3d095e7f9ff1364f483136e2657cc0ed68f19faead"
  postfix:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -757,16 +765,15 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/prosody"
-    tag: "stable-9779@sha256:5864f3f72d3605a52a1b90ec845a4a1837a851d7774dcbfdc9490beb4bdda18a"
+    tag: "stable-9823@sha256:1c52b4ca8397545d54067c67a54c50473d83242c75f001fbf20ee628dfc80b7b"
  redis:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry-1.docker.io"
    # upstreamRepository: "bitnami/redis"
-    # WE ARE STUCK WITH <7.4 because of https://redis.com/blog/redis-adopts-dual-source-available-licensing/
    registry: "registry-1.docker.io"
    repository: "bitnami/redis"
-    tag: "7.2.3-debian-11-r2@sha256:9ac3bbf7740969d32689e360ddcfa5f672538c47f6f6cf296173c3078de0edf2"
+    tag: "7.4.1-debian-12-r2@sha256:3cfa11e8fef45c006a101ed7cfaae2cdaed7a5167c8ada2a3f76a1de54488cd0"
  synapse:
    # providerCategory: "Supplier"
    # providerResponsible: "Element"
--- a/helmfile/environments/default/ingress.yaml
+++ b/helmfile/environments/default/ingress.yaml
@@ -13,13 +13,13 @@ ingress:
      element: "100M"
      nextcloud: "100M"
      openproject: "100M"
-      openXchangeAppSuite: "100M"
+      oxAppSuite: "100M"
      xwiki: "100M"
    bodyTimeout:
      collabora: 600
      element: 60
      nextcloud: 600
      openproject: 60
-      openXchangeAppSuite: 60
+      oxAppSuite: 60
      xwiki: 60
 ...
--- a/helmfile/environments/default/opendesk_main.gotmpl
+++ b/helmfile/environments/default/opendesk_main.gotmpl
@@ -55,7 +55,7 @@ nubus:
 openproject:
  enabled: true
  namespace: ~
-oxAppsuite:
+oxAppSuite:
  enabled: true
  namespace: ~
 postfix:
--- a/helmfile/environments/default/replicas.yaml
+++ b/helmfile/environments/default/replicas.yaml
@@ -122,6 +122,8 @@ replicas:
  umsUmcServer: 1
  # -- scalable: tbd
  umsUmcServerProxy: 1
+  # -- scalable: true
+  nginxS3Gateway: 1

  # -- component: Video conference (Jitsi)
  # -- scalable: tbd
@@ -162,7 +164,7 @@ replicas:
  # dedicated workers for specific queues are possible with OpenProject.
  openprojectWorker: 1

-  # -- component: Groupware (OX Appsuite)
+  # -- component: Groupware (OX App Suite)
  # -- scalable: tbd
  openxchangeCoreDocumentConverter: 1
  # -- scalable: tbd
--- a/helmfile/environments/default/resources.yaml
+++ b/helmfile/environments/default/resources.yaml
@@ -218,6 +218,13 @@ resources:
    requests:
      cpu: 0.1
      memory: "32Mi"
+  nginxS3Gateway:
+    limits:
+      cpu: 99
+      memory: "64Mi"
+    requests:
+      cpu: "100m"
+      memory: "16Mi"
  openproject:
    limits:
      cpu: 99
--- a/helmfile/environments/default/secrets.gotmpl
+++ b/helmfile/environments/default/secrets.gotmpl
@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 secrets:
-  oxAppsuite:
+  oxAppSuite:
    adminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "admin_password" | sha1sum | quote }}
    migrationsMasterPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "opendesk") "ox_appsuite" "migrations_master_password" | sha1sum | quote }}
    cookieHashSalt: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "cookie_hash_salt" | sha1sum | quote }}
Author	SHA1	Message	Date
Jaime Conde	33002a1e8f	fix(nubus): OX Connector kyverno errors	2024-12-02 13:12:24 +00:00
Thorsten Roßner	18fcaa0331	fix(nextcloud): Update Chart to 3.6.1 and Image to 2.3.3 (including rollback to 29.0.8). Introducing setting for `functional.filestore.sharing.external.sendPasswordMail`	2024-12-02 12:07:05 +01:00
Thorsten Roßner	f96942536f	fix(helmfile): Streamline `commonLabels.deployStage`.	2024-11-29 12:20:15 +01:00
Thorsten Roßner	56ce3355fc	fix(jitsi): Update to 2.0.9823 and chart to 2.1.1	2024-11-29 06:24:38 +01:00
Thorsten Roßner	6ff1fcd438	fix(helmfile): Unify templating name for Open-Xchange to `openxchange` and for OX App Suite to `oxAppSuite`.	2024-11-28 15:07:25 +01:00
Dominik Kaminski	8611d95e5a	fix(open-xchange): Fix truststore decrypt error on self-signed deployments	2024-11-27 13:12:44 +01:00
Thorsten Roßner	86ef0be542	fix(helmfile): Use dictionaries for defining `customization.yaml`, please read migrations.md for more details	2024-11-26 17:02:48 +01:00
Dominik Kaminski	df144fe3d3	fix(services): Add template for certificate issuerRef.kind	2024-11-26 13:41:59 +01:00
Dominik Kaminski	83da87e962	feat(helmfile): Add template support for antivirus icap/milter	2024-11-26 08:59:57 +00:00
Thorsten Roßner	e2b3bd543f	fix(xwiki): Set superadmin password account only when debug is enabled	2024-11-26 07:03:30 +00:00
Thorsten Roßner	e5ad0bb2e0	fix(ci): Explicitly set RELEASE_BRANCH (to `main`) for scan and release steps	2024-11-25 16:23:17 +01:00
Dominik Kaminski	1213ecc425	fix(element): Rename release opendesk-element to opendesk-element-web	2024-11-25 16:14:46 +01:00
Dominik Kaminski	5e0b2e26fc	fix(services): Update Redis to 7.4.1 as required by OX Appsuite, please read migrations.md for more details	2024-11-25 16:14:04 +01:00
Dominik Kaminski	1402593556	fix(nextcloud): Add Redis TLS option	2024-11-23 06:50:12 +00:00
Dominik Kaminski	564fb2d7c7	fix(helmfile): Add Redis username and tls option	2024-11-23 06:50:12 +00:00
Dominik Kaminski	9e102e2d1b	fix(element): Add extensive database options	2024-11-23 06:50:12 +00:00
Dominik Kaminski	b3b6ab5a61	fix(nubus): Add nginx s3 proxy when minio disabled	2024-11-23 06:50:12 +00:00
Dominik Kaminski	7f1f6cdcd4	fix(nextcloud): Fix templating for nextcloud database name	2024-11-23 06:50:12 +00:00
Dominik Kaminski	de15071ae9	fix(xwiki): Fix templating for xwiki database port	2024-11-23 06:50:12 +00:00
Dominik Kaminski	c8c12a278e	fix(nextcloud): Fix templating for nextcloud database user	2024-11-23 06:50:12 +00:00