docs(phone-dial-in): added note about nginx proxy-buffer-size

docs: jibri.link removed, not needed
docs(phone-dial-in): architecture for the dial-in
2025-12-06 07:21:36 +01:00 · 2025-04-17 11:44:58 +03:00 · 2025-04-04 10:47:32 +03:00 · 2025-04-03 18:42:21 +03:00 · 2025-04-01 09:19:01 +00:00 · 2025-04-01 09:19:01 +00:00
35 changed files with 565 additions and 123 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -74,7 +74,8 @@ variables:
      - "yes"
      - "no"
  FLUSH_EXTERNAL_SERVICES_BEFORE:
-    description: "Recreates databases and purges objectstorage. Useful when using external services and required overrides."
+    description: >
+      Recreates databases and purges objectstorage. Useful when using external services and required overrides.
    value: "no"
    options:
      - "yes"
@@ -265,10 +266,11 @@ db-cleanup:
          $FLUSH_EXTERNAL_SERVICES_BEFORE != "no"
      when: "on_success"
  script:
+    # yamllint disable-line rule:line-length rule:quoted-strings
    - export FILES=(${CI_PROJECT_DIR}/helmfile/environments/default/database.yaml.gotmpl ${CI_PROJECT_DIR}/helmfile/environments/dev/write-over-values-for-environment.yaml.gotmpl)
    # Cleanup MariaDB
    - |
-      export DATABASES="nextcloud oxAppSuite xwiki"
+      export DATABASES="oxAppSuite"
      export MARIADB_HOST=""
      export MARIADB_PORT=""
      export MARIADB_USERNAME=""
@@ -314,7 +316,8 @@ db-cleanup:
      done;
    # Cleanup PostgreSQL
    - |
-      export DATABASES="keycloak keycloakExtension notes openproject synapse umsGuardianManagementApi umsNotificationsApi umsSelfservice" 
+      export DATABASES="keycloak keycloakExtension nextcloud notes openproject synapse umsGuardianManagementApi \
+      umsNotificationsApi umsSelfservice xwiki"
      export PGDATABASE="postgres"
      export PGHOST=""
      export PGPORT=""
@@ -356,7 +359,7 @@ db-cleanup:
      export AWS_ENDPOINT=""
      export AWS_ACCESS_KEY_ID=""
      export AWS_SECRET_ACCESS_KEY=""
-      
+
      for BUCKET in $BUCKETS; do
        export ENV_BUCKET=${BUCKET}

--- a/.gitlab/lint/lint-kyverno.yml
+++ b/.gitlab/lint/lint-kyverno.yml
@@ -5,7 +5,7 @@ include:
  - local: "/.gitlab/lint/lint-common.yml"

 lint-kyverno:
-  allow_failure: true
+  allow_failure: false
  extends: ".lint-common"
  image: "${OPENDESK_LINT_IMAGE}"
  parallel:
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,73 @@
+## [1.2.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.2.0...v1.2.1) (2025-03-28)
+
+
+### Bug Fixes
+
+* **dovecot:** Support external secrets ([f758685](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f758685a2eb4c04bad6bce103cc5ba273c80606d))
+* **element:** Update Synapse to 1.127.1; Fixes https://www.cve.org/CVERecord?id=CVE-2025-30355 which applies to Synapse installations with unrestricted (no allow list) federation enabled ([5cd12b9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5cd12b91c78269b84749280e71aee0fcb195da17))
+* **openproject:** Update to 15.4.2 ([aa8e30b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/aa8e30b34f24302c756b2297b05e138d15ed0d2d))
+
+# [1.2.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.2...v1.2.0) (2025-03-25)
+
+
+### Bug Fixes
+
+* **collabora:** Set proper theming for Collabora Online (openDesk EE) ([896b3c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/896b3c102cd59a9c4d0ae28457261a4749b37a6d))
+* **collabora:** Update to 24.04.12 ([4296db7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4296db7c90c93c3c268a7642ae920d412cb70429))
+* **dev-tooling:** Fix path names when refencing local Helm chart copies in `helmfile-child.yaml.gotmpl` files ([60f5e36](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/60f5e36b7cf183ac9f15b0e56b486e642c54ac4d))
+* **docs:** Add `functional.md` and reference it in `getting-started.md` ([0efc0af](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0efc0af761703a63392034df3f34acf569174e0c))
+* **docs:** Add testing.md ([c4e4258](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c4e425816272951082fa15f1ab4ff4aee4a4598d))
+* **dovecot:** Update EE Helm chart to resolve issue with mandatory set `PriorityClass` ([696f2da](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/696f2daa9c3df6b0db744d81bd6e159b3f9be440))
+* **element:** Run UVS container as a non-root user ([f262507](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f26250774e4bdb157181c3c8fe5c51f7429771ed))
+* **element:** Update NeoChoice and NeoBoard widget to latest releases ([7456543](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7456543d81625599372f781f963fe5902f969627))
+* **helmfile:** Add missing `deletePodsOnSuccessTimeout` statements ([87144b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/87144b8fd3268ad8196673999241ed1a1bf234fa))
+* **helmfile:** Support for `functional.externalServices.matrix.federation.domainAllowList` ([817af98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/817af98fcdf9bca0028365796fb17a8cd5d9f4f9))
+* **intercom:** Allow transient session cookies and rolling session duration configuration ([4d59d12](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4d59d12a9703e05cb6bc47fe413ebcaafdcb4c8b))
+* **intercom:** Update to Intercom Service v2.10.3 ([7b05213](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7b05213d6eaa96717e368bc68b79af44c9b3d921))
+* **jitsi:** Update chart to v3.1.0 incl. a fix in room history toggle ([1480253](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1480253a52e5a9848b626f60b7fb75ad7c43c4a5))
+* **migrations:** Explicit scoping of role required for access to the migration's ConfigMap ([02488fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02488fe2dd84046735bdb9351e47d4508eaf191f))
+* **nextcloud:** Disable integration with OX App Suite if groupware it is not available ([fdfe76c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fdfe76c37e597534b2a8b4bf609e28628aabff3e))
+* **nextcloud:** Update apps and support branding of the HTML title ([bc55f6a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc55f6a366398aae497bde8d81b9663b04f992de))
+* **nextcloud:** Update images for improved log output ([f1147f0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f1147f0fdf12271c47225f81069013afdf8bd5f3))
+* **nextcloud:** Update images to allow logging in environments where inotify cannot be used ([0110675](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01106757da8d8d5a60629126a794c1d61d850f0b))
+* **nextcloud:** Update to 30.0.6 including latest apps ([52b0b13](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/52b0b13e6bf4be738bd29029d1f2940e93a99045))
+* **nubus:** Add imagePullSecrets to nginx-s3-gateway ([466b70a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/466b70a9bb9bbbaf25c920fcca965388eb4d0350))
+* **nubus:** Add migrations for Nubus 1.7.0; See migrations.md for details ([7d7e9e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7d7e9e65b32e6445b45edcb8bf15f64f79d63a2f))
+* **nubus:** Always use S3 gateway for assets ([1e62a0d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1e62a0dfe14ccd840e910d6aea79fb7beabb8da5))
+* **nubus:** Change logo URLs for apps referencing the openDesk logo provided by Nubus ([5d398f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5d398f5d64fd03ad9e9a3898424f485fef8888b1))
+* **nubus:** Cleanup of unnecessary LDAP groups; customization option to show the OX App Suite context selection in the IAM's admin UI ([4c42ed7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4c42ed76e82fc0cd517a7409e21cadb757fdac8a))
+* **nubus:** Delete now legacy Ingress `ums-minio-rewrites` ([1c50aa5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1c50aa5ce2ffef4446b28504c461faf84ef856c8))
+* **nubus:** Fix mixed up links for legal and privacy statement ([dbcc785](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dbcc785134a79ebe500724739338702c5e6772a3))
+* **nubus:** Indent `nubusPortalConsumer.persistence.groupMembershipCache` causing `persistence.storages.nubusPortalConsumer.*` to be ignored; See migrations.md for details ([baa5b14](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/baa5b14551f405a5e17ddfc62733c98868a1f205))
+* **nubus:** Register OX provisioning consumer only when OX is enabled; See migrations.md for details ([adb3fa1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/adb3fa18eb36de91927c8118493038b400ff77d5))
+* **nubus:** Remove unnecessary inactive portal tiles and folders ([1724fa1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1724fa14a3fcab9473da06f7702eb248eef334c6))
+* **nubus:** Update openDesk customizing: Preset openDesk specific attributes on `Administrator` account; Remove unused portal categories ([6edfe72](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6edfe7239fd3916be71f830543c01084100b8aba))
+* **opendesk-services:** Add notes to certificate resource ([d18abb0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d18abb0d0a2e011065a6c40f80f56bbdb5a48a90))
+* **openproject:** Update `opendesk-openproject-bootstrap` to support external secrets ([41e0aae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/41e0aaeffec3e0b4f83662b4381713d2480533fc))
+* **openproject:** Update to 15.3.0 including update for seeding relevant environment variables ([a6de1fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a6de1fe694e7cbee88db5a0688b60e7c8d8e4cff))
+* **openproject:** Update to 15.3.1 ([f34a4a3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f34a4a360178f3a54cfe45198c4717241a9c5289))
+* **openproject:** Update to 15.3.2 ([6723a34](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6723a34c229fb683d5adb1c8c900afb0c3f24087))
+* **openproject:** Update to 15.4.0 ([2a0f2a3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2a0f2a33330e149f8b4b26a3b3c5273274b2c0ca))
+* **openproject:** Update to 15.4.1 ([747cae5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/747cae545abf186b8ec19b5203cdf47c67667601))
+* **openxchange:** Template HTML title from `.Values.theme.texts.productName` ([2e992fc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2e992fc23606a497d770e44fb3afeada1f5d54dd))
+* **openxchange:** Update to latest 8.35 patch level ([44c2081](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/44c2081bd860bd66204d2648f287fc6c5b928faa))
+* **ox-connector:** Update to v0.14.7 ([dd3b35b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd3b35b626d860389fad4fc0541dc962fe51c060))
+* **postfix:** Add internal authentication ([2389d59](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2389d597358f53e43be5982e29125eabda94bf6c))
+* **postfix:** Add recipient delimiter support ([f92b76b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f92b76b2b28c7955123f83881d23f719ea8dfd5c))
+* **requirements.md:** Set Ingress NGINX 1.11.5 as requirement ([2bf8e1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2bf8e1de9873e15501b282d8e0d16350559e54dd))
+* **synapse:** Use synapse-guest-module by Element (supplier) ([2730b03](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2730b03e701922c3b14fdd5f8e8dfb64223b3edc))
+
+
+### Features
+
+* **helmfile:** Use PostgreSQL as default database for Nextcloud and XWiki;  follow `migrations.md` when upgrading an existing environment ([2f584bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2f584bd8e82ab7262659d6b24613f214f6e9ad25))
+* **nextcloud:** Support external secrets for metrics token ([dbec2ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dbec2ec36f5019bc0f5e9769ab02701ebac4aa2c))
+* **notes:** Update to v2.4.0 ([3d35440](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d35440dc76c703872488ec468649ed274099fd5))
+* **nubus:** Support of external secrets in opendesk-keycloak-bootstrap ([3d2f751](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d2f75165a571a67d08f7e9588297c70fc808179))
+* **nubus:** Update to v1.7.0 ([d018385](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d018385473df1f5154e15ca8c55145d10e713797))
+* **openxchange:** Update to OX App Suite 8.35 ([037537b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/037537b394b2e07aa05590c8bcf7c1145df7d7e9))
+* **xwiki:** Update to 16.10.5 ([bfd27f3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bfd27f3c396d6f05ed3e6dd4cd9f2ff424250da8))
+
 ## [1.1.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.1...v1.1.2) (2025-02-19)


--- a/README.md
+++ b/README.md
@@ -32,18 +32,18 @@ For production use the [openDesk Enterprise Edition](./README-EE.md) is required

 openDesk currently features the following functional main components:

-| Function             | Functional Component        | Component<br/>Version                                                                                | Upstream Documentation                                                                                                                |
-| -------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
-| Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89)                       | [For the most recent release](https://element.io/user-guide)                                                                          |
-| Collaborative notes  | Notes (aka Docs)            | [2.4.0](https://github.com/suitenumerique/docs/releases/tag/v2.4.0)                                  | Online documentation/welcome document available in installed application                                                              |
-| Diagram editor       | CryptPad ft. diagrams.net   | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                               | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | [30.0.6](https://nextcloud.com/de/changelog/#30-0-6)                                                 | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
-| Groupware            | OX App Suite                | [8.35](https://documentation.open-xchange.com/appsuite/releases/8.35/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
-| Knowledge management | XWiki                       | [16.10.5](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.5/)                     | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
-| Portal & IAM         | Nubus                       | [1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | [15.4.1](https://www.openproject.org/docs/release-notes/15-4-1/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
-| Videoconferencing    | Jitsi                       | [2.0.9955](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9955)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
-| Weboffice            | Collabora                   | [24.04.12.4](https://www.collaboraoffice.com/code-24-04-release-notes/)                              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
+| Function             | Functional Component        | Component<br/>Version                                                                                                         | Upstream Documentation                                                                                                                |
+|----------------------|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
+| Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89)                                                | [For the most recent release](https://element.io/user-guide)                                                                          |
+| Collaborative notes  | Notes (aka Docs)            | [2.4.0](https://github.com/suitenumerique/docs/releases/tag/v2.4.0)                                                           | Online documentation/welcome document available in installed application                                                              |
+| Diagram editor       | CryptPad ft. diagrams.net   | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                                                        | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
+| File management      | Nextcloud                   | [30.0.6](https://nextcloud.com/de/changelog/#30-0-6)                                                                          | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
+| Groupware            | OX App Suite                | [8.35](https://documentation.open-xchange.com/appsuite/releases/8.35/)                                                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Knowledge management | XWiki                       | [16.10.5](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.5/)                                              | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
+| Portal & IAM         | Nubus                       | [1.7.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html#version-1-7-0-2025-02-23) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
+| Project management   | OpenProject                 | [15.4.2](https://www.openproject.org/docs/release-notes/15-4-2/)                                                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Videoconferencing    | Jitsi                       | [2.0.9955](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9955)                                         | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
+| Weboffice            | Collabora                   | [24.04.12.4](https://www.collaboraoffice.com/code-24-04-release-notes/)                                                       | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |

 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -433,6 +433,10 @@ In openDesk, OX App Suite is used for email, calendar, address book and personal

 [XWiki](https://www.xwiki.org) is an open-source wiki platform for knowledge management and collaboration.

+## Jitsi Phone Dial-in
+
+[Dial-in architecture notes](phone-dial-in/notes.md) describes the infrastructure to integrate an ability to participate in Jitsi calls. 
+
 # Application specific user accounts

 While the IAM managed users centrally, some applications come with local accounts for administrative purposes.
--- a/docs/architecture/apis.md
+++ b/docs/architecture/apis.md
@@ -7,6 +7,7 @@ SPDX-License-Identifier: Apache-2.0

 This chapter presents APIs available in openDesk grouped by applications.

+<!-- TOC -->
 * [IAM - Nubus](#iam---nubus)
  * [UMC Python API](#umc-python-api)
  * [UMC store API](#umc-store-api)
@@ -43,7 +44,7 @@ This chapter presents APIs available in openDesk grouped by applications.
  * [BCF API](#bcf-api)
 * [Video Conferencing - Jitsi](#video-conferencing---jitsi)
  * [IFrame API](#iframe-api)
-  * [Lib-jitsi-meet API](#lib-jitsi-meet-api)
+  * [lib-jitsi-meet API](#lib-jitsi-meet-api)
  * [Jitsi Meet React SDK](#jitsi-meet-react-sdk)
 * [Chat - Element](#chat---element)
  * [Matrix Application Service API](#matrix-application-service-api)
@@ -60,6 +61,7 @@ This chapter presents APIs available in openDesk grouped by applications.
  * [Scripting API](#scripting-api)
  * [Java API](#java-api)
  * [JavaScript API](#javascript-api)
+<!-- TOC -->

 # IAM - Nubus

--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -18,6 +18,8 @@ SPDX-License-Identifier: Apache-2.0
  * [OpenProject](#openproject)
  * [PostgreSQL](#postgresql)
  * [Keycloak](#keycloak)
+    * [Setting the log level](#setting-the-log-level)
+    * [Accessing the Keycloak admin console](#accessing-the-keycloak-admin-console)
 <!-- TOC -->

 # Disclaimer
@@ -198,6 +200,8 @@ While you will find all details in the [psql subsection](https://www.postgresql.

 ## Keycloak

+### Setting the log level
+
 Keycloak is the gateway to integrate other authentication management systems or applications. It can be desired to
 avoid enabling debug mode for the whole platform when you just need to look into Keycloak.

@@ -214,3 +218,9 @@ kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"dat

 > **Note**<br>
 > As the `ums-keycloak-extensions-handler` is performing frequent (one per second) requests to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.
+
+### Accessing the Keycloak admin console
+
+Deployments set to `debug.enable: true` expose the Keycloak admin console at `http://id.<your_opendesk_domain>/admin/`. This can also be achieved by updating the Ingress `ums-keycloak-extensions-proxy` with an additional path that allows access to `/admin/`.
+
+The admin console login is using the default Keycloak admin account `kcadmin` and the password from the secret `ums-opendesk-keycloak-credentials`.
--- a/docs/enhanced-configuration/idp-federation.md
+++ b/docs/enhanced-configuration/idp-federation.md
@@ -28,10 +28,10 @@ This document shows how to configure your organization's IdP and the openDesk Id

 We would like to list successful IdP federation scenarios, so we are also happy about input from the community:

-| External IdP                                                        | last openDesk version tested |
-| ------------------------------------------------------------------- | ---------------------------- |
-| [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0                       |
-| [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                       |
+| External IdP                                                        | openDesk versions tested |
+|---------------------------------------------------------------------|--------------------------|
+| [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0, v1.2.0           |
+| [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                   |

 # Prerequisites

--- a/docs/enhanced-configuration/matrix-federation.md
+++ b/docs/enhanced-configuration/matrix-federation.md
@@ -6,7 +6,6 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Matrix federation</h1>

 <!-- TOC -->
-* [Context](#context)
 * [Example configuration](#example-configuration)
  * [Disable federation](#disable-federation)
  * [Separate Matrix domain](#separate-matrix-domain)
--- a/docs/enhanced-configuration/separate-mail-matrix-domain.md
+++ b/docs/enhanced-configuration/separate-mail-matrix-domain.md
@@ -6,7 +6,6 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Separate domains for mail and or Matrix </h1>

 <!-- TOC -->
-* [Context](#context)
 * [Example configuration](#example-configuration)
  * [Mail domain](#mail-domain)
  * [Matrix domain](#matrix-domain)
--- a/docs/external-services.md
+++ b/docs/external-services.md
@@ -67,10 +67,10 @@ service.
 |                    |                    | Username  | `databases.umsSelfservice.username`           | `selfservice_user`           |
 |                    |                    | Password  | `databases.umsSelfservice.password`           |                              |
 | Nextcloud          | Nextcloud          |           |                                               |                              |
-|                    |                    | Type      | `databases.nextcloud.type`                    | `mariadb`                    |
+|                    |                    | Type      | `databases.nextcloud.type`                    | `postgresql`                 |
 |                    |                    | Name      | `databases.nextcloud.name`                    | `nextcloud`                  |
-|                    |                    | Host      | `databases.nextcloud.host`                    | `mariadb`                    |
-|                    |                    | Port      | `databases.nextcloud.port`                    | `3306`                       |
+|                    |                    | Host      | `databases.nextcloud.host`                    | `postgresql`                 |
+|                    |                    | Port      | `databases.nextcloud.port`                    | `5432`                       |
 |                    |                    | Username  | `databases.nextcloud.username`                | `nextcloud_user`             |
 |                    |                    | Password  | `databases.nextcloud.password`                |                              |
 | Notes              | Notes              |           |                                               |                              |
@@ -109,11 +109,11 @@ service.
 |                    |                    | Username  | `databases.dovecotDictmap.username`           | `dovecot_dictmap_user`       |
 |                    |                    | Password  | `databases.dovecotDictmap.password`           |                              |
 | XWiki[^4]          | XWiki              |           |                                               |                              |
-|                    |                    | Type      | `databases.xwiki.type`                        | `mariadb`                    |
+|                    |                    | Type      | `databases.xwiki.type`                        | `postgresql`                 |
 |                    |                    | Name      | `databases.xwiki.name`                        | `xwiki`                      |
-|                    |                    | Host      | `databases.xwiki.host`                        | `mariadb`                    |
-|                    |                    | Port      | `databases.xwiki.port`                        | `3306`                       |
-|                    |                    | Username  | `databases.xwiki.username`                    | `root`                       |
+|                    |                    | Host      | `databases.xwiki.host`                        | `postgresql`                 |
+|                    |                    | Port      | `databases.xwiki.port`                        | `5432`                       |
+|                    |                    | Username  | `databases.xwiki.username`                    | `xwiki_user`                 |
 |                    |                    | Password  | `databases.xwiki.password`                    |                              |

 # Object storage
--- a/docs/functional.md
+++ b/docs/functional.md
@@ -7,6 +7,11 @@ SPDX-License-Identifier: Apache-2.0

 This document addresses the available functional configuration options of an openDesk deployment.

+<!-- TOC -->
+* [Supported functional configuration](#supported-functional-configuration)
+* [Customization of functional options](#customization-of-functional-options)
+<!-- TOC -->
+
 ## Supported functional configuration

 While the openDesk applications allow a wide range of configuration options, only a small subset of them are supported by openDesk. This subset can be found in [`helmfile/environments/default/functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl)
@@ -27,4 +32,4 @@ The following categories are available. Each category contains a set of options
 In case the options from [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl) are not sufficient, you might want to look into [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl). The customizations give you control over all templating that is being done in openDesk, but be aware it is an unsupported approach, so in case you have a strong need for customizations, please let us know by opening a ticket. We will check if it is a use case that can be supported by implementing it as part of the aforementioned [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl).

 > **Note<br>**
-> You can not directly template your own values in the structure found in [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl), rather, you need to reference your custom value files to overwrite the openDesk defaults. In the app specific `helmfile-child.yaml.gotmpl` files, the openDesk value files are referenced first, then afterwards, the files you define in the customizations are read. 
+> You can not directly template your own values in the structure found in [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl), rather, you need to reference your custom value files to overwrite the openDesk defaults. In the app specific `helmfile-child.yaml.gotmpl` files, the openDesk value files are referenced first, then afterwards, the files you define in the customizations are read.
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -21,8 +21,6 @@ This documentation lets you create an openDesk evaluation instance on your Kuber
    * [Container runtime](#container-runtime)
    * [Volumes](#volumes)
  * [Customize deployment](#customize-deployment)
-    * [Functional features](#functional-features)
-    * [Features through Customization](#features-through-customization)
  * [Connectivity](#connectivity)
    * [Ports](#ports)
      * [Web-based user interface](#web-based-user-interface)
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -9,6 +9,9 @@ SPDX-License-Identifier: Apache-2.0
 * [Disclaimer](#disclaimer)
 * [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
 * [Manual checks/actions](#manual-checksactions)
+  * [From v1.1.2](#from-v112)
+      * [Helmfile cleanup: Do not configure OX provisioning when no OX installed](#helmfile-cleanup-do-not-configure-ox-provisioning-when-no-ox-installed)
+      * [Helmfile new default: PostgreSQL for XWiki and Nextcloud](#helmfile-new-default-postgresql-for-xwiki-and-nextcloud)
  * [From v1.1.1](#from-v111)
    * [Pre-upgrade from v1.1.1](#pre-upgrade-from-v111)
      * [Helmfile feature update: App settings wrapped in `apps.` element](#helmfile-feature-update-app-settings-wrapped-in-apps-element)
@@ -47,6 +50,9 @@ SPDX-License-Identifier: Apache-2.0
      * [Updated customizable template attributes](#updated-customizable-template-attributes)
      * [`migrations` S3 bucket](#migrations-s3-bucket)
 * [Automated migrations - Details](#automated-migrations---details)
+  * [From v1.1.2 (automated)](#from-v112-automated)
+    * [migrations-pre](#migrations-pre)
+    * [migrations-post](#migrations-post)
  * [From v1.0.0 (automated)](#from-v100-automated)
  * [From v0.9.0 (automated)](#from-v090-automated)
  * [Related components and artifacts](#related-components-and-artifacts)
@@ -75,6 +81,7 @@ To upgrade existing deployments, you cannot skip any version mentioned in the co

 | Mandatory version |
 | ----------------- |
+| v1.2.x            |
 | v1.1.x            |
 | v1.0.0            |
 | v0.9.0            |
@@ -89,6 +96,67 @@ When interested in more details about the automated migrations, please read sect

 Be sure you check all the sections for the releases your are going to update your current deployment from.

+## From v1.1.2
+
+#### Helmfile cleanup: Do not configure OX provisioning when no OX installed
+
+**Target group:** Installations that have no OX App Suite installed.
+
+With openDesk 1.2.0 the OX provisioning consumer will not be registered when there is no OX installed.
+
+We do not remove the consumer for existing installations, if you want to do that for your existing installation please perform the following steps:
+
+```
+export NAMESPACE=<your_namespace>
+kubectl -n ${NAMESPACE} exec -it ums-provisioning-nats-0 -c nats-box -- sh -c 'nats consumer rm stream:ox-connector durable_name:ox-connector --user=admin --password=${NATS_PASSWORD} --force'
+kubectl -n ${NAMESPACE} exec -it ums-provisioning-nats-0 -c nats-box -- sh -c 'nats stream rm stream:ox-connector --user=admin --password=${NATS_PASSWORD} --force'
+kubectl -n ${NAMESPACE} delete secret ums-provisioning-ox-credentials-test
+```
+
+#### Helmfile new default: PostgreSQL for XWiki and Nextcloud
+
+**Target group:** All upgrade installations that do not already use the previous optional PostgreSQL database backend for Nextcloud and XWiki.
+
+openDesk now uses PostgreSQL as default database backend for Nextcloud and XWiki.
+
+When upgrading existing instances you likely want to keep the current database backend (MariaDB).
+
+**Use case A:** You use your own external database services, if not see "Use case B" further down.
+
+You just have to add the new `type` attribute and set it to `mariadb`:
+
+```yaml
+databases:
+  nextcloud:
+    type: "mariadb"
+  xwiki:
+    type: "mariadb"
+```
+
+**Use case B:** You use the openDesk supplied database services.
+
+Ensure you set the following attributes before upgrading, this includes the aforementioned `type` attribute.
+
+```yaml
+databases:
+  nextcloud:
+    type: "mariadb"
+    host: "mariadb"
+    port: 3306
+  xwiki:
+    type: "mariadb"
+    host: "mariadb"
+    port: 3306
+    username: "root"
+```
+
+In case you are planning to migrate an existing instance from MariaDB to PostgreSQL please check the upstream documentation for details:
+
+- Nextcloud database migration: https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
+- XWiki:
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
+
 ## From v1.1.1

 ### Pre-upgrade from v1.1.1
@@ -604,6 +672,20 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0

 # Automated migrations - Details

+## From v1.1.2 (automated)
+
+> **Note**<br>
+> Details can be found in [run_4.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_4.py).
+
+### migrations-pre
+
+- Delete PVC `group-membership-cache-ums-portal-consumer-0`: With the upgrade the Nubus Portal Consumer no longer requires to be executed with root privileges. The PVC contains files that require root permission to access them, therefore the PVC gets deleted (and re-created) during the upgrade.
+- Delete StatefulSet `ums-portal-consumer`: A bug was fixed in the templating of the Portal Consumer's PVC causing the values in `persistence.storages.nubusPortalConsumer.*` to be ignored. As these values are immutable, we had to delete the whole StatefulSet.
+
+### migrations-post
+
+- Restarting Deployment `ums-provisioning-udm-transformer` and StatefulSet `ums-provisioning-udm-listener` as well as deleting the Nubus Provisioning consumer `durable_name:incoming` on stream `stream:incoming`: Due to a bug in Nubus 1.7.0 the `incoming` stream was blocked after the upgrade, the aforementioned measures unblock the stream.
+
 ## From v1.0.0 (automated)

 With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.
--- a/docs/monitoring.md
+++ b/docs/monitoring.md
@@ -14,7 +14,7 @@ well as the overall status of monitoring integration.
 * [Metrics](#metrics)
 * [Alerts](#alerts)
 * [Dashboards for Grafana](#dashboards-for-grafana)
-* [Components](#components)
+* [Component overview](#component-overview)
 <!-- TOC -->

 # Technology
--- a/docs/phone-dial-in/architcture.drawio.png
+++ b/docs/phone-dial-in/architcture.drawio.png
--- a/docs/phone-dial-in/notes.md
+++ b/docs/phone-dial-in/notes.md
@@ -0,0 +1,200 @@
+# Phone dial in
+
+
+![alt text](architcture.drawio.png)
+
+#### Dial-in related jitsi configs
+
+https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-jitsi/-/blob/main/charts/opendesk-jitsi/values.yaml?ref_type=heads#L226-230
+
+`values.yaml`
+```yaml
+extraConfig:
+    doNotStoreRoom: false
+    dialinCountryCode: "DE"
+    # e.g. "+49 1111 22233344"
+    dialinPhoneNumbers: ""
+extraEnvs:
+    COLIBRI_WEBSOCKET_REGEX: "[a-z0-9._-]+"
+    # This value will be replace with internal conference mapper later when
+    # it is ready.
+    CONFCODE_URL: "https://jitsi-api.jitsi.net/conferenceMapper"
+    DIALIN_NUMBERS_URL: "/static/dialin-phone-numbers.json"
+```
+
+The template to generate the `dial-phone-numbers.json`
+https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-jitsi/-/blob/main/charts/opendesk-jitsi/files/web/dialin-phone-numbers.json?ref_type=heads
+
+
+### Frontend and the k8s NGINX ingress
+
+The frontend uses large cookies, the default "4k" for the nginx proxy is not enough.
+
+Modify the value in the ingress annotations
+```
+annotations:
+    nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
+```
+
+Reference https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md#proxy-buffer-size
+
+
+## 1. ovc-frontent -> opendesk
+
+ovc-frontend env
+```properties
+NEXT_PUBLIC_ICS_DOMAIN=https://ics.nightly.opendesk.qa
+NEXT_PUBLIC_PORTAL_DOMAIN=https://portal.nightly.opendesk.qa
+```
+
+## 2. ovc-frontend -> jitsi
+
+ovc-frontend env
+```properties
+NEXT_PUBLIC_JITSI_LINK=https://jitsi.opendesk.qa
+```
+
+## 3. ovc-frontend -> keycloak
+
+[NEXTAUTH_SECRET](https://next-auth.js.org/configuration/options#nextauth_secret)
+
+client_id and client_secret provided by keycloak.
+end_session and refresh urls can be found in keycloak `keycloak.com/realms/{realm}/.well-known` page.
+
+
+ovc-frontend env
+```properties
+KEYCLOAK_CLIENT_ID=ovc-client
+KEYCLOAK_CLIENT_SECRET=clientSecret
+NEXTAUTH_SECRET=clientSecret
+KEYCLOAK_ISSUER=https://KEYCLOAK.io/realms/opendesk
+END_SESSION_URL=https://KEYCLOAK.io/realms/opendesk/protocol/openid-connect/logout
+REFRESH_TOKEN_URL=https://KEYCLOAK.io/realms/opendesk/protocol/openid-connect/token
+
+```
+
+## 4. ovc-frontend -> ovc-backend
+
+ovc-frontend env
+```properties
+NEXT_PUBLIC_BACKEND_BASE_URL=https://api.opendesk.qa
+```
+
+## 5. ovc-frontend <-> ovc-videotest
+
+OPTIONAL, can be disabled and th videotest button will be hidden.
+
+ovc-frontend env
+```properties
+NEXT_PUBLIC_VIDEO_TEST_ENABLED=true
+NEXT_PUBLIC_VIDEO_TEST_LINK=https://videotest.opendesk.qa
+```
+
+
+## 6. ovc-backend -> postgres
+
+backend env vars
+```
+spring.datasource.password=secret
+spring.datasource.url=jdbc:postgresql://{{ $dbService }}:5432/{{ db.name }}
+spring.datasource.username=user
+```
+
+## 7. ovc-backend -> keycloak
+
+```
+spring.security.oauth2.resourceserver.jwt.issuer-uri={{ .Values.settings.keycloak.url }}/realms/{{ .Values.settings.keycloak.realm }}
+```
+
+## 8. JITSI -> ovc-backend
+
+#### Conference mapper for dial-in
+
+
+Phone line users that use a regular phone to attend a jitsi meeting can only enter numbers after they have dialed in a phone number. For Jitsi and the SIP server to know which conference they are calling into a mapping is created `conference name <-> pin number (conference code)`. A conference mapper api allows an external system to find a conference name by pin number or a pin number from a conference name.
+
+
+
+Jitsi uses `CONFCODE_URL` env param that "conference mapper" conference search api, it will use the `search pin by conference` functionality to present a dialog with a PIN number if a dial-in user wishes to know it.
+
+In the dial-in backend the endpoint has this template 
+`/api/v1.0/conference-mapper/jigasi/by-meeting-id?conference=`
+
+jitsi-meet configuration environment can be set like this
+```
+CONFCODE_URL=https://backend.domain/api/v1.0/conference-mapper/jigasi/by-meeting-id
+```
+
+SIP server may use a `search conference id by pin`  functionality api from the dial-in backend conference mapper.
+`/api/v1.0/conference-mapper/jigasi/by-pin?id={pin}`
+
+
+> The way a SIP server communicates with the dial-in backend conference mapper and JIGASI (Jitsi component) depends on the SIP server vendor, this is outside the scope of this document. 
+
+
+Jitsi implementation of the conference mapper API is  described in 
+https://github.com/jitsi/jitsi-meet/blob/master/resources/cloud-api.swagger
+They support a `/conferenceMapper` api endpoint that can search by `id` (pin) or `conference`. So both Jitsi and the SIP server can connect to a sigle endpoint. In the ovc-backend it's separated into 2 endpoints.
+
+
+## ovc-backend SIP config
+
+Used in "Copy Info" button functionality.
+```properties
+sip.phone.number=+49 40 3003 5005
+```
+
+## ovc-backend JWT token api 
+
+OPTIONAL, may be needed if jitsi requires a JWT token. 
+
+```yaml
+## this is part of Spring Boot  application.yaml, can also be provided as env vars
+jitsi:
+  domain: https://jitsi.opendesk.domain
+  jwt:
+    secret: oeRaYY7
+    expiration-in-minutes: 60              # how much longer after meeting end time the token is valid
+    expiration-for-rooms-in-minutes: 180   # same as above, but for rooms and instant meetings
+    not-before-in-minutes: 30              # how many minutes earlier the meeting can be opened
+```
+
+## ovc-videotest
+
+Optional component, phone dial-in can function without it. 
+
+It's a frontend only and doesn't require a backend to function. Configured by mounting a file in `/app/build/config/config.js`
+
+`config.js` example
+```js
+window.customConfig = {
+    // jitsi host
+    "REACT_APP_JITSI_FQDN": "meet.jit.si",
+    
+    // If jitsi requires a JWT, point it to a running ovc-videotest-backend api that 
+    // will return a token for a specific room. {roomName} is a special hardcoded  placeholder that will be replaced by the real room name when the api is being called (to make the api call flexible).
+    // "REACT_APP_JWT_ENDPOINT_URL": "http://localhost:8081/{roomName}",
+    
+    // prefix for videotest rooms. If a backend is used it may reject generating a JWT token if a room name doesn't have this prefix
+    "REACT_APP_ROOM_PREFIX":"videotest",
+
+    // if no callback parameter is provided, should be the ovc-frontend url
+    "REACT_APP_DEFAULT_CALLBACK_URL":"http://localhost:8080",
+
+    // to improve security only URLS in the list are allowed as callbacks
+    // if the list is empty any callback url is allowed
+    "REACT_APP_ALLOWED_CALLBACK_URLS":"http://localhost:3000,https://localhost:3000",
+    
+    // If you don't have a backend and jitsi requires a JWT token, for debugging purposes put the entire JWT here.
+    "REACT_APP_DEBUG_JITSI_JWT": ""
+}
+```
+
+
+
+
+
+
+
+
+ 
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -25,8 +25,8 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)

 - K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
- Ingress controller (Ingress NGINX) == [4.11.x/1.11.x](https://github.com/kubernetes/ingress-nginx/releases) - tested with 1.11.1 up to 1.11.4
-  - **Note**: We are working on support for more recent versions, as issues have been reported with 1.12.x.
+- Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases) - tested with 1.11.1 up to 1.11.5
+  - **Important Note**: We are working on support for more recent versions, but please ensure to use at least 1.11.5 due to ["security issues"](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) in earlier versions.
 - [Helm](https://helm.sh/) >= v3.9.0
 - [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc8**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
--- a/docs/security-context.md
+++ b/docs/security-context.md
@@ -155,7 +155,7 @@ This list gives you an overview of templated security settings and if they compl
 | **element**/matrix-neodatefix-bot-bootstrap | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/matrix-neodatefix-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-element | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
-| **element**/opendesk-matrix-user-verification-service | :x: | no | no | no | no | 0 | 0 | yes | yes |
+| **element**/opendesk-matrix-user-verification-service | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **element**/opendesk-matrix-user-verification-service-bootstrap | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-synapse | :white_check_mark: | no | no | yes | yes | 10991 | 10991 | yes | yes |
 | **element**/opendesk-synapse-web | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
@@ -210,6 +210,7 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/nextcloud-integration-ui | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/opendesk-open-xchange-bootstrap | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/postfix-ox | :x: | yes | yes | yes | no | 0 | 0 | yes | no |
 | **opendesk-migrations-post**/opendesk-migrations-post | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **opendesk-migrations-pre**/opendesk-migrations-pre | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **opendesk-openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
@@ -226,7 +227,7 @@ This list gives you an overview of templated security settings and if they compl
 | **services-external**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services-external**/minio | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services-external**/opendesk-dkimpy-milter | :x: | yes | no | yes | yes | 1000 | 1000 | yes | no |
-| **services-external**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
+| **services-external**/postfix | :x: | yes | yes | yes | no | 0 | 0 | yes | no |
 | **services-external**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services-external**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |
--- a/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
+++ b/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
@@ -25,6 +25,7 @@ controller:
 image:
  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collaboraController.registry }}/{{ .Values.images.collaboraController.repository }}"
  tag: {{ .Values.images.collaboraController.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
  - name: {{ . | quote }}
@@ -38,6 +39,10 @@ ingress:
      paths:
        - path: "/controller"
          pathType: "Prefix"
+  tls:
+    - secretName: {{ .Values.ingress.tls.secretName | quote }}
+      hosts:
+        - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"

 podAnnotations: {}

--- a/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
@@ -74,7 +74,7 @@ releases:
    installed: {{ .Values.apps.nubus.enabled }}
    timeout: 900

-  # NGINX S3 Gateway (when cluster minio is not used)
+  # NGINX S3 Gateway
  - name: "nubus"
    chart: "nginx-s3-gateway-repo/{{ .Values.charts.nginxS3Gateway.name }}"
    version: "{{ .Values.charts.nginxS3Gateway.version }}"
@@ -83,7 +83,7 @@ releases:
      {{- range .Values.customization.release.nginxS3Gateway }}
      - {{ . }}
      {{- end }}
-    installed: {{ not .Values.apps.minio.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl
@@ -3,6 +3,10 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+global:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
 image:
  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nginxS3Gateway.registry | quote }}
  repository: {{ .Values.images.nginxS3Gateway.repository | quote }}
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -17,13 +17,8 @@ global:
      cnAdmin:
        password: {{ .Values.secrets.nubus.ldapSecret | quote }}
  nubusDeployment: true
-  nubusMasterPassword: {{ .Values.secrets.nubus.masterpassword | quote }}
-  objectStorage:
-    bucket: {{ .Values.objectstores.nubus.bucket | quote }}
-    connection:
-      host: "minio"
-      port: "9000"
-      protocol: "http"
+  secrets:
+    masterPassword: {{ .Values.secrets.nubus.masterpassword | quote }}
  subDomains:
    portal: {{ .Values.global.hosts.nubus | quote }}
    keycloak: {{ .Values.global.hosts.keycloak | quote }}
@@ -133,6 +128,8 @@ ingress:
  tls:
    enabled: {{ .Values.ingress.tls.enabled }}
    secretName: {{ .Values.ingress.tls.secretName | quote }}
+  minio:
+    enabled: false

 # Nubus bundled services
 postgresql:
@@ -583,16 +580,18 @@ nubusPortalConsumer:
        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . | quote }}
        {{- end }}
+    assetsBaseUrl: {{ printf "https://%s.%s/univention/portal" .Values.global.hosts.nubus .Values.global.domain | quote }}
    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
-    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
-    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
  objectStorage:
    auth:
      accessKey: {{ .Values.objectstores.nubus.username | quote }}
      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+    bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
+    endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
  persistence:
-    size: {{ .Values.persistence.storages.nubusPortalConsumer.size | quote }}
-    storageClass: {{ coalesce .Values.persistence.storages.nubusPortalConsumer.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+    groupMembershipCache:
+      size: {{ .Values.persistence.storages.nubusPortalConsumer.size | quote }}
+      storageClass: {{ coalesce .Values.persistence.storages.nubusPortalConsumer.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
  podAnnotations:
    intents.otterize.com/service-name: "ums-portal-consumer"
  provisioningApi:
@@ -682,16 +681,18 @@ nubusPortalServer:
    auth:
      accessKey: {{ .Values.objectstores.nubus.username | quote }}
      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
-  portalServer:
-    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
-    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
+    bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
+    endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
    objectStorageCredentialSecret:
      name: "ums-portal-server-minio-opendesk-credentials"
      accessKeyKey: "access-key-id"
      secretKeyKey: "secret-key-id"
+  portalServer:
    centralNavigation:
      enabled: true
      authenticatorSecretName: "ums-opendesk-portal-server-central-navigation"
+    featureToggles:
+      notifications_api: false
  replicaCount: {{ .Values.replicas.umsPortalServer }}
  resources:
    {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
@@ -827,6 +828,7 @@ nubusLdapServer:
  replicaCountPrimary: {{ .Values.replicas.umsLdapServerPrimary }}
  replicaCountSecondary: {{ .Values.replicas.umsLdapServerSecondary }}
  replicaCountProxy: {{ .Values.replicas.umsLdapServerProxy }}
+  resources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
  resourcesPrimary: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
  resourcesSecondary: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
  serviceAccount:
@@ -972,12 +974,14 @@ nubusProvisioning:
  registerConsumers:
    additionalAnnotations:
      intents.otterize.com/service-name: "ums-provisioning-register-consumers"
+    {{- if .Values.apps.oxAppSuite.enabled }}
    createUsers:
      oxConsumer:
        existingSecret:
          name: ums-provisioning-ox-credentials
          keyMapping:
            password: "ox-connector.json"
+    {{- end }}
    image:
      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
      repository: {{ .Values.images.nubusWaitForDependency.repository }}
@@ -1017,6 +1021,9 @@ nubusUdmListener:
  replicaCount: {{ .Values.replicas.umsUdmListener }}
  resources:
    {{ .Values.resources.umsUdmListener | toYaml | nindent 4 }}
+  nats:
+    auth:
+      password: {{ .Values.secrets.nubus.provisioning.udmListenerNatsPassword | quote}}

 nubusSelfServiceListener:
  enabled: false
@@ -1055,6 +1062,8 @@ nubusSelfServiceConsumer:
      password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}
  resources:
    {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
+  resourcesWaitForDependency:
+    {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
  replicaCount: {{ .Values.replicas.umsSelfserviceConsumer }}
  waitForDependency:
    image:
@@ -1088,6 +1097,14 @@ nubusStackDataUms:
    repository: {{ .Values.images.nubusDataLoader.repository }}
    tag: {{ .Values.images.nubusDataLoader.tag }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  nubusPortalConsumer:
+    objectStorage:
+      bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
+      endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
+  nubusPortalServer:
+    objectStorage:
+      bucketName: {{ .Values.objectstores.nubus.bucket | quote }}
+      endpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
  initResources:
    {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}
  # In openDesk the external memcache does not expect a username to be set. Overwriting
@@ -1096,6 +1113,13 @@ nubusStackDataUms:
    memcached:
      auth:
        username: ""
+      connection:
+        host: {{ .Values.cache.umsSelfservice.host | quote }}
+    postgresql:
+      auth:
+        username: {{ .Values.databases.umsSelfservice.username | quote }}
+      connection:
+        host: {{ .Values.databases.umsSelfservice.host | quote }}
  pullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
  resources:
@@ -1383,6 +1407,12 @@ nubusKeycloakBootstrap:
    intents.otterize.com/service-name: "ums-keycloak-bootstrap"
  resources:
    {{ .Values.resources.umsKeycloakBootstrap | toYaml | nindent 4 }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 # Credential secrets for accessing customer supplied services
 extraSecrets:
--- a/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
@@ -24,14 +24,16 @@ dovecot:
    host: {{ .Values.databases.dovecotDictmap.host | quote }}
    port: {{ .Values.databases.dovecotDictmap.port }}
    username: {{ .Values.databases.dovecotDictmap.username | quote }}
-    password: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
+    password:
+      value: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
    keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
  sharedMailboxes:
    enabled: false
    host: {{ .Values.databases.dovecotACL.host | quote }}
    port: {{ .Values.databases.dovecotACL.port }}
    username: {{ .Values.databases.dovecotACL.username | quote }}
-    password: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
+    password:
+      value: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
    keyspace: {{ .Values.databases.dovecotACL.name | quote }}
  objectStorage:
    encryption:
@@ -41,5 +43,6 @@ dovecot:
        value: {{ env "DOVECOT_CRYPT_PUBLIC_KEY" | quote }}
    fqdn: {{ .Values.objectstores.dovecot.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
    username: {{ .Values.objectstores.dovecot.username | quote }}
-    password: {{ .Values.secrets.minio.dovecotUser | quote }}
+    password:
+      value: {{ .Values.secrets.minio.dovecotUser | quote }}
 ...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -10,26 +10,37 @@ image:
  tag: {{ .Values.images.dovecot.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}

+imageInitDovecot:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.dovecotBootstrap.registry | quote }}
+  repository: {{ .Values.images.dovecotBootstrap.repository | quote }}
+  tag: {{ .Values.images.dovecotBootstrap.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
 imagePullSecrets:
  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}

 dovecot:
  mailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
-  password: {{ .Values.secrets.dovecot.doveadm | quote }}
+  password:
+    value: {{ .Values.secrets.dovecot.doveadm | quote }}
  migration:
    enabled: {{ .Values.functional.migration.oxAppSuite.enabled }}
-    masterPassword: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
+    masterPassword:
+      value: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
  ldap:
    enabled: true
    host: {{ .Values.ldap.host | quote }}
    port: 389
    base: "{{ .Values.ldap.baseDn }}"
    dn: "uid=ldapsearch_dovecot,cn=users,{{ .Values.ldap.baseDn }}"
-    password: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
+    password:
+      value: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
  oidc:
    enabled: true
-    clientID: "opendesk-dovecot"
-    clientSecret: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
+    clientID:
+      value: "opendesk-dovecot"
+    clientSecret:
+      value: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
    introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
    introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
    usernameAttribute: "opendesk_username"
--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -71,8 +71,10 @@ postfix:

  staticAuthDB:
    enabled: true
-    username: "opendesk-system"
-    password: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+    username:
+      value: "opendesk-system"
+    password:
+      value: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}

  {{- if .Values.antivirus.milter.host }}
  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
--- a/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
@@ -6,7 +6,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/product-development/charts/opendesk-dovecot-pro"
    name: "dovecot"
-    version: "1.0.1"
+    version: "2.0.2"
    verify: true
  oxAppSuite:
    registry: "registry.opencode.de"
--- a/helmfile/environments/default/charts.yaml.gotmpl
+++ b/helmfile/environments/default/charts.yaml.gotmpl
@@ -99,7 +99,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-dovecot"
    name: "dovecot"
-    version: "1.4.2"
+    version: "2.0.0"
    verify: true
  element:
    # providerCategory: "Platform"
@@ -109,7 +109,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-element"
-    version: "6.1.2"
+    version: "6.1.3"
    verify: true
  elementWellKnown:
    # providerCategory: "Platform"
@@ -119,7 +119,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-well-known"
-    version: "6.1.2"
+    version: "6.1.3"
    verify: true
  home:
    # providerCategory: "Platform"
@@ -211,7 +211,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-matrix-user-verification-service"
-    version: "6.1.2"
+    version: "6.1.3"
    verify: true
  memcached:
    # providerCategory: "Community"
@@ -231,7 +231,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
    name: "opendesk-migrations"
-    version: "1.4.1"
+    version: "1.6.0"
    verify: true
  minio:
    # providerCategory: "Community"
@@ -251,7 +251,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud"
-    version: "4.0.1"
+    version: "4.0.3"
    verify: true
  nextcloudManagement:
    # providerCategory: "Platform"
@@ -261,7 +261,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud-management"
-    version: "4.0.1"
+    version: "4.0.3"
    verify: true
  nginx:
    # providerCategory: "Community"
@@ -303,7 +303,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
    name: "nubus"
-    version: "1.5.1"
+    version: "1.7.0"
    verify: true
  opendeskAlerts:
    # providerCategory: "Platform"
@@ -355,7 +355,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
    name: "openproject"
-    version: "9.8.1"
+    version: "9.8.3"
    verify: true
  openprojectBootstrap:
    # providerCategory: "Platform"
@@ -419,7 +419,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix"
    name: "postfix"
-    version: "2.3.3"
+    version: "3.0.0"
    verify: true
  postgresql:
    # providerCategory: "Platform"
@@ -449,7 +449,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse"
-    version: "6.1.2"
+    version: "6.1.3"
    verify: true
  synapseAdmin:
    # Enterprise Component
@@ -477,7 +477,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-create-account"
-    version: "6.1.2"
+    version: "6.1.3"
    verify: true
  synapseGroupsync:
    # Enterprise Component
@@ -505,7 +505,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-web"
-    version: "6.1.2"
+    version: "6.1.3"
    verify: true
  xwiki:
    # providerCategory: "Supplier"
@@ -517,6 +517,6 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
    name: "xwiki"
-    version: "1.4.3"
+    version: "1.4.4"
    verify: false
 ...
--- a/helmfile/environments/default/database.yaml.gotmpl
+++ b/helmfile/environments/default/database.yaml.gotmpl
@@ -40,11 +40,10 @@ databases:
    password: ""
    connectionLimit: ~
  nextcloud:
-    # Nextcloud itself also supports `postgresql` or `oci`
-    type: "mariadb"
+    type: "postgresql"
    name: "nextcloud"
-    host: "mariadb"
-    port: 3306
+    host: "postgresql"
+    port: 5432
    username: "nextcloud_user"
    password: ""
    connectionLimit: ~
@@ -125,12 +124,11 @@ databases:
    password: ""
    connectionLimit: 10
  xwiki:
-    # XWiki itself also supports `postgresql`
-    type: "mariadb"
+    type: "postgresql"
    name: "xwiki"
-    host: "mariadb"
-    port: 3306
-    username: "root"
+    host: "postgresql"
+    port: 5432
+    username: "xwiki_user"
    password: ""
    connectionLimit: ~
 ...
--- a/helmfile/environments/default/global.generated.yaml.gotmpl
+++ b/helmfile/environments/default/global.generated.yaml.gotmpl
@@ -3,5 +3,5 @@
 ---
 global:
  systemInformation:
-    releaseVersion: "v1.1.2"
+    releaseVersion: "v1.2.1"
 ...
--- a/helmfile/environments/default/images.yaml.gotmpl
+++ b/helmfile/environments/default/images.yaml.gotmpl
@@ -77,6 +77,14 @@ images:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images/dovecot-public-sector"
    tag: "2.3.21@sha256:c76965a84d1ca527f523404eb027119f6736b199c094e4671037cb345ecad3dc"
+  dovecotBootstrap:
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "alpine/k8s"
+    registry: "registry-1.docker.io"
+    repository: "alpine/k8s"
+    tag: "1.32.3@sha256:eec3541331932d8613ce7b3283508063cba7f704302e9b4eda45e49b38a2a0f9"
  element:
    # providerCategory: "Supplier"
    # providerResponsible: "Element"
@@ -295,7 +303,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
-    tag: "1.4.1@sha256:c831f3bb27da483cbf46239d8f96df9597f710fbe3804f198ee1d89b1be71936"
+    tag: "1.6.0@sha256:67ac4872f879b3ef3e27924754b3f89c6bdb158c22bd91c6c7c484aa2fed91ce"
  milter:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -369,7 +377,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "41", "5"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/data-loader"
-    tag: "0.80.2@sha256:04b4b928e5e957f6544b6e0af32c75340cfacf182a78e03bc1a65bdf9f8d9e5d"
+    tag: "0.87.0@sha256:b45af938d7b0c3138054a859985e60c76c8a79caeb1dc31a6cd4189035bb07b7"
  nubusGuardianAuthorizationApi:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -418,8 +426,8 @@ images:
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+).+$'
    # upstreamMirrorStartFrom: ["22", "0", "3"]
    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-keycloak"
-    tag: "25.0.1-ucs1@sha256:61cb3e703672f6d8806af41bec8056ca84e295bbeb546fdb5349322d1174a43d"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak"
+    tag: "25.0.6-ucs5@sha256:8e9df64f9b6c5ce6e5f0ae732f0aadc928e13e7166236bd16bf647b92dad22bb"
  nubusKeycloakBootstrap:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -459,7 +467,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "8", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-notifier"
-    tag: "0.29.1@sha256:c06923e8d9190a83d94b2f3e429d8ae812f09fbb9f89b5689d3e221ccbbcd1ab"
+    tag: "0.33.0@sha256:1aed364bff3a5ce8fe6c19e6c8914a3243f7a0684c3ea9330fc61bcb6cbe4cac"
  nubusLdapServer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -469,7 +477,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "8", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server"
-    tag: "0.29.1@sha256:0d3f136572849311490d2b616fa948bb6c97a6df9517fcc3770264ed8ee5c8e6"
+    tag: "0.33.0@sha256:9354c79788ac48820ac781463e50f6ee315bf352b4ae384c3355124347953aa8"
  nubusLdapServerDhInitContainer:
    # providerCategory: 'Community'
    # providerResponsible: 'Univention'
@@ -477,7 +485,7 @@ images:
    # upstreamRepository: 'natsio/nats-box'
    registry: "registry-1.docker.io"
    repository: "natsio/nats-box"
-    tag: "0.14.2@sha256:c9b8ebaabb2ca4c227feb4f6b856dc72d4775ac3d71f80d2c65aa82303079011"
+    tag: "0.16.0-nonroot@sha256:f486ca86dfc9b72a2310ea720994a94ce55e447ad01daccd2fb33d61f322dc51"
  nubusLdapServerLeaderElector:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -487,7 +495,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "29", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server-elector"
-    tag: "0.31.1@sha256:70d23a5055acb2bcaaa629e78b2168355efebab20047a40a8f410b1ce0f624e2"
+    tag: "0.33.0@sha256:c1304a156094b276199fb263baf93e3704ceece478d7f663061b1b1f05f5931c"
  nubusNats:
    # providerCategory: 'Community'
    # providerResponsible: 'Univention'
@@ -495,7 +503,7 @@ images:
    # upstreamRepository: 'library/nats'
    registry: "registry-1.docker.io"
    repository: "library/nats"
-    tag: "2.10.10@sha256:fa26beda8a3187ccefa47afcfe9ea6d0e2f40a57c8f64d70bd63c792d7973938"
+    tag: "2.10.26@sha256:736d575e60135ce1d50fc206675d48d0e57dcaa0704f696f0cb4b5f6dadd49d7"
  nubusNatsBox:
    # providerCategory: 'Community'
    # providerResponsible: 'Univention'
@@ -503,7 +511,7 @@ images:
    # upstreamRepository: 'natsio/nats-box'
    registry: "registry-1.docker.io"
    repository: "natsio/nats-box"
-    tag: "0.14.2@sha256:c9b8ebaabb2ca4c227feb4f6b856dc72d4775ac3d71f80d2c65aa82303079011"
+    tag: "0.16.0-nonroot@sha256:f486ca86dfc9b72a2310ea720994a94ce55e447ad01daccd2fb33d61f322dc51"
  nubusNatsReloader:
    # providerCategory: 'Community'
    # providerResponsible: 'Univention'
@@ -511,7 +519,7 @@ images:
    # upstreamRepository: 'natsio/nats-server-config-reloader'
    registry: "registry-1.docker.io"
    repository: "natsio/nats-server-config-reloader"
-    tag: "0.14.1@sha256:77dd4c60001ffbf442c6b25592e73b4fca06ea9406c677607192788d80453783"
+    tag: "0.17.1@sha256:f364bb8330d3430666ca09f17c6a43bfaefde32f0f3e79d4a41c588c29936e99"
  nubusNotificationsApi:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -521,7 +529,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/notifications-api"
-    tag: "0.48.3@sha256:7d4e8e0a6fb6be2b3f1e5f0db49375d7a0a5820fc7517b685b2109dac00ea823"
+    tag: "0.55.0@sha256:845d027becc48892314ed9bed4f2c78feaa63d632fcded2fe1cdc6458b1ba831"
  nubusOpendeskExtension:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -567,7 +575,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "27", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-consumer"
-    tag: "0.48.3@sha256:329ad2fbfdba2fb3cb0b170158f9fdff8786c0f1e24537d16a197432e0d0f2d0"
+    tag: "0.55.0@sha256:919b4de5d2ef27e239f1d3e944ab58dfaa3e5ef52b865a31fe465da165b03eed"
  nubusPortalExtension:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -577,7 +585,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "28", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-extension"
-    tag: "0.44.3@sha256:734efc0adda680526dde09387db964612f9e0ab020382580984488cc993c68f0"
+    tag: "0.55.0@sha256:6f4fff6a53ffb8be858f3a06e9832b90f773500877dd8ab0e20da82008f3d964"
  nubusPortalFrontend:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -595,7 +603,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-server"
-    tag: "0.48.3@sha256:331a3f247d3c3d496ee1be78d71b6c737666f2fbf0bced1985e2edb295729e59"
+    tag: "0.55.0@sha256:bb9d73f1a75cf50073d7f8f8cfbeeecce930a7370cb80f1c543956aa669f7fd4"
  nubusProvisioningDispatcher:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -605,7 +613,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-dispatcher"
-    tag: "0.48.1@sha256:0fac927b2690d6b704e4918102adcbd971effd2cf4af2fb7b86aba5902788a8e"
+    tag: "0.49.1@sha256:3ebc70a95749504f771e257187854d6bd3623fe9b0f8085aa4116e5290db9beb"
  nubusProvisioningEventsAndConsumerApi:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -615,7 +623,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-events-and-consumer-api"
-    tag: "0.48.1@sha256:042633fbf98f9600fa79103476871f4754aab5633b0d04ad4aae780e80f685f4"
+    tag: "0.49.1@sha256:8ad56dc861fa4880c100ba9efffe75398e8b077e4eeb673dadac34cfe44aa1ba"
  nubusProvisioningPrefill:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -625,7 +633,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-prefill"
-    tag: "0.48.1@sha256:6019d3ab31a69c46c12addb7b7ede30e9b25d236169f3bb4bde678d576f207d3"
+    tag: "0.49.1@sha256:3b3eac87ca6dd140236e8a36cd5b42efceb33013beb836f1caeff85ff700a570"
  nubusProvisioningUdmListener:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -635,7 +643,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-listener"
-    tag: "0.48.1@sha256:39aeb312e0148400b54184dbbe4595cd75e8dc62c0abfaaf56efc863f2486810"
+    tag: "0.49.1@sha256:4534ec7c0ee1af3a1eabd4a39cc28c5ddc225e0c3a6bea31a0d6cdf6dcb11147"
  nubusProvisioningUdmTransformer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -645,7 +653,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-transformer"
-    tag: "0.48.1@sha256:414a329af821e50b20c0443bc6364f91f4f6a8cc879cc881757a715f273c5a99"
+    tag: "0.49.1@sha256:43f4636ed88333005570c97c51cf46deba499a25ffd65e993b37cf1418dfc483"
  nubusSelfServiceConsumer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -655,7 +663,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "3", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-invitation"
-    tag: "0.12.3@sha256:8c20895767bb1972a3abb066ba8adc4034ce718b199fbe205a9ae67d5544a888"
+    tag: "0.14.0@sha256:999c50058a02f6006a8d1732b651a5c738c5ee91fc453dc8ae3fcdbb9d4192c0"
  nubusUdmRestApi:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -665,7 +673,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/udm-rest-api"
-    tag: "0.26.1@sha256:7b5e2fd05ebdd388a9f4af7fb254f95fe120ea6e038e0436070e581b2c0b4abd"
+    tag: "0.29.0@sha256:2b061d1cf244aeadcb790a08cac94804a32abe73dd442382355a6657b05c0ff2"
  nubusUmcGateway:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -675,7 +683,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "7", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-gateway"
-    tag: "0.35.5@sha256:f9a13261821de731f3c3a665aa128b16d7e48e6f3d79a9d4038f9667069542c8"
+    tag: "0.37.0@sha256:3ac0e34e9b1c353ab7778bae548804e3dcc236dd454c3f500de9795eb7dda947"
  nubusUmcServer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -685,7 +693,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "7", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-server"
-    tag: "0.35.5@sha256:f81ce86b16f03d8c840c2f5f6d6814b8119caf2a08f0f01b0a5dab5a528d228a"
+    tag: "0.37.0@sha256:ef06422cab2ab2bc4f84a13dfd7bfb7e862a3504f83fc6957fcbdfaa433d0468"
  nubusUmcServerProxy:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -703,7 +711,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/wait-for-dependency"
-    tag: "0.26.0@sha256:a31fde86bf21c597a31356fe492ab7e7a03a89282ca215eb7100763d6eb96b6b"
+    tag: "0.28.0@sha256:816ad27b76046be360398274ba3c1f1bcec8f58c2ea5a200b2fb675aab1a5ab8"
  opendeskKeycloakBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -729,7 +737,7 @@ images:
    # upstreamMirrorStartFrom: ["13", "1", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "15.4.1@sha256:4614f6c27f114d4dcaed28449e287784f8b8834e1982535eb89ea00d5fad2230"
+    tag: "15.4.2@sha256:d88df284e03b5c255ad3963ebe335f38a4e069754569dd47c5e92930e0b26a1b"
  openprojectBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -882,6 +890,14 @@ images:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/postfix"
    tag: "3.0.1@sha256:d2c6543b35b616ac3e6c8c27222d3154c0d35680813a8942ce0cc3fa9ea72a6d"
+  postfixBootstrap:
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "alpine/k8s"
+    registry: "registry-1.docker.io"
+    repository: "alpine/k8s"
+    tag: "1.32.3@sha256:eec3541331932d8613ce7b3283508063cba7f704302e9b4eda45e49b38a2a0f9"
  postgresql:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -917,7 +933,7 @@ images:
    # upstreamMirrorStartFrom: ["1", "91", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse"
-    tag: "v1.121.1@sha256:5d8081b6004eb115635334dbc1ec2f87318f19d5ad0e7c62f7476d4cc16de277"
+    tag: "v1.127.1@sha256:0b0b933314ac9e1ba917a72c29d5b49c47828ab6e8df3aae3ac244ee947a89fc"
  synapseCreateUser:
    # providerCategory: "Community"
    # providerResponsible: "Nordeck"
--- a/helmfile/environments/default/repositories.yaml.gotmpl
+++ b/helmfile/environments/default/repositories.yaml.gotmpl
@@ -7,7 +7,7 @@ repositories:
  image:
    dockerHub: ""
    registryOpencodeDe: ""
-    registryOpencodeDeEnterprise: "registry.opencode.de"
+    registryOpencodeDeEnterprise: ""
  # Fine-granular registry settings, useful when you can't use virtual (Artifactory) or group (Nexus) repositories.
  # Higher precedence than `global.imageRegistry`
  helm:
--- a/helmfile/environments/default/secrets.yaml.gotmpl
+++ b/helmfile/environments/default/secrets.yaml.gotmpl
@@ -36,9 +36,6 @@ secrets:
      ox: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_ox" | sha1sum | quote }}
      openproject: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_openproject" | sha1sum | quote }}
      xwiki: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_xwiki" | sha1sum | quote }}
-    defaultAccounts:
-      userPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "default_accounts_user_password" | sha1sum | quote }}
-      adminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "default_accounts_user_admin" | sha1sum | quote }}
    systemAccounts:
      administratorPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "Administrator" | sha1sum | quote }}
      sysIdpUserPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "sysIdpUser" | sha1sum | quote }}
@@ -54,6 +51,7 @@ secrets:
        udmTransformerPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "udmproducer" "events_api" | sha1sum | quote }}
      dispatcherNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "dispatcher" "nats" | sha1sum | quote }}
      prefillNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "prefill" "nats" | sha1sum | quote }}
+      udmListenerNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "udmListener" "nats" | sha1sum | quote }}
      udmTransformerNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "udmTransformer" "nats" | sha1sum | quote }}
    guardian:
      udmPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "cn=admin" "udm" | sha1sum | quote }}
--- a/helmfile/files/theme/portal/stylesheet.css
+++ b/helmfile/files/theme/portal/stylesheet.css
@@ -136,7 +136,9 @@
 #kc-login,
 #kc-logout,
 #saveTOTPBtn,
-.pf-c-button.btn-lg {
+.pf-c-button.btn-lg,
+.kc-social-provider-name
+{
  color: var(--color-opendesk-white);
  border: 2px solid;
 }
--- a/helmfile/shared/migrations.yaml.gotmpl
+++ b/helmfile/shared/migrations.yaml.gotmpl
@@ -19,7 +19,7 @@ cleanup:
  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}

 migrations:
-  runId: 3
+  runId: 4
  namespace: {{ .Values.apps.migrations.namespace | default .Release.Namespace | quote }}
  loglevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
  failOnUnexpectedState: true
Author	SHA1	Message	Date
segnord	e8fbd3d4e1	docs(phone-dial-in): added note about nginx proxy-buffer-size	2025-04-17 11:44:58 +03:00
segnord	ae9de0a83e	docs: jibri.link removed, not needed	2025-04-04 10:47:32 +03:00
segnord	306c4e295d	docs(phone-dial-in): architecture for the dial-in	2025-04-03 18:42:21 +03:00
Thorsten Roßner	97cb914f18	fix(xwiki): Update Helm chart to v1.4.4 to fix the problem with XWiki not starting when secrets contained specific (XML interpreted) characters	2025-04-01 09:19:01 +00:00
Thorsten Roßner	0c92d1681c	fix(helmfile): Remove no longer used `secrets.nubus.defaultAccounts.*`	2025-04-01 09:19:01 +00:00
Thomas Kaltenbrunner	f6aeffb189	fix(helmfile): Fix Kyverno lint issues for EE components	2025-03-31 12:59:39 +02:00
Thorsten Roßner	a0f852e104	chore(release): 1.2.1 [skip ci] ## [1.2.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.2.0...v1.2.1) (2025-03-28) ### Bug Fixes * dovecot: Support external secrets ([`f758685`](`f758685a2e`)) * element: Update Synapse to 1.127.1; Fixes https://www.cve.org/CVERecord?id=CVE-2025-30355 which applies to Synapse installations with unrestricted (no allow list) federation enabled ([`5cd12b9`](`5cd12b91c7`)) * openproject: Update to 15.4.2 ([`aa8e30b`](`aa8e30b34f`))	2025-03-28 13:18:50 +00:00
Thorsten Roßner	aa8e30b34f	fix(openproject): Update to 15.4.2	2025-03-28 14:10:05 +01:00
Thorsten Roßner	5cd12b91c7	fix(element): Update Synapse to 1.127.1; Fixes https://www.cve.org/CVERecord?id=CVE-2025-30355 which applies to Synapse installations with unrestricted (no allow list) federation enabled	2025-03-28 14:07:48 +01:00
Thomas Kaltenbrunner	f758685a2e	fix(dovecot): Support external secrets	2025-03-28 14:07:48 +01:00
Thorsten Roßner	c37eedba42	chore(docs): Update ToC across MD files and document Nubus version bump in `README.md`	2025-03-27 07:43:59 +01:00
Dominik Kaminski	04efd54022	chore(release): 1.2.0 [skip ci] # [1.2.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.2...v1.2.0) (2025-03-25) ### Bug Fixes * collabora: Set proper theming for Collabora Online (openDesk EE) ([`896b3c1`](`896b3c102c`)) * collabora: Update to 24.04.12 ([`4296db7`](`4296db7c90`)) * dev-tooling: Fix path names when refencing local Helm chart copies in `helmfile-child.yaml.gotmpl` files ([`60f5e36`](`60f5e36b7c`)) * docs: Add `functional.md` and reference it in `getting-started.md` ([`0efc0af`](`0efc0af761`)) * docs: Add testing.md ([`c4e4258`](`c4e4258162`)) * dovecot: Update EE Helm chart to resolve issue with mandatory set `PriorityClass` ([`696f2da`](`696f2daa9c`)) * element: Run UVS container as a non-root user ([`f262507`](`f26250774e`)) * element: Update NeoChoice and NeoBoard widget to latest releases ([`7456543`](`7456543d81`)) * helmfile: Add missing `deletePodsOnSuccessTimeout` statements ([`87144b8`](`87144b8fd3`)) * helmfile: Support for `functional.externalServices.matrix.federation.domainAllowList` ([`817af98`](`817af98fcd`)) * intercom: Allow transient session cookies and rolling session duration configuration ([`4d59d12`](`4d59d12a97`)) * intercom: Update to Intercom Service v2.10.3 ([`7b05213`](`7b05213d6e`)) * jitsi: Update chart to v3.1.0 incl. a fix in room history toggle ([`1480253`](`1480253a52`)) * migrations: Explicit scoping of role required for access to the migration's ConfigMap ([`02488fe`](`02488fe2dd`)) * nextcloud: Disable integration with OX App Suite if groupware it is not available ([`fdfe76c`](`fdfe76c37e`)) * nextcloud: Update apps and support branding of the HTML title ([`bc55f6a`](`bc55f6a366`)) * nextcloud: Update images for improved log output ([`f1147f0`](`f1147f0fdf`)) * nextcloud: Update images to allow logging in environments where inotify cannot be used ([`0110675`](`01106757da`)) * nextcloud: Update to 30.0.6 including latest apps ([`52b0b13`](`52b0b13e6b`)) * nubus: Add imagePullSecrets to nginx-s3-gateway ([`466b70a`](`466b70a9bb`)) * nubus: Add migrations for Nubus 1.7.0; See migrations.md for details ([`7d7e9e6`](`7d7e9e65b3`)) * nubus: Always use S3 gateway for assets ([`1e62a0d`](`1e62a0dfe1`)) * nubus: Change logo URLs for apps referencing the openDesk logo provided by Nubus ([`5d398f5`](`5d398f5d64`)) * nubus: Cleanup of unnecessary LDAP groups; customization option to show the OX App Suite context selection in the IAM's admin UI ([`4c42ed7`](`4c42ed76e8`)) * nubus: Delete now legacy Ingress `ums-minio-rewrites` ([`1c50aa5`](`1c50aa5ce2`)) * nubus: Fix mixed up links for legal and privacy statement ([`dbcc785`](`dbcc785134`)) * nubus: Indent `nubusPortalConsumer.persistence.groupMembershipCache` causing `persistence.storages.nubusPortalConsumer.` to be ignored; See migrations.md for details ([`baa5b14`](`baa5b14551`)) nubus: Register OX provisioning consumer only when OX is enabled; See migrations.md for details ([`adb3fa1`](`adb3fa18eb`)) * nubus: Remove unnecessary inactive portal tiles and folders ([`1724fa1`](`1724fa14a3`)) * nubus: Update openDesk customizing: Preset openDesk specific attributes on `Administrator` account; Remove unused portal categories ([`6edfe72`](`6edfe7239f`)) * opendesk-services: Add notes to certificate resource ([`d18abb0`](`d18abb0d0a`)) * openproject: Update `opendesk-openproject-bootstrap` to support external secrets ([`41e0aae`](`41e0aaeffe`)) * openproject: Update to 15.3.0 including update for seeding relevant environment variables ([`a6de1fe`](`a6de1fe694`)) * openproject: Update to 15.3.1 ([`f34a4a3`](`f34a4a3601`)) * openproject: Update to 15.3.2 ([`6723a34`](`6723a34c22`)) * openproject: Update to 15.4.0 ([`2a0f2a3`](`2a0f2a3333`)) * openproject: Update to 15.4.1 ([`747cae5`](`747cae545a`)) * openxchange: Template HTML title from `.Values.theme.texts.productName` ([`2e992fc`](`2e992fc236`)) * openxchange: Update to latest 8.35 patch level ([`44c2081`](`44c2081bd8`)) * ox-connector: Update to v0.14.7 ([`dd3b35b`](`dd3b35b626`)) * postfix: Add internal authentication ([`2389d59`](`2389d59735`)) * postfix: Add recipient delimiter support ([`f92b76b`](`f92b76b2b2`)) * requirements.md: Set Ingress NGINX 1.11.5 as requirement ([`2bf8e1d`](`2bf8e1de98`)) * synapse: Use synapse-guest-module by Element (supplier) ([`2730b03`](`2730b03e70`)) ### Features * helmfile: Use PostgreSQL as default database for Nextcloud and XWiki; follow `migrations.md` when upgrading an existing environment ([`2f584bd`](`2f584bd8e8`)) * nextcloud: Support external secrets for metrics token ([`dbec2ec`](`dbec2ec36f`)) * notes: Update to v2.4.0 ([`3d35440`](`3d35440dc7`)) * nubus: Support of external secrets in opendesk-keycloak-bootstrap ([`3d2f751`](`3d2f75165a`)) * nubus: Update to v1.7.0 ([`d018385`](`d018385473`)) * openxchange: Update to OX App Suite 8.35 ([`037537b`](`037537b394`)) * xwiki: Update to 16.10.5 ([`bfd27f3`](`bfd27f3c39`))	2025-03-25 17:57:00 +00:00
Thorsten Roßner	1c50aa5ce2	fix(nubus): Delete now legacy Ingress `ums-minio-rewrites`	2025-03-25 18:24:21 +01:00
Thorsten Roßner	2bf8e1de98	fix(requirements.md): Set Ingress NGINX 1.11.5 as requirement	2025-03-25 11:20:26 +01:00
Thorsten Roßner	5d398f5d64	fix(nubus): Change logo URLs for apps referencing the openDesk logo provided by Nubus	2025-03-25 08:33:58 +01:00
Dominik Kaminski	897bd4c466	docs: Update security-context.md	2025-03-25 07:41:39 +01:00
Dominik Kaminski	d070b09636	ci(gitlab): Enforce opendesk-lint	2025-03-25 07:22:58 +01:00
Dominik Kaminski	466b70a9bb	fix(nubus): Add imagePullSecrets to nginx-s3-gateway	2025-03-25 07:22:58 +01:00
Thorsten Roßner	adb3fa18eb	fix(nubus): Register OX provisioning consumer only when OX is enabled; See migrations.md for details	2025-03-25 07:22:48 +01:00
Thorsten Roßner	1e62a0dfe1	fix(nubus): Always use S3 gateway for assets	2025-03-25 07:21:45 +01:00
Thorsten Roßner	696f2daa9c	fix(dovecot): Update EE Helm chart to resolve issue with mandatory set `PriorityClass`	2025-03-25 07:21:32 +01:00
Thorsten Roßner	2c8d7f0380	docs(external-services.md): Update XWiki and Nextcloud to use PostgreSQL	2025-03-24 14:14:08 +01:00
Thorsten Roßner	c9a8a60ff3	chore(ci): Fix yaml linting issues	2025-03-24 11:25:59 +01:00
Thorsten Roßner	7d7e9e65b3	fix(nubus): Add migrations for Nubus 1.7.0; See migrations.md for details	2025-03-24 08:43:03 +01:00
Thorsten Roßner	baa5b14551	fix(nubus): Indent `nubusPortalConsumer.persistence.groupMembershipCache` causing `persistence.storages.nubusPortalConsumer.*` to be ignored; See migrations.md for details	2025-03-24 07:10:06 +00:00
Thorsten Roßner	9e083de84d	chore(helmfile): Manually bump version in `global.generated.yaml.gotmpl` to test migration	2025-03-24 07:10:06 +00:00
Norbert Tretkowski	d018385473	feat(nubus): Update to v1.7.0	2025-03-24 07:10:06 +00:00
Thorsten Roßner	2f584bd8e8	feat(helmfile): Use PostgreSQL as default database for Nextcloud and XWiki; follow `migrations.md` when upgrading an existing environment	2025-03-21 14:59:54 +01:00